unicornscan: Network reconnaissance and port scanner

1. Tool Introduction

Unicornscan is an asynchronous, stateless network reconnaissance tool designed for information gathering and stimulus/response correlation across large networks. Built with a distributed, user-land TCP/IP stack, it decouples packet transmission from response processing, similar in philosophy to Masscan, and allows extremely fast TCP and UDP scanning. Unicornscan was created for security research purposes and offers features such as active/passive OS and application fingerprinting, PCAP file logging, and a relational-database-friendly output format, making it useful for large-scale scan data analysis. It is included in the Kali Linux repositories.

2. Installation

sudo apt update
sudo apt install unicornscan -y

Verify:

unicornscan -V

Expected output:

unicornscan 0.4.7

3. Syntax

unicornscan [OPTIONS] {target specification}[:port specification]

4. Command-Line Options (Full Reference)

• -h, --help — Show help/usage
• -V — Show version
• -v — Verbose mode (repeat for more verbosity, e.g. -vv)
• -i <interface> — Set interface to use
• -s <ip> — Set source address for packets
• -e <ip> — Set source address (alt syntax in some builds)
• -m <mode> — Scan mode: T (TCP scan, default), U (UDP scan), A (ARP scan), sf (sniffer mode), syn, etc.
• -Iv6 — Enable IPv6 scanning
• -r <pps> — Packets per second send rate
• -p <ports> — Ports to scan (e.g., 1-65535)
• --repeats <n> / -R <n> — Number of times to repeat/send each probe
• -l <file> — Log results to a file
• -w <file> — Write results to pcap file
• -Z — Enable “immediate mode” output as results arrive
• -t <ttl> — Set TTL of outgoing packets
• -M <mtu> — Set MTU for fragmentation
• -T <tos> — Set Type of Service field
• -E — Enable “Send TCP options” style extended probes
• -F — Set FIN flag on TCP packets
• -S — Set SYN flag on TCP packets (default for TCP scans)
• -P — Set PSH flag on TCP packets
• -A — Set ACK flag on TCP packets
• -b <payload group> — Use a specific UDP payload group for application banners
• -d <delay> — Delay in seconds before starting scan
• -D — Enable “Dumb-mode” simple output for scripting
• -q — Quiet mode (minimal output)
• -Q — Enable stateful, “quick” full-connect scan mode
• --ipfrag — Enable IP packet fragmentation for evasion
• -I <count> — Set immediate report threshold count

(Note: Unicornscan’s flag set varies slightly between build versions; unicornscan --help on the installed system is the authoritative reference.)

5. Basic Usage

sudo unicornscan 192.168.1.0/24

Expected output:

Using interface(s) eth0
Scanning 256 total hosts with 65535 total packets
TCP open                     ssh[   22]         from 192.168.1.10     ttl 64
TCP open                    http[   80]         from 192.168.1.10     ttl 64

6. Practical Examples

Example 1 — Basic TCP scan of a single host

sudo unicornscan 10.10.10.5:1-1024

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open                    http[   80]         from 10.10.10.5     ttl 64

Example 2 — UDP scan mode

sudo unicornscan -mU 10.10.10.5:53,161

UDP open                  domain[   53]         from 10.10.10.5     ttl 64
UDP open                    snmp[  161]         from 10.10.10.5     ttl 64

Example 3 — Scan with a custom packet rate

sudo unicornscan -r 500 10.10.10.0/24:1-1000

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open              microsoft-ds[  445]      from 10.10.10.9     ttl 128

Example 4 — Save results to a pcap file

sudo unicornscan 10.10.10.5:1-65535 -w results.pcap

[creates results.pcap for offline analysis in Wireshark]

Example 5 — ARP-mode local subnet scan

sudo unicornscan -mA 192.168.1.0/24

ARP who-has 192.168.1.10 reply from AA:BB:CC:DD:EE:FF
ARP who-has 192.168.1.15 reply from 11:22:33:44:55:66

Example 6 — Full port range TCP scan on a single host

sudo unicornscan 10.10.10.5:1-65535

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64
TCP open                    http[   80]         from 10.10.10.5     ttl 64
TCP open                    mysql[ 3306]         from 10.10.10.5     ttl 64

Example 7 — Repeat probes for reliability on lossy networks

sudo unicornscan -R 3 10.10.10.5:1-1000

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 8 — Verbose output with immediate reporting

sudo unicornscan -v -Z 10.10.10.5:1-1000

[verbose] sending SYN to 10.10.10.5:22
TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 9 — Scan with source IP spoofing

sudo unicornscan -s 10.10.10.99 10.10.10.5:1-100

TCP open                     ssh[   22]         from 10.10.10.5     ttl 64

Example 10 — Quiet/dumb mode for script-friendly output

sudo unicornscan -D -q 10.10.10.5:1-1000

10.10.10.5,22,tcp,open
10.10.10.5,80,tcp,open

7. Common Use Cases

• Large-scale asynchronous TCP/UDP reconnaissance similar to Masscan, with additional application banner fingerprinting.
• Research-oriented scanning where pcap capture and stimulus/response correlation are needed.
• ARP-mode host discovery on a local subnet.
• Situations requiring flexible TCP flag control for probe crafting (SYN, FIN, ACK, PSH).

8. Automation with Bash

#!/bin/bash
# unicorn_sweep.sh - TCP sweep across a subnet, log results to CSV
SUBNET="10.10.10.0/24"
OUTFILE="unicorn_scan.csv"

echo "[*] Running Unicornscan TCP sweep on $SUBNET..."
sudo unicornscan -D -q "$SUBNET:1-1024" > "$OUTFILE"

echo "[+] Results saved to $OUTFILE"
column -s, -t "$OUTFILE"

9. Tips and Best Practices

• Run with sudo/root, since raw socket crafting requires elevated privileges.
• Use -r to throttle packet rate on networks where flooding could disrupt production traffic.
• Prefer -D -q (dumb/quiet mode) when scripting, since it produces clean, parseable output.
• Cross-verify important findings with Nmap, as Unicornscan’s asynchronous nature can occasionally miss slow responders on lossy links — use -R to repeat probes if accuracy is critical.
• Since Unicornscan development has slowed compared to Masscan/RustScan, treat it as a specialized/legacy tool for research use cases rather than a primary daily driver.

10. Troubleshooting

• No output at all: verify the correct interface with -i and confirm the tool has raw socket privileges (sudo).
• “unicornscan: command not found”: reinstall via sudo apt install unicornscan --reinstall.
• Segmentation faults on some Kali builds: check for a known compatibility bug; try running with reduced scan scope or update to the latest packaged version.
• Missed hosts on scan: increase -R (repeats) and lower -r (rate) to reduce packet loss.

11. References

• SourceForge project page: https://sourceforge.net/projects/unicornscan/
• Kali Linux tool page: https://www.kali.org/tools/unicornscan/
• Man page: man unicornscan (installed locally)