deade1e/radarThe hackable network scanner
Radar is a small but efficient network scanner written in Rust heavily inspired
by masscan.
These are the main features:
pnetAs masscan, it aims to be as fast as possible. On my 1Gbit network it achieves
circa 300k packets per second.
After downloading the binary from the release page do:
xz -d radar-x86_64-musl.xz
mv radar-x86_64-musl radar
chmod +x radar
You can easily obtain a nix shell via: nix shell github:deade1e/radar
First of all open a radar console:
$ sudo ./radar -i default console
sudo or the equivalent permission is required to use the raw sockets.
This opens the scanner in console mode, where you can issue various commands.
To see all of them, just type help. The console mode is based on
Hackshell.
Show the help with all commands and brief description:
radar> help
Show the internal ARP table:
radar> arp
Perform an ARP scan on all the interface's subnets:
radar> arpscan -a
View the scan command help:
radar> scan --help
Error: Scan the network
Usage: scan [OPTIONS] -p <PORTS> <SUBNET>
Arguments:
<SUBNET> The subnet to scan
Options:
-p <PORTS> The ports to scan
-u, --udp Use UDP instead of TCP
-a, --arp-mode Enables ARP mode for scanning only the local network. When this option is enabled the packets are sent directly to the target MAC address instead of the router MAC address. An ARP
scan will be performed before the actual port scan while using this option
-r, --max-rate <MAX_RATE> The maximum rate of packets to send per second. Default = 1000
-j, --json JSON output
--json-content Include response packet content in the JSON output
-b, --blacklist <BLACKLIST> Blacklist file of subnets not to be scanned or ever contacted in any way. Mandatory when a /0 (global IPv4) scan is performed
-m, --router-mac <ROUTER_MAC> Router MAC address. Used when the router cannot be detected automatically or for benchmarking purposes
-c, --content <CONTENT> The content of the packet to send. Must be a base64 encoded string. Only used in UDP mode
-h, --help Print help
Perform a basic scan of an internal subnet:
radar> scan -p 1-1000 192.168.1.0/24
This mode uses the default gateway to route packets, as masscan does.
By adding -a the ARP mode is enabled and therefore individual MAC addresses
get resolved before sending the ethernet frames.
If you want to go faster you must set the --max-rate parameter. Be cautious,
it might crash the router/network.
Perform a UDP scan with a preloaded content in search of DNS servers:
radar> scan -p 53 192.168.1.0/24 -u -c kOQBAAABAAAAAAABBmdvb2dsZQNjb20AAAEAAQAAKQSwAAAAAAAA
This base64 content is a DNS request for google.com.
Sometime UDP services are just a bit shy, help it by feeding them the correct payloads!
Monitor for DHCP requests on your interface:
radar> monitor -f dhcp-req
You can monitor for other events too! Check monitor --help to see all of them.
View the current ongoing tasks:
radar> task
Task Started at
---- ----------
monitor 2026-01-07 00:09:34
Terminate a task:
radar> task -t monitor
Script the console to execute a list of commands on start:
$ sudo ./radar -i default console -r script.txt
Want to save the output?
$ sudo ./radar -i default console -r script.txt > scan_output.log
Status messages are printed on stderr while command execution results are
printed on stdout.
One shot scan command:
$ sudo ./radar -i default scan --help
rustup default stable
rustup target add x86_64-unknown-linux-musl
rustup component add rustfmt rust-analyzer rust-src clippy
export CARGO_BUILD_TARGET="x86_64-unknown-linux-musl"
cargo build
nix build
nix develop
The project aims to be an extended and more pluggable/hackable version of
masscan. It both works in local networks and non RFC1918 ones, so yes, you can
theoretically scan the whole internet with it.
The usage of this program to scan the whole internet or not authorized hosts might get you fined and/or arrested. Triple check before doing anything.
You have been warned.