RustScan: Complete Guide to High-Speed Port Scanning and Service Discovery Using Kali Linux

1. Tool Introduction

RustScan is a modern, open-source port scanner written in Rust by Bee (bee-san). Its design goal is to be “the fastest port scanner,” using asynchronous techniques and an adaptive learning algorithm to scan all 65,535 ports on a host in seconds. Rather than trying to replace Nmap’s deep service/script scanning capability, RustScan is built to complement it: RustScan rapidly identifies which ports are open, then automatically pipes those results into Nmap for detailed service/version/script scanning. It supports a scripting/plugin system of its own and a configurable batch/ulimit system to maximize scan speed without overwhelming the host OS.

2. Installation

Kali Linux includes RustScan in its repositories:

sudo apt update
sudo apt install rustscan -y

Alternative installation via the .deb release or cargo:

# via cargo (Rust package manager)
cargo install rustscan

Verify:

rustscan --version

Expected output:

rustscan 2.3.0

3. Syntax

rustscan [OPTIONS] -a <IP/host/CIDR> -- [Nmap options]

4. Command-Line Options (Full Reference)

• -a, --addresses <IP/host/CIDR/file> — Target(s) to scan
• -p, --ports <ports> — Specific ports to scan (comma separated)
• -r, --range <start-end> — Port range to scan
• --top — Scan only the most common ports (Nmap top ports list)
• -b, --batch-size <size> — Number of ports scanned concurrently (default 4500)
• -t, --timeout <ms> — Time in milliseconds before a port is considered closed
• --tries <tries> — Number of scan attempts before giving up on a port
• -u, --ulimit <limit> — Set the OS file descriptor limit for the scan
• --scan-order <serial|random> — Order in which ports are scanned
• -g, --greppable — Greppable output (no banner, minimal formatting)
• --no-nmap (via -- -sV omission) — skip automatic Nmap invocation, print RustScan results only when no Nmap args passed
• -oJ <file> — Output results in JSON format (via accessible flags in newer versions)
• --accessible — Accessible mode for screen readers (simplified output)
• -c, --config <path> — Path to a custom TOML configuration file
• -x, --exclude-ports <ports> — Ports to exclude from the scan
• --exclude-addresses <IP/CIDR> — Addresses to exclude from scan
• --no-config — Ignore the default configuration file
• --scripts <none|default|custom> — Control RustScan’s own script engine behavior
• -h, --help — Show help
• -V, --version — Show version
• -- <nmap args> — Everything after -- is passed directly to Nmap for the follow-up scan

5. Basic Usage

rustscan -a 10.10.10.5

Expected output:

.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
Open 10.10.10.5:22
Open 10.10.10.5:80
Open 10.10.10.5:3306
[~] Starting Nmap
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql

6. Practical Examples

Example 1 — Scan a single IP with default settings

rustscan -a 192.168.1.10

Open 192.168.1.10:22
Open 192.168.1.10:445
[~] Starting Nmap
PORT    STATE SERVICE
22/tcp  open  ssh
445/tcp open  microsoft-ds

Example 2 — Scan a specific port range

rustscan -a 192.168.1.10 -r 1-1000

Open 192.168.1.10:21
Open 192.168.1.10:80

Example 3 — Scan a CIDR range with greppable output

rustscan -a 192.168.1.0/24 -g

192.168.1.10 -> [22,80,443]
192.168.1.15 -> [80]

Example 4 — Increase batch size and lower timeout for speed

rustscan -a 10.10.10.5 -b 6500 -t 1500

Open 10.10.10.5:22
Open 10.10.10.5:80
[~] Starting Nmap

Example 5 — Pass Nmap script/version flags after --

rustscan -a 10.10.10.5 -- -sC -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.52
| http-title: Home

Example 6 — Scan multiple targets from a file

rustscan -a targets.txt

Open 10.10.10.5:22
Open 10.10.10.6:80

Example 7 — Exclude specific ports

rustscan -a 10.10.10.5 -p 1-1000 -x 135,139

Open 10.10.10.5:22
Open 10.10.10.5:445

Example 8 — Top ports only scan

rustscan -a 10.10.10.5 --top

Open 10.10.10.5:22
Open 10.10.10.5:80
Open 10.10.10.5:443

Example 9 — Custom ulimit for large batch scans

rustscan -a 10.10.10.0/24 -u 5000 -b 4500

Open 10.10.10.5:22
Open 10.10.10.9:3389

Example 10 — Accessible mode output

rustscan -a 10.10.10.5 --accessible

Open 10.10.10.5 port 22
Open 10.10.10.5 port 80

7. Common Use Cases

• Rapid full-port-range discovery as a precursor to Nmap deep scanning (CTF and OSCP-style workflows).
• Time-constrained engagements where scanning all 65,535 ports with Nmap alone would be too slow.
• Integrating into automated recon pipelines where speed of initial triage matters.
• Scanning large internal ranges quickly before selecting hosts for focused manual testing.

8. Automation with Bash

#!/bin/bash
# rustscan_pipeline.sh - full port sweep then detailed Nmap scan
TARGET="$1"
OUTDIR="./rustscan_results"
mkdir -p "$OUTDIR"

echo "[*] Running RustScan against $TARGET..."
rustscan -a "$TARGET" -b 4500 -- -sC -sV -oN "$OUTDIR/${TARGET}_nmap.txt"

echo "[+] Full results saved to $OUTDIR/${TARGET}_nmap.txt"

9. Tips and Best Practices

• Increase -b (batch size) cautiously; too high a value on a low ulimit system can cause “too many open files” errors — raise -u accordingly.
• Use -- followed by standard Nmap flags to get the best of both worlds: RustScan’s speed for port discovery and Nmap’s depth for service enumeration.
• On unreliable or high-latency networks, raise -t (timeout) to avoid false negatives on slow-to-respond ports.
• Use -g for greppable, script-friendly output when chaining into other tools.
• Keep RustScan updated, as batch size defaults and adaptive learning behavior have changed across versions.

10. Troubleshooting

• “Too many open files” error: lower -b batch size or raise the OS ulimit -n and RustScan’s -u flag.
• Ports reported open but Nmap follow-up shows closed: increase -t timeout, since a busy network may cause false positives at very fast timeouts.
• RustScan hangs at “Starting Nmap”: confirm Nmap is installed and accessible in $PATH.
• Inconsistent results between runs: try --scan-order serial for deterministic ordering instead of random.

11. References

• GitHub repository: https://github.com/RustScan/RustScan
• Official documentation/book: https://rustscan.github.io/RustScan/
• Kali Linux tool page: https://www.kali.org/tools/rustscan/