root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat masscan.md
// recon

Masscan

21 Jul 2026 · 6 min read
reconcheatsheetsmasscan
masscan is an asynchronous TCP port scanner able to sweep the entire Internet in minutes, with a syntax deliberately similar to nmap. Its strength is speed: it transmits packets using its own user-space TCP/IP stack, without waiting for a reply before sending the next one. It is used to quickly discover which ports are open across huge ranges before moving on to finer analysis.

What really matters is understanding that masscan does not use the operating system's stack: it transmits and receives with its own stack, which is why it reaches hundreds of thousands of packets per second, but also why --rate is a double-edged sword. A rate that is too high saturates your own link or VPN tunnel and produces false negatives: open ports you never see because the replies get dropped. On a VPN lab, moderate rates are more reliable than theoretical maximums.

1. Beginner level — scans and output formats

MASSCAN cheat sheet — Beginner
CommandWhat it does
masscan -p80 10.10.10.0/24Scan one port across a network
masscan -p1-65535 <ip>All TCP ports
masscan -p80,443 10.0.0.0/8 --rate 10000Several ports at 10k pps
masscan <ip> --top-ports 100The 100 most common ports
masscan -p80 10.10.10.0/24 -oL out.txtSave in list format
masscan -p80 10.10.10.0/24 -oG out.gnmapGrepable output
masscan -p80 10.10.10.0/24 -oX out.xmlXML output
masscan -p80 10.10.10.0/24 -oJ out.jsonJSON output
masscan -p80 10.10.10.0/24 -e tun0Specify the interface
masscan -pU:53,161 <ip>UDP port scan
masscan --interactive -p80 <ip>Show results live
masscan -p80 -iL targets.txtTargets from a file
masscan --echo > scan.confDump the configuration to a file
masscan -p80 10.10.10.0/24 --rate 1000Tune the rate (pps)

2. Advanced level — rate, exclusions and banners

MASSCAN cheat sheet — Advanced
CommandWhat it does
masscan -p1-65535 10.0.0.0/8 --rate 100000Massive sweep (100k pps)
masscan -p80 10.0.0.0/8 --exclude 10.0.0.1Exclude hosts
masscan -p80 10.0.0.0/8 --excludefile ex.txtExclude from a file
masscan -c scan.confLoad the configuration from a file
masscan -p80 <ip> --bannersGrab service banners
masscan -p80 <ip> --source-ip <spoof>Spoof the source IP
masscan -p80 <ip> --source-port 61000Fix the source port
masscan -p80 10.0.0.0/8 --shard 1/3Split the scan across machines
masscan -p80 <ip> --rate 100000 --wait 0No final wait (fast)
masscan -p80 <ip> --router-mac <mac>Fix the router MAC (odd networks)
masscan -p80 <ip> --ttl 200Adjust the packets' TTL
masscan --nmapShow the flag equivalence with nmap
masscan -p80 10.10.10.0/24 -oL - | awk '/open/{print $4}'Extract only the live IPs
masscan -p- <ip> --rate 5000 -oG masscan.gnmapSave to hand off to nmap later

3. Details people miss

  • masscan needs root privileges (or the CAP_NET_RAW capability) because it opens raw sockets; without them it won't start.
  • The default --rate is very conservative. Pushing it too high on an HTB/lab VPN causes false negatives: lower the rate if a port you know is open doesn't show up.
  • Its output formats are not identical to nmap's. Use -oG/-oX to find live hosts fast, then feed those IPs and ports to nmap -sV for real fingerprinting.
  • UDP scanning is requested with -pU: (for example -pU:53,161), not with -p; mixing the TCP and UDP syntax is a common mistake.
  • --banners makes masscan complete the TCP handshake with its own stack; this can clash with the kernel stack (which sends a RST), so it's wise to set --source-port and block that port in the local firewall.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.