Masscan vs Unicornscan

Masscan is a free command-line TCP port scanner for scanning many machines across wide address ranges. The project says one machine can transmit 10 million packets per second. It supports asynchronous transmission, arbitrary port and address ranges, and scanning IPv4 and IPv6 together without a separate IPv6 mode. Banner checks cover protocols and services including FTP, HTTP, IMAP4, memcached, POP3, SMTP, SSH, SSL, SMBv1, SMBv2, Telnet, RDP and VNC. Results can be saved as XML, binary, grepable, JSON or list output. Its usage and output are intended to be familiar to Nmap users, with some Nmap-compatible options. Masscan runs on Linux, macOS and Windows and is available for self-hosting. The project describes PF_RING DNA support for high-speed transmission and says it can use PF_RING ZC when the adapter name indicates it. It is free software under the GNU Affero General Public License version 3, whose notice states there is no warranty. Users must specify ports and target IP addresses or simple ranges; DNS names are not accepted. The README warns that its custom TCP/IP stack can conflict with the local stack and describes using a separate source IP or firewalling its source port.

Unicornscan is a free network reconnaissance tool that sends asynchronous, stateless probes and records responses. Its documented scan modes include TCP SYN scans, UDP probes with protocol-specific payloads, local-network ARP discovery, and stateless TCP traceroute. Alicorn provides a web interface for reviewing results, with scan history, host and port statistics, OS fingerprinting, and network topology visualization. The pgsqldb module can export results to PostgreSQL, which Alicorn uses for storage; Alicorn also starts a PostgREST API with its web server. Optional free DB-IP Lite databases add country, city, and ASN lookups to scan output and the interface. Packages are listed for Debian, Ubuntu, Fedora, RHEL-compatible distributions, and macOS through Homebrew or DMG. Linux capabilities are set automatically so scans can run without root privileges. The Alicorn interface requires Docker and PostgreSQL. Compound scan modes that begin with ARP are limited to targets on the local broadcast domain because ARP requests cannot cross routers. The install guide directs users to the project website and GitHub Issues for support.