Network
masscan
Asynchronous Internet-scale port scanner for fast, coarse coverage of large in-scope CIDRs.
What it is
masscan is for authorized wide-net discovery when Nmap across a large allocation would miss the window. It answers 'which ports are open' quickly; follow up with Nmap version detection on the hits. Rate must be negotiated — default rates will look like an attack.
Reach for it when
Large external or internal CIDR with an agreed packets-per-second cap, before you spend Nmap time on live hosts.
Watch-outs
Default rate is unsafe on production and on shared cloud networks. Always set --rate from the RoE, bind a source IP the client expects, and exclude broadcast/OT ranges. Never point it at a CDN or a third-party SaaS.
Typical invocation
masscan 198.51.100.0/24 -p80,443,22,3389 --rate 500 -oJ recon/masscan.json
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.