The importance of port scanning

Port scanning is a crucial part of system administration and security. Using port scanners enables IT professionals to determine the following:

• Open ports and available services.
• Potential vulnerabilities related to misconfigurations or outdated policies.
• Network device and asset inventories.
• Firewall settings.
• Changes to network configurations.

Masscan is among several port scanners available, includingNmap, which can be more detailed, complex and slower than some use cases require, andAngry IP Scanner, a fast, user-friendly port scanner tailored to identify open ports and live hosts on smaller networks.

Masscan's speed on large networks makes it an attractive option for admins who want a quick and basic scan of available hosts and open ports. It avoids more in-depth analysis, such as OS detection or scan scripting, which enables it to achieve basic scanning goals.

How to compile and run Masscan

Masscan works on Linux, macOS and Windows. Depending on your preferred OS, you might need to compile it yourself. Expect the best performance on Linux, especially for very large scan jobs. According to the vendor, macOS and Windows only send around 300,000 packets per second, whileLinux can send 1.5 million packets per second.

You have several options for getting Masscan. If you're not confident in compiling it yourself, you can find precompiled versions online. Be sure you trust the source and always look for the current version.

To compile it on a Linux system, type:

sudo apt-get --assume-yes install git make gcc

git clone https://github.com/robertdavidgraham/masscan

cd masscan

make

make install

Use similar processes on macOS and Windows. Since the application is written in C, it's portable. You can also useKali Linux,ParrotOS orBlackArch to run Masscan.

Example Masscan scans

Masscan's simplicity means there aren't many options or variations to learn. When learning how to use Masscan, you'll find that running it mainly requires specifying target addresses and ports. You can also redirect the standard output to a file.

Use the following examples to construct your own scans.

How to scan a single port

Scan a single port on an IPv4 network segment by typing:

masscan -p80 10.0.0.0/8

Results appear on the screen, though you can redirect the output to a file for later analysis (more on this below).

How to scan multiple ports

Target multiple ports by using the-p option and separating the desired port numbers with commas. For example, to scan for web services, type-p80,443.

masscan -p80,443 10.0.0.0/8

How to scan a range of ports

Scan a range of ports by using a value such as-p6000-7000 to cover all ports between 6000 and 7000. This feature is particularly useful if you have multiple applications using custom or nonstandard ports.

masscan -p6000-7000 10.0.0.0/8

How to use a configuration file for repeatable scans

Masscan offers several basic options to modify scan capabilities. For example, set a--max-rate value to define the number of packets per second sent in the scan. The default is a lowly 100 packets per second, so it might be worth modifying that to--max-rate 100000 or more. Remember that Windows and macOS are more limited than Linux in this respect.

You could also use a text file to exclude particular ports if you need to conduct very specific scans or avoid particular ports. Be especially careful if you're scanning the internet because your scan could get you denylisted.

Specify anexclude.txtfile by using the--excludefile flag.

masscan 0.0.0.0/0 -p-65365 --excludefile exclude.txt

Again, carefully update that file to specify areas of the internet to avoid. Avoid scanning the internet itself and instead conduct more targeted assessments within your own network's boundaries.

Since network scanning is often a recurring task in auditing andvulnerability detection, you might want to specify detailed settings in a configuration file and then call the file when you're ready to scan. You could even schedule that task usingcron, a time-based scheduler in Unix-like OSes that enables you to schedule commands to run at specific dates and times.

Begin by creating the configuration file:

# Basic scan ports 0-1023 for my internal network

rate = 100000

output-format = xml

output-status = all

output-filename = internal-scan.xml

ports = 0-1023

range = 0.0.0.0-255.255.255.255

excludefile = exclude-ports.txt

Name the file customscan.conf --or whatever you prefer.

Next, specify the configuration file as part of yourmasscan command:

masscan -c customscan.conf

IPv6 compatibility

You can use Masscan to scanIPv6 address ranges without any additional flags, even in the same scan. Remember that IPv6 networks can be immense, so carefully plan and limit your scans.

How to define output formats

Masscan can output results in several common formats. Use the following summary to determine which option best suits your needs:

• Binary. The default format, which is readable using the--readscan option.
• Grepable. Use the-oG <filename.txt> option to render the output in a format easily searched withgrepand similar tools.
• List. Use the-oL <filename.txt> option to render output as a line-by-line list containing the host and a port.
• XML. Use the-oX <filename.xml> option to render output inXML.
• JSON. Use the-oJ <filename.json> option to render output inJSON.

Remember that these files could be large depending on the scan options selected.

Masscan vs. Nmap

Most network and security professionals have used Nmap; Masscan deliberately mimics this ubiquitous tool. Nmap has far more options and flexibility, but Masscan relies on many parallel settings and approaches. Consider the following:

• Nmap is capable of name resolution; Masscan is not.
• Masscan requires the -p<port-number> parameter.
• Output options, such as-oX or-oG, are the same.

Use themasscan --nmap command to see a list of specific settings shared between the two.

Masscan offers high-speed, simple scans of large networks. While tools like Nmap provide more options, they are also slower and more complex to use. Most network and security professionals will likely use both tools, maximizing the strengths of each.

Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget, The New Stack and CompTIA Blogs.