1. Tool Introduction
RustScan is a modern, open-source port scanner written in Rust by Bee (bee-san). Its design goal is to be “the fastest port scanner,” using asynchronous techniques and an adaptive learning algorithm to scan all 65,535 ports on a host in seconds. Rather than trying to replace Nmap’s deep service/script scanning capability, RustScan is built to complement it: RustScan rapidly identifies which ports are open, then automatically pipes those results into Nmap for detailed service/version/script scanning. It supports a scripting/plugin system of its own and a configurable batch/ulimit system to maximize scan speed without overwhelming the host OS.
2. Installation
Kali Linux includes RustScan in its repositories:
sudo apt update
sudo apt install rustscan -y
Alternative installation via the .deb release or cargo:
# via cargo (Rust package manager)
cargo install rustscan
Verify:
rustscan --version
Expected output:
rustscan 2.3.0
3. Syntax
rustscan [OPTIONS] -a <IP/host/CIDR> -- [Nmap options]
4. Command-Line Options (Full Reference)
-a, --addresses <IP/host/CIDR/file>— Target(s) to scan-p, --ports <ports>— Specific ports to scan (comma separated)-r, --range <start-end>— Port range to scan--top— Scan only the most common ports (Nmap top ports list)-b, --batch-size <size>— Number of ports scanned concurrently (default 4500)-t, --timeout <ms>— Time in milliseconds before a port is considered closed--tries <tries>— Number of scan attempts before giving up on a port-u, --ulimit <limit>— Set the OS file descriptor limit for the scan--scan-order <serial|random>— Order in which ports are scanned-g, --greppable— Greppable output (no banner, minimal formatting)--no-nmap(via-- -sVomission) — skip automatic Nmap invocation, print RustScan results only when no Nmap args passed-oJ <file>— Output results in JSON format (via accessible flags in newer versions)--accessible— Accessible mode for screen readers (simplified output)-c, --config <path>— Path to a custom TOML configuration file-x, --exclude-ports <ports>— Ports to exclude from the scan--exclude-addresses <IP/CIDR>— Addresses to exclude from scan--no-config— Ignore the default configuration file--scripts <none|default|custom>— Control RustScan’s own script engine behavior-h, --help— Show help-V, --version— Show version-- <nmap args>— Everything after--is passed directly to Nmap for the follow-up scan
5. Basic Usage
rustscan -a 10.10.10.5
Expected output:
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
Open 10.10.10.5:22
Open 10.10.10.5:80
Open 10.10.10.5:3306
[~] Starting Nmap
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3306/tcp open mysql
6. Practical Examples
Example 1 — Scan a single IP with default settings
rustscan -a 192.168.1.10
Open 192.168.1.10:22
Open 192.168.1.10:445
[~] Starting Nmap
PORT STATE SERVICE
22/tcp open ssh
445/tcp open microsoft-ds
Example 2 — Scan a specific port range
rustscan -a 192.168.1.10 -r 1-1000
Open 192.168.1.10:21
Open 192.168.1.10:80
Example 3 — Scan a CIDR range with greppable output
rustscan -a 192.168.1.0/24 -g
192.168.1.10 -> [22,80,443]
192.168.1.15 -> [80]
Example 4 — Increase batch size and lower timeout for speed
rustscan -a 10.10.10.5 -b 6500 -t 1500
Open 10.10.10.5:22
Open 10.10.10.5:80
[~] Starting Nmap
Example 5 — Pass Nmap script/version flags after --
rustscan -a 10.10.10.5 -- -sC -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu
80/tcp open http Apache httpd 2.4.52
| http-title: Home
Example 6 — Scan multiple targets from a file
rustscan -a targets.txt
Open 10.10.10.5:22
Open 10.10.10.6:80
Example 7 — Exclude specific ports
rustscan -a 10.10.10.5 -p 1-1000 -x 135,139
Open 10.10.10.5:22
Open 10.10.10.5:445
Example 8 — Top ports only scan
rustscan -a 10.10.10.5 --top
Open 10.10.10.5:22
Open 10.10.10.5:80
Open 10.10.10.5:443
Example 9 — Custom ulimit for large batch scans
rustscan -a 10.10.10.0/24 -u 5000 -b 4500
Open 10.10.10.5:22
Open 10.10.10.9:3389
Example 10 — Accessible mode output
rustscan -a 10.10.10.5 --accessible
Open 10.10.10.5 port 22
Open 10.10.10.5 port 80
7. Common Use Cases
- Rapid full-port-range discovery as a precursor to Nmap deep scanning (CTF and OSCP-style workflows).
- Time-constrained engagements where scanning all 65,535 ports with Nmap alone would be too slow.
- Integrating into automated recon pipelines where speed of initial triage matters.
- Scanning large internal ranges quickly before selecting hosts for focused manual testing.
8. Automation with Bash
#!/bin/bash
# rustscan_pipeline.sh - full port sweep then detailed Nmap scan
TARGET="$1"
OUTDIR="./rustscan_results"
mkdir -p "$OUTDIR"
echo "[*] Running RustScan against $TARGET..."
rustscan -a "$TARGET" -b 4500 -- -sC -sV -oN "$OUTDIR/${TARGET}_nmap.txt"
echo "[+] Full results saved to $OUTDIR/${TARGET}_nmap.txt"
9. Tips and Best Practices
- Increase
-b(batch size) cautiously; too high a value on a lowulimitsystem can cause “too many open files” errors — raise-uaccordingly. - Use
--followed by standard Nmap flags to get the best of both worlds: RustScan’s speed for port discovery and Nmap’s depth for service enumeration. - On unreliable or high-latency networks, raise
-t(timeout) to avoid false negatives on slow-to-respond ports. - Use
-gfor greppable, script-friendly output when chaining into other tools. - Keep RustScan updated, as batch size defaults and adaptive learning behavior have changed across versions.
10. Troubleshooting
- “Too many open files” error: lower
-bbatch size or raise the OSulimit -nand RustScan’s-uflag. - Ports reported open but Nmap follow-up shows closed: increase
-ttimeout, since a busy network may cause false positives at very fast timeouts. - RustScan hangs at “Starting Nmap”: confirm Nmap is installed and accessible in
$PATH. - Inconsistent results between runs: try
--scan-order serialfor deterministic ordering instead ofrandom.
11. References
- GitHub repository: https://github.com/RustScan/RustScan
- Official documentation/book: https://rustscan.github.io/RustScan/
- Kali Linux tool page: https://www.kali.org/tools/rustscan/