RustScan for fast full-range port discovery

RustScan is a Rust-based port scanner that finds all 65k ports in as little as three seconds and pipes results straight into Nmap, built for authorized assessments and network inventory work.

Tool	bee-san/RustScan — a fast, extensible Rust port scanner with a multi-language scripting engine
Category	network reconnaissance / port scanning
Primary Use	Rapid TCP port discovery across all 65k ports with automatic piping of found ports into Nmap for service enumeration during authorized engagements
Safe Use	Intended for penetration testers and security teams scanning systems they own or have written authorization to assess; also suited to lab environments and internal asset inventory
Telemetry Note	High-speed full-range scans generate distinctive connection bursts that IDS/IPS sensors and rate-limiting firewalls will flag; blue teams should expect rapid SYN-style connection attempts across the entire port range from a single source

RustScan describes itself as "The Modern Port Scanner" and its headline claim is blunt: all 65,535 ports scanned in roughly three seconds at its fastest configuration. The project, written in Rust and sitting at over 20,000 stars under the bee-san/RustScan repository, is one of the more visible entries in the current generation of reconnaissance tooling. It is licensed under GPL-3.0, ships prebuilt binaries via its GitHub releases page, and is packaged across a long list of distributions tracked through Repology. For practitioners, the pitch is simple: replace the slow, first-phase discovery step of a port sweep with something that finishes before your coffee cools, then hand off to the tools that already do deep enumeration well.

What RustScan actually does internally is worth separating from marketing. It is a connection-based discovery engine that rapidly identifies open ports and then, critically, pipes those ports into Nmap automatically. This two-stage design is the architectural heart of the tool: RustScan does not try to replace Nmap's service detection, version fingerprinting, or scripting engine. Instead it compresses the discovery phase and lets the mature ecosystem handle the rest. Anyone who has watched a full-range nmap scan crawl through closed ports on a latency-heavy target will immediately understand the value proposition, and anyone running authorized assessments against large CIDR blocks will appreciate it even more.

Installation is deliberately low-friction. The README points at the releases page for standalone binaries but recommends package managers, and the officially supported path for source installs is cargo install rustscan, which requires a working Rust toolchain. On macOS, brew install rustscan is the natural route; on Arch, pacman -S rustscan. The breadth of packaging — the Repology badge tracks availability across many repositories — signals a project that has moved past the hobbyist stage and is being maintained as real infrastructure by a contributor base the README counts at 26 people under its all-contributors scheme.

The feature list is compact but each item carries weight. Beyond raw speed, RustScan ships a scripting engine supporting Python, Lua, and Shell, and it handles the expected input formats: IPv6, CIDR ranges, and file-based target lists. The scripting engine is where the tool differentiates itself from a simple masscan alternative. The README gives the canonical example — take discovered ports and pipe them into Nmap — but also notes conditional workflows such as running smb-enum when SMB is found open. That turns RustScan from a scanner into a lightweight orchestration layer where port state drives downstream actions in whatever language the operator prefers.

The "Adaptive Learning" feature set is the most conceptually interesting part of the README, and the authors are careful to defuse hype around it. The umbrella term covers features that learn about the environment being scanned and how the operator uses the tool, improving behavior over time — with the explicit caveat "no bloated machine learning here, just basic maths." One concrete application the README illustrates is automatically fine-tuning scan parameters to match the host OS being probed. In practice this means the tool adjusts its concurrency and timing behavior rather than brute-forcing a single configuration, which matters both for reliability and for not melting fragile embedded targets during authorized internal scans.

Performance is treated as a guarded invariant, not a marketing claim. The README describes continuous-integration tests that fail the build if RustScan becomes significantly slower than the previous version, effectively making regressions in speed a blocking defect. The team uses HyperFine to benchmark performance over time and answer, in their words, "are we getting faster, are we getting slower." Every pull request is reviewed by at least one person, often two, with manual testing to confirm no negative performance impact. This is an unusually disciplined engineering posture for offensive-adjacent tooling and explains why the project has held its reputation.

Stealth is acknowledged rather than ignored. The README explicitly notes that while speed is the default, running a deliberately slow scan for stealth reasons is supported. That matters for authorized engagements where the rules of engagement call for low-and-slow traffic to avoid tripping client monitoring, or where fragile legacy systems cannot tolerate aggressive connection rates. Operators should still assume that any full-range scan — fast or slow — is visible to the destination's logging and detection stack; RustScan changes the timing profile, not the fundamental observability of TCP connection attempts.

A notable and unusual angle is accessibility. The README dedicates a section to it, stating that RustScan is "one of the first penetration testing tools that aims to be entirely accessible," and links to broader discussion of how inaccessible most tooling in the industry is. The project runs CI testing aimed at ensuring accessibility and treats it as an ongoing commitment. For team leads building inclusive security teams, this is a genuine differentiator — most CLI recon tools make no such effort, and screen-reader-friendly output behavior in a port scanner is rare enough to be worth highlighting.

Configuration and usage documentation are split sensibly. There is a basic usage guide, a second guide titled "Things you may want to do" covering the more advanced workflows, and dedicated documentation for the config file. The config file deserves attention from anyone deploying RustScan at scale, since scripting-engine integration and adaptive behavior both presumably live there alongside scan tuning. The project also maintains a Discord community and a contribution guide, and its hacktoberfest topic suggests regular participation in open-source events.

From a defensive perspective, RustScan is a useful teaching artifact. Blue teams should understand that a full 65k-port sweep completing in seconds produces a very distinctive traffic signature: a burst of connection attempts across the entire port space from a single source, often triggering rate limits, IPS alerts, or firewall drops long before the scan finishes. Detection engineering around rapid sequential port access is straightforward, and RustScan's own stealth mode — which slows the scan — is effectively an acknowledgment that the fast mode is loud by design. Asset owners can also use the tool internally for legitimate attack-surface inventory of their own ranges.

Where RustScan fits in a professional workflow is best summarized as the acceleration of phase one. Recon and enumeration typically start with broad discovery, narrow to open services, then pivot to version and vulnerability analysis. RustScan compresses the first two steps — discovery plus automatic Nmap handoff — and its scripting engine lets teams codify the third. For bug bounty hunters working within scope, internal red teams with authorization, and sysadmins inventorying their own networks, the economics are compelling: minutes of scanning collapse into seconds, and the Nmap integration means no workflow retraining is required.

The project's maturity indicators — 20,000+ stars, broad distribution packaging, 26 credited contributors, performance-gating CI, dual-review PR process, and an active community — collectively suggest a tool that is safe to adopt as a standard part of a toolkit rather than an experiment. The GPL-3.0 license permits free use and modification with reciprocal obligations for derived works. For anyone whose authorized workflow still begins with a slow full-range nmap sweep, RustScan is one of the clearest quality-of-life upgrades available in modern reconnaissance tooling.

Official project repository for bee-san/RustScan.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.