masscan-scan

masscan ultra-large-scale high-speed port scanning methodology

masscan is an asynchronous stateless port scanner, with core advantages:Extreme speed(theoretically up to 10 million packets/second) + Large-scale scanning(designed specifically for internet-wide scanning) + nmap-compatible output. Requires root privileges.

Project address:https://github.com/robertdavidgraham/masscan

Tool selection strategy

masscan is suitable for scanning large network segments (/16 and above), with speeds far exceeding nmap and naabu. However, it does not perform service identification. Recommended workflow: masscan quickly discovers ports → nmap -sV performs service identification. For small-scale scanning, naabu is more convenient.

Phase 1: Basic scanning

# 扫描单个目标（需 root）
sudo masscan 192.168.1.1 -p 80,443,8080

# 扫描网段
sudo masscan 10.0.0.0/24 -p 1-1000

Full port scan

sudo masscan 192.168.1.0/24 -p 0-65535

Control packet sending rate (default 100 packets/second)

sudo masscan 10.0.0.0/16 -p 80,443 --rate 10000


## Phase 2: 大规模扫描

```bash
# B 段扫描（65536 个 IP）
sudo masscan 10.0.0.0/16 -p 22,80,443,3389 --rate 50000

# A 段扫描（谨慎使用）
sudo masscan 10.0.0.0/8 -p 80,443 --rate 100000

# 从文件读取目标
sudo masscan -iL targets.txt -p 80,443

# 排除特定 IP
sudo masscan 10.0.0.0/16 -p 80 --excludefile exclude.txt

Phase 3: Output formats

# List 格式（简洁，推荐）
sudo masscan 10.0.0.0/24 -p 80,443 -oL results.txt

# JSON 格式
sudo masscan 10.0.0.0/24 -p 80,443 -oJ results.json

# nmap XML 格式（兼容 nmap 工具链）
sudo masscan 10.0.0.0/24 -p 80,443 -oX results.xml

# Grepable 格式
sudo masscan 10.0.0.0/24 -p 80,443 -oG results.gnmap

Phase 4: Advanced options

# Banner 抓取
sudo masscan 10.0.0.0/24 -p 80 --banners

# 指定网卡
sudo masscan 10.0.0.0/24 -p 80 -e eth0

# 指定源 IP
sudo masscan 10.0.0.0/24 -p 80 --adapter-ip 192.168.1.100

# 暂停和恢复扫描
sudo masscan 10.0.0.0/8 -p 80 --resume paused.conf
# Ctrl+C 暂停时会生成 paused.conf

# 使用配置文件
sudo masscan -c masscan.conf

Common combinations for penetration testing

Scenario	Command
Internal network quick discovery	`sudo masscan 10.0.0.0/16 -p 22,80,443,3389 --rate 10000 -oL results.txt`
Web service discovery	`sudo masscan CIDR -p 80,443,8080,8443 --rate 50000 -oL web.txt`
Database ports	`sudo masscan CIDR -p 3306,5432,1433,6379,27017 --rate 10000`
Full port scan	`sudo masscan target -p 0-65535 --rate 10000 -oL all.txt`