Farsight

Spec sheet

Purpose

Farsight is a stateless SYN-based TCP scanner and banner grabber built on Linux AF_XDP.Read 9 Oct 2026 · github.com

License

The repository identifies its license as MIT.Read 9 Oct 2026 · github.com

Adaptive scanning

Its PMap-derived targeting strategy uses accumulated ClickHouse results to guide which ports and IPv4 prefixes to scan.Read 9 Oct 2026 · github.com

Adaptive targeting

Its PMap-derived targeting strategy learns from accumulated ClickHouse results to prioritize ports and IP prefixes.Read 8 Oct 2026 · github.com

Configuration

The scanner is configuration-driven and runs as a long-lived daemon that alternates full sweeps and rescans.Read 8 Oct 2026 · github.com

Data storage

Farsight writes scan results to ClickHouse, which it also uses as the source of historical data for its targeting strategy.Read 9 Oct 2026 · github.com

Database requirement

A reachable self-hosted or managed ClickHouse server is required to store results and seed targeting graphs.Read 8 Oct 2026 · github.com

Exclusions

Operators can exclude CIDR ranges, IP ranges, or individual addresses using exclude.conf.Read 9 Oct 2026 · github.com

Extensibility

Other protocols can be added through parser and payload traits.Read 8 Oct 2026 · github.com

Honeypot detection

It detects hosts returning identical banners repeatedly and abandons the remaining port budget for those hosts.Read 9 Oct 2026 · github.com

Opt-out

The maintainer says to request exclusion from mainstream Farsight scanning by emailing [email protected] or submitting a pull request to exclude.conf.Read 8 Oct 2026 · github.com

Opt-out contact

The README says to contact [email protected] or submit a pull request changing exclude.conf to request scanning-range opt-out.Read 9 Oct 2026 · github.com

Performance

The project reports saturating a 1 Gbps link in a test using an Intel I225-V with the igc driver.Read 9 Oct 2026 · github.com

Protocol support

Minecraft Server List Ping is the only implemented application protocol; the README describes traits for adding others.Read 9 Oct 2026 · github.com

Rate limiting

The configurable controller.max_rate sets a global packets-per-second ceiling.Read 9 Oct 2026 · github.com

Requirements

It requires Linux with AF_XDP support, a compatible XDP-capable NIC and driver, Rust nightly, bpf-linker, runtime capabilities, and a reachable ClickHouse server.Read 9 Oct 2026 · github.com

Results storage

Farsight writes scan results to ClickHouse, which also supplies history for its targeting strategy.Read 8 Oct 2026 · github.com

Safety controls

It supports address exclusion lists and a configurable per-address port budget, and its documentation advises honoring opt-outs and keeping scan rates reasonable.Read 8 Oct 2026 · github.com

Scanning

It can scan the entire IPv4 address space or a configured subset.Read 8 Oct 2026 · github.com

Scope limit

Farsight currently supports IPv4 only.Read 8 Oct 2026 · github.com

Scope limitation

The README lists IPv4 only and Minecraft SLP only as current limitations.Read 9 Oct 2026 · github.com

Where Specifiction places it

• Port Scanner Software#18 of 267.4