RustScan: Fast Modern Port Scanner Scanning 65,535 Ports in 3 Seconds with Nmap Integration

On October 8, 2026, cybersecurity intelligence channel @DarkWebInformer highlighted RustScan (bee-san/RustScan), an open-source port scanner engineered in Rust to drastically accelerate large-scale network reconnaissance and vulnerability triage. Designed not to replace Nmap's deep protocol inspection but to eliminate manual friction in reconnaissance workflows, RustScan focuses on maximizing initial port discovery velocity and immediately piping active targets into downstream enumeration tools.

Image source: GitHub bee-san / Dark Web Informer (@DarkWebInformer)

In penetration testing and infrastructure security audits, inspecting the full range of 65,535 TCP ports has traditionally been a major operational bottleneck. Because full-range scans with conventional tooling can take minutes or even tens of minutes, practitioners often default to scanning only top 1,000 standard ports, risking blind spots on non-standard ports. RustScan addresses this by leveraging Rust's asynchronous I/O to sweep the entire port range within seconds, piping only the discovered open ports directly into Nmap for targeted enumeration.

Sweeping 65,535 Ports at High Velocity via Asynchronous Socket Architecture

The core capability of RustScan is its high-velocity scanning engine, engineered to scan all 65,535 ports in approximately 3 seconds at its fastest operating threshold.

According to project documentation, RustScan minimizes per-port latency by pairing asynchronous network dispatch with system-level open file limit adjustments:

• Configurable Batching: Scans 4,500 ports concurrently by default (-b, --batch), with the ability to scale batch size up to 65,535 ports simultaneously when supported by the host operating system's file descriptor limit (-u, --ulimit).
• Granular Timeout Controls: Allows operators to set response timeouts in milliseconds (-T, --timeout, default 1,500ms), reducing overall duration on low-latency networks or increasing tolerance on high-jitter links to prevent false negatives.
• Adaptive Tuning: Instead of relying on heavy machine learning runtimes, RustScan uses basic mathematical feedback loops to monitor round-trip times and network responses, dynamically optimizing packet timing and intervals as scanning progresses.

As noted in the project documentation, scanning 65,535 ports in 3 seconds represents a benchmark under optimal conditions with sufficient bandwidth and tuned system file limits; real-world throughput varies based on target responsiveness and intermediate firewall constraints.

Automated Nmap Piping and Multi-Language Scripting Engine (Python, Lua, Shell)

Beyond raw port scanning, RustScan acts as an orchestration bridge across network assessment workflows.

The maintainers emphasize that RustScan's explicit design goal is to improve Nmap rather than displace it, streamlining the handoff between rapid surface discovery and comprehensive inspection:

• Automatic Nmap Handoff: Once open ports are identified, RustScan automatically pipes them directly into nmap -vvv -p $PORTS $IP. This removes the error-prone step of manually copying port lists into Nmap commands.
• Custom Nmap Flag Passthrough: Appending Nmap arguments after a -- delimiter (e.g., rustscan -T 1500 127.0.0.1 -- -A -sC) allows operators to trigger OS detection, service version probing, and default NSE scripts seamlessly on the exact ports discovered.
• Integrated Scripting Engine: Includes native scripting support for Python, Lua, and Shell. Operators can configure automated triggers, such as launching targeted post-scan tools like smb-enum as soon as port 445 is confirmed open.

Enterprise Reconnaissance Features and Operational Considerations

To accommodate diverse network topologies and infrastructure engagements, RustScan packages standard enterprise reconnaissance utilities:

• IPv6 and CIDR Subnet Support: Supports modern IPv6 targets alongside standard IPv4 addresses and CIDR subnet blocks for bulk scanning.
• File-Based Target Queuing: Ingests line-separated text files containing IP addresses and hostnames for batch reconnaissance pipelines.

However, operational deployments require understanding key network tradeoffs. Transmitting thousands of concurrent TCP connection requests in brief bursts is noisy; it quickly triggers rate-limiting, packet dropping, or active blocking on firewalls and intrusion prevention systems (IPS).

Additionally, on congested links or across high-latency WAN connections, aggressive packet rates can cause response drops, leading to missed open ports. Consequently, RustScan is best utilized for rapid initial perimeter mapping and narrowing down exposed services, while leaving granular service fingerprinting to the downstream Nmap phase.

Sources

• RustScan Official GitHub Repository: bee-san/RustScan
• Original Social Signal (@DarkWebInformer on X): RustScan: A fast, modern port scanner