Network Scanning

Photo by Brett Sayles on Pexels

The question “masscan or nmap?” comes up constantly in penetration testing discussions, and the framing is almost always wrong. These tools aren’t alternatives — they’re complements. Understanding why requires understanding what each one is actually optimized for.

masscan is optimized for speed across scale. nmap is optimized for accuracy and depth on individual targets. They solve different problems in the same workflow. Once that clicks, the choice between them isn’t either/or — it’s about sequencing.

The Core Difference

The fundamental difference between masscan and nmap isn’t their feature sets — it’s their TCP stack architecture, and that architecture choice determines everything else about how they behave.

How masscan Works

masscan sends TCP SYN packets at the configured rate (--rate) without using the OS TCP stack. It maintains its own state table tracking which probes were sent, listening for incoming SYN-ACK responses on a raw socket. When a SYN-ACK arrives — indicating an open port — masscan records it and immediately sends RST (reset) to close the connection rather than completing the three-way handshake.

The asynchronous design means masscan doesn’t wait for a response to probe N before sending probe N+1. At high rates (e.g., 100,000 pps), masscan may send millions of probes before the first responses arrive. The timing window for associating responses with probes is configurable via --wait.

The consequences of this design:

• Very fast at scale — can scan a /16 (65,536 hosts × all 65,535 ports) in minutes
• Lower accuracy — at very high rates, responses may arrive outside the wait window and be missed; some hosts may not respond to the custom stack’s SYN packets the same way they would to OS-originated packets
• No application layer — masscan only identifies open TCP ports; it doesn’t do version detection, banner grabbing, or scripting
• Network impact — high packet rates can saturate uplinks, trigger IDS/IPS, and cause collateral packet loss on congested networks

How nmap Works

nmap’s default scan mode (-sS, SYN scan) uses OS raw sockets to send TCP SYN packets and wait for responses. A SYN-ACK indicates open; RST indicates closed; no response indicates filtered. nmap tracks each probe synchronously and has retry logic for dropped packets.

On top of this port state detection, nmap layers:

• Version detection (-sV) — completes the TCP handshake, sends service-specific probes, and compares banners against a database of known service fingerprints
• OS detection (-O) — analyzes TCP/IP response characteristics (TTL, window size, timestamp options) to fingerprint the OS
• NSE scripts (-sC / --script) — Lua-based scripts that perform everything from SMB enumeration to vulnerability checks against discovered services
• UDP scanning (-sU) — nmap supports UDP; masscan has limited UDP capability

Side-by-Side Comparison

masscan: Commands and Flags

masscan [IP/CIDR] -p[ports] --rate=[pps] [options]

# All 65535 ports on a /24 subnet, 10,000 pps
masscan -p0-65535 10.10.10.0/24 --rate=10000 -oG masscan.txt

# Specific ports only (faster)
masscan -p80,443,8080,8443,22,21,25,445,3389 192.168.0.0/16 --rate=50000 -oG masscan-out.txt

# Full internet range (theoretical; use with extreme caution and authorization)
masscan 0.0.0.0/0 -p80 --rate=1000000 -oJ web-hosts.json

# JSON output
masscan -p22,80,443 10.10.10.0/24 --rate=5000 -oJ output.json

# Custom wait time (seconds to wait for late responses)
masscan -p0-65535 10.10.10.1 --rate=100000 --wait 10

masscan Output Formats

-oG filename.txt    # Grepable (easiest for post-processing)
-oJ filename.json   # JSON
-oX filename.xml    # XML
-oB filename.bin    # Binary (for later conversion)

Reading masscan Grepable Output

nmap: Commands and Flags

nmap [scan type] [options] [target]

# Standard pentest scan (SYN + version + scripts + all ports)
nmap -sV -sC -p- 10.10.10.1 --min-rate 5000

# Fast SYN scan all ports, no version/scripts
nmap -sS -p- 10.10.10.1 -T4

# With OS detection
nmap -sV -O -p- 10.10.10.1

# Ping sweep (host discovery, no port scan)
nmap -sn 10.10.10.0/24

# Specific ports with all features
nmap -sV -sC -O -p22,80,443,445 10.10.10.1

# Save all output formats
nmap -sV -sC -p- 10.10.10.1 -oA scan_results

nmap Timing Templates

The Combined Workflow

The pattern that appears most in professional penetration testing: masscan for fast discovery across a range, nmap for detail on discovered targets. Here’s that workflow in full:

# Scan full port range across the target subnet
masscan -p0-65535 10.10.10.0/24 --rate=10000 -oG masscan-discovery.txt

# Extract unique open ports from grepable output
grep "open" masscan-discovery.txt \
  | awk '{print $5}' \
  | cut -d'/' -f1 \
  | sort -un \
  | tr '\n' ',' \
  | sed 's/,$//' \
  > open_ports.txt

# Extract unique live hosts
grep "Host:" masscan-discovery.txt \
  | awk '{print $3}' \
  | sort -u \
  > live_hosts.txt

cat open_ports.txt
# Example output: 22,80,443,445,8080

cat live_hosts.txt
# Example output:
# 10.10.10.1
# 10.10.10.5
# 10.10.10.45

# Run nmap with full features against discovered open ports only
PORTS=$(cat open_ports.txt)
HOST="10.10.10.5"

nmap -sV -sC -O -p${PORTS} ${HOST} -oA nmap-detailed-${HOST}

The combined workflow’s advantage: masscan’s sweep covers all 65535 ports across the full subnet in minutes. nmap then runs against only the discovered open ports — dramatically reducing nmap’s scan time while still getting full version and script data.

Scenario Guide: Which Tool for What

Defensive Context

Both masscan and nmap scans are detectable — they generate network traffic that endpoint detection, IDS/IPS, and firewall logs can capture. The detection strategies differ:

masscan detection: The custom TCP stack produces packets with consistent characteristic patterns (e.g., specific TCP option configurations, window sizes) that differ from OS-native packets. Modern IDS signatures can detect masscan based on packet characteristics, not just scan rate. The high packet rate itself also triggers rate-based alerts. A masscan scan at 100,000 pps will appear in network flow logs as an anomalous volume of SYN packets from a single source.

nmap detection: The NSE scripts, version detection probes, and OS fingerprinting all produce distinctive traffic patterns. The Nmap timing templates (-T1 through -T5) control how these patterns are spread over time — slow scans (-T1) are harder to detect with rate-based rules, but signature-based detection can still identify nmap’s specific probe sequences regardless of timing.

What defenders should know: Seeing a masscan sweep from an external IP is almost always a red flag — it’s not typical user traffic. Seeing it from an internal IP might indicate a compromised host, an authorized vulnerability scan, or a rogue admin. Both warrant investigation. A properly configured IDS (Snort/Suricata rules) combined with firewall logging catches the majority of port scanning activity.

Reduce your scan surface: Every open port that isn’t necessary is a potential attack vector. Regular port scans of your own external IP range — from an external vantage point — surface exposed services that shouldn’t be there. Services that aren’t needed externally should be firewalled at the perimeter, not just on the host. Defense in depth means assuming the host firewall might fail.

Frequently Asked Questions