Network Scanning Tools Compared: Nmap, Zenmap, Angry IP Scanner, Hping3 and Masscan

Key takeaways

• Nmap is the tool to learn first. The other tools fill gaps around it.
• Zenmap and Angry IP Scanner lower the entry barrier. Neither goes as deep as the Nmap command line.
• Masscan trades depth for speed. Pair it with Nmap instead of choosing between them.
• Hping3 and Netcat are for studying one packet or one connection at a time, not for surveying a network.
• Every example here targets a lab you own. Scanning anything else needs written authorisation.

Before you scan: permission and a safe lab

Short answer: scan only machines you own or have written permission to test. In India, unauthorised access to a computer system can attract action under the IT Act, 2000 (sections 43 and 66 deal with this), and a scan is often the first thing an investigator sees in the logs. Ask a lawyer how the Act applies to your situation. See the Ministry of Electronics and IT for the Act, and CERT-In for incident reporting.

Build a small lab so that you can practise freely. A simple one is a host-only network in VirtualBox or VMware with two virtual machines: a Kali Linux VM (see the Kali Linux documentation) and an intentionally vulnerable target such as Metasploitable 2. A host-only network keeps the traffic off your home or college LAN. Every command below uses 192.168.56.0/24, the usual VirtualBox host-only range, with the target at 192.168.56.101. Change these to match your own lab.

Which network scanning tool should you use?

Short answer: pick by the job. Listing live hosts is a different job from reading service versions, and both differ from testing one firewall rule.

Check the current status of each tool on its own project page before you rely on it. Unicornscan in particular has seen little development for years.

Nmap: the scanner everything else is measured against

Short answer: Nmap sends probes, reads how each port responds, and sorts ports into open, closed or filtered. Add flags and it also reads service versions, guesses the operating system and runs scripts. The Nmap reference guide documents every option.

Start with host discovery, then scan ports on the hosts you find:

# Ping sweep only: which hosts are up? (no port scan)
nmap -sn 192.168.56.0/24

# TCP SYN scan of the 1000 most common ports (needs root)
sudo nmap -sS 192.168.56.101

# Add service version detection
sudo nmap -sS -sV 192.168.56.101

# Add OS detection (needs root)
sudo nmap -O 192.168.56.101

Illustrative output for the SYN scan (your ports and wording will differ):

Starting Nmap 7.xx ( https://nmap.org )
Nmap scan report for 192.168.56.101
Host is up (0.00040s latency).
Not shown: 977 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http

What a SYN scan actually does

Nmap sends a TCP SYN packet to a port. A SYN/ACK reply means something is listening, so the port is open. A RST reply means closed. No reply, or an ICMP unreachable message, usually means a firewall is filtering the port. Nmap then sends a RST and never completes the three-way handshake. That is why it is called a "stealth" scan. The name is old. Any modern firewall or IDS logs and flags a burst of SYNs to many ports, so do not treat it as invisible.

Flags worth learning first

• -sn finds live hosts without scanning ports.
• -sS is the SYN scan. -sT is the full connect scan, which works without root.
• -sV asks open ports what software and version they run.
• -O guesses the operating system from TCP/IP behaviour.
• -p- scans all 65535 ports instead of the default top 1000.
• -A turns on version detection, OS detection, default scripts and traceroute together. It is noisy, so use it deliberately.
• --script vuln runs vulnerability-related scripts from the Nmap Scripting Engine. Treat the findings as leads to verify, not proof.

Zenmap: Nmap with a window around it

Short answer: Zenmap is the official GUI for Nmap. It lets you choose a scan profile, runs the same nmap command underneath, and shows results in tabs, plus a topology view.

Its best feature for learners is that it prints the exact command line it is running. Pick the "Intense scan" profile, read the command it builds, and you learn the flags by watching. Its limits are that you cannot do everything from the profile list, and large scans are awkward to read in a window. Check the Zenmap page on nmap.org for its current status before you rely on it.

Angry IP Scanner: the fastest way to list live hosts

Short answer: Angry IP Scanner pings a range of addresses and shows which are alive, with hostname and response time. It is free, open source and runs on Windows, macOS and Linux. Details are on angryip.org.

Enter a start and end IP, press Start, and you get a list in seconds. You can add a few fetchers, such as open ports and hostname. It is a good fit when a network admin asks "what is plugged into this subnet right now?". It does not do version detection or scripting, so use Nmap when you need to know what is running on a host.

Hping3: one packet at a time

Short answer: Hping3 builds a TCP, UDP or ICMP packet with the flags and ports you choose and prints each reply. It is for understanding how a host or firewall reacts, not for surveying a network.

# Send 3 TCP SYN packets to port 80 of your lab target
sudo hping3 -S -p 80 -c 3 192.168.56.101

Illustrative output:

HPING 192.168.56.101 (eth1 192.168.56.101): S set, 40 headers + 0 data bytes
len=44 ip=192.168.56.101 ttl=64 DF id=0 sport=80 flags=SA seq=0 win=5840 rtt=0.6 ms

Read the reply: flags=SA is SYN/ACK, so the port is open. flags=RA would be RST/ACK, so closed. No reply points to a filtering device in between. A good lab exercise is to turn on a host firewall rule on the Metasploitable VM, send the same probe, and watch the answer change. For more, see our guide to the Hping3 tool.

Hping3 can also generate floods of packets. Run that only inside an isolated lab network, never on a shared or production network, because it can take services down.

Masscan: speed first, detail later

Short answer: Masscan uses its own asynchronous TCP/IP stack to send probes at very high rates, so it can sweep huge address ranges far faster than Nmap. Its source and documentation are on GitHub.

# Scan ports 1-1024 on the lab subnet, limited to 1000 packets/second
sudo masscan 192.168.56.0/24 -p1-1024 --rate 1000

Illustrative output:

Discovered open port 22/tcp on 192.168.56.101
Discovered open port 80/tcp on 192.168.56.101

Always set --rate deliberately. Masscan's default is modest, but a high rate can overwhelm a small network, a home router or a fragile device. It also has basic banner grabbing, so the claim that it only reports open ports is not quite right, but it does not match Nmap's detection depth.

The usual workflow is two steps. Let Masscan find open ports quickly, then hand just those hosts and ports to Nmap:

sudo nmap -sV -p 22,80 192.168.56.101

Netcat and Unicornscan: the supporting cast

Netcat is not a scanner. It opens a connection and lets you talk to a port by hand, which makes it handy for reading a service banner:

nc -v 192.168.56.101 21

If the FTP service is listening, you typically see its greeting line. The exact wording of the -v output depends on which Netcat variant you have (OpenBSD, traditional or Ncat).

Unicornscan is an older asynchronous scanner. You can still read about it, but with Masscan and Nmap available and Unicornscan development quiet for years, most students can skip it.

Strengths and limits at a glance

Which tool for which job?

Common mistakes

• Scanning without a scope. A written scope lists IP ranges, dates and what is off limits. Without it you have no protection.
• Running -A on everything. It sends a lot of traffic and fills logs. Start small and add detail where you need it.
• Trusting "closed" as a security result. A filtered port may still be reachable from another source address.
• Treating script output as confirmed vulnerabilities. Verify each finding in your lab before you report it.
• Leaving Masscan at a high rate on a small network.

How defenders spot scans

Understanding the defender's view makes you better at both roles. Scans leave patterns: one source sending SYNs to many ports, one source touching many hosts in sequence, bursts of ICMP echo requests, and many connections that never complete. Firewall logs and an IDS can alert on these patterns. Rate limiting, closing unused ports and keeping a current inventory of what should be listening all reduce what a scan can find. For the concepts behind this, read what network scanning is and how it works and host discovery techniques.

Frequently asked questions

What is the best network scanning tool?

Nmap is the best all-round choice because it handles host discovery, port scanning, service detection, OS fingerprinting and scripting in one tool. Others are better at single jobs: Angry IP Scanner for quick host lists, Masscan for speed, Hping3 for crafted packets.

Is Zenmap the same as Nmap?

Zenmap is the official graphical front end for Nmap. It runs Nmap underneath and shows the results in tabs and a topology view. Anything Zenmap does, you can do with the nmap command. Check nmap.org for its current release status.

Which is better for beginners, Nmap or Angry IP Scanner?

Angry IP Scanner is easier on day one because you type an IP range and press Start. Nmap takes a few hours to learn, but it teaches you how scanning actually works and goes far deeper. Most students should learn both.

What is the difference between Masscan and Nmap?

Masscan sends packets with its own TCP/IP stack and can scan huge ranges very quickly, but it mainly reports open ports. Nmap is slower but identifies service versions, runs scripts and guesses operating systems. A common workflow is Masscan first, then Nmap on the results.

How is Hping3 different from Nmap?

Hping3 builds and sends individual packets with flags, ports and options that you choose, then shows the replies. Nmap automates scans across many hosts and ports. Use Hping3 to study one firewall rule or one TCP behaviour, and Nmap to survey a network.

Is it legal to scan a network in India?

Only with permission. Scanning your own lab or a network where you hold written authorisation is fine. Scanning systems you do not own can fall under unauthorised access provisions of the IT Act, 2000. Always get the scope and dates in writing first.

What does the Nmap -sS flag do?

It runs a TCP SYN scan. Nmap sends a SYN packet and reads the reply: SYN/ACK means open, RST means closed, no reply or an ICMP error suggests filtered. It never completes the handshake. It needs root or administrator rights.

Can Masscan replace Nmap?

No. Masscan is built for speed across large ranges, and it does have basic banner grabbing, but Nmap's service detection, OS detection and scripting engine are far deeper. Use Masscan to find where to look and Nmap to find out what is there.

Next steps

Set up the two-VM lab, run each command above against Metasploitable, and write down what changes when you add a flag. If you want guided practice with a trainer, look at WebAsha's Certified Ethical Hacking CEH v13 AI course.

Related reading

• Host Discovery Techniques in Zenmap | Complete Ethical Hacking Guide 2026
• Top Host Discovery Techniques in Ethical Hacking | ICMP, ARP, TCP Scans Explained