19. Information Gathering and Scanning
19.9 Masscan: Very Fast Port Scanning
Masscan is built for speed: it can scan huge IP ranges very quickly by sending packets asynchronously. It only finds open ports – no version detection, no scripts. Professionals often use Masscan to find open ports quickly, then Nmap for details on only those ports.
sudo masscan 192.168.56.20 -p1-65535 --rate 1000 -e eth1 # all ports, limited rate
sudo masscan 192.168.56.0/24 -p22,80,443 --rate 500 -e eth1 # a few ports across the lab range
sudo masscan 192.168.56.20 -p1-65535 --rate 1000 -oL ports.txt -e eth1 # save as list
| Nmap | Masscan | |
|---|---|---|
| Speed | Moderate | Very high |
| Version / OS / scripts | Yes | No |
| Accuracy on slow networks | High | Can miss ports at high rates |
| Best for | Detailed scanning of a few hosts | Quick open-port discovery on big ranges |
Keep the rate low and the target inside your lab
Masscan at a high --rate can flood a network and make your own router or VM crash. In the lab stay at --rate 1000 or lower, and always pass -e with your host-only interface.
Ravindra Bagale's Tip
--rate vadhavla ki scan fast hoto, pan packets drop hotat aani ughde ports sutatat. Masscan cha result "final" samju naka – je ports milale tyanvar Nmap -sV chalvun confirm kara. Speed peksha accuracy mahatvachi.
Lab
Run Masscan for all ports on Metasploitable 2 at --rate 1000, then compare its list with your 02_allports Nmap result from 19.8. Note any difference and re-run Nmap on those ports to confirm.