Sigh, there is a bug in the IP checksum code. I know that because I double check the checksum whenever sending a packet. Sometimes, when doing Internet-wide scans, a message appears saying that checksum failed, so either the calculation is wrong, or the verification is wrong.

root@vps7026:~# masscan 10.176.0.0/12 -p21,22,80,443,3389 --rate 3000 --excludefile /root/masscan/data/exclude.conf
/root/masscan/data/exclude.conf: excluding 121 ranges from file
FAIL: target IP address list empty
[hint] try something like "--range 10.0.0.0/8"
[hint] try something like "--range 192.168.0.100-192.168.0.200"

root@vps7026:~# masscan --range 10.176.0.0/12 -p21,22,80,443,3389 --rate 3000 --excludefile /root/masscan/data/exclude.conf
/root/masscan/data/exclude.conf: excluding 121 ranges from file
FAIL: target IP address list empty
[hint] try something like "--range 10.0.0.0/8"
[hint] try something like "--range 192.168.0.100-192.168.0.200"

root@vps7026:~# masscan -p21,22,80,443,3389 --range 10.176.0.0-10.191.255.255 --rate 3000 --excludefile /root/masscan/data/exclude.conf > conf/rackspace.conf
/root/masscan/data/exclude.conf: excluding 121 ranges from file
FAIL: target IP address list empty
[hint] try something like "--range 10.0.0.0/8"
[hint] try something like "--range 192.168.0.100-192.168.0.200"

Right now for output you have an option of the masscan default string or XML. A third option is needed for parsing during run or using readscan when the full XML output is not needed.

An example would be the nmap -oG output: http://nmap.org/book/output-formats-grepable-output.html This format uses tab separation which isn't ideal.

Proposed output is a csv format:
,,,<state (open|closed)>,<Application layer protocol (snmp,http,dns,telnet,etc...)>,

The banner should be enclosed in quotes or escape any commas. To make the use of the output the output should have a consistent number of commas for field parsing. Every field but the banner should be downcased.

masscan should default to --seed time to reduce the load on those first poort buggers in the default seed.

This is a request to add the following information to in the XML output:

• Record the arguments passed to masscan
• Record the total count of hosts scanned

Right now masscan includes the following hosts info:

From my testing, the count of down isn't being used? For example, the above output was from a scan of 256 IP addresses, and a single port. I was expecting the total count to include "256" and the down count to be the difference, or "234".

It currently isn't

Despite what the port and protocol that is being scanned for the output always shows it is tcp.
Example:
SNMP scan, port 161 Udp
Banner on port 161/tcp on XXX.XXX.XXX.XXX: [snmp] sysDescr:Technicolor CableHome Gateway

I got this error when I run it on windows:

$ bin/masscan -p80 fc3a:956e:4b69:1c1e:5ebc:11a5:3e71:3e7e
FAIL: unknown command-line parameter "fc3a:956e:4b69:1c1e:5ebc:11a5:3e71:3e7e"
 [hint] did you want "--fc3a:956e:4b69:1c1e:5ebc:11a5:3e71:3e7e"?

$ bin/masscan -p80 -6 fc3a:956e:4b69:1c1e:5ebc:11a5:3e71:3e7e
nmap(-6): unsupported: maybe one day

This is what happens when I attempt to use masscan on an IPv6 address. :(

The options --exclude and --excludefile correctly read in the excluded IPv4 ranges (which you can verify with the --echo option), but it ignores them. Code needs to be added during scan init to remove the excluded ranges from the scan ranges.

On Windows, setting a flag like:

-p T:22,53,139,445,U:53,137,161

I'm only seeing results for UDP port 53 but expecting results for UDP 137 and 161. However in the following I get results for UDP 53, 137, and 161 as expected:

-p T:22,53,139,445,U:53,U:137,U:161

SSL certs are getting truncated:
This is from openssl: openssl s_client -showcerts -connect XXX.XXX.XXX.XXX:443 </dev/null 2>/dev/null|openssl x509 -outform PEM |hexdump -C
00000000 2d 2d 2d 2d 2d 42 45 47 49 4e 20 43 45 52 54 49 |-----BEGIN CERTI|
00000010 46 49 43 41 54 45 2d 2d 2d 2d 2d 0a 4d 49 49 46 |FICATE-----.MIIF|
00000020 6e 6a 43 43 42 49 61 67 41 77 49 42 41 67 49 4b |njCCBIagAwIBAgIK|
00000030 59 51 61 30 66 77 41 41 41 41 41 41 43 44 41 4e |YQa0fwAAAAAACDAN|
00000040 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 55 46 |BgkqhkiG9w0BAQUF|
00000050 41 44 41 71 4d 53 67 77 4a 67 59 44 0a 56 51 51 |ADAqMSgwJgYD.VQQ|
00000060 44 45 78 39 4e 59 57 6c 75 55 33 52 79 5a 57 56 |DEx9NYWluU3RyZWV|
00000070 30 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 63 79 31 |0QXJjaGl0ZWN0cy1|
00000080 54 51 6c 4d 79 4d 44 45 78 4c 55 4e 42 4d 42 34 |TQlMyMDExLUNBMB4|
00000090 58 44 54 45 7a 4d 44 51 78 4d 6a 41 77 0a 4d 7a |XDTEzMDQxMjAw.Mz|
000000a0 41 30 4f 46 6f 58 44 54 45 31 4d 44 51 78 4d 6a |A0OFoXDTE1MDQxMj|
000000b0 41 77 4d 7a 41 30 4f 46 6f 77 4b 44 45 6d 4d 43 |AwMzA0OFowKDEmMC|
000000c0 51 47 41 31 55 45 41 78 4d 64 62 57 46 70 62 43 |QGA1UEAxMdbWFpbC|
000000d0 35 74 59 57 6c 75 63 33 52 79 5a 57 56 30 0a 59 |5tYWluc3RyZWV0.Y|
000000e0 58 4a 6a 61 47 6c 30 5a 57 4e 30 63 79 35 75 5a |XJjaGl0ZWN0cy5uZ|
000000f0 58 51 77 67 67 45 69 4d 41 30 47 43 53 71 47 53 |XQwggEiMA0GCSqGS|
00000100 49 62 33 44 51 45 42 41 51 55 41 41 34 49 42 44 |Ib3DQEBAQUAA4IBD|
00000110 77 41 77 67 67 45 4b 41 6f 49 42 41 51 43 7a 0a |wAwggEKAoIBAQCz.|
00000120 34 64 79 6e 70 39 69 2f 7a 38 4d 43 30 4f 5a 73 |4dynp9i/z8MC0OZs|
00000130 4a 6c 58 49 6e 6e 6a 50 42 6c 6e 52 63 4d 59 41 |JlXInnjPBlnRcMYA|
00000140 6d 39 4c 4c 4e 4f 50 43 56 49 42 78 67 79 5a 50 |m9LLNOPCVIBxgyZP|
00000150 6e 48 62 59 72 67 71 2b 6b 72 54 4e 74 30 31 5a |nHbYrgq+krTNt01Z|
00000160 0a 70 50 70 36 42 6f 35 67 65 2f 49 55 44 4a 68 |.pPp6Bo5ge/IUDJh|
00000170 37 44 55 72 66 45 36 73 6a 59 68 6d 7a 4a 31 30 |7DUrfE6sjYhmzJ10|
00000180 67 42 33 54 62 61 37 43 4d 5a 48 42 78 30 51 67 |gB3Tba7CMZHBx0Qg|
00000190 61 7a 43 56 56 71 57 44 61 67 34 4a 74 59 49 44 |azCVVqWDag4JtYID|
000001a0 2f 0a 4a 68 33 48 69 79 37 6b 76 54 58 36 67 73 |/.Jh3Hiy7kvTX6gs|
000001b0 6e 4c 54 63 35 55 35 77 51 43 31 4e 2b 4f 42 4a |nLTc5U5wQC1N+OBJ|
000001c0 2f 4d 45 72 4a 63 7a 72 53 44 71 62 43 2b 4b 39 |/MErJczrSDqbC+K9|
000001d0 50 4d 6e 78 33 55 71 64 4f 56 44 67 79 34 4f 50 |PMnx3UqdOVDgy4OP|
000001e0 71 68 0a 74 4b 57 76 6a 66 61 55 59 77 30 69 65 |qh.tKWvjfaUYw0ie|
000001f0 58 52 6d 64 55 30 64 43 36 58 54 56 68 62 4e 5a |XRmdU0dC6XTVhbNZ|
00000200 41 31 61 4d 31 2f 65 46 52 43 68 75 63 4c 64 76 |A1aM1/eFRChucLdv|
00000210 35 77 70 75 46 77 58 67 38 59 78 7a 49 78 2f 33 |5wpuFwXg8YxzIx/3|
00000220 71 36 77 0a 52 78 38 43 63 39 76 55 2b 67 4f 73 |q6w.Rx8Cc9vU+gOs|
00000230 4e 50 4b 31 41 6b 4c 45 4c 55 58 77 51 36 53 6d |NPK1AkLELUXwQ6Sm|
00000240 6b 38 4f 6f 53 4a 31 70 32 45 30 77 73 57 62 41 |k8OoSJ1p2E0wsWbA|
00000250 31 70 62 42 30 32 4e 7a 77 54 56 30 52 6c 6c 36 |1pbB02NzwTV0Rll6|
00000260 2f 59 30 69 0a 78 6a 43 47 4e 64 4a 6e 5a 45 4d |/Y0i.xjCGNdJnZEM|
00000270 6e 6c 66 71 39 6a 6f 35 54 41 67 4d 42 41 41 47 |nlfq9jo5TAgMBAAG|
00000280 6a 67 67 4c 47 4d 49 49 43 77 6a 41 64 42 67 4e |jggLGMIICwjAdBgN|
00000290 56 48 51 34 45 46 67 51 55 53 57 72 50 77 42 58 |VHQ4EFgQUSWrPwBX|
000002a0 61 67 75 7a 78 0a 48 55 30 64 34 56 38 62 30 32 |aguzx.HU0d4V8b02|
000002b0 6f 64 41 65 41 77 44 67 59 44 56 52 30 50 41 51 |odAeAwDgYDVR0PAQ|
000002c0 48 2f 42 41 51 44 41 67 57 67 4d 47 59 47 41 31 |H/BAQDAgWgMGYGA1|
000002d0 55 64 45 51 52 66 4d 46 32 43 47 47 31 68 61 57 |UdEQRfMF2CGG1haW|
000002e0 35 7a 64 48 4a 6c 0a 5a 58 52 68 63 6d 4e 6f 61 |5zdHJl.ZXRhcmNoa|
000002f0 58 52 6c 59 33 52 7a 4c 6d 35 6c 64 49 49 64 62 |XRlY3RzLm5ldIIdb|
00000300 57 46 70 62 43 35 74 59 57 6c 75 63 33 52 79 5a |WFpbC5tYWluc3RyZ|
00000310 57 56 30 59 58 4a 6a 61 47 6c 30 5a 57 4e 30 63 |WV0YXJjaGl0ZWN0c|
00000320 79 35 75 5a 58 53 43 0a 49 6c 4e 43 55 7a 49 77 |y5uZXSC.IlNCUzIw|
00000330 4d 54 45 75 54 57 46 70 62 6c 4e 30 63 6d 56 6c |MTEuTWFpblN0cmVl|
00000340 64 45 46 79 59 32 68 70 64 47 56 6a 64 48 4d 75 |dEFyY2hpdGVjdHMu|
00000350 62 47 39 6a 59 57 77 77 48 77 59 44 56 52 30 6a |bG9jYWwwHwYDVR0j|
00000360 42 42 67 77 46 6f 41 55 0a 34 65 59 79 34 65 53 |BBgwFoAU.4eYy4eS|
00000370 6c 43 6e 2f 61 77 47 37 52 79 42 57 6a 4b 52 4d |lCn/awG7RyBWjKRM|
00000380 62 33 41 41 77 67 65 77 47 41 31 55 64 48 77 53 |b3AAwgewGA1UdHwS|
00000390 42 35 44 43 42 34 54 43 42 33 71 43 42 32 36 43 |B5DCB4TCB3qCB26C|
000003a0 42 32 49 61 42 31 57 78 6b 0a 59 58 41 36 4c 79 |B2IaB1Wxk.YXA6Ly|
000003b0 38 76 51 30 34 39 54 57 46 70 62 6c 4e 30 63 6d |8vQ049TWFpblN0cm|
000003c0 56 6c 64 45 46 79 59 32 68 70 64 47 56 6a 64 48 |VldEFyY2hpdGVjdH|
000003d0 4d 74 55 30 4a 54 4d 6a 41 78 4d 53 31 44 51 53 |MtU0JTMjAxMS1DQS|
000003e0 78 44 54 6a 31 54 51 6c 4d 79 0a 4d 44 45 78 4c |xDTj1TQlMy.MDExL|
000003f0 45 4e 4f 50 55 4e 45 55 43 78 44 54 6a 31 51 64 |ENOPUNEUCxDTj1Qd|
00000400 57 4a 73 61 57 4d 6c 4d 6a 42 4c 5a 58 6b 6c 4d |WJsaWMlMjBLZXklM|
00000410 6a 42 54 5a 58 4a 32 61 57 4e 6c 63 79 78 44 54 |jBTZXJ2aWNlcyxDT|
00000420 6a 31 54 5a 58 4a 32 61 57 4e 6c 0a 63 79 78 44 |j1TZXJ2aWNl.cyxD|
00000430 54 6a 31 44 62 32 35 6d 61 57 64 31 63 6d 46 30 |Tj1Db25maWd1cmF0|
00000440 61 57 39 75 4c 45 52 44 50 55 31 68 61 57 35 54 |aW9uLERDPU1haW5T|
00000450 64 48 4a 6c 5a 58 52 42 63 6d 4e 6f 61 58 52 6c |dHJlZXRBcmNoaXRl|
00000460 59 33 52 7a 4c 45 52 44 50 57 78 76 0a 59 32 46 |Y3RzLERDPWxv.Y2F|
00000470 73 50 32 4e 6c 63 6e 52 70 5a 6d 6c 6a 59 58 52 |sP2NlcnRpZmljYXR|
00000480 6c 55 6d 56 32 62 32 4e 68 64 47 6c 76 62 6b 78 |lUmV2b2NhdGlvbkx|
00000490 70 63 33 51 2f 59 6d 46 7a 5a 54 39 76 59 6d 70 |pc3Q/YmFzZT9vYmp|
000004a0 6c 59 33 52 44 62 47 46 7a 63 7a 31 6a 0a 55 6b |lY3RDbGFzcz1j.Uk|
000004b0 78 45 61 58 4e 30 63 6d 6c 69 64 58 52 70 62 32 |xEaXN0cmlidXRpb2|
000004c0 35 51 62 32 6c 75 64 44 43 42 34 41 59 49 4b 77 |5Qb2ludDCB4AYIKw|
000004d0 59 42 42 51 55 48 41 51 45 45 67 64 4d 77 67 64 |YBBQUHAQEEgdMwgd|
000004e0 41 77 67 63 30 47 43 43 73 47 41 51 55 46 0a 42 |Awgc0GCCsGAQUF.B|
000004f0 7a 41 43 68 6f 48 41 62 47 52 68 63 44 6f 76 4c |zAChoHAbGRhcDovL|
00000500 79 39 44 54 6a 31 4e 59 57 6c 75 55 33 52 79 5a |y9DTj1NYWluU3RyZ|
00000510 57 56 30 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 63 |WV0QXJjaGl0ZWN0c|
00000520 79 31 54 51 6c 4d 79 4d 44 45 78 4c 55 4e 42 0a |y1TQlMyMDExLUNB.|
00000530 4c 45 4e 4f 50 55 46 4a 51 53 78 44 54 6a 31 51 |LENOPUFJQSxDTj1Q|
00000540 64 57 4a 73 61 57 4d 6c 4d 6a 42 4c 5a 58 6b 6c |dWJsaWMlMjBLZXkl|
00000550 4d 6a 42 54 5a 58 4a 32 61 57 4e 6c 63 79 78 44 |MjBTZXJ2aWNlcyxD|
00000560 54 6a 31 54 5a 58 4a 32 61 57 4e 6c 63 79 78 44 |Tj1TZXJ2aWNlcyxD|
00000570 0a 54 6a 31 44 62 32 35 6d 61 57 64 31 63 6d 46 |.Tj1Db25maWd1cmF|
00000580 30 61 57 39 75 4c 45 52 44 50 55 31 68 61 57 35 |0aW9uLERDPU1haW5|
00000590 54 64 48 4a 6c 5a 58 52 42 63 6d 4e 6f 61 58 52 |TdHJlZXRBcmNoaXR|
000005a0 6c 59 33 52 7a 4c 45 52 44 50 57 78 76 59 32 46 |lY3RzLERDPWxvY2F|
000005b0 73 0a 50 32 4e 42 51 32 56 79 64 47 6c 6d 61 57 |s.P2NBQ2VydGlmaW|
000005c0 4e 68 64 47 55 2f 59 6d 46 7a 5a 54 39 76 59 6d |NhdGU/YmFzZT9vYm|
000005d0 70 6c 59 33 52 44 62 47 46 7a 63 7a 31 6a 5a 58 |plY3RDbGFzcz1jZX|
000005e0 4a 30 61 57 5a 70 59 32 46 30 61 57 39 75 51 58 |J0aWZpY2F0aW9uQX|
000005f0 56 30 0a 61 47 39 79 61 58 52 35 4d 43 45 47 43 |V0.aG9yaXR5MCEGC|
00000600 53 73 47 41 51 51 42 67 6a 63 55 41 67 51 55 48 |SsGAQQBgjcUAgQUH|
00000610 68 49 41 56 77 42 6c 41 47 49 41 55 77 42 6c 41 |hIAVwBlAGIAUwBlA|
00000620 48 49 41 64 67 42 6c 41 48 49 77 45 77 59 44 56 |HIAdgBlAHIwEwYDV|
00000630 52 30 6c 0a 42 41 77 77 43 67 59 49 4b 77 59 42 |R0l.BAwwCgYIKwYB|
00000640 42 51 55 48 41 77 45 77 44 51 59 4a 4b 6f 5a 49 |BQUHAwEwDQYJKoZI|
00000650 68 76 63 4e 41 51 45 46 42 51 41 44 67 67 45 42 |hvcNAQEFBQADggEB|
00000660 41 45 51 68 4b 41 36 68 2f 71 45 41 6d 65 2b 36 |AEQhKA6h/qEAme+6|
00000670 59 6e 44 63 0a 31 41 6c 2f 58 32 4a 35 44 6c 43 |YnDc.1Al/X2J5DlC|
00000680 4a 73 72 61 4a 5a 66 77 4f 4c 69 5a 35 71 30 6a |JsraJZfwOLiZ5q0j|
00000690 68 6b 6c 57 36 54 46 45 51 34 65 6d 7a 35 37 4a |hklW6TFEQ4emz57J|
000006a0 69 53 78 6b 56 30 6d 72 71 4c 44 31 77 76 75 48 |iSxkV0mrqLD1wvuH|
000006b0 43 48 4e 52 4d 0a 50 45 31 6c 51 4c 31 6e 57 38 |CHNRM.PE1lQL1nW8|
000006c0 5a 42 54 44 74 42 4b 2b 44 62 6d 75 53 42 4d 36 |ZBTDtBK+DbmuSBM6|
000006d0 6a 52 54 4d 54 62 37 6e 5a 67 4c 72 74 73 68 75 |jRTMTb7nZgLrtshu|
000006e0 4b 7a 71 57 4a 56 33 4b 51 70 31 67 33 2f 55 32 |KzqWJV3KQp1g3/U2|
000006f0 50 61 39 4c 68 51 0a 42 73 74 4e 4a 49 64 4e 33 |Pa9LhQ.BstNJIdN3|
00000700 2b 48 48 42 35 32 55 70 2b 74 37 31 43 6c 55 45 |+HHB52Up+t71ClUE|
00000710 2b 37 2f 4a 63 2f 52 47 47 2b 4a 49 6a 69 47 37 |+7/Jc/RGG+JIjiG7|
00000720 2b 2f 39 2f 31 59 55 63 6d 70 6c 54 75 39 38 4e |+/9/1YUcmplTu98N|
00000730 64 56 6a 62 52 55 30 0a 66 57 77 53 4b 35 41 44 |dVjbRU0.fWwSK5AD|
00000740 68 50 68 53 38 43 57 2b 63 75 70 45 64 4a 68 74 |hPhS8CW+cupEdJht|
00000750 43 76 37 62 4b 56 69 74 6d 2f 62 4e 4e 38 51 56 |Cv7bKVitm/bNN8QV|
00000760 43 51 5a 59 62 31 6e 39 7a 64 75 46 51 4a 4f 4b |CQZYb1n9zduFQJOK|
00000770 48 57 6f 36 31 39 4c 30 0a 4a 74 6c 66 6d 47 57 |HWo619L0.JtlfmGW|
00000780 50 61 6a 2b 31 64 38 53 7a 7a 6a 53 76 2b 4d 73 |Paj+1d8SzzjSv+Ms|
00000790 49 2f 63 46 70 72 62 6e 33 41 32 69 2f 4a 41 6b |I/cFprbn3A2i/JAk|
000007a0 37 4d 4d 6a 4b 45 51 51 45 72 78 73 70 61 61 45 |7MMjKEQQErxspaaE|
000007b0 42 65 2b 67 66 4a 42 7a 2b 0a 6c 58 73 3d 0a 2d |Be+gfJBz+.lXs=.-|
000007c0 2d 2d 2d 2d 45 4e 44 20 43 45 52 54 49 46 49 43 |----END CERTIFIC|
000007d0 41 54 45 2d 2d 2d 2d 2d 0a |ATE-----.|
000007d9

From Masscan:
dm-imac-12-22-2013:tmp dmaynor$ echo "MIIFnjCCBIagAwIBAgIKYQa0fwAAAAAACDANBgkqhkiG9w0BAQUFADAqMSgwJgYDVQQDEx9NYWluU3RyZWV0QXJjaGl0ZWN0cy1TQlMyMDExLUNBMB4XDTEzMDQxMjAwMzA0OFoXDTE1MDQxMjAwMzA0OFowKDEmMCQGA1UEAxMdbWFpbC5tYWluc3RyZWV0YXJjaGl0ZWN0cy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCz4dynp9i/z8MC0OZsJlXInnjPBlnRcMYAm9LLNOPCVIBxgyZPnHbYrgq+krTNt01ZpPp6Bo5ge/IUDJh7DUrfE6sjYhmzJ10gB3Tba7CMZHBx0QgazCVVqWDag4JtYID/Jh3Hiy7kvTX6gsnLTc5U5wQC1N+OBJ/MErJczrSDqbC+K9PMnx3UqdOVDgy4OPqhtKWvjfaUYw0ieXRmdU0dC6XTVhbNZA1aM1/eFRChucLdv5wpuFwXg8YxzIx/3q6wRx8Cc9vU+gOsNPK1AkLELUXwQ6Smk8OoSJ1p2E0wsWbA1pbB02NzwTV0Rll6/Y0ixjCGNdJnZEMnlfq9jo5TAgMBAAGjggLGMIICwjAdBgNVHQ4EFgQUSWrPwBXaguzxHU0d4V8b02odAeAwDgYDVR0PAQH/BAQDAgWgMGYGA1UdEQRfMF2CGG1haW5zdHJlZXRhcmNoaXRlY3RzLm5ldIIdbWFpbC5tYWluc3RyZWV0YXJjaGl0ZWN0cy5uZXSCIlNCUzIwMTEuTWFpblN0cmVldEFyY2hpdGVjdHMubG9jYWwwHwYDVR0jBBgwFoAU4eYy4eSlCn/awG7RyBWjKRMb3AAwgewGA1UdHwSB5DCB4TCB3qCB26CB2IaB1WxkYXA6Ly8vQ049TWFpblN0cmVldEFyY2hpdGVjdHMtU0JTMjAxMS1DQSxDTj1TQlMyMDExLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPU1haW5TdHJlZXRBcmNoaXRlY3RzLERDPWxvY2FsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCB4AYIKwYBBQUHAQEEgdMwgdAwgc0GCCsGAQUFBzAChoHAbGRhcDovLy9DTj1NYWluU3RyZWV0QXJjaGl0ZWN0cy1TQlMyMDExLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBL" | hexdump -C
00000000 4d 49 49 46 6e 6a 43 43 42 49 61 67 41 77 49 42 |MIIFnjCCBIagAwIB|
00000010 41 67 49 4b 59 51 61 30 66 77 41 41 41 41 41 41 |AgIKYQa0fwAAAAAA|
00000020 43 44 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 |CDANBgkqhkiG9w0B|
00000030 41 51 55 46 41 44 41 71 4d 53 67 77 4a 67 59 44 |AQUFADAqMSgwJgYD|
00000040 56 51 51 44 45 78 39 4e 59 57 6c 75 55 33 52 79 |VQQDEx9NYWluU3Ry|
00000050 5a 57 56 30 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 |ZWV0QXJjaGl0ZWN0|
00000060 63 79 31 54 51 6c 4d 79 4d 44 45 78 4c 55 4e 42 |cy1TQlMyMDExLUNB|
00000070 4d 42 34 58 44 54 45 7a 4d 44 51 78 4d 6a 41 77 |MB4XDTEzMDQxMjAw|
00000080 4d 7a 41 30 4f 46 6f 58 44 54 45 31 4d 44 51 78 |MzA0OFoXDTE1MDQx|
00000090 4d 6a 41 77 4d 7a 41 30 4f 46 6f 77 4b 44 45 6d |MjAwMzA0OFowKDEm|
000000a0 4d 43 51 47 41 31 55 45 41 78 4d 64 62 57 46 70 |MCQGA1UEAxMdbWFp|
000000b0 62 43 35 74 59 57 6c 75 63 33 52 79 5a 57 56 30 |bC5tYWluc3RyZWV0|
000000c0 59 58 4a 6a 61 47 6c 30 5a 57 4e 30 63 79 35 75 |YXJjaGl0ZWN0cy5u|
000000d0 5a 58 51 77 67 67 45 69 4d 41 30 47 43 53 71 47 |ZXQwggEiMA0GCSqG|
000000e0 53 49 62 33 44 51 45 42 41 51 55 41 41 34 49 42 |SIb3DQEBAQUAA4IB|
000000f0 44 77 41 77 67 67 45 4b 41 6f 49 42 41 51 43 7a |DwAwggEKAoIBAQCz|
00000100 34 64 79 6e 70 39 69 2f 7a 38 4d 43 30 4f 5a 73 |4dynp9i/z8MC0OZs|
00000110 4a 6c 58 49 6e 6e 6a 50 42 6c 6e 52 63 4d 59 41 |JlXInnjPBlnRcMYA|
00000120 6d 39 4c 4c 4e 4f 50 43 56 49 42 78 67 79 5a 50 |m9LLNOPCVIBxgyZP|
00000130 6e 48 62 59 72 67 71 2b 6b 72 54 4e 74 30 31 5a |nHbYrgq+krTNt01Z|
00000140 70 50 70 36 42 6f 35 67 65 2f 49 55 44 4a 68 37 |pPp6Bo5ge/IUDJh7|
00000150 44 55 72 66 45 36 73 6a 59 68 6d 7a 4a 31 30 67 |DUrfE6sjYhmzJ10g|
00000160 42 33 54 62 61 37 43 4d 5a 48 42 78 30 51 67 61 |B3Tba7CMZHBx0Qga|
00000170 7a 43 56 56 71 57 44 61 67 34 4a 74 59 49 44 2f |zCVVqWDag4JtYID/|
00000180 4a 68 33 48 69 79 37 6b 76 54 58 36 67 73 6e 4c |Jh3Hiy7kvTX6gsnL|
00000190 54 63 35 55 35 77 51 43 31 4e 2b 4f 42 4a 2f 4d |Tc5U5wQC1N+OBJ/M|
000001a0 45 72 4a 63 7a 72 53 44 71 62 43 2b 4b 39 50 4d |ErJczrSDqbC+K9PM|
000001b0 6e 78 33 55 71 64 4f 56 44 67 79 34 4f 50 71 68 |nx3UqdOVDgy4OPqh|
000001c0 74 4b 57 76 6a 66 61 55 59 77 30 69 65 58 52 6d |tKWvjfaUYw0ieXRm|
000001d0 64 55 30 64 43 36 58 54 56 68 62 4e 5a 41 31 61 |dU0dC6XTVhbNZA1a|
000001e0 4d 31 2f 65 46 52 43 68 75 63 4c 64 76 35 77 70 |M1/eFRChucLdv5wp|
000001f0 75 46 77 58 67 38 59 78 7a 49 78 2f 33 71 36 77 |uFwXg8YxzIx/3q6w|
00000200 52 78 38 43 63 39 76 55 2b 67 4f 73 4e 50 4b 31 |Rx8Cc9vU+gOsNPK1|
00000210 41 6b 4c 45 4c 55 58 77 51 36 53 6d 6b 38 4f 6f |AkLELUXwQ6Smk8Oo|
00000220 53 4a 31 70 32 45 30 77 73 57 62 41 31 70 62 42 |SJ1p2E0wsWbA1pbB|
00000230 30 32 4e 7a 77 54 56 30 52 6c 6c 36 2f 59 30 69 |02NzwTV0Rll6/Y0i|
00000240 78 6a 43 47 4e 64 4a 6e 5a 45 4d 6e 6c 66 71 39 |xjCGNdJnZEMnlfq9|
00000250 6a 6f 35 54 41 67 4d 42 41 41 47 6a 67 67 4c 47 |jo5TAgMBAAGjggLG|
00000260 4d 49 49 43 77 6a 41 64 42 67 4e 56 48 51 34 45 |MIICwjAdBgNVHQ4E|
00000270 46 67 51 55 53 57 72 50 77 42 58 61 67 75 7a 78 |FgQUSWrPwBXaguzx|
00000280 48 55 30 64 34 56 38 62 30 32 6f 64 41 65 41 77 |HU0d4V8b02odAeAw|
00000290 44 67 59 44 56 52 30 50 41 51 48 2f 42 41 51 44 |DgYDVR0PAQH/BAQD|
000002a0 41 67 57 67 4d 47 59 47 41 31 55 64 45 51 52 66 |AgWgMGYGA1UdEQRf|
000002b0 4d 46 32 43 47 47 31 68 61 57 35 7a 64 48 4a 6c |MF2CGG1haW5zdHJl|
000002c0 5a 58 52 68 63 6d 4e 6f 61 58 52 6c 59 33 52 7a |ZXRhcmNoaXRlY3Rz|
000002d0 4c 6d 35 6c 64 49 49 64 62 57 46 70 62 43 35 74 |Lm5ldIIdbWFpbC5t|
000002e0 59 57 6c 75 63 33 52 79 5a 57 56 30 59 58 4a 6a |YWluc3RyZWV0YXJj|
000002f0 61 47 6c 30 5a 57 4e 30 63 79 35 75 5a 58 53 43 |aGl0ZWN0cy5uZXSC|
00000300 49 6c 4e 43 55 7a 49 77 4d 54 45 75 54 57 46 70 |IlNCUzIwMTEuTWFp|
00000310 62 6c 4e 30 63 6d 56 6c 64 45 46 79 59 32 68 70 |blN0cmVldEFyY2hp|
00000320 64 47 56 6a 64 48 4d 75 62 47 39 6a 59 57 77 77 |dGVjdHMubG9jYWww|
00000330 48 77 59 44 56 52 30 6a 42 42 67 77 46 6f 41 55 |HwYDVR0jBBgwFoAU|
00000340 34 65 59 79 34 65 53 6c 43 6e 2f 61 77 47 37 52 |4eYy4eSlCn/awG7R|
00000350 79 42 57 6a 4b 52 4d 62 33 41 41 77 67 65 77 47 |yBWjKRMb3AAwgewG|
00000360 41 31 55 64 48 77 53 42 35 44 43 42 34 54 43 42 |A1UdHwSB5DCB4TCB|
00000370 33 71 43 42 32 36 43 42 32 49 61 42 31 57 78 6b |3qCB26CB2IaB1Wxk|
00000380 59 58 41 36 4c 79 38 76 51 30 34 39 54 57 46 70 |YXA6Ly8vQ049TWFp|
00000390 62 6c 4e 30 63 6d 56 6c 64 45 46 79 59 32 68 70 |blN0cmVldEFyY2hp|
000003a0 64 47 56 6a 64 48 4d 74 55 30 4a 54 4d 6a 41 78 |dGVjdHMtU0JTMjAx|
000003b0 4d 53 31 44 51 53 78 44 54 6a 31 54 51 6c 4d 79 |MS1DQSxDTj1TQlMy|
000003c0 4d 44 45 78 4c 45 4e 4f 50 55 4e 45 55 43 78 44 |MDExLENOPUNEUCxD|
000003d0 54 6a 31 51 64 57 4a 73 61 57 4d 6c 4d 6a 42 4c |Tj1QdWJsaWMlMjBL|
000003e0 5a 58 6b 6c 4d 6a 42 54 5a 58 4a 32 61 57 4e 6c |ZXklMjBTZXJ2aWNl|
000003f0 63 79 78 44 54 6a 31 54 5a 58 4a 32 61 57 4e 6c |cyxDTj1TZXJ2aWNl|
00000400 63 79 78 44 54 6a 31 44 62 32 35 6d 61 57 64 31 |cyxDTj1Db25maWd1|
00000410 63 6d 46 30 61 57 39 75 4c 45 52 44 50 55 31 68 |cmF0aW9uLERDPU1h|
00000420 61 57 35 54 64 48 4a 6c 5a 58 52 42 63 6d 4e 6f |aW5TdHJlZXRBcmNo|
00000430 61 58 52 6c 59 33 52 7a 4c 45 52 44 50 57 78 76 |aXRlY3RzLERDPWxv|
00000440 59 32 46 73 50 32 4e 6c 63 6e 52 70 5a 6d 6c 6a |Y2FsP2NlcnRpZmlj|
00000450 59 58 52 6c 55 6d 56 32 62 32 4e 68 64 47 6c 76 |YXRlUmV2b2NhdGlv|
00000460 62 6b 78 70 63 33 51 2f 59 6d 46 7a 5a 54 39 76 |bkxpc3Q/YmFzZT9v|
00000470 59 6d 70 6c 59 33 52 44 62 47 46 7a 63 7a 31 6a |YmplY3RDbGFzcz1j|
00000480 55 6b 78 45 61 58 4e 30 63 6d 6c 69 64 58 52 70 |UkxEaXN0cmlidXRp|
00000490 62 32 35 51 62 32 6c 75 64 44 43 42 34 41 59 49 |b25Qb2ludDCB4AYI|
000004a0 4b 77 59 42 42 51 55 48 41 51 45 45 67 64 4d 77 |KwYBBQUHAQEEgdMw|
000004b0 67 64 41 77 67 63 30 47 43 43 73 47 41 51 55 46 |gdAwgc0GCCsGAQUF|
000004c0 42 7a 41 43 68 6f 48 41 62 47 52 68 63 44 6f 76 |BzAChoHAbGRhcDov|
000004d0 4c 79 39 44 54 6a 31 4e 59 57 6c 75 55 33 52 79 |Ly9DTj1NYWluU3Ry|
000004e0 5a 57 56 30 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 |ZWV0QXJjaGl0ZWN0|
000004f0 63 79 31 54 51 6c 4d 79 4d 44 45 78 4c 55 4e 42 |cy1TQlMyMDExLUNB|
00000500 4c 45 4e 4f 50 55 46 4a 51 53 78 44 54 6a 31 51 |LENOPUFJQSxDTj1Q|
00000510 64 57 4a 73 61 57 4d 6c 4d 6a 42 4c 0a |dWJsaWMlMjBL.|
0000051d

Hi Rob!
I'd love for masscan to output text in a way I can feed it directly to nmap - by that I mean as though one were going to now scan the findings using nmap, since the heavy lifting of discovering ports is now done...

10.0.0.1 -p 80,443,8080

etc..
so that one could literally pipe the output of masscan directly to the input of nmap - it would greatly improve workflow fluidity! :D

Thanks in advance!
-Viss

running debian (kali linux 3.12 kernel) with all prereq's.

src/main.c:50:59: fatal error: crypto-base64.h: No such file or directory
compilation terminated.

not sure which lib you need in addition, google research was not useful.

When --interactive is paired with any output option like -oG or --output-format no information is displayed on the screen.

A run with just interactive:
sudo masscan -p80 0.0.0.0/0 --exclude 255.255.255.255 --interactive

Starting masscan 1.0.2 (http://bit.ly/14GZzcT) at 2014-01-23 21:26:32 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 4294967295 hosts [1 port/host]
Discovered open port 80/tcp on 115.165.126.162
Discovered open port 80/tcp on 86.56.196.77
Discovered open port 80/tcp on 108.171.250.220
Discovered open port 80/tcp on 108.59.251.233
Discovered open port 80/tcp on 109.185.249.145
Discovered open port 80/tcp on 109.62.250.71
Discovered open port 80/tcp on 71.189.241.75
Discovered open port 80/tcp on 71.227.241.15
Discovered open port 80/tcp on 173.246.37.146
Discovered closed port 80/tcp on 174.50.36.215
^Cwaiting 10 seconds to exit...
saving resume file to: paused.conf

A run with interactive and -oG:
sudo masscan -p80 0.0.0.0/0 --exclude 255.255.255.255 --interactive -oG badtest.grep

Starting masscan 1.0.2 (http://bit.ly/14GZzcT) at 2014-01-23 21:25:31 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 4294967295 hosts [1 port/host]
^Cwaiting 10 seconds to exit...
saving resume file to: paused.conf

Seeing as you already have a list of devices who either don't want to be or react badly to being scanned, it would be nice to avoid scanning them by other people who download the project.

No guarantee in keeping it up-to-date, but at least a good start to avoid the loudest complainers. 😄

Probably the last thing I want to collect as it eats up quite a bit of scan result disk space.

I do, however, want to detect the banners of services.

venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:127995 errors:0 dropped:0 overruns:0 frame:0
TX packets:74394 errors:0 dropped:27 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:165737898 (165.7 MB) TX bytes:6890666 (6.8 MB)

venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:199.175.51.99 P-t-P:199.175.51.99 Bcast:199.175.51.99 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

e.g.

scanner@199:/brisket$ sudo masscan --rate 2337 --adapter venet0:0 --adapter-ip 199.175.51.99 -p 1433 96.127.0.0/18
FAIL: failed to detect MAC address of interface: "venet0:0"
[hint] try something like "--adapter-mac 00-11-22-33-44-55"
scanner@199:/brisket$ sudo masscan --rate 2337 --adapter venet0:0 --adapter-ip 199.175.51.99 --adapter-mac 00:00:00:00:00:00 -p 1433 96.127.0.0/18
FAIL: failed to detect MAC address of interface: "venet0:0"
[hint] try something like "--adapter-mac 00-11-22-33-44-55"
scanner@199:~/brisket$ sudo masscan --rate 2337 --adapter venet0:0 --adapter-ip 199.175.51.99 --adapter-mac 00:00:00:00:00:00:00:00:00:00:00:00 -p 1433 96.127.0.0/18
FAIL: failed to detect MAC address of interface: "venet0:0"
[hint] try something like "--adapter-mac 00-11-22-33-44-55"

nmap works but you have to specify the following (perhaps it'll help you:

nmap -e venet0:0 -Pn -S <real_ip_of_server> <target_ip>

Not entirely sure what this error means but it doesn't appear to be causing any errors in the scan. It happens every now and then on Ubuntu 12.04.02 LTS

Linux 3.2.0-24-virtual #39-Ubuntu SMP Mon May 21 18:44:18 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

Starting masscan 1.0 (http://bit.ly/14GZzcT) at 2013-11-05 01:02:50 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 256 hosts [4 ports/host]
set_affinity: returned error linux:00:00 remaining, 0-tcbs, rr=0
/home/scanner/brisket/conf/exclude.conf: excluding 14 ranges from file

Starting masscan 1.0 (http://bit.ly/14GZzcT) at 2013-11-05 01:03:02 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 512 hosts [4 ports/host]
set_affinity: returned error linux:00:00 remaining, 0-tcbs, rr=0
/home/scanner/brisket/conf/exclude.conf: excluding 14 ranges from file
set_affinity: returned error linux:0

I've found a bug in the "Finalize" section of base64 cert encode: it should look like:

if (px == 0) {
    switch (state) {
    case 0:
        // 0 octets in buffer b64x DO NOTHING
        // out_b64(b64x, banout, PROTO_X509_CERT); 
        break;
    case 1:
        // 1 octets in buffer b64x - 8 BITS 6+2
        b64x *= 256; // increase buffer to 16 bits 6+(2+4)+4
        banout_append_char(banout, PROTO_X509_CERT, b64[(b64x>>10)&0x3F]);
        banout_append_char(banout, PROTO_X509_CERT, b64[(b64x>>4)&0x3F]);
        banout_append_char(banout, PROTO_X509_CERT, '=');
        banout_append_char(banout, PROTO_X509_CERT, '=');
        break;
    case 2:
        // 2 octets in buffer b64x - 16 BITS 6+6+4
        b64x *= 256; // increase buffer to 24 bits 6+6+(4+2)+6
        // b64x *= 256;
        banout_append_char(banout, PROTO_X509_CERT, b64[(b64x>>18)&0x3F]);
        banout_append_char(banout, PROTO_X509_CERT, b64[(b64x>>12)&0x3F]);
        banout_append_char(banout, PROTO_X509_CERT, b64[(b64x>>6)&0x3F]);
        banout_append_char(banout, PROTO_X509_CERT, '=');
        break;
    }

    banout_end(banout, PROTO_X509_CERT);

}

Have fun !!!

I guess that a different program design will be needed for your function "control_c_handler".

• The variables "control_c_pressed" and "control_c_pressed_again" should use the data type "sig_atomic_t".
• The functions "fprintf" and "fflush" do not belong to the list of async-signal-safe functions.

--state closed
--state open

(where --state would default to both open and closed)

Would help keep the output files smaller and would save me time performing post-scan sanitization/manipulation

Along with the current Redis scheme we need to add another optional scheme that treats Redis as a FIFO queue, so while the scan is running, results from one or more scanners can be sent to a redis system, while other systems extract information from the queue and do something with it.

On Windows (maybe Linux too), the rate limiting it not quite working. The actual rate is about 2 to 4 times higher than the specified rate. I've spent some time on this and I don't know why.

The reason this bug is complicated is because the rate-limiting/throttling is weird so that it doesn't interfere with the speed. Since this is designed to run at 10-million packets/second, the overhead PER PACKET needs to be as small as possible.

There is probably a better way to do the throttling.

So I can send and rx from separate locations

Please fix default TCP window size to avoid easy detection:

In templ-pkt.c

static unsigned char default_tcp_template[] =
"\0\1\2\3\4\5" /* Ethernet: destination /
"\6\7\x8\x9\xa\xb" / Ethernet: source /
"\x08\x00" / Ethernet type: IPv4 /
"\x45" / IP type /
"\x00"
"\x00\x28" / total length = 40 bytes /
"\x00\x00" / identification /
"\x00\x00" / fragmentation flags /
"\xFF\x06" / TTL=255, proto=TCP /
"\xFF\xFF" / checksum /
"\0\0\0\0" / source address /
"\0\0\0\0" / destination address /
"\0\0" / source port /
"\0\0" / destination port /
"\0\0\0\0" / sequence number /
"\0\0\0\0" / ack number /
"\x50" / header length /
"\x02" / SYN */

"\x04\x00"      /* SET window TO 1024 MODIFIED */

"\xFF\xFF"      /* checksum */
"\x00\x00"      /* urgent pointer */

"\x02\x04\x05\xb4"  /* options [mss 1460] MODIFIED */

;

I've tried also to add a minimal TCP option [mss 1460] but it seems that get lost in generated pkt...

Fixed lenght somewhere in code?

Bye

I'm seeing issues like the following during scanning on one of my boxes:

root@computer:~# masscan -p80 -oB /dev/null
/etc/masscan/excludes.txt: excluding 127 ranges from file

Starting masscan 1.0 (http://bit.ly/14GZzcT) at 2013-10-15 22:51:11 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 3700699389 hosts [1 port/host]
***** test me ******.00% done,510865596:27:21 remaining, 0-tcbs,     
***** test me ******.08% done,   1:58:14 remaining, 0-tcbs,     
***** test me ******.16% done,   1:44:16 remaining, 0-tcbs,     
^Cwaiting 10 seconds to exit...                                    

an open proxy test would be useful. Arguments woud be the port the suspected proxy is on and a URL to request to verify to proxy is open. HTTP response of 200, 301, 302 would be passing conditions.

Would it be possible to allow source port randomization as well?

I have looked at a few source files for your current software. I have noticed that some checks for return codes are missing.

Would you like to add more error handling for return values from functions like the following?

• malloc ⇒ dedup_create
• fflush ⇒ close_rotate

A scan for 21,22,23,25,U:53,80,110,143,U:161, 443,445,1741,3389,5060

I keep getting these errors:
tcb: double free: 0.0.0.0 : 0 (0x561cc64e)emaining, found=19770

Current you do: sometext

Nmap suggets:

Changing to match the nmap dtd means that existing mmap parsing tools can be used on mass cap output.

We exclude about 50 ranges when doing Internet-scale scans. This fragments the range tables. This slows sown IP address selection, which effectively does a linear search of all ranges when looking up an index. We need a faster algorithm that runs at per-packet speeds.

On Windows Server 2012, when scanning a single host, and a small number of ports, using sendq will not send any packets.

masscan --sendq -p1-10 10.10.10.10

Keys need to include the timestamp of the scan and/or the name of the scan, so that multiple scans can exist in the same database

Output of build on 13.10 with gcc (Ubuntu/Linaro 4.8.1-10ubuntu9) 4.8.1
make
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/crypto-base64.c -o tmp/crypto-base64.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/event-timeout.c -o tmp/event-timeout.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/in-binary.c -o tmp/in-binary.o
src/in-binary.c: In function ‘parse_file’:
src/in-binary.c:242:13: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 4 has type ‘uint64_t’ [-Wformat=]
fprintf(stderr, "%s: %8llu\r", filename, total_records);
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/logger.c -o tmp/logger.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main.c -o tmp/main.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-conf.c -o tmp/main-conf.o
src/main-conf.c: In function ‘masscan_echo’:
src/main-conf.c:184:5: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
fprintf(fp, "seed = %llu\n", masscan->seed);
^
src/main-conf.c: In function ‘masscan_save_state’:
src/main-conf.c:329:5: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
fprintf(fp, "resume-index = %llu\n", masscan->resume.index);
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-dedup.c -o tmp/main-dedup.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-initadapter.c -o tmp/main-initadapter.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-listscan.c -o tmp/main-listscan.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-ptrace.c -o tmp/main-ptrace.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-src.c -o tmp/main-src.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-status.c -o tmp/main-status.o
src/main-status.c: In function ‘status_print’:
src/main-status.c:140:25: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 7 has type ‘uint64_t’ [-Wformat=]
);
^
src/main-status.c:149:24: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 5 has type ‘uint64_t’ [-Wformat=]
);
^
src/main-status.c:149:24: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 6 has type ‘uint64_t’ [-Wformat=]
src/main-status.c:159:24: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 8 has type ‘uint64_t’ [-Wformat=]
);
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/main-throttle.c -o tmp/main-throttle.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/masscan-app.c -o tmp/masscan-app.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/out-binary.c -o tmp/out-binary.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/out-null.c -o tmp/out-null.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/output.c -o tmp/output.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/out-redis.c -o tmp/out-redis.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/out-text.c -o tmp/out-text.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/out-xml.c -o tmp/out-xml.o
src/out-xml.c: In function ‘xml_out_close’:
src/out-xml.c:58:13: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 6 has type ‘uint64_t’ [-Wformat=]
);
^
src/out-xml.c:58:13: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 7 has type ‘uint64_t’ [-Wformat=]
src/out-xml.c:58:13: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 8 has type ‘uint64_t’ [-Wformat=]
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/pixie-backtrace.c -o tmp/pixie-backtrace.o
src/pixie-backtrace.c: In function ‘pixie_backtrace_init’:
src/pixie-backtrace.c:70:13: warning: ignoring return value of ‘readlink’, declared with attribute warn_unused_result [-Wunused-result]
readlink("/proc/self/exe", global_self, sizeof(global_self));
^
src/pixie-backtrace.c: In function ‘handle_segfault’:
src/pixie-backtrace.c:43:19: warning: ignoring return value of ‘system’, declared with attribute warn_unused_result [-Wunused-result]
system(foo);
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/pixie-file.c -o tmp/pixie-file.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/pixie-threads.c -o tmp/pixie-threads.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/pixie-timer.c -o tmp/pixie-timer.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-arp.c -o tmp/proto-arp.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-banner1.c -o tmp/proto-banner1.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-banout.c -o tmp/proto-banout.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-dns.c -o tmp/proto-dns.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-http.c -o tmp/proto-http.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-icmp.c -o tmp/proto-icmp.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-netbios.c -o tmp/proto-netbios.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-preprocess.c -o tmp/proto-preprocess.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-snmp.c -o tmp/proto-snmp.o
src/proto-snmp.c: In function ‘snmp_banner_oid’:
src/proto-snmp.c:248:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 4 has type ‘uint64_t’ [-Wformat=]
sprintf_s(foo, sizeof(foo), ".%llu", x);
^
src/proto-snmp.c:248:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 4 has type ‘uint64_t’ [-Wformat=]
src/proto-snmp.c: In function ‘handle_snmp’:
src/proto-snmp.c:563:8: warning: ‘request_id’ may be used uninitialized in this function [-Wmaybe-uninitialized]
if ((seqno&0x7FFFffff) != request_id)
^
src/proto-snmp.c: In function ‘snmp_selftest’:
src/proto-snmp.c:643:8: warning: ‘request_id’ may be used uninitialized in this function [-Wmaybe-uninitialized]
if (request_id != 0x26)
^
src/proto-snmp.c:635:14: note: ‘request_id’ was declared here
unsigned request_id;
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-ssh.c -o tmp/proto-ssh.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-ssl.c -o tmp/proto-ssl.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-ssl-test.c -o tmp/proto-ssl-test.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-tcp.c -o tmp/proto-tcp.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-udp.c -o tmp/proto-udp.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-x509.c -o tmp/proto-x509.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/proto-zeroaccess.c -o tmp/proto-zeroaccess.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rand-blackrock.c -o tmp/rand-blackrock.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rand-lcg.c -o tmp/rand-lcg.o
src/rand-lcg.c: In function ‘lcg_calculate_constants’:
src/rand-lcg.c:320:13: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("%llu ", factors[i]);
^
src/rand-lcg.c:322:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("m = %-24llu (0x%llx)\n", m, m);
^
src/rand-lcg.c:322:9: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
src/rand-lcg.c:323:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("a = %-24llu (0x%llx)\n", a, a);
^
src/rand-lcg.c:323:9: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
src/rand-lcg.c:324:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("c = %-24llu (0x%llx)\n", c, c);
^
src/rand-lcg.c:324:9: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
src/rand-lcg.c:325:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("c%%m = %-24llu (0x%llx)\n", c%m, c%m);
^
src/rand-lcg.c:325:9: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
src/rand-lcg.c:326:9: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘uint64_t’ [-Wformat=]
printf("a%%m = %-24llu (0x%llx)\n", a%m, a%m);
^
src/rand-lcg.c:326:9: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
src/rand-lcg.c:349:17: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘uint64_t’ [-Wformat=]
count += printf("%*llu ", digits, x);
^
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rand-primegen.c -o tmp/rand-primegen.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/ranges.c -o tmp/ranges.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-arp.c -o tmp/rawsock-arp.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock.c -o tmp/rawsock.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-getif.c -o tmp/rawsock-getif.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-getip.c -o tmp/rawsock-getip.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-getmac.c -o tmp/rawsock-getmac.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-getroute.c -o tmp/rawsock-getroute.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-pcapfile.c -o tmp/rawsock-pcapfile.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rawsock-pfring.c -o tmp/rawsock-pfring.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/rte-ring.c -o tmp/rte-ring.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/siphash24.c -o tmp/siphash24.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/smack1.c -o tmp/smack1.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/smackqueue.c -o tmp/smackqueue.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/string_s.c -o tmp/string_s.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/syn-cookie.c -o tmp/syn-cookie.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/templ-payloads.c -o tmp/templ-payloads.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/templ-pkt.c -o tmp/templ-pkt.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -c src/xring.c -o tmp/xring.o
gcc -g -ggdb -fno-omit-frame-pointer -rdynamic -I. -Wall -O3 -Wno-format -o bin/masscan tmp/crypto-base64.o tmp/event-timeout.o tmp/in-binary.o tmp/logger.o tmp/main.o tmp/main-conf.o tmp/main-dedup.o tmp/main-initadapter.o tmp/main-listscan.o tmp/main-ptrace.o tmp/main-src.o tmp/main-status.o tmp/main-throttle.o tmp/masscan-app.o tmp/out-binary.o tmp/out-null.o tmp/output.o tmp/out-redis.o tmp/out-text.o tmp/out-xml.o tmp/pixie-backtrace.o tmp/pixie-file.o tmp/pixie-threads.o tmp/pixie-timer.o tmp/proto-arp.o tmp/proto-banner1.o tmp/proto-banout.o tmp/proto-dns.o tmp/proto-http.o tmp/proto-icmp.o tmp/proto-netbios.o tmp/proto-preprocess.o tmp/proto-snmp.o tmp/proto-ssh.o tmp/proto-ssl.o tmp/proto-ssl-test.o tmp/proto-tcp.o tmp/proto-udp.o tmp/proto-x509.o tmp/proto-zeroaccess.o tmp/rand-blackrock.o tmp/rand-lcg.o tmp/rand-primegen.o tmp/ranges.o tmp/rawsock-arp.o tmp/rawsock.o tmp/rawsock-getif.o tmp/rawsock-getip.o tmp/rawsock-getmac.o tmp/rawsock-getroute.o tmp/rawsock-pcapfile.o tmp/rawsock-pfring.o tmp/rte-ring.o tmp/siphash24.o tmp/smack1.o tmp/smackqueue.o tmp/string_s.o tmp/syn-cookie.o tmp/templ-payloads.o tmp/templ-pkt.o tmp/xring.o -lpcap -lm -lrt -ldl -lpthread

Can you add code to do file rotation based on size as well as time. I would like to be able to specify the size in megabytes or gigabytes based on the M or G flag following the size.

For example:
--rotate 100M

[35306058.762766] masscan[28216]: segfault at de23b0 ip b75e2b07 sp bf87a740 error 4 in libc-2.15.so[b757d000+1a4000]
[35306058.769081] masscan[28217]: segfault at 6993b0 ip b7556b07 sp bff8f600 error 4 in libc-2.15.so[b74f1000+1a4000]

Linux HOST 3.2.0-24-virtual #37-Ubuntu SMP Wed Apr 25 12:51:49 UTC 2012 i686 i686 i386 GNU/Linux

Not sure what else you'd need for troubleshooting.

This is a request for masscan to include support for the IKE protocol on UDP port 500.

It would be great to have Redis support as an output option. It would be very usefu to save the output into a Redis queue to incorporate post processing tools.

What do you think?

masscan --nmap shows the "-oJ and -oL" but no output results from using the flag

OUTPUT:
-oL/-oJ : Output scan in List or JSON format, respectively,
to the given filename.

spelling mistake "transnit" at line 77 of main.c

Built from latest commit:

$ /usr/local/bin/masscan -p80 224.0.0.0/8
FAIL: target IP address list empty
[hint] try something like "--range 10.0.0.0/8"
[hint] try something like "--range 192.168.0.100-192.168.0.200"

If you note the output below (not really pcaps, just named them wrong) some of the files are 2-400 bytes long and it looks like they had an error when rotating. For instance 140105-155959-snmp.pcap is 399 bytes long and rotated at 15:59. Then 140105-150000-snmp.pcap is 67M and also rotated at 15:59.

Then 140105-160000-snmp.pcap is is 68M and rotated at 16:59, then 140105-165959-snmp.pcap is 341 bytes are rotated at 16:59, then 140105-165960-snmp.pcap is 255 bytes are rotated at 17:00.

-rw-r--r-- 1 root root 25M Jan 5 14:59 140105-143527-snmp.pcap
-rw-r--r-- 1 root root 287 Jan 5 15:00 140105-145959-snmp.pcap
-rw-r--r-- 1 root root 399 Jan 5 15:59 140105-155959-snmp.pcap
-rw-r--r-- 1 root root 67M Jan 5 15:59 140105-150000-snmp.pcap
-rw-r--r-- 1 root root 279 Jan 5 16:00 140105-155960-snmp.pcap
-rw-r--r-- 1 root root 68M Jan 5 16:59 140105-160000-snmp.pcap
-rw-r--r-- 1 root root 341 Jan 5 16:59 140105-165959-snmp.pcap
-rw-r--r-- 1 root root 255 Jan 5 17:00 140105-165960-snmp.pcap
-rw-r--r-- 1 root root 66M Jan 5 18:00 140105-170000-snmp.pcap
-rw-r--r-- 1 root root 66M Jan 5 19:00 140105-180000-snmp.pcap
-rw-r--r-- 1 root root 67M Jan 5 20:00 140105-190000-snmp.pcap
-rw-r--r-- 1 root root 68M Jan 5 21:00 140105-200000-snmp.pcap
-rw-r--r-- 1 root root 62M Jan 5 22:00 140105-210000-snmp.pcap
-rw-r--r-- 1 root root 77M Jan 5 23:00 140105-220000-snmp.pcap
-rw-r--r-- 1 root root 68M Jan 6 00:00 140105-230000-snmp.pcap
-rw-r--r-- 1 root root 15M Jan 6 00:13 140106-000000-snmp.pcap

scan2text is gone, the new way to read binary files is masscan --readscan

Need to add NTP logic to check for the DDoS capable servers

https://github.com/robertdavidgraham/masscan/blob/master/src/rand-blackrock.c

FYI the error is that % rounds towards zero, and does not generate nonnegative equivalence classes.

If you rewrite using e.g. LongMath.mod() as per http://code.google.com/p/guava-libraries/wiki/MathExplained then the bidirectional verification code you have works.

If you don't, then you're basically doing many extra rounds sometimes because you generate a negative number which is masked because you compute with unsigned.

I have ported your code to Java, and it now passes the bidirectional verifier.

ASan found this

==10003== ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000465826 at pc 0x4093d9 bp 0x7fff8d1119f0 sp 0x7fff8d1119e8
READ of size 1 at 0x000000465826 thread T0
    #0 0x4093d8 (/masscan/bin/masscan+0x4093d8)
    #1 0x40d550 (/masscan/bin/masscan+0x40d550)
    #2 0x406511 (/masscan/bin/masscan+0x406511)
    #3 0x7f3843afad84 (/lib64/libc-2.17.so+0x21d84)
    #4 0x407e24 (/masscan/bin/masscan+0x407e24)
0x000000465826 is located 6 bytes to the right of global variable '*.LC16 (src/templ-payloads.c)' (0x465800) of size 32
0x000000465826 is located 26 bytes to the left of global variable '*.LC17 (src/templ-payloads.c)' (0x465840) of size 51
Shadow bytes around the buggy address:
  0x000080084ab0: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  0x000080084ac0: f9 f9 f9 f9 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9
  0x000080084ad0: 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9 00 00 00 05
  0x000080084ae0: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x000080084af0: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9
=>0x000080084b00: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 03 f9
  0x000080084b10: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080084b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080084b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 f9 f9
  0x000080084b40: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x000080084b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe

any idea for better payload memory management ?

0x4093d8 is in payload_add (src/templ-payloads.c:444).
439             exit(1); /* out of memory */
440 
441         p->port = rangelist_pick(ports, i);
442         p->source_port = source_port;
443         p->length = (unsigned)length;
444         memcpy(p->buf, buf, length);
445         p->xsum = partial_checksum(buf, length);
446         p->set_cookie = set_cookie;
447 
448         /* insert in sorted order */

0x40d550 is in payloads_create (src/templ-payloads.c:710).
705         if (length == 0xFFFFFFFF)
706             length = (unsigned)strlen(hard_coded_payloads[i].buf);
707         
708         /* Add this to our real payloads. This will get overwritten
709          * if the user adds their own with the same port */
710         payload_add(payloads,
711                     (const unsigned char*)hard_coded_payloads[i].buf,
712                     length,
713                     &list,
714                     hard_coded_payloads[i].source_port,

0x406511 is in main (src/main.c:1257).
1252        masscan->wait = 10; /* how long to wait for responses when done */
1253        masscan->max_rate = 100.0; /* max rate = hundred packets-per-second */
1254        masscan->nic_count = 1;
1255        masscan->shard.one = 1;
1256        masscan->shard.of = 1;
1257        masscan->payloads = payloads_create();
1258        strcpy_s(   masscan->rotate_directory,
1259                    sizeof(masscan->rotate_directory),
1260                    ".");
1261    

Target system 127.0.0.1 has ports 22 and 80 open.

./masscan -sS -p22,80 127.0.0.1

This only reports one of the open ports, where as

./masscan -sS --ports 22-80 127.0.0.1

reports both as open.