Tools · Nmap and network discovery · 21 / 25
Nmap vs Masscan vs RustScan: which port scanner to use and when
Compare how the three scanners work, where each is accurate, and how to combine a fast sweep with Nmap’s service detection on networks you own.
Three designs
Nmap is a full-featured scanner with discovery, timing control, service and OS detection, and scripts. Masscan uses its own TCP/IP stack and transmits asynchronously at very high rates, which lets it sweep huge address ranges for a few ports quickly, but it does little beyond telling you a port answered. RustScan finds open ports fast with many concurrent connections and then hands them to Nmap for detail.
Speed comes from parallelism and skipping retries. That is fine on a clean network and inaccurate on a lossy one.
Matching the tool to the job
For a lab or a few hundred internal hosts, Nmap alone is usually right. For a large address space where you only care about a handful of ports, such as checking every public address you own for RDP and SMB, Masscan is designed for it. For a single host where you want every TCP port and then versions, RustScan or a two-stage Nmap run with --min-rate gets there quickly.
Whatever finds the ports, use Nmap -sV and scripts on the results before you write a finding. A Masscan hit is “something answered”, not a service identification.
Lab: same target, three tools
Scan your lab VM’s full TCP range with each tool, using a modest rate. Compare the open port lists and the times. Then add 5% loss with tc netem and repeat. Note which tool misses ports first. Finish by feeding the union of open ports into Nmap -sV.
Masscan needs its own source port range or a firewall rule so your host’s kernel does not reset its connections. Read its documentation for --src-port before running it, and keep the rate low on anything you share.
sudo masscan 192.168.56.101 -p1-65535 --rate 2000 -oL masscan.txt rustscan -a 192.168.56.101 --ulimit 5000 -- -sV sudo nmap -p- --min-rate 2000 192.168.56.101
Responsible use
High-rate scanners can saturate links, fill firewall state tables, and set off alarms across an organization. Agree on rates and windows with the network owner, and never point them at address space you do not control.
Record which tool produced each result. A reviewer interprets a Masscan-only list differently from Nmap output with versions.
Diagram
Fast sweep versus deep scan
Combine them instead of choosing one.
Strength. Very fast open-port discovery.
Gap. No reliable service or version detail; fewer retries.
Use. Large ranges, few ports.
Strength. Speed plus identification.
Gap. Two steps to script.
Use. Most real inventory work.
Check yourself
1. Which tool is built for sweeping very large address ranges for a few ports?
2. A fast scanner reports port 8443 open. What should you do before filing a finding?
3. Why might high-rate scanners miss ports on a lossy network?