Hi folks! Masscan has a peculiar reputation: everyone knows the one command that scans the internet, and almost nobody knows the dozen options that make it actually usable in daily work. The man page exists, but it is terse, and half the answers people need are one line long and buried.

So we took a live Masscan 1.3.2, pointed it at a server we own, and worked through the flags that come up again and again: reading targets from a file, excluding networks you must not touch, picking a source port, cutting the ten-second wait at the end, scanning UDP, pinging, and resuming an interrupted run. Every output below is real.

Consider this the reference we wish we had when we started. Grab your terminal.

Table of Contents

-iL: Targets From a File

Typing ranges on the command line stops being fun at about the third one. -iL takes a plain text file — one target per line, single addresses or CIDR blocks mixed freely:

cat targets.txt
203.0.113.10
198.51.100.0/24

masscan -iL targets.txt -p80,443 --rate 200 -oL -

#masscan
open tcp 80 203.0.113.10 1786889783
open tcp 443 203.0.113.10 1786889783
# end

Two practical notes. First, the file is read once at startup, so editing it mid-scan changes nothing. Second, you can combine -iL with targets on the command line — they add up rather than override each other, which is occasionally surprising.

–excludefile: The Flag That Keeps You Out of Trouble

If you take one thing from this article, take this one. --excludefile reads a list of ranges that must never be touched, and exclusions win over targets — always.

cat exclude.txt
203.0.113.10/32

masscan 203.0.113.10 -p443 --rate 200 --excludefile exclude.txt -oL -

exclude.txt: excluding 1 ranges from file
FAIL: target IP address list empty
 [hint] all addresses were removed by exclusion ranges

Notice how explicit that is: Masscan tells you how many ranges it loaded, then refuses to run at all because nothing was left. That refusal is a feature — a silent empty scan would be far worse.

In practice you keep a permanent exclude.txt with everything that must stay untouched — customer networks that opted out, government ranges, your monitoring hosts — and you pass it on every single run. Building the habit costs nothing and prevents the one mistake that gets your provider’s abuse desk involved.

–open-only: What It Really Changes

People add --open-only expecting it to filter closed ports out of their results, then get confused because the results looked the same without it.

Here is why: in a plain SYN scan, the default output already contains only what answered. We scanned a closed port with the list format and no flag at all — the output was empty apart from the header and footer. Adding --open-only to a scan of open ports changed nothing in the result either.

masscan -iL targets.txt -p80,443,9999 --rate 200 --open-only -oL -

#masscan
open tcp 80 203.0.113.10 1786889783
open tcp 443 203.0.113.10 1786889783
# end

Port 9999 was closed and simply is not there. The flag earns its keep in modes where non-open states do get reported — banner grabbing and some UDP work — so keeping it in your standard command line is harmless insurance rather than a no-op.

–source-port: Why You Would Set It

By default Masscan picks its own source port. Fixing it explicitly is a small thing with two real uses:

masscan 203.0.113.10 -p443 --rate 200 --source-port 61000 -oL -

#masscan
open tcp 443 203.0.113.10 1786889832
# end
  • Firewall rules. A known source port lets you write one precise rule instead of opening a range — this is the usual companion to banner grabbing on Linux, where you need to stop the kernel from sending RST packets on that port.
  • Not fighting your own OS. Masscan runs its own TCP stack alongside the kernel’s. Pinning a port the kernel is not using avoids the two of them stepping on each other.

Pick something high and unused, well outside the ephemeral range your system hands out.

–wait: The Ten Seconds You Are Wasting

This is our favourite small optimisation, because the effect is immediate and measurable.

After sending the last packet, Masscan waits ten seconds by default for stragglers to reply. Reasonable across the internet, silly for a one-host check. Set --wait 0 and it exits as soon as it is done:

time masscan 203.0.113.10 -p443 --rate 200 --wait 0 -oL -

#masscan
open tcp 443 203.0.113.10 1786889879
# end

real    0m1.416s

One and a half seconds instead of eleven-plus. If you script Masscan into a loop over many small targets, this single flag is the difference between a job that finishes over lunch and one that does not.

The trade-off is real though: on slow or distant networks some replies genuinely arrive in those last seconds, and with --wait 0 you will miss them. Use it for local and quick checks, leave the default for wide sweeps.

Scanning UDP: the -pU Syntax

UDP ports need a prefix, and the syntax trips people up because it looks like Nmap’s but is not identical. The form is -pU:<ports>:

masscan 8.8.8.8 -pU:53 --rate 200 -oL -

#masscan
open udp 53 8.8.8.8 1786889843
# end

Note the protocol column in the output says udp, so mixed scans stay unambiguous. You can combine both protocols in one run:

masscan 203.0.113.0/24 -p80,443,U:53,U:161 --rate 1000 -oL -

Keep expectations sober: UDP has no handshake, so “open” here means something answered. Silence is ambiguous — it can equally mean open-but-quiet or filtered.

–ping: ICMP Sweeps

Masscan can do plain host discovery without touching any port:

masscan 203.0.113.10 --ping --rate 200 -oL -

#masscan
open icmp 0 203.0.113.10 1786889854
# end

The result is reported as open icmp 0, which reads oddly the first time — the “port” is zero because ICMP has no ports. Parsers that assume a real port number will need a special case for this.

It is a fast way to find live hosts before a heavier scan, with the usual caveat that plenty of hosts simply do not answer ICMP.

–rate: The Only Number That Matters

--rate sets packets per second, and it is the knob that decides both how long your scan takes and how much you annoy everyone in the path.

masscan 203.0.113.0/24 -p443 --rate 500 -oL -

Rules of thumb we hold to:

  • Start low — a few hundred — when scanning someone else’s network for the first time.
  • The bottleneck is rarely Masscan. Consumer routers, VMs and cheap VPS links give up long before the scanner does.
  • Watch the progress line: if the reported rate sits far below what you asked for, something upstream is the limit and raising the number will not help.

Interrupted Scans and paused.conf

Hit Ctrl+C on a long scan and Masscan writes a file called paused.conf into the current directory. We interrupted a /16 sweep and here is what landed there:

# resume information
resume-index = 1642
seed = 10890191339754220106
rate = 300
shard = 1/1
nocapture = servername

output-filename = /dev/null
output-format = list

adapter-ip = 160.119.76.42

The interesting fields are resume-index — how far the scan got — and seed. Masscan randomises target order, and the seed is what makes that order reproducible; without it, “continue where we stopped” would be meaningless.

Two things worth knowing: the file lands in whatever directory you launched from, and each new interrupted scan overwrites it. If you run several scans from the same folder, copy that file somewhere safe before starting the next one.

Putting It All in a Config File

Once your command line grows past a couple of flags, move it into a config file. Same options, written as key/value pairs without the dashes:

# scan.conf
rate = 1000
ports = 80,443,U:53
excludefile = /etc/masscan/exclude.txt
source-port = 61000
wait = 0
output-format = json
output-filename = results.json
masscan -c scan.conf -iL targets.txt

The big win is that your exclusion list becomes part of the standing configuration instead of something you have to remember to type. That is exactly the kind of thing you want to be automatic.

Conclusion

The short list to remember: -iL for targets, --excludefile always, --wait 0 for quick checks, -pU: for UDP, --source-port when firewalls or banners are involved, and --rate as the one number to tune. If a long scan dies, look for paused.conf before you start over from scratch.

If you would rather skip the flag archaeology entirely — and the scan nodes, and the abuse complaints that come with running your own — that is what ScaniteX does: you choose ranges and ports, we run it and hand back the results. Happy scanning, and only where you are allowed.

Try ScaniteX for Free!

Automated platform for scanning open ports and detecting active services online.

Start a 24-hour trial period (promo code FREE10) to test all scanning features for your business security.

Get Free Trial
Views: 1