Masscan is a port scanner built for a single purpose: probing a very large number of IP addresses in a very short time. Its author, security researcher Robert David Graham, released it in 2013 under the AGPL v3 free licence, and the code lives on GitHub in the robertdavidgraham/masscan repository. According to the project documentation, the program can transmit up to ten million packets per second from one machine, enough to sweep the whole IPv4 space for a given port in a few minutes. Its use is restricted to networks you are authorised to audit.
What Masscan is for
A port scanner sends packets to addresses and ports, then watches the replies to work out which services are open. Nmap, the reference in this field, converses with every host to extract as much information as possible. Masscan takes the opposite approach. It separates transmission and reception into two independent threads, never waits for a host’s reply before moving on to the next one, and carries its own TCP/IP stack instead of relying on the operating system’s. This asynchronous design, which the README compares to the difference between the nginx and Apache web servers, is what gives it its speed.
The syntax deliberately mirrors Nmap. You give address ranges, in IPv4 as well as IPv6, and a list of ports with the -p option, then set the pace with –rate. By default the program sends only one hundred packets per second, and it is up to the user to raise that figure knowingly. The scan order is always randomised, so that the load is spread across the targeted networks rather than hitting them in sequence. Results can be written as XML, JSON, grepable text, a plain list or a compact binary format, and an exclusion file keeps the scanner away from ranges it must not touch.
Beyond simply spotting open ports, Masscan can complete the TCP handshake to grab the banner of common services such as HTTP, SSH, FTP, SMTP, SMB, RDP or VNC. The documentation explains that this feature requires giving the program a separate IP address or firewalling its source port locally, otherwise the system’s network stack kills the connection before the banner arrives. To go beyond two million packets per second, the author points to the PF_RING ZC driver from ntop, the same company behind ntopng in this category.
A comparison with Scapy clarifies where each tool belongs. Scapy is a Python library for forging and dissecting packets one at a time, ideal for understanding a protocol or writing a precise test. Masscan builds only one kind of probe, but at a scale Scapy cannot reach. The two often complement each other: a Masscan sweep to find hosts, then a closer look with Nmap or Scapy.
Who is it for?
Masscan is aimed at security teams that inventory the services exposed on a large corporate network, at auditors commissioned for a penetration test, and at researchers studying the state of the Internet at scale. It assumes you understand what you are doing: the README warns that the program can saturate a local network and that an IPv6 scan focused on a single subnet can bring the target down.
It does not replace Nmap. It performs no DNS resolution, accepts no hostnames, detects neither operating systems nor precise service versions, and offers no scripting engine. On Windows and inside virtual machines, the documentation puts the ceiling at around three hundred thousand packets per second, against more than a million on native Linux. Above all, scanning addresses without written permission is illegal in most countries and may get your address banned by operators who monitor this kind of traffic. For a fine-grained look at a few machines, Nmap remains the right tool.
Download Masscan safely
The project is distributed as source code on GitHub, in the robertdavidgraham/masscan repository, whose releases page offers the archive of version 1.3.2, the most recent tagged release. According to the README, building requires nothing more than a C compiler and the make command on Linux and macOS, while Windows uses a Visual Studio project or MinGW. The libpcap library, or Npcap on Windows, is needed at run time. The software is entirely free of charge, the author simply inviting donations.
Caution is warranted with a tool of this kind. Precompiled Masscan executables circulate on download sites and forums, sometimes bundled with malicious payloads. The source code from the official repository, compiled yourself or obtained through your distribution’s package manager, remains the only reliable route.
Frequently asked questions
Is Masscan legal?
The tool itself is perfectly legal free software. What is regulated is its use: scanning addresses you do not own, without the owner’s written permission, is an offence under most legislations. Penetration tests are always carried out under an engagement that defines the authorised scope.
Does Masscan replace Nmap?
No. Masscan excels at quickly spotting open ports across vast address ranges, but it detects neither operating systems nor service versions and has no scripting engine. Common practice is to run Masscan first, then hand the discovered hosts to Nmap for a detailed analysis.
Which systems does it run on?
The README states that Linux is the primary platform and the one with the highest rates, but that the code also builds and runs on Windows, macOS and FreeBSD. On Windows, the Npcap capture library is required.
