Masscan vs Sherlock Forensics Port Scanner
Masscan
github.comSherlock Forensics Port Scanner
sherlockforensics.comSide by side
| Figure | Masscan | Sherlock Forensics Port Scanner |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 2 | 1 |
| Spec score · Port Scanner Software | 8.7 (#2) | 7.4 (#19) |
| Intended users | The README describes Masscan as tuned for scanning many machines across wide ranges, while Nmap is described as designed for intensive scanning of a single machine or small range. | The maker describes it as a lightweight GUI scanner for penetration testers, compliance auditors, and system administrators. |
| Maker | The repository credits Robert David Graham as the creator and gives his contact email and @ErrataRob account. | The maker identifies itself as Sherlock Forensics and describes itself as a Vancouver cybersecurity firm with more than 20 years of experience. |
| Purpose | Masscan is an Internet-scale TCP port scanner designed for wide-range scanning of many machines. | Sherlock Forensics Port Scanner scans TCP ports, identifies open ports, grabs service banners, and maps target hosts’ attack surfaces. |
Plans
In their own words
Masscan
Masscan is a free command-line TCP port scanner for scanning many machines across wide address ranges. The project says one machine can transmit 10 million packets per second. It supports asynchronous transmission, arbitrary port and address ranges, and scanning IPv4 and IPv6 together without a separate IPv6 mode. Banner checks cover protocols and services including FTP, HTTP, IMAP4, memcached, POP3, SMTP, SSH, SSL, SMBv1, SMBv2, Telnet, RDP and VNC. Results can be saved as XML, binary, grepable, JSON or list output. Its usage and output are intended to be familiar to Nmap users, with some Nmap-compatible options. Masscan runs on Linux, macOS and Windows and is available for self-hosting. The project describes PF_RING DNA support for high-speed transmission and says it can use PF_RING ZC when the adapter name indicates it. It is free software under the GNU Affero General Public License version 3, whose notice states there is no warranty. Users must specify ports and target IP addresses or simple ranges; DNS names are not accepted. The README warns that its custom TCP/IP stack can conflict with the local stack and describes using a separate source IP or firewalling its source port.
Sherlock Forensics Port Scanner
Sherlock Forensics Port Scanner is a free desktop GUI tool for identifying exposed TCP ports and the services behind them. It scans the top 1,000 TCP ports by default, accepts custom port and CIDR ranges, and can scan all 65,535 TCP ports. For open ports, it retrieves service banners to identify software and version strings. Scans use TCP connect with the full three-way handshake; SYN scans are not supported. Results export to CSV with timestamps, target host, port, protocol, state and service identification. Each export includes an Ed25519-signed sidecar with the CSV’s SHA-256, signature, per-installation public key and UTC timestamp. The scanner identifies ports and services but does not check results against CVE databases or attempt exploitation. It runs on Windows and Linux. Version 0.1.7 supports 64-bit Windows 10/11 as a single executable without installation dependencies or elevated privileges; the native Linux x64 binary requires libgtk-3, libfontconfig1 and libxkbcommon. The free plan has no trial period, feature restrictions or expiry.