hailscan 2.7

Hailscan 2.6 is a small concurrent TCP connect scanner written by awgn (awgn@cosmos.it) and updated by Lamerone (info@lamerone.net). This release preserves that original work while refactoring the codebase and improving its event-driven scanner.

hailscan is a small concurrent TCP connect scanner for IPv4 systems with a POSIX socket API. It uses non-blocking connections and poll(2) and does not require raw-socket privileges.

The source is split into four modules: hailscan.c coordinates the command line, targets.c parses and resolves targets and ports, scan.c implements the event-driven scanner, and util.c contains shared numeric and clock helpers.

Only scan systems for which you have explicit authorization.

Build

./configure
make
make check

The executable is named hs. Install it with make install, optionally using DESTDIR and prefix in the usual way.

Usage

hs [options] [target | CIDR | -f file] [port | low-high ...]

Examples:

# A few ports on localhost
./hs 127.0.0.1 22 80 443 8000-8100

# All TCP ports, 512 concurrent sockets and a 750 ms timeout
./hs -c -n 512 -T 750 192.0.2.10

# An IPv4 subnet in CIDR notation
./hs 10.0.0.0/24 22 80 443

# Targets from a file; blank lines and # comments are accepted
./hs -f hosts.txt 22 80 443

Options:

• -f file: read targets from a file.
• -t sec: connection timeout in whole seconds (default: 3).
• -T msec: connection timeout in milliseconds.
• -w msec: optional pause between event-loop iterations.
• -n sockets: maximum concurrent sockets (default: 256).
• -u: suppress timeout messages.
• -d: print failed connections as well as open ports.
• -c: scan every TCP port if no ports are listed.
• -v address: bind connections to a local IPv4 address.
• -l port: bind connections to a local source port.

Without explicit ports or -c, ports listed by the operating system's service database are scanned. At completion, hailscan prints counts, elapsed time and the effective target rate.

Performance guidance

The best values depend on latency, packet loss, firewall behavior and the process file-descriptor limit. For a LAN, -n 512 -T 500 is a reasonable starting point. For remote networks, use a longer timeout and increase concurrency gradually. If the host is rate-limited, use -w deliberately.