How to Install and Use Naabu in Linux for Fast Network Port Scanning and Discovery

Network port scanning is a critical step in security assessments, server auditing, and infrastructure mapping. While standard tools like Nmap provide unparalleled service fingerprinting and vulnerability scripting capabilities, scanning large IP ranges or full 65,535-port spaces across multiple hosts can be slow. Naabu, developed by ProjectDiscovery, is a lightweight, ultra-fast port scanning tool designed specifically for high-speed network asset discovery.

Written in Go, Naabu focuses on doing one job exceptionally well: rapidly enumerating open TCP/UDP ports using raw SYN or CONNECT packets with minimal resource overhead, and seamlessly piping results into Nmap for targeted deep service analysis.

Key Features of Naabu

Naabu provides distinctive advantages for DevOps and security professionals:

• SYN and CONNECT Scan Modes: Automatically utilizes raw SYN packet scanning when executed with root privileges, falling back to unprivileged TCP CONNECT sockets when running as a standard user.
• Automatic CDN Exclusion: Integrates built-in IP filtering to detect and skip Content Delivery Network (CDN) edge nodes (such as Cloudflare, Akamai, and Fastly), preventing wasteful scanning of third-party proxies.
• Native Nmap Integration: Supports the -nmap-cli flag to automatically feed discovered open ports directly into an Nmap service detection scan without manual copy-pasting.
• Pipeline Modularity: Works seamlessly with tools like subfinder and httpx via standard Unix pipes.

Installing Naabu on Linux

Running raw SYN scans requires libpcap to construct low-level network packets. Install dependencies, then download the pre-compiled binary:

# Step 1: Install libpcap library
sudo apt update
sudo apt install libpcap-dev -y

# Step 2: Download and install Naabu binary
curl -s https://api.github.com/repos/projectdiscovery/naabu/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf naabu_*_linux_amd64.tar.gz
sudo mv naabu /usr/local/bin/
naabu -version

Command Flags and Filtering Options

The table below summarizes common command-line options in Naabu:

Flag	Functionality	Usage Example
-host <target>	Target single IP address or hostname	naabu -host 192.168.1.50
-list, -l <file>	Text file containing target IPs/domains	naabu -l hosts.txt
-p <ports>	Specify ports or port ranges	naabu -p 80,443,8080,8443 or -p 1-1000
-top-ports <n>	Scan most common n ports (100, 1000)	naabu -top-ports 1000
-rate <n>	Packets transmitted per second	naabu -rate 1000 (default 1000)
-c <threads>	Number of concurrent workers	naabu -c 25
-nmap-cli <args>	Pipes discovered ports into Nmap	naabu -host example.com -nmap-cli "nmap -sV -sC"

Running High-Speed Port Scans

1. Scanning Full Port Space (All 65,535 Ports)

To scan an internal development server across all TCP ports at 1,000 packets per second (requires sudo for raw SYN packets):

sudo naabu -host 192.168.1.100 -p - -rate 1000

2. Chaining Discovered Ports into Nmap for Deep Service Fingerprinting

Use Naabu to rapidly identify open ports across a host, then let Nmap perform detailed version detection (-sV) and default script scans (-sC) strictly on those verified ports:

sudo naabu -host 192.168.1.100 -top-ports 1000 -nmap-cli "nmap -sV -sC -oN deep_scan.txt"

This hybrid workflow saves immense time compared to running standard full-port Nmap scans from scratch.

3. Passive Reconnaissance into Active Port Probing

Pipe discovered subdomains directly into Naabu to locate live web ports:

subfinder -d example.com -silent | naabu -p 80,443,8000,8080,8443 -silent -o open_ports.txt

Frequently Asked Questions

Why does Naabu recommend running with sudo?

When run as root or with CAP_NET_RAW capabilities, Naabu sends raw SYN packets (half-open scanning), which is significantly faster and less resource-intensive than completing full TCP three-way handshakes via unprivileged CONNECT calls.

Does Naabu scan UDP ports?

By default, Naabu focuses on TCP ports. However, you can enable UDP scanning by appending the -scan-type s,u flag along with specified UDP port ranges.