Nmap Finds Your Open Ports Before Attackers Do
Nmap 7.99, masscan, and RustScan represent three distinct network scanning philosophies. A pentester doesn’t pick one: they combine all three to map their attack surface before someone else does it for them.
Nmap, born in 1997 from Gordon « Fyodor » Lyon’s keyboard, remains in July 2026 the world’s most deployed port scanner with version 7.99. masscan, created in 2013 by Robert Graham, claims 10 million packets per second and a full Internet scan in under 5 minutes. RustScan, launched in 2019 by Brandon « bee » Skerritt, has racked up 20,200 GitHub stars by promising a full TCP port scan in 3 seconds. Three tools, three philosophies, one hard truth: your network has open ports you don’t know about, and a scanner will find them before an attacker does.
Nmap — the Swiss Army knife of network scanning
Nmap’s strength isn’t raw speed — a full 65,535-port TCP scan can take hours — but the depth of analysis it delivers once a port is identified. The classic pentester workflow unfolds in three phases.
First, host discovery (-sn) identifies live machines on a segment without sending a single packet to a TCP port. Nmap combines ICMP Echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp probes: no firewall blocks all of them at once, and a combination that fails the first check often passes the third.
Next, port scanning. The SYN scan (-sS) is the default and most widely used mode: it sends a SYN packet, reads the SYN-ACK or RST in response, and never completes the TCP handshake — the target kernel logs nothing, making it quieter than a full connect scan (-sT). UDP scanning (-sU) is slower but essential for services like DNS (53), SNMP (161), or NTP (123) that never listen on TCP. A full -p- sweep covers all 65,535 TCP ports plus the 1,000 most common UDP ports, and only a complete scan guarantees you won’t miss an exotic service hiding above port 10,000.
Finally, service and OS detection (-sV and -O) turns every open port into actionable intelligence: exact SSH server version, the underlying Linux distribution and kernel, the NetBIOS name of a Windows box. Nmap maintains a signature database of over 2,200 protocols and relies on more than 3,000 OS fingerprints to identify a target with accuracy often exceeding 90%.
# SYN scan of the 1,000 most common ports
nmap -sS 192.168.1.0/24
# Full scan + version detection + default scripts
nmap -sS -sV -sC -p- 192.168.1.100
# Aggressive OS detection
nmap -O --osscan-guess 192.168.1.100The Nmap Scripting Engine (NSE), activated with -sC or --script, is what separates a scanner from an audit platform. Scripts, written in Lua, are grouped into categories: auth (authentication bypass), vuln (known CVE detection), brute (dictionary attacks), discovery (SMB share enumeration, SNMP walks), exploit (active exploitation), safe and default (non-intrusive). With over 600 scripts shipped by default, Nmap replaces half a dozen specialized tools for common protocols.
# Known vulnerability scan on an HTTP service
nmap --script vuln -p 443 example.com
# Full SMB enumeration
nmap --script smb-os-discovery,smb-enum-shares -p 445 10.0.0.0/24masscan — scanning the Internet in 5 minutes
masscan throws out the operating system’s TCP/IP stack and implements its own network stack in userspace. This architecture lets it emit SYN packets asynchronously at 10 million packets per second on a machine with a 10 Gbps NIC, using the PF_RING ZC driver to bypass the Linux kernel entirely.
The tradeoff is severe: masscan does not perform service detection, does not complete TCP handshakes, and using it with the system’s local IP can cause conflicts with the native TCP stack. For reliable scanning, you either assign it a separate source IP (--source-ip) or configure iptables to hide the source port it uses.
# Scan ports 22, 80, and 443 across an entire /8 subnet
masscan -p22,80,443 10.0.0.0/8 --rate 10000
# Scan with banner grabbing (requires a dedicated IP)
masscan -p80,443 10.0.0.0/8 --banners --source-ip 192.168.1.200
# Load configuration from a file
masscan -c scan.conf --rate 1000000masscan shines for large-scale reconnaissance: mapping every port 22, 80, 443, and 3389 across a /16 subnet in seconds, identifying hosts that expose an unexpected service on a /8 before drilling down with Nmap. Banner grabbing (--banners) works for HTTP, SSH, FTP, SMTP, POP3, IMAP, Telnet, RDP, VNC, SMBv1/v2, SSL, and memcached — enough for a first pass before handing off to Nmap for deep analysis.
Open source under the AGPL v3 license, masscan is maintained by Robert Graham (a.k.a. @ErrataRob) and has accumulated 25,900 GitHub stars. Its last development activity dates back several years, but the code compiles cleanly on modern Linux in seconds with make -j.
Stealth techniques and timing
A network scan is not a neutral act: an IDS like Snort or Suricata detects a SYN sweep within seconds, and a fail2ban policy blocks the source IP after a handful of attempts. All three scanners offer countermeasures.
Nmap’s timing templates (-T0 through -T5) control emission speed. -T2 (polite) inserts 0.4 seconds between each probe and slips past most default IDS thresholds for scans under 100 ports. -T4 (aggressive) is the right tradeoff for an internal scan where latency is low and detection isn’t a concern. -T5 (insane) fires packets as fast as the network accepts them and will trigger an alert within seconds.
# Stealthy scan with IP fragmentation and decoys
nmap -sS -T2 -f -D RND:10 192.168.1.100
# Idle scan (requires a zombie host)
nmap -sI zombie_host:80 192.168.1.100IP fragmentation (-f) splits packets into 8-byte fragments, forcing a firewall to reassemble before inspecting — some older filters simply give up. Decoys (-D) mix Nmap’s traffic with packets from spoofed addresses, burying the real IP in background noise. The idle scan (-sI) uses a zombie machine with a predictable IP-ID to scan without ever revealing the true source address: the target sees only the zombie.
masscan offers no decoys or fragmentation, but the --rate parameter lets you spread a scan over several hours at 10 packets per second — slow enough to fly under the radar of a default-configured IDS.
RustScan — modern speed
RustScan doesn’t try to replace Nmap: it complements it upstream. Where Nmap takes several minutes to sweep 65,535 ports, RustScan does it in 3 seconds thanks to an asynchronous engine written in Rust that opens thousands of sockets in parallel. Once open ports are identified, RustScan automatically passes them to Nmap for service detection and NSE scripts.
# Full port scan, then Nmap on the open ports
rustscan -a 192.168.1.100 -- -sV -sC
# Batch scan with 4,000 concurrent sockets
rustscan -a 192.168.1.0/24 --batch-size 4000The project includes a scripting engine that accepts Python, Lua, and Shell, triggered automatically on discovered open ports. You can write a script that attempts default-key SSH login on every port 22 found, or grabs the HTTP title on every port 80, without having to chain tools manually.
RustScan ships as a static binary on GitHub Releases, in the Arch Linux repositories (pacman -S rustscan), and via Cargo (cargo install rustscan). Licensed under GPL v3, the project remains actively maintained with 20,200 stars and a community that feeds the shared script repository.
Auditing your network like a pentester
An effective audit follows a methodical progression, not a copy-pasted command list.
Step 1 — Discovery. Identify every live machine on the segment. A simple nmap -sn 192.168.1.0/24 is enough for a home network. For an enterprise /16, chain masscan to avoid waiting an hour.
Step 2 — Fast scan of common ports. Run masscan on the top 1,000 ports (--top-ports 1000) to get a first map in seconds, then RustScan in full-port mode on the hosts that matter.
Step 3 — Deep analysis. On every open port, trigger Nmap with -sV -sC to identify the service, its version, and known vulnerabilities via NSE scripts. A --script vuln on web and SMB services often reveals an exploitable flaw in under 30 seconds.
Step 4 — Document. Export every result in XML (-oX) for import into a vulnerability management tool, or in greppable format (-oG) for fast command-line processing.
# Full audit in three commands
masscan -p1-65535 10.0.0.0/24 --rate 5000 -oG masscan.gnmap
rustscan -a 10.0.0.0/24 -- -sV -oX nmap_full.xml
nmap -sV --script vuln -p $(grep open masscan.gnmap | cut -d'/' -f1 | paste -sd,) 10.0.0.0/24An important caveat: scanning a network you don’t own is illegal in most jurisdictions. In the United States, the Computer Fraud and Abuse Act (CFAA) criminalizes unauthorized access; in the United Kingdom, the Computer Misuse Act 1990 carries up to two years’ imprisonment. These tools are for use exclusively on your own infrastructure or on targets for which you have obtained written authorization.
Which scanner for which job
Nmap remains the reference tool for any deep audit. masscan is unbeatable for mapping an entire fleet or a /8 subnet in under a minute. RustScan shines as the first line when you need to identify all open ports in three seconds before handing off to Nmap.
If you manage fewer than 50 machines, Nmap alone is enough. If you need to audit a /16 or /8, start with masscan for triage, then Nmap for depth. If you’re automating security CI/CD pipelines, RustScan + Nmap is the fastest duo to integrate.
In every case, run the scan before someone else does.