v-byte-cpu/sx🖖 Fast, modern, easy-to-use network scanner
sx is the command-line network scanner designed to follow the UNIX philosophy.
The goal of this project is to create the fastest network scanner with clean and simple code.
The simplest way is to download from GitHub Releases and place the executable file in your PATH.
Requirements:
On macOS, install the Xcode Command Line Tools first so CGO can link against the system libpcap:
xcode-select --install
From the root of the source tree, run:
go build
Here's a quick examples showing how you can scan networks with sx.
Scan your local network and display the IP address, MAC address and associated hardware vendor of connected devices:
sx arp 192.168.0.1/24
sample output:
192.168.0.1 b0:be:76:40:05:8d TP-LINK TECHNOLOGIES CO.,LTD.
192.168.0.111 80:c5:f2:0b:02:e3 AzureWave Technology Inc.
192.168.0.171 88:53:95:2d:3c:af Apple, Inc.
with JSON output:
sx arp --json 192.168.0.1/24
sample output:
{"ip":"192.168.0.1","mac":"b0:be:76:40:05:8d","vendor":"TP-LINK TECHNOLOGIES CO.,LTD."}
{"ip":"192.168.0.111","mac":"80:c5:f2:0b:02:e3","vendor":"AzureWave Technology Inc."}
{"ip":"192.168.0.171","mac":"88:53:95:2d:3c:af","vendor":"Apple, Inc."}
wait 5 seconds before exiting to receive delayed reply packets, by default sx waits 300 milliseconds:
sx arp --exit-delay 5s 192.168.0.1/24
Live scan mode that rescans network every 10 seconds:
sx arp 192.168.0.1/24 --live 10s
Unlike nmap and other scanners that implicitly perform ARP requests to resolve IP addresses to MAC addresses before the actual scan, sx explicitly uses the ARP cache concept. ARP cache file is a simple text file containing JSON string on each line (JSONL file), which has the same JSON fields as the ARP scan JSON output described above. Scans of higher-level protocols like TCP and UDP read the ARP cache file from the stdin and then start the actual scan.
This not only simplifies the design of the program, but also speeds up the scanning process, since it is not necessary to perform an ARP scan every time.
Let's assume that the actual ARP cache is in the arp.cache file. We can create it manually
or use ARP scan as shown below:
sx arp 192.168.0.1/24 --json | tee arp.cache
Once we have the ARP cache file, we can run scans of higher-level protocols like TCP SYN scan:
cat arp.cache | sx tcp -p 1-65535 192.168.0.171
sample output:
192.168.0.171 22
192.168.0.171 443
In this case we find out that ports 22 and 443 are open.
If you see send: No buffer space available during large scans, it usually means the sender is outrunning the kernel/raw-socket buffers.
The first fix is to add --rate and lower the send burst, for example -r 100000/s or lower if needed.
On some systems, tuning OS socket/buffer limits can also help, but rate limiting is the primary fix.
scan with JSON output:
cat arp.cache | sx tcp --json -p 1-65535 192.168.0.171
sample output:
{"scan":"tcpsyn","ip":"192.168.0.171","port":22}
{"scan":"tcpsyn","ip":"192.168.0.171","port":443}
scan multiple port ranges:
cat arp.cache | sx tcp -p 1-23,25-443 192.168.0.171
or individual ports:
cat arp.cache | sx tcp -p 22,443 192.168.0.171
or use the --ports-file option to specify a file with ports or port ranges to scan, one per line.
scan ip/port pairs from a file with JSON output:
cat arp.cache | sx tcp --json -f ip_ports_file.jsonl
Each line of the input file is a json string, which must contain the ip and port fields.
sample input file:
{"ip":"10.0.1.1","port":1080}
{"ip":"10.0.2.2","port":1081}
It is possible to specify the ARP cache file using the -a or --arp-cache options:
sx tcp -a arp.cache -p 22,443 192.168.0.171
or stdin redirect:
sx tcp -p 22,443 192.168.0.171 < arp.cache
You can also use the tcp syn subcommand instead of the tcp:
cat arp.cache | sx tcp syn -p 22 192.168.0.171
tcp subcomand is just a shorthand for tcp syn subcommand unless --flags option is passed, see below.
sx supports scanning with virtual network interfaces (wireguard, openvpn, etc.) and in this case it is not necessary to use the arp cache, since these interfaces require raw IP packets instead of Ethernet frames as input. For instance, scanning an IP address on a vpn network:
sx tcp 10.1.27.1 -p 80 --json
Most network scanners try to interpret results of the scan. For instance they say "this port is closed" instead of "I received a RST". Sometimes they are right. Sometimes not. It's easier for beginners, but when you know what you're doing, you keep on trying to deduce what really happened from the program's interpretation, especially for more advanced scan techniques.
sx tries to overcome those problems. It returns information about all reply packets for TCP FIN, NULL, Xmas and custom TCP scans. The information contains IP address, TCP port and all TCP flags set in the reply packet.
TCP FIN scan and its other variations (NULL and Xmas) exploit RFC793 Section 3.9: