> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/rustscan.md).

# RustScan

**RustScan** is a fast port scanner written in Rust. It leverages the performance advantages of the Rust programming language to rapidly scan all 65,535 TCP ports on a target, significantly outperforming traditional port scanners in terms of speed.

#### Install via `.deb` file

Download the latest release from the [official GitHub repository](https://github.com/bee-san/RustScan/releases).

```
unzip rustscan.deb.zip
```

```bash
sudo apt install ./rustscan.deb
```

Syntax

```bash
rustscan -a <target> [options]
```

#### Common Options

* `-a`: Specifies the target IP or hostname.
* `--ulimit <value>`: Sets the ulimit value (default: 5000).
* `--range <start-end>`: Specifies a custom port range to scan (e.g., `1-1000`).
* `-b <number>`: Sets batch size for concurrent scans.
* `--timeout <ms>`: Time in milliseconds before a port is considered closed.
* `--greppable`: Outputs results in a greppable format.
* `--`: Everything after `--` is passed directly to Nmap.

Examples

* **Scan all ports on a host**

  ```bash
  rustscan -a 192.168.1.10
  ```
* **Scan specific port range**

  ```bash
  rustscan -a 192.168.1.10 --range 1-1000
  ```
* **Increase ulimit for faster scanning**

  ```bash
  rustscan -a 192.168.1.10 --ulimit 10000
  ```
* **Scan and pass open ports to Nmap for detailed enumeration**

  ```bash
  rustscan -a 192.168.1.10 -- -sV
  ```
* **Scan multiple targets from a file**

  ```bash
  cat targets.txt | xargs -n1 rustscan -a
  ```