Port scanning is a cornerstone of network discovery, security auditing, and server hardening. For decades, Network Mapper (Nmap) has served as the gold standard for port inspection and service enumeration. However, scanning all 65,535 TCP ports on a target host using Nmap alone can be painfully slow, often taking several minutes per machine due to conservative timeout thresholds and single-threaded discovery loops.
RustScan revolutionises this workflow. Written in Rust for maximum memory safety and multi-threaded asynchronous performance, RustScan is an ultra-fast port scanner capable of scanning all 65,535 ports in less than three seconds under optimal network conditions. Instead of replacing Nmap, RustScan pairs seamlessly with it: RustScan rapidly detects open ports, then automatically passes those specific ports directly into Nmap for detailed service version detection, operating system fingerprinting, and NSE script execution. This guide explains how to install RustScan on Linux, configure scan parameters, and automate deep vulnerability audits.
Installing RustScan on Linux
RustScan provides pre-compiled binaries, distribution packages, and containerised deployments.
Method 1: Install via Native Debian/Ubuntu Package
On Debian, Ubuntu, or Linux Mint systems, download and install the official .deb package from GitHub Releases:
wget https://github.com/RustScan/RustScan/releases/latest/download/rustscan_latest_amd64.deb
sudo dpkg -i rustscan_latest_amd64.debMethod 2: Install via Cargo
If you have Rust installed on any Linux distribution (Arch, Fedora, openSUSE):
cargo install rustscanMethod 3: Run via Docker
If you prefer running security tools in isolated containers without local system dependencies:
docker pull rustscan/rustscan:latestVerify your installation by querying the binary version:
rustscan --versionRunning a Basic Port Scan
To scan an IP address or domain name across all 65,535 ports using default adaptive batch settings:
rustscan -a 192.168.1.50RustScan immediately begins firing asynchronous SYN packets across the entire port range. Once open ports are identified, RustScan outputs them to the console and invokes the local Nmap binary to fingerprint running services.
To scan multiple hosts or an entire subnet simultaneously:
rustscan -a 192.168.1.0/24Passing Custom Arguments to Nmap
By default, RustScan feeds discovered ports into basic Nmap service detection (-sV). You can append custom Nmap parameters using the double-dash (--) separator at the end of the command:
rustscan -a 192.168.1.50 -- -A -sC -T4In this example:
- RustScan scans all 65,535 ports in roughly two seconds.
- Discovered open ports (such as
22, 80, 443, 3306) are automatically passed to Nmap. - Nmap runs aggressive OS detection (
-A) and default NSE security scripts (-sC) strictly against those open ports, avoiding wasted time probing closed ports.
Configuring Performance and Batch Sizes
RustScan’s speed is governed by how many concurrent sockets it attempts to open simultaneously (batch size) and how long it waits for a SYN-ACK reply (timeout):
| Option | Flag | Default Value | Description |
|---|---|---|---|
| Batch Size | -b, --batch-size <num> |
4500 | Number of concurrent sockets opened. Increase on fast LANs; decrease on fragile Wi-Fi. |
| Timeout | -t, --timeout <ms> |
1500 | Milliseconds to wait before declaring a port closed or filtered. |
| Range | -r, --range <start-end> |
1-65535 | Restricts scanning to a specific port range (e.g. 1-1000). |
| Quiet Mode | -q, --quiet |
False | Suppresses ASCII art banners and outputs raw JSON or port lists for scripting. |
Example of an aggressive local area network scan:
rustscan -a 10.0.0.15 -b 8000 -t 500Adjusting Linux System File Descriptor Limits
Because RustScan opens thousands of network sockets concurrently, you may encounter the error Too many open files (os error 24) if your operating system’s ulimit ceiling is set too low.
Check your current soft limit:
ulimit -nIf the limit is set to the default 1024, temporarily elevate it in your current terminal session before launching heavy scans:
ulimit -n 65535To make this change permanent for dedicated security testing rigs, append * soft nofile 65535 and * hard nofile 65535 to /etc/security/limits.conf.