daemon-sec-cheatsheet

rustscan.md (46824B)

---

 ---
 title: "RustScan"
 description: "RustScan 2.4.1 in depth: how the connect sweep works, the batch/timeout/ulimit maths, the Nmap hand-off and its traps, config precedence, the scripting engine, and HTB/CPTS workflows. Every behaviour checked against the source and a live lab."
 category: enumeration
 tags: [enumeration, port-scanning, network, nmap, htb, cpts]
 tools: [RustScan, Nmap]
 difficulty: intermediate
 updated: "2026-10-09"
 references:
   - name: "RustScan source, tag 2.4.1"
     url: "https://github.com/bee-san/RustScan/tree/2.4.1"
     author: "RustScan contributors"
     relation: inspired
     note: "Flag semantics, config merge order, batch-size inference, target parsing and the script-header parser on this page were read from src/main.rs, src/input.rs, src/address.rs, src/scanner and src/scripts at this tag, then reproduced live."
   - name: "RustScan wiki"
     url: "https://github.com/bee-san/RustScan/wiki"
     author: "RustScan contributors"
     relation: link-only
     note: "Upstream usage docs. Several pages (trigger_port, tag matching, config value case, adaptive learning) describe behaviour the 2.4.1 code does not have; where they disagree, this page follows the code."
   - name: "Nmap Reference Guide: Host Discovery"
     url: "https://nmap.org/book/man-host-discovery.html"
     author: "Gordon Lyon"
     relation: link-only
     note: "What Nmap sends to decide a host is up, and so why the Nmap stage needs -Pn."
   - name: "Docker Hub: rustscan/rustscan"
     url: "https://hub.docker.com/r/rustscan/rustscan"
     relation: link-only
     note: "Tag list checked 2026-10-09: the newest image is 2.3.0, amd64 only."
   - name: "Kali package tracker: rustscan"
     url: "https://pkg.kali.org/pkg/rustscan"
     relation: link-only
     note: "2.4.1-0kali1, built for amd64, arm64, armhf and i386."
 ---
 
 ## What RustScan is, and what it isn't
 
 RustScan answers one question fast: which TCP ports on these addresses finish a handshake? It
 asks with plain `connect()` calls, thousands in flight at once on an async runtime, so it needs no
 root and no raw sockets. Then, host by host, it runs a script. The default script is Nmap, pointed
 at exactly the ports that answered. That split is where the speed comes from. The 65,535-port sweep
 is cheap, and Nmap's expensive work (`-sC`, `-sV`) only ever touches ports already known to be open.
 
 Everything else you might expect from a scanner, it either hands to Nmap or doesn't do at all:
 
 | | RustScan 2.4.1 | What that means for you |
 |---|---|---|
 | Scan type | TCP connect only (full handshake, then shutdown) | No root needed. Every open port gets a real connection, which the service may log |
 | Port states | open, or not open | Closed (RST) and filtered (silence) look identical. Nmap is what tells them apart |
 | Host discovery | none | Every address you give it gets every port, alive or not |
 | Retransmits | none unless `--tries` is above 1 | One dropped SYN or SYN-ACK is one missed port, with no warning |
 | Versions, OS, NSE | none, delegated | `-sV`, `-sC` and `-O` happen in the Nmap stage, after `--` |
 | UDP | `--udp`: one probe per port, open only if something replies | See [UDP mode](#udp-mode) |
 | Stealth | none: no SYN, decoys, fragmentation or source-port options | `--scan-order random` shuffles the port order, and that's all |
 | "Adaptive learning" | batch size is sized against your open-file limit at startup | Nothing is learned or saved between runs. 2.4.1 writes no state files |
 
 > [!info] **How this page was checked.** Written against **RustScan 2.4.1** (the current release, February 2025) and **Nmap 7.99** on macOS arm64, on 2026-10-09. Every flag, message and gotcha below was read from the 2.4.1 source and then reproduced against throwaway listeners on 127.0.0.1, with `HOME` pointed at an empty directory so no stray config could interfere. Output blocks are real captures from those runs. Upstream's wiki disagrees with the code in several places. Where they differ, this page follows the code and says so.
 
 ---
 
 ## Quick start
 
 ```bash
 mkdir -p recon    # Nmap's -oA fails, and takes the whole run with it, if the directory is missing
 
 # One box: every TCP port, then default scripts + versions on exactly those ports, saved
 rustscan -a $IP -u 5000 -- -Pn -sCV -oA recon/$NAME
 
 # Port list only, no Nmap. Prints one line per host: 10.10.11.5 -> [22,80,443]
 rustscan -a $IP -u 5000 -g
 
 # Lossy VPN or a Windows firewall: smaller window, longer timeout, one retry
 rustscan -a $IP -u 5000 -b 1000 -t 3000 --tries 2 -- -Pn -sCV -oA recon/$NAME
 ```
 
 What each piece is doing:
 
 - **`-u 5000`** raises the open-file limit for this run. Without it, a stock macOS shell (soft limit
   256) silently cuts the batch to 128 sockets, and a typical Debian/Kali shell (1024) cuts it to 512.
   See [the batch maths](#how-rustscan-sizes-the-batch).
 - **`--`** ends RustScan's flags. Everything after it is appended to the Nmap command line, which is
   run through `sh -c`. That matters for quoting, see [quoting through `--`](#quoting-through---).
 - **`-Pn`** stops Nmap from running its own ping and deciding the host is down. RustScan has already
   proved it's up. See [why `-Pn`, every time](#-pn-every-time).
 - **`-oA recon/$NAME`** is your record. RustScan holds Nmap's output back until Nmap exits, and if
   Nmap fails its output is thrown away. The files survive either way.
 
 ---
 
 ## What happens when you press enter
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">One RustScan run, start to exit</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <div class="flow__diagram" data-dir="td">
       <div class="flow-rank"><div class="flow-node is-entry">FLAGS + CONFIG<span class="sub">~/.rustscan.toml overrides the CLI</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">TARGETS<span class="sub">CIDR · first DNS answer · file · minus -x</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">BATCH SIZE<span class="sub">-b, capped by your soft ulimit</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node">CONNECT SWEEP<span class="sub">B sockets in flight · -t per try · --tries</span></div></div>
       <div class="flow-edge"></div>
       <div class="flow-rank"><div class="flow-node is-decision">-g or --scripts none?</div></div>
       <div class="flow-branches">
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">yes</span></div><div class="flow-node">PRINT<span class="sub">ip -> [ports]</span></div></div>
         <div class="flow-lane"><div class="flow-edge"><span class="flow-edge__label">no</span></div><div class="flow-node">SCRIPTS, HOST BY HOST<span class="sub">default: nmap -vvv -p PORTS + your -- args</span></div></div>
       </div>
       <div class="flow-join"></div>
       <div class="flow-rank"><div class="flow-node is-goal">EXIT 0<span class="sub">even if nothing was open or Nmap failed</span></div></div>
     </div>
   </div>
 </figure>
 
 1. **Flags are merged with `~/.rustscan.toml`, and the file wins.** If the config sets `addresses`,
    `batch_size`, `timeout`, `command` or most other keys, your command-line value is replaced. This is
    the single most confusing behaviour in the tool. See [the config file](#the-config-file).
 2. **Targets become a flat list of IPs.** A CIDR expands to every address in it, network and
    broadcast included. A hostname becomes its *first* resolved address only. A filename is read
    line by line. Duplicates and `-x` exclusions are dropped.
 3. **The batch size is checked against your soft open-file limit**, and cut if it doesn't fit.
 4. **Sockets are ordered port-major:** port 1 on every host, then port 2 on every host, and so on.
    On a subnet the load spreads across hosts instead of piling onto one.
 5. **A sliding window of B connects runs.** Each socket gets up to `--tries` attempts of `-t`
    milliseconds each, and the moment one finishes the next one starts. A completed handshake means
    open. Anything else (RST, timeout, unreachable) means not open, and the reason is only visible
    with `RUST_LOG=debug`.
 6. **Results are grouped per host.** Ports come out in the order they answered, not sorted.
 7. **Scripts run per host, one after another, after the whole sweep has finished.** The default
    script is `nmap -vvv -p <ports> -4|-6 <ip>` with your `--` arguments appended. Its output is
    captured and printed only when it exits.
 8. **The exit status is 0** whether anything was found or not, and whether Nmap worked or not. It's
    only non-zero for a config parse error, no resolvable target, or a broken custom-scripts setup.
 
 ---
 
 ## Install
 
 | Source | Version (2026-10-09) | Command | Notes |
 |---|---|---|---|
 | Kali repo | 2.4.1 | `sudo apt install rustscan` | amd64, arm64, armhf and i386, so it works on Apple Silicon Kali VMs |
 | Homebrew | 2.4.1 | `brew install rustscan` | Pulls in `nmap` as a dependency |
 | Arch (extra) | 2.4.1 | `sudo pacman -S rustscan` | Install `nmap` separately |
 | Cargo | 2.4.1 | `cargo install rustscan` | The only method upstream officially supports. Install `nmap` separately |
 | GitHub release | 2.4.1 | download `rustscan.deb.zip`, `unzip`, then `sudo dpkg -i rustscan_2.4.1-1_amd64.deb` | The 2.4.1 assets are zip-wrapped, and the `.deb` is amd64 only |
 | Docker Hub | **2.3.0** | `docker run -it --rm rustscan/rustscan:2.3.0 -a $IP` | Stale (last pushed September 2024) and amd64 only, so it's emulated on Apple Silicon and arm64 Kali. 2.4.1 ships no Dockerfile |
 
 ```bash
 rustscan --version    # rustscan 2.4.1
 nmap --version        # the default script runs whatever `nmap` is first on PATH
 ```
 
 > [!tip] **Skip the Docker image.** Older guides call Docker "recommended" because the container's open-file limit is high. A native package with `-u 5000` solves the same problem, runs the current version, and doesn't add an emulation layer or a NAT hop between you and the target. If you do use the container, remember that `--rm` deletes anything Nmap wrote inside it, so mount a directory for `-oA`.
 
 ---
 
 ## Flag reference (2.4.1, complete)
 
 | Flag | Default | What it really does |
 |---|---|---|
 | `-a, --addresses <list>` | (required) | Comma list of IPs, CIDRs and hostnames, or a path to a file. See [Targets](#targets) |
 | `-p, --ports <list>` | | Comma list only. Ranges are rejected (`-p 80-90` errors). Can't be combined with `-r` |
 | `-r, --range <start-end>` | `1-65535` | Used automatically when neither `-p` nor `-r` is given |
 | `-e, --exclude-ports <list>` | | Removed from whatever `-p`, `-r` or `--top` produced |
 | `-x, --exclude-addresses <list>` | | IPs, CIDRs or hostnames, removed after expansion |
 | `--top` | off | Uses the `[ports]` table from your config. **With no table, it silently scans all 65,535.** See [`--top`](#--top-does-nothing-without-a-config) |
 | `-b, --batch-size <n>` | 4500 | Maximum sockets in flight. Capped by your soft ulimit |
 | `-t, --timeout <ms>` | 1500 | Per attempt, not per port |
 | `--tries <n>` | 1 | Attempts per port. `0` is corrected to `1` |
 | `-u, --ulimit <n>` | | Sets the soft and hard open-file limit for this process before the batch is sized |
 | `--scan-order serial\|random` | serial | Order of the sweep. Changes nothing about what's found |
 | `--scripts none\|default\|custom` | default | `default` runs Nmap. `none` prints `ip -> [ports]`. `custom` uses `~/.rustscan_scripts/` |
 | `--udp` | off | UDP probe mode. See [UDP mode](#udp-mode) |
 | `-g, --greppable` | off | Prints only `ip -> [ports]`. No Nmap, no scripts, no warnings |
 | `--accessible` | off | No banner, no colour, plain `Open ip:port` lines. Good for logs too |
 | `--no-banner` | off | Hides the ASCII banner only |
 | `-c, --config-path <file>` | `~/.rustscan.toml` | Read a different config |
 | `-n, --no-config` | off | Ignore the config file completely |
 | `--resolver <list\|file>` | system | DNS servers used **only if the system resolver fails** the name |
 | `-- <args>` | | Appended to every script's command line, then re-parsed by `sh -c` |
 | `RUST_LOG=info\|debug` (env var) | | `info` adds a timing summary. `debug` dumps merged options, batch size and socket errors |
 
 > [!danger] **There is no `-q`.** Plenty of guides, including the previous version of this page, show `rustscan -q` for "ports only". 2.4.1 has no such flag:
 > ```text
 > error: unexpected argument '-q' found
 >
 >   tip: to pass '-q' as a value, use '-- -q'
 > ```
 > The flag you want is `-g`.
 
 ---
 
 ## Targets
 
 ```bash
 rustscan -a 10.10.11.5
 rustscan -a 10.10.11.5,10.10.11.6,dc01.corp.htb
 rustscan -a 10.10.110.0/24 -x 10.10.110.1,10.10.110.254
 rustscan -a 2001:db8::15                  # IPv6 works; the Nmap stage gets -6 automatically
 rustscan -a scope.txt                     # one IP, CIDR or hostname per line
 ```
 
 What bites:
 
 - **A hostname becomes one address.** RustScan takes the first answer the system resolver gives
   back. In the lab, `-a localhost` scanned `::1` only, so a service bound to `127.0.0.1` came back as
   "no open ports". Dual-stack names and round-robin DNS hide hosts this way. Resolve them yourself
   (`dig +short`, `getent ahosts`) and pass IPs.
 - **The system resolver goes first.** Your `/etc/hosts` entries work, which is what you want for
   `*.htb` names. `--resolver` is a fallback for names the system can't resolve, not an override.
 - **A CIDR includes the network and broadcast addresses.** A `/30` is 4 targets, not 2.
 - **Bad lines in a target file are skipped without a word.** A `# comment` or a typo just fails to
   resolve. Only a top-level `-a` value that can't be resolved prints `Host "x" could not be resolved.`
   If nothing resolves at all, you get `No IPs could be resolved, aborting scan.` and exit status 1.
 - **Nmap is handed the IP, not the name.** HTTP scripts in the Nmap stage send the IP as the Host
   header. On a vhost box that's useful, because `http-title` reports the redirect target
   (`Did not follow redirect to http://box.htb/`) and gives you the name. Once you have it, point
   web tools at the name.
 - **There is no host discovery.** Every address gets every port. On a dead address, each probe burns
   the full timeout, so a mostly-empty /24 is very slow (see the [runtime table](#the-only-formula-you-need)).
   Find live hosts first:
 
 ```bash
 # Live hosts first. Unprivileged -sn only tries TCP 80/443, so run it as root,
 # and add -PS22,445,3389 when Windows firewalls swallow ping.
 sudo nmap -sn -PE -PS22,80,443,445,3389 10.10.110.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
 rustscan -a live.txt -u 5000 -g > open.txt
 ```
 
 ---
 
 ## Ports
 
 ```bash
 rustscan -a $IP                                   # 1-65535 (the default range)
 rustscan -a $IP -r 1-10000
 rustscan -a $IP -p 22,80,443,445,3389,5985
 rustscan -a $IP -e 21,23                          # whatever the rules of engagement put off-limits
 ```
 
 ### `--top` does nothing without a config
 
 `--top` reads the top-1000 list from the `[ports]` table of your config file. Upstream ships that
 table in its example `config.toml`. Homebrew, apt and cargo don't install it. With no table, `--top`
 is ignored and you get the full range:
 
 ```text
 $ RUST_LOG=debug rustscan -a 127.0.0.1 --top -g      # no ~/.rustscan.toml
     Number of ports 65535
 $ RUST_LOG=debug rustscan -a 127.0.0.1 --top -g      # with the [ports] table installed
     Number of ports 1000
 ```
 
 Two ways to get a real top-N:
 
 ```bash
 # 1. Install upstream's [ports] table. If you already have a ~/.rustscan.toml, append instead of overwriting.
 curl -fsSL https://raw.githubusercontent.com/bee-san/RustScan/2.4.1/config.toml \
   | sed -n '/^\[ports\]/,$p' > ~/.rustscan.toml
 rustscan -a $IP --top
 
 # 2. No config: build Nmap's current top-N from nmap-services and pass it with -p.
 #    Kali: /usr/share/nmap/nmap-services   Homebrew: "$(brew --prefix)/share/nmap/nmap-services"
 top=$(awk '$2 ~ /\/tcp$/ {print $3, $2}' /usr/share/nmap/nmap-services \
       | sort -rn | head -1000 | cut -d' ' -f2 | cut -d/ -f1 | paste -sd, -)
 rustscan -a $IP -p "$top"
 ```
 
 The `[ports]` table only ever applies when `--top` is passed. A normal run still scans the full
 range, so it's safe to leave in place.
 
 ### `--scan-order random`
 
 This shuffles the port list (a shuffle for `-p` lists, a linear congruential sequence for ranges).
 The set of ports found doesn't change, and the target still sees tens of thousands of connections in
 seconds. It's not evasion. If you need to be gentle, lower `-b`.
 
 ---
 
 ## Speed, accuracy and the batch maths
 
 ### The only formula you need
 
 Each socket in the window either finishes quickly (open, or RST for closed) or burns its whole
 timeout (filtered, or a dead host). In the worst case, where nothing answers:
 
 ```text
 runtime ≈ (hosts × ports × tries ÷ batch) × timeout
 ```
 
 | Case (nothing answers) | Settings | Worst case |
 |---|---|---|
 | 1 host, all ports | `-b 4500 -t 1500` (defaults) | ~22 s |
 | 1 host, all ports | `-b 4500 -t 1500 --tries 2` | ~44 s |
 | 1 host, all ports | `-b 1000 -t 3000` | ~3.3 min |
 | 1 host, all ports | `-b 500 -t 3000` | ~6.6 min |
 | 1 host, all ports, stock macOS shell | batch silently cut to 128, `-t 1500` | ~12.8 min |
 | /24, all ports | `-b 4500 -t 1500` | ~93 min |
 
 The floor is set by RSTs. 65,535 ports on loopback took **2.5 s** in the lab at `-b 500`, `4500`
 and `10000` alike, because every closed port refused instantly. A real target lands somewhere
 between that floor and the table, depending on how much of it is filtered.
 
 ### Why a big batch misses ports
 
 RustScan sends one SYN per try and never retransmits. With thousands of handshakes in flight,
 anything that drops packets under load loses some SYN-ACKs, and those ports quietly report as not
 open:
 
 - **your side:** VM NAT engines (VMware, VirtualBox), the VPN client (OpenVPN on HTB and OffSec labs),
   home-router connection tables
 - **their side:** SYN-flood protection, per-source rate limits, host firewalls that drop rather than
   reject
 
 The fix costs less than the problem: lower `-b`, raise `-t`, add `--tries 2`. A retry only costs
 extra time on ports that don't answer. When it matters, run a gentle pass and diff it against the
 fast one:
 
 ```bash
 fast=$(rustscan -a $IP -u 5000 -g | sed -E 's/.*\[(.*)\]/\1/' | tr , '\n' | sort -n)
 slow=$(rustscan -a $IP -u 5000 -b 1000 -t 3000 --tries 2 -g | sed -E 's/.*\[(.*)\]/\1/' | tr , '\n' | sort -n)
 diff <(echo "$fast") <(echo "$slow") && echo "same ports both runs"
 ```
 
 ### How RustScan sizes the batch
 
 Before the sweep starts, RustScan compares the batch you asked for (B, default 4500) with your soft
 open-file limit (U, from `ulimit -Sn`, or the value you gave `-u`):
 
 | Condition | Batch actually used | Seen in the lab |
 |---|---|---|
 | U ≥ B | B, unchanged | U=5000, B=4500 → 4500 |
 | U < B and U < 3000 | U ÷ 2 | U=256 (macOS) → **128**; U=1024 (common on Kali) → **512** |
 | U < B and 3000 ≤ U ≤ 8000 | U − 100 | U=4000, B=4500 → 3900 |
 | U < B and U > 8000 | 3000 | U=10000, `-b 65535` → **3000** |
 
 The last row is the trap. Asking for more than your limit when the limit is already high gets you
 3000, not "as many as fit". If you want 9,900, ask for 9,900.
 
 What a cut batch looks like:
 
 ```text
 $ ulimit -n 256; rustscan -a 127.0.0.1 -r 18000-18500 --no-banner --scripts none
 [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
 [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
 ```
 
 When your limit is comfortably above the batch, you get a hint instead, and it can be ignored:
 `[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 1048476'.`
 
 ### Raising the limit
 
 ```bash
 ulimit -Sn; ulimit -Hn            # soft and hard limits for this shell
 rustscan -a $IP -u 5000           # per run: the simplest fix, no system changes
 ulimit -n 5000                    # per shell, if you'd rather set it once (put it in ~/.zshrc or ~/.bashrc)
 ```
 
 `-u` sets both limits for RustScan and the Nmap it spawns. It works without root as long as the
 value is at or below your hard limit. If the kernel refuses, the source prints
 `[!] ERROR. Failed to set ulimit value.` and carries on with the old limit and a smaller batch.
 
 ### Profiles
 
 | Situation | Flags | Why |
 |---|---|---|
 | Loopback, or a lab VM on the same host | defaults + `-u 5000` | RSTs come back instantly |
 | HTB / OffSec VPN, one box | `-u 5000`, then compare against a gentler pass if anything looks thin | The VPN is usually what drops packets |
 | Windows box with the firewall on | `-u 5000 -b 1000 -t 3000 --tries 2 -- -Pn` | Filtered ports eat full timeouts, and drops are common |
 | Through a ligolo-ng tunnel | `-b 200 -t 3000 --tries 2` | The tunnel's userland TCP stack is the bottleneck |
 | Fragile or production kit (printers, OT, old appliances) | `-b 100 -t 3000` | Gentle, not stealthy. The tool's own help warns these may not cope |
 | A subnet | host discovery first, then `-a live.txt` | Dead addresses cost full timeouts on every port |
 
 ---
 
 ## The Nmap hand-off
 
 ### What actually runs
 
 The built-in default script is one line:
 
 ```text
 nmap -vvv -p {{port}} -{{ipversion}} {{ip}}
 ```
 
 Your `--` arguments are appended to the end, `{{port}}` becomes the comma-joined open ports, and
 `{{ipversion}}` becomes `4` or `6`. Captured from the lab, with `-- -Pn -sV`:
 
 ```text
 Open 127.0.0.1:18021
 Open 127.0.0.1:18022
 Open 127.0.0.1:18080
 Open 127.0.0.1:18445
 [~] Starting Script(s)
 [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -Pn -sV" on ip 127.0.0.1
 Depending on the complexity of the script, results may take some time to appear.
 [~] Starting Nmap 7.991 ( https://nmap.org ) at 2026-10-09 12:59 +0100
 ...
 PORT      STATE SERVICE    REASON  VERSION
 18021/tcp open  ftp        syn-ack
 18022/tcp open  ssh        syn-ack (protocol 2.0)
 ```
 
 The `Running script` line prints the template with its placeholders unfilled, and it only appears
 when you passed `--` arguments. What follows from that one line:
 
 - **`-vvv` is always on.** Only a custom script can remove it.
 - **One Nmap per host, one after another**, and only after the whole sweep. A /24 with 40 live hosts
   means 40 sequential Nmap runs.
 - **Output is held until Nmap exits.** On a domain controller with `-sC`, that can be minutes of
   silence. Use `-oA`, or run Nmap yourself (see [two-stage](#two-stage-when-you-want-control)).
 - **Nmap's stderr is discarded, and a non-zero exit throws its stdout away too.** You get
   `[!] Error Exit code = 1` and nothing else.
 - **Nmap missing from PATH** shows up as `[!] Error Exit code = 127`.
 
 ### `-Pn`, every time
 
 Given a port list, Nmap still runs host discovery first. Unprivileged, that's a TCP connect to ports
 80 and 443. As root, it's an ICMP echo, a SYN to 443, an ACK to 80 and an ICMP timestamp request.
 If none of those get an answer, which is normal for a Windows box with its firewall on and no web
 server, Nmap marks the host down and scans nothing, even though RustScan just found it open ports.
 `-Pn` skips that check. RustScan has already done the proving.
 
 ### Root-only Nmap flags fail quietly
 
 RustScan runs Nmap as you. Tested as a normal user:
 
 | `--` arguments | Result |
 |---|---|
 | `-sS`, `-O`, `-sU` | Nmap refuses to start. RustScan prints `[!] Error Exit code = 1` and that's all you get |
 | `-A` | Runs, but unprivileged Nmap skips OS detection without any warning (it does the same when you run it directly) |
 | `-sCV`, `--script ...`, `-oA` | Fine |
 
 You can `sudo rustscan ...`, but then RustScan reads the config and scripts from root's home, and
 your output files belong to root. The cleaner fix is to only give Nmap root:
 [two-stage](#two-stage-when-you-want-control).
 
 ### Quoting through `--`
 
 RustScan joins your `--` arguments with spaces and hands the result to `sh -c`. The shell splits it
 again, so any argument containing a space falls apart. This is a scope problem, not just a typo:
 
 ```text
 $ rustscan -a 127.0.0.1 -p 18080 --accessible -- -Pn --script 'banner or http-title'
 Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -Pn --script banner or http-title" on ip 127.0.0.1
 NSE: Loaded 1 scripts for scanning.
 Performing system-dns for 2 domain names that were deferred
 Nmap scan report for localhost (127.0.0.1)
 Nmap scan report for or (0.0.0.0)
 ```
 
 Nmap ran one script, then treated `or` and `http-title` as extra **targets** and resolved them.
 With a DNS search domain configured, a word like that can resolve to a real host you were never
 authorised to scan. Wrap the inner value a second time:
 
 ```bash
 rustscan -a $IP -- -Pn --script "'banner or http-title'"
 rustscan -a $IP -- -Pn --script "'(default or vuln) and not intrusive'"
 ```
 
 The same goes for `--script-args` values with spaces in them. Don't pass `-p` after `--` either:
 the hand-off already sets `-p`, and Nmap quits with `Only 1 -p option allowed`. The same `sh -c` also expands `$(...)`, backticks, `;`, `|` and globs inside your `--` arguments.
 Treat everything after `--` as a shell command line. If an Nmap argument needs quotes, it's usually
 easier to run Nmap yourself.
 
 ### Two-stage: when you want control
 
 ```bash
 mkdir -p recon
 ports=$(rustscan -n -a $IP -u 5000 -g | sed -E 's/.*\[(.*)\]/\1/')
 echo "$ports"
 sudo nmap -Pn -sS -sCV -O -p "$ports" -oA recon/$NAME $IP
 ```
 
 You get live Nmap output, root-only flags, a real exit code, normal quoting, and `-n` keeps a stray
 config from changing the sweep. Worth wrapping in a function (tested in bash and zsh):
 
 ```bash
 # rs <ip> [name]: every TCP port with RustScan, then a live nmap -sCV on exactly those ports.
 rs() {
   local ip=$1 name=${2:-$1} ports v=
   case $ip in *:*) v=-6 ;; esac          # Nmap needs -6 for IPv6 targets
   mkdir -p recon
   ports=$(rustscan -n -a "$ip" -u 5000 -g | sed -E 's/.*\[(.*)\]/\1/' | tr , '\n' | sort -n | paste -sd, -)
   [ -n "$ports" ] || { echo "rs: no open TCP ports on $ip" >&2; return 1; }
   echo "rs: $ip -> $ports"
   nmap $v -Pn -sCV -p "$ports" -oA "recon/$name" "$ip"
 }
 ```
 
 ---
 
 ## Output, parsing and logging
 
 ### Normal output
 
 ```text
 [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 1048476'.
 Open 127.0.0.1:18021
 Open 127.0.0.1:18022
 [~] Starting Script(s)
 [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -Pn" on ip 127.0.0.1
 ```
 
 `[~]` is information, `[>]` is an action, `[!]` is a warning. `Open ip:port` lines print live as
 ports answer, so you can start reading the attack surface before the sweep finishes. The banner (and
 its random quote) also prints the config path it looked for:
 `[~] The config file is expected to be at "/home/kali/.rustscan.toml"`.
 
 ### Greppable rules
 
 - One line per host **that had open ports**: `10.10.11.5 -> [22,80,443]`. Hosts with nothing open
   print nothing.
 - With `-g`, no Nmap or scripts run, even if you passed `--` arguments.
 - Ports are listed in the order they answered, and hosts in no particular order. Sort before you diff.
 - Warnings are suppressed too. An empty result can mean "nothing open" or "something's wrong". When in
   doubt, run once without `-g`.
 
 ```bash
 # Comma list of ports for one host (portable: BSD and GNU sed, no grep -P)
 rustscan -a $IP -g | sed -E 's/.*\[(.*)\]/\1/'
 
 # Sorted, one per line
 rustscan -a $IP -g | sed -E 's/.*\[(.*)\]/\1/' | tr , '\n' | sort -n
 
 # Many hosts: save the sweep, then run Nmap per host, 4 at a time
 mkdir -p recon
 rustscan -a live.txt -u 5000 -g > open.txt
 sed -E 's/^(.*) -> \[(.*)\]$/\1 \2/' open.txt \
   | xargs -P 4 -n 2 sh -c 'case $0 in *:*) v=-6 ;; *) v= ;; esac; nmap $v -Pn -sCV -p "$1" -oA "recon/$0" "$0"'
 ```
 
 ### Exit codes
 
 | Situation | Exit status |
 |---|---|
 | Ports found, Nmap succeeded | 0 |
 | No open ports at all | 0 |
 | Nmap failed (root-only flag, bad argument, missing binary) | 0 |
 | TOML error in the config | 1 |
 | No target could be resolved | 1 |
 | `--scripts custom` without `~/.rustscan_scripts.toml` | 1 |
 
 So `rustscan ... && next-step` tells you nothing about the scan. Test the output instead, as `rs`
 does above.
 
 ### Logging
 
 RustScan has no `-v`. Verbosity comes from the `RUST_LOG` environment variable:
 
 ```bash
 RUST_LOG=info  rustscan -a $IP --scripts none        # adds a timing summary
 RUST_LOG=debug rustscan -a $IP -p 22 -g 2>&1 | less  # everything below
 ```
 
 ```text
     RustScan Benchmark Summary
     Portscan   | 2.475484  s
     Scripts    | 0.000007959s
     RustScan   | 2.5862627 s
 ```
 
 `debug` is the fastest way to answer "why did it do that?":
 
 - `Main() opts arguments are Opts { ... }` shows the final settings after the config merge. Check it
   first whenever a flag seems to be ignored.
 - `Batch size 128` shows the batch actually used, after the ulimit check.
 - `Typical socket connection errors {"Connection refused (os error 61) ::1"}` lists the distinct
   errors from the sweep. Refused means closed. Timeouts mean filtered or dead. Errors like
   "Network is unreachable" mean the problem is your routing or VPN, not the target.
 
 ---
 
 ## UDP mode
 
 `--udp` connects a UDP socket to each port, sends one probe per try, and waits `-t` for any reply. For
 well-known services (DNS, NTP, SNMP, NetBIOS name service, IKE, IPMI, SSDP, mDNS, memcached, CLDAP and
 others, 63 entries in total) the probe is Nmap's own payload from `nmap-payloads`, compiled into the
 binary. Every other port gets an empty datagram.
 
 - **A reply means open.** An ICMP port-unreachable means closed. **Silence isn't reported at all**, so
   open services that ignore an empty or unexpected probe simply vanish.
 - **It's slow and lossy over big ranges.** Linux rate-limits ICMP errors by default, so most closed
   ports look silent and burn the full timeout. Keep `--udp` to short lists.
 - **The default Nmap stage scans those port numbers over TCP**, not UDP. From the lab:
 
 ```text
 $ rustscan --udp -a 127.0.0.1 -p 15353 --accessible -- -Pn
 Open 127.0.0.1:15353
 ...
 PORT      STATE  SERVICE REASON
 15353/tcp closed unknown conn-refused
 ```
 
 `-- -sU` fixes that, but needs root. The clean pattern is to find candidates with RustScan, then
 version them with a root Nmap:
 
 ```bash
 # Ports with built-in probes that matter on HTB / CPTS style boxes
 udp=$(rustscan -n -a $IP --udp -p 53,69,111,123,137,161,389,500,623,1900,5353,11211 \
         -t 2000 --tries 2 -g | sed -E 's/.*\[(.*)\]/\1/')
 [ -n "$udp" ] && sudo nmap -Pn -sU -sV -p "$udp" $IP
 
 # The broader alternative: let Nmap do UDP properly
 sudo nmap -Pn -sU --top-ports 100 -sV --version-intensity 0 $IP
 ```
 
 ---
 
 ## The config file
 
 RustScan reads `~/.rustscan.toml` unless you pass `-c <file>` (use another file) or `-n` (use none).
 If the file exists but doesn't parse, the run stops with `Found <error> in configuration file.
 Aborting scan.` and exit status 1.
 
 ### The file overrides your command line
 
 Most guides present the config as defaults, but it doesn't behave like defaults. Any key it sets
 **replaces** the matching command-line flag. Tested with a config that set
 `addresses = ["127.0.0.1"]`, `batch_size = 50`, `timeout = 900`, `greppable = false` and
 `command = ["-sV"]`:
 
 ```text
 $ RUST_LOG=debug rustscan -c cfg.toml -a 127.0.0.2 -b 2000 -g ...
 addresses: ["127.0.0.1"]   batch_size: 50   timeout: 900   greppable: false   command: ["-sV"]
 
 $ RUST_LOG=debug rustscan -n -c cfg.toml -a 127.0.0.2 -b 2000 -g ...
 addresses: ["127.0.0.2"]   batch_size: 2000   greppable: true   command: []
 ```
 
 With that file in place, every scan goes to 127.0.0.1 whatever you type after `-a`, ignores `-b`,
 and ignores your `--` arguments. Configs copied from older guides (this page's previous version
 included) set `addresses = ["127.0.0.1"]` for exactly this reason. Delete that line.
 
 | Key | Type | Notes |
 |---|---|---|
 | `addresses` | array of strings | Replaces `-a`. **Never put this in a config** |
 | `batch_size`, `timeout`, `tries` | integers | Replace `-b`, `-t`, `--tries` |
 | `ulimit` | integer | Replaces `-u`. The one key worth setting |
 | `greppable`, `accessible`, `udp` | booleans | Replace `-g`, `--accessible`, `--udp`. `greppable = false` beats `-g` |
 | `scan_order` | `"Serial"` or `"Random"` | **Capitalised.** `"random"` is a parse error that aborts every scan |
 | `scripts` | `"None"`, `"Default"` or `"Custom"` | **Capitalised**, same rule |
 | `command` | array of strings | Replaces your `--` arguments entirely |
 | `range` | `{ start = 1, end = 1000 }` | Replaces `-r` (`-p` still wins) |
 | `exclude_ports`, `exclude_addresses` | arrays | Replace `-e`, `-x` |
 | `resolver` | string | Replaces `--resolver` |
 | `[ports]` table | `80 = 1` lines | Only read by `--top`; doesn't affect normal scans |
 
 Keys you don't set leave the command line alone. Unknown keys are ignored, so the `ip = "127.0.0.1"`
 line at the top of upstream's example file does nothing.
 
 ### A config that helps instead of hurting
 
 ```toml
 # ~/.rustscan.toml: only settings you'd never want to change per scan
 ulimit = 5000
 
 # Paste upstream's [ports] table below this line if you want --top to work (see Ports).
 ```
 
 Everything that changes per target (`-b`, `-t`, `--tries`, the Nmap arguments) belongs on the command
 line or in a shell function like `rs`, where you can see it.
 
 ---
 
 ## The scripting engine
 
 `--scripts custom` swaps the built-in Nmap call for your own scripts. It's powerful, but the parser
 is strict, and almost every mistake fails silently. Everything below was tested by planting scripts
 in a sandboxed home directory.
 
 ### Where things live
 
 | Path | Purpose |
 |---|---|
 | `~/.rustscan_scripts.toml` | **Required.** Holds `tags = [...]`. If it's missing: `[!] Initiating scripts failed!` and exit status 1 |
 | `~/.rustscan_scripts/` | Script files. Every file directly inside is parsed, subdirectories are not |
 
 Custom mode **replaces** the default Nmap run. If you still want Nmap, ship it as a script (example 1
 below).
 
 ### Which scripts get picked
 
 A script runs only if **every tag in the script also appears in `~/.rustscan_scripts.toml`**. The
 config is an allow-list. A script tagged `["htb", "web"]` doesn't run when the config says
 `tags = ["htb"]`, and it does once the config says `tags = ["htb", "web"]`. Upstream's docs describe
 the opposite rule. The code does this one.
 
 ### The header format
 
 ```bash
 #!/usr/bin/env bash
 #tags = ["htb"]
 #developer = ["you"]
 #ports_separator = " "
 #call_format = "bash {{script}} {{ip}} {{port}}"
 
 echo "the script body starts after the first line that isn't a # line"
 ```
 
 How RustScan reads it:
 
 1. **Line 1 is skipped** (the shebang, or anything else).
 2. **From line 2, every consecutive line starting with `#` is collected.** All `#` characters are
    stripped out of it and the result is parsed as TOML.
 3. **The block ends at the first line that doesn't start with `#`.** Normally that's a blank line.
 
 What goes wrong:
 
 - **A normal comment directly under the header kills the script.** `# enumerate SMB` becomes the TOML
   line `enumerate SMB`, the parse fails, and the script is dropped with no message (visible only with
   `RUST_LOG=debug`). Always leave a blank line after the header.
 - **`#` inside `call_format` is deleted**, because every `#` on the line goes.
 - **`tags` must be an array.** `#tags = "htb"` fails to parse and the script is dropped.
 
 | Field | Effect |
 |---|---|
 | `tags` | Matched against the config's allow-list. A script without tags never runs |
 | `call_format` | The command, run with `sh -c` after the placeholders are filled. Without it: `Error Failed to parse execution format.` |
 | `ports_separator` | Joins the open ports for `{{port}}`. Default `,`. Use `" "` to get them as separate arguments |
 | `port` | **Replaces `{{port}}` with this literal value for every host that had any open port.** It doesn't check that the port was open |
 | `developer` | Parsed and ignored |
 | `trigger_port` | **Not a field in 2.4.1.** It's silently ignored and the script receives every open port. Upstream's docs and example scripts still use it |
 
 Placeholders: `{{script}}` (the script's full path), `{{ip}}`, `{{port}}` (the joined open ports, or
 the `port` value), `{{ipversion}}` (`4` or `6`).
 
 ### How scripts run
 
 - **One at a time, per host, after the sweep.** The order is directory order, not alphabetical, so
   numbering files `10-`, `20-` doesn't sequence them.
 - **`--` arguments are appended to every script's command line.**
 - **Only stdout is shown, and only when the script exits.** stderr is discarded. Add `2>&1` inside
   the script if you want it.
 - **A non-zero exit throws the output away** and prints `[!] Error Exit code = N`. End scripts with
   `exit 0` unless you really want that.
 
 ### Three scripts that work
 
 All three were run together against the lab listeners.
 
 **1. Nmap with your defaults, saved per host.** This replaces the built-in call.
 
 ```text
 #!nmap
 #tags = ["htb"]
 #ports_separator = ","
 #call_format = "nmap -vvv -Pn -sCV -p {{port}} -{{ipversion}} -oA recon/rs_{{ip}} {{ip}}"
 ```
 
 Save it as `~/.rustscan_scripts/10-nmap.txt`. It needs no interpreter, because `call_format` calls
 `nmap` directly. Run it from a directory that contains `recon/`.
 
 **2. Find every web service, whatever the port.** Since `port` isn't a trigger, the script tests
 each open port itself:
 
 ```bash
 #!/usr/bin/env bash
 #tags = ["htb"]
 #ports_separator = " "
 #call_format = "bash {{script}} {{ip}} {{port}}"
 
 # Every open port gets one HTTP and one HTTPS probe; anything that answers is a web service.
 ip=$1; shift
 for p in "$@"; do
   for scheme in http https; do
     out=$(curl -sk -m 4 -o /dev/null -w '%{http_code} %{redirect_url}' "$scheme://$ip:$p/" 2>/dev/null)
     case $out in
       000*) ;;                                   # nothing spoke HTTP here
       *) echo "[web] $scheme://$ip:$p -> $out" ;;
     esac
   done
 done
 exit 0
 ```
 
 The redirect URL in the output is often the vhost you need for `/etc/hosts`.
 
 **3. Gate on a port yourself.** This is how to get the "only if 445 is open" behaviour people expect
 from `trigger_port`:
 
 ```bash
 #!/usr/bin/env bash
 #tags = ["htb"]
 #ports_separator = " "
 #call_format = "bash {{script}} {{ip}} {{port}}"
 
 # RustScan's `port` field is not a trigger, so the script gates itself.
 ip=$1; shift
 case " $* " in
   *" 445 "*) nxc smb "$ip" -u '' -p '' --shares 2>&1; nxc smb "$ip" -u guest -p '' --shares 2>&1 ;;
   *) echo "[smb] 445 closed on $ip, skipping" ;;
 esac
 exit 0
 ```
 
 ```bash
 printf 'tags = ["htb"]\n' > ~/.rustscan_scripts.toml
 mkdir -p recon && rustscan -a $IP -u 5000 --scripts custom
 ```
 
 See [NetExec](/sheets/active-directory/netexec) for what to do with the SMB result.
 
 ---
 
 ## Workflows
 
 ### One HTB / CPTS box
 
 ```bash
 export IP=10.10.11.5 NAME=box
 mkdir -p recon
 
 # 1. Fast full sweep with versions and default scripts on the hits
 rustscan -a $IP -u 5000 -- -Pn -sCV -oA recon/$NAME
 
 # 2. If it's a Windows box, or anything looks thin, sweep again gently and compare
 rustscan -a $IP -u 5000 -b 1000 -t 3000 --tries 2 -g
 
 # 3. Quick UDP pass on the ports that matter (the Nmap half needs root)
 udp=$(rustscan -n -a $IP --udp -p 53,69,111,123,137,161,389,500,623,1900,5353,11211 -t 2000 --tries 2 -g | sed -E 's/.*\[(.*)\]/\1/')
 [ -n "$udp" ] && sudo nmap -Pn -sU -sV -p "$udp" -oA recon/${NAME}_udp $IP
 ```
 
 Next steps by port are in [Service Enumeration](/sheets/pentest-workflow/service-enumeration) and
 [Common Ports and Services](/sheets/enumeration/common-ports-and-services). This scan is stage 1 of
 [Recon and Host Discovery](/sheets/pentest-workflow/recon-and-host-discovery).
 
 ### A Windows domain controller
 
 A DC typically answers on 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 5985 and 9389, plus a
 run of RPC ports in the 49152-65535 range. That's 20-30 ports, and `-sC` against all of them can take
 minutes, during which RustScan shows nothing because Nmap's output is held back. Use the two-stage
 form, or `rs`, so you can watch Nmap work:
 
 ```bash
 rs $IP dc01
 ```
 
 ### An internal subnet
 
 ```bash
 mkdir -p recon
 sudo nmap -sn -PE -PS22,80,443,445,3389 10.10.110.0/24 -oG - | awk '/Up$/{print $2}' > live.txt
 rustscan -a live.txt -u 5000 -g > open.txt
 sed -E 's/^(.*) -> \[(.*)\]$/\1 \2/' open.txt \
   | xargs -P 4 -n 2 sh -c 'case $0 in *:*) v=-6 ;; *) v= ;; esac; nmap $v -Pn -sCV -p "$1" -oA "recon/$0" "$0"'
 ```
 
 Host discovery first, because RustScan has none. Then one sweep across every live host, then Nmap
 in parallel instead of RustScan's one-host-at-a-time default.
 
 ### Through a pivot
 
 - **ligolo-ng, or any tun-style pivot:** RustScan works unchanged, because to it the internal network
   is just a route. The tunnel's userland TCP stack is the bottleneck, so drop `-b` to a few hundred
   and raise `-t` (see [ligolo-ng](/sheets/tunneling-pivoting/ligolo-ng)).
 - **A SOCKS proxy (chisel, `ssh -D`) with proxychains:** RustScan has no proxy support, and thousands
   of concurrent connects through one SOCKS proxy are slow and unreliable. Scan a short port list with
   `proxychains -q nmap -sT -Pn -n` instead.
 
 ---
 
 ## Troubleshooting by symptom
 
 | You see | Cause | Fix |
 |---|---|---|
 | `Looks like I didn't find any open ports for X. This is usually caused by a high batch size.` | Really nothing open, packet loss, a dead host, or the wrong address (a hostname that resolved to `::1`) | Pass an IP, try `-b 1000 -t 3000 --tries 2`, check `RUST_LOG=debug` socket errors |
 | Different ports on each run | Drops under load: VPN, VM NAT, rate limits | Lower `-b`, raise `-t`, `--tries 2`, diff two runs |
 | `[!] Your file limit is very small...` | Soft ulimit under 3000, batch halved | `-u 5000` |
 | `-b 65535` scans slower than expected | Limit above 8000 but below B, so the batch dropped to 3000 | Ask for a B below your limit, for example `-b 9900` |
 | `[!] Error Exit code = 1` after `Running script` | Nmap refused: root-only flag (`-sS`, `-O`, `-sU`), bad argument, or the `-oA` directory is missing | Two-stage with `sudo nmap`, `mkdir -p recon` |
 | `[!] Error Exit code = 127` | `nmap` isn't on PATH | Install Nmap, or check PATH under sudo |
 | Nmap says the host seems down, or `0 hosts up` | Nmap's own discovery failed | `-- -Pn` |
 | Nmap scanned hosts called `or`, `and`, `not` | A space in an `--` argument got split | `-- --script "'a or b'"` |
 | Your `-a`, `-b` or `--` args are ignored | The config file overrides them | `-n`, then fix `~/.rustscan.toml` |
 | `Found TOML parse error at line 1, column 14` / `Aborting scan.` | Lowercase `scan_order` or `scripts` value, or other bad TOML | `"Random"`, `"Custom"` (capitalised) |
 | `--top` takes as long as a full scan | No `[ports]` table in the config | See [`--top`](#--top-does-nothing-without-a-config) |
 | UDP hit, but Nmap shows `/tcp closed` | The default Nmap stage scans TCP | `sudo nmap -sU` on the found ports |
 | `Initiating scripts failed! No such file or directory (os error 2)` | `--scripts custom` without `~/.rustscan_scripts.toml` | Create it with a `tags` array |
 | A custom script never runs | Tags not all allowed, a comment in the header block, or `tags` not an array | Fix the header, check `RUST_LOG=debug` |
 | A port-specific script runs on every host | `port` overrides `{{port}}`, it isn't a trigger, and `trigger_port` doesn't exist | Gate inside the script (example 3) |
 | A custom script's output vanished | Non-zero exit, or it wrote to stderr | `exit 0`, `2>&1` |
 | A panic: `Too many open files. Please reduce batch size...` | Batch above what the OS actually allows | Lower `-b`, raise `-u` |
 
 ---
 
 ## Noise, safety and scope
 
 - **Nothing about RustScan is quiet.** Every open port gets a complete TCP connection that the service
   accepts and then sees closed. SSH daemons log it, many web servers log it, and any IDS sees tens of
   thousands of connections from one source in seconds. Random order and a small batch only make that
   take longer.
 - **Fragile targets can fall over.** RustScan's own help text warns that a server may not handle this
   many simultaneous connections. Printers, embedded and OT devices, old appliances and small VPSs get
   `-b 100` or less.
 - **Scope:** use `-x` for out-of-scope addresses inside an in-scope range. A CIDR includes the network
   and broadcast addresses. A hostname resolves to one address, which for a CDN-fronted name may not
   be the client's. And an unquoted `--` argument can add targets of its own.
 
 ---
 
 ## RustScan vs the alternatives
 
 | | RustScan | `nmap -p- --min-rate` | masscan | naabu |
 |---|---|---|---|---|
 | How it scans | async `connect()` window | SYN as root (connect otherwise), with retransmits and adaptive timing | raw SYN from its own TCP stack, at a fixed packet rate | SYN as root, or connect |
 | Root needed | no | for SYN | yes | for SYN |
 | Host discovery | no | yes | no | yes |
 | Reports closed ports | no | yes, and filtered separately | only with `--show closed` | no |
 | Nmap hand-off | built in | not needed | manual | built in (`-nmap-cli`) |
 | Best at | one box, every port, fast, no root | accuracy, the final word on a port | very large ranges | ProjectDiscovery pipelines |
 
 Whatever finds the ports, Nmap owns the service and version truth. The plain-Nmap two-stage pattern
 is in [Recon and Host Discovery](/sheets/pentest-workflow/recon-and-host-discovery), Nmap itself is in
 [Nmap](/sheets/enumeration/nmap) and [NSE Guide](/sheets/enumeration/nse-guide), and parsing Nmap
 output is in [Awesome Nmap Grep](/sheets/enumeration/awesome-nmap-grep).
 
 ---
 
 ## Quick reference
 
 ```bash
 rustscan -a $IP -u 5000 -- -Pn -sCV -oA recon/$NAME            # the default first scan
 rustscan -a $IP -u 5000 -g                                      # ports only: ip -> [p,p,p]
 rustscan -a $IP -u 5000 -b 1000 -t 3000 --tries 2 -- -Pn -sCV  # lossy link or Windows firewall
 rustscan -a $IP -p 22,80,443,445                                # specific ports (no ranges in -p)
 rustscan -a $IP -r 1-10000                                      # a range
 rustscan -a $IP -e 21,23                                        # exclude ports
 rustscan -a 10.10.110.0/24 -x 10.10.110.1                       # subnet minus an address
 rustscan -a live.txt -g > open.txt                              # file of targets
 rustscan -n -a $IP -g                                           # ignore ~/.rustscan.toml
 rustscan -a $IP -- -Pn --script "'default or vuln'"             # NSE expressions: double-quote them
 rustscan -n -a $IP --udp -p 53,123,161,500 -t 2000 --tries 2 -g # UDP candidates (then sudo nmap -sU)
 rustscan -a $IP --scripts custom                                # run ~/.rustscan_scripts/*
 RUST_LOG=debug rustscan -a $IP -p 22 -g                         # see merged options, batch, errors
 ```