docs(address): say that parse_addresses must not run inside async code

hickory's synchronous resolver runs its own tokio runtime, and tokio panics
when a runtime is dropped inside an asynchronous context. That was already
true before, but library users now have to run the scanner on tokio, so
they are more likely to call `parse_addresses` from async code. Document
the two safe ways: call it before starting the runtime (as the binary does)
or through `spawn_blocking`.

.SRCINFO

@@ -2,7 +2,7 @@ pkgbase = rustscan-bin
 	pkgdesc = Faster Nmap Scanning with Rust
 	pkgver = 1.1.0
 	pkgrel = 1
-	url = https://github.com/brandonskerritt/rustscan
+	url = https://github.com/rustscan/rustscan
 	arch = x86_64
 	license = MIT
 	depends = rustup

.all-contributorsrc

@@ -36,11 +36,234 @@
         "ideas",
         "example"
       ]
+    },
+    {
+      "login": "bernardoamc",
+      "name": "Bernardo Araujo",
+      "avatar_url": "https://avatars0.githubusercontent.com/u/428984?v=4",
+      "profile": "http://bernardoamc.github.io/",
+      "contributions": [
+        "code",
+        "bug",
+        "design"
+      ]
+    },
+    {
+      "login": "Isona",
+      "name": "Izzy Whistlecroft",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/11759523?v=4",
+      "profile": "https://github.com/Isona",
+      "contributions": [
+        "bug"
+      ]
+    },
+    {
+      "login": "imlonghao",
+      "name": "imlonghao",
+      "avatar_url": "https://avatars1.githubusercontent.com/u/4951333?v=4",
+      "profile": "https://imlonghao.com",
+      "contributions": [
+        "bug",
+        "maintenance"
+      ]
+    },
+    {
+      "login": "royharoush",
+      "name": "royharoush",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/8113056?v=4",
+      "profile": "https://github.com/royharoush",
+      "contributions": [
+        "ideas",
+        "design"
+      ]
+    },
+    {
+      "login": "Atul9",
+      "name": "Atul Bhosale",
+      "avatar_url": "https://avatars1.githubusercontent.com/u/3390330?v=4",
+      "profile": "https://github.com/Atul9",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "TGotwig",
+      "name": "Thomas Gotwig",
+      "avatar_url": "https://avatars0.githubusercontent.com/u/30773779?v=4",
+      "profile": "https://tgotwig.me",
+      "contributions": [
+        "platform"
+      ]
+    },
+    {
+      "login": "remigourdon",
+      "name": "Rémi Gourdon",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/2874133?v=4",
+      "profile": "https://github.com/remigourdon",
+      "contributions": [
+        "doc",
+        "code"
+      ]
+    },
+    {
+      "login": "cmnatic",
+      "name": "Ben (CMNatic)",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/4163116?v=4",
+      "profile": "https://cmnatic.co.uk",
+      "contributions": [
+        "code",
+        "doc",
+        "design"
+      ]
+    },
+    {
+      "login": "Ferryistaken",
+      "name": "Alessandro Ferrari",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/47927670?v=4",
+      "profile": "https://github.com/Ferryistaken",
+      "contributions": [
+        "content"
+      ]
+    },
+    {
+      "login": "Phenomite",
+      "name": "Phenomite",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/8285537?v=4",
+      "profile": "https://github.com/Phenomite",
+      "contributions": [
+        "content"
+      ]
+    },
+    {
+      "login": "SuperSandro2000",
+      "name": "Sandro",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/7258858?v=4",
+      "profile": "https://supersandro.de/",
+      "contributions": [
+        "content",
+        "bug",
+        "code"
+      ]
+    },
+    {
+      "login": "caass",
+      "name": "Cass",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/25358963?v=4",
+      "profile": "https://swag.lgbt",
+      "contributions": [
+        "platform",
+        "code",
+        "bug"
+      ]
+    },
+    {
+      "login": "niklasmohrin",
+      "name": "Niklas Mohrin",
+      "avatar_url": "https://avatars0.githubusercontent.com/u/47574893?v=4",
+      "profile": "https://github.com/niklasmohrin",
+      "contributions": [
+        "doc",
+        "code",
+        "bug"
+      ]
+    },
+    {
+      "login": "tim77",
+      "name": "Artem Polishchuk",
+      "avatar_url": "https://avatars0.githubusercontent.com/u/5614476?v=4",
+      "profile": "https://liberapay.com/Artem4/",
+      "contributions": [
+        "platform"
+      ]
+    },
+    {
+      "login": "buermarc",
+      "name": "buermarc",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/44375277?v=4",
+      "profile": "https://github.com/buermarc",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "bergabman",
+      "name": "bergabman",
+      "avatar_url": "https://avatars1.githubusercontent.com/u/44554109?v=4",
+      "profile": "https://github.com/bergabman",
+      "contributions": [
+        "code",
+        "bug",
+        "design"
+      ]
+    },
+    {
+      "login": "dmitris",
+      "name": "Dmitry Savintsev",
+      "avatar_url": "https://avatars0.githubusercontent.com/u/31205?v=4",
+      "profile": "https://github.com/dmitris",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "bofh69",
+      "name": "Sebastian Andersson",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/1444315?v=4",
+      "profile": "https://github.com/bofh69",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "mattcorbin",
+      "name": "Matt Corbin",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/6537765?v=4",
+      "profile": "https://github.com/mattcorbin",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "rootsploit",
+      "name": "RootSploit",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/67270834?v=4",
+      "profile": "http://rootsploit.com",
+      "contributions": [
+        "blog"
+      ]
+    },
+    {
+      "login": "eiffel-fl",
+      "name": "eiffel-fl",
+      "avatar_url": "https://avatars2.githubusercontent.com/u/12171754?v=4",
+      "profile": "https://github.com/eiffel-fl",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "u5surf",
+      "name": "Y.Horie",
+      "avatar_url": "https://avatars1.githubusercontent.com/u/14180225?v=4",
+      "profile": "https://github.com/u5surf",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "okrplay",
+      "name": "Oskar",
+      "avatar_url": "https://avatars3.githubusercontent.com/u/32576280?v=4",
+      "profile": "https://github.com/okrplay",
+      "contributions": [
+        "code",
+        "test"
+      ]
     }
   ],
   "contributorsPerLine": 7,
   "projectName": "RustScan",
-  "projectOwner": "brandonskerritt",
+  "projectOwner": "RustScan",
   "repoType": "github",
   "repoHost": "https://github.com",
   "skipCi": true

.dockerignore

@@ -0,0 +1,2 @@
+.git
+Dockerfile

.github/FUNDING.yml

@@ -1,4 +1 @@
-github: brandonskerritt
-patreon: brandonskerritt
-ko_fi: hacker
-custom: ["https://monzo.me/bee", "https://paypal.me/brandonskerritt"]
+github: bee-san

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+IMPORTANT: If you do not fill this out, your issue will be automatically closed.
+
+As of November 2024, RustScan no longer offiically supports any packages other than `cargo`. If you have an issue with Docker or a `.deb`, please bring it up with whoever created it :)
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/config.yml

@@ -1,2 +1,2 @@
 todo:
-  keyword: "TODO"
+  keyword: "// TODO"

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "daily"
+- package-ecosystem: "docker"
+  directory: "/"
+  schedule:
+    interval: "daily"
+- package-ecosystem: cargo
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10
+  ignore:
+  - dependency-name: anyhow
+    versions:
+    - 1.0.38
+    - 1.0.39
+  - dependency-name: serde
+    versions:
+    - 1.0.123
+  - dependency-name: futures
+    versions:
+    - 0.3.12
+  - dependency-name: rlimit
+    versions:
+    - 0.5.3

.github/release-drafter.yml

@@ -0,0 +1,4 @@
+template: |
+  ## What’s Changed
+
+  $CHANGES

.github/scan-benchmark/scan_bench.py

@@ -0,0 +1,919 @@
+#!/usr/bin/env python3
+"""Compare RustScan builds by scanning listeners on the loopback interface.
+
+CI-only tooling for ``.github/workflows/scan-benchmark.yml``; it is not part
+of the test suite. It port-scans 127.0.0.1, so only run it on a disposable CI
+runner, never on a developer machine or a shared host.
+
+``run`` starts ``serve`` (TCP listeners and UDP responders on 127.0.0.1) in a
+separate process, runs every scenario with every build (interleaving the
+builds so that drift on the runner affects them all alike), checks that all
+builds report the same open ports, and writes the raw measurements as JSON
+plus a Markdown summary of the medians. On Linux the workflow also sets up a
+host behind an artificial delay (a network namespace on the runner, with its
+own ``serve``), so that answers arrive after a round trip, as they do from a
+remote host, instead of while the probe is being sent.
+
+Measured per run:
+
+* scan time: RustScan's own "Portscan" timer (``RUST_LOG=rustscan=info``),
+  reported as throughput (sockets per second);
+* wall time of the whole process, and the time until the first ``Open`` line
+  appears on stdout (latency to the first result);
+* peak RSS and CPU time (user + system) of the process;
+* peak number of open file descriptors (Windows: handles) and of threads,
+  sampled every few milliseconds while the scan runs.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import platform
+import re
+import selectors
+import signal
+import socket
+import statistics
+import subprocess
+import sys
+import threading
+import time
+from dataclasses import asdict, dataclass, field
+
+LOOPBACK = "127.0.0.1"
+
+# Ports `serve` listens on. They stay below 32768, i.e. below the ephemeral
+# port ranges of Linux (32768-60999), macOS and Windows (49152-65535): a scan
+# of a port inside the ephemeral range can occasionally connect a socket to
+# itself and report a bogus open port.
+TCP_PORTS = tuple(range(1024, 32768, 101))  # 315 open TCP ports
+UDP_PORTS = tuple(range(1031, 32768, 997))  # 32 open UDP ports
+SWEEP = (1, 32767)
+
+SAMPLE_INTERVAL = 0.005  # seconds between fd/thread samples
+RUN_TIMEOUT = 300  # seconds before a run is killed and counted as failed
+
+
+# --------------------------------------------------------------------------
+# Listener process
+# --------------------------------------------------------------------------
+
+
+def serve(addresses: list[str]) -> int:
+    """Accepts (and closes) TCP connections and answers every UDP datagram."""
+    selector = selectors.DefaultSelector()
+    bound: dict[str, dict[str, list[int]]] = {"tcp": {}, "udp": {}, "busy": {}}
+
+    for address in addresses:
+        for kind, ports in (("tcp", TCP_PORTS), ("udp", UDP_PORTS)):
+            sock_type = socket.SOCK_STREAM if kind == "tcp" else socket.SOCK_DGRAM
+            for port in ports:
+                sock = socket.socket(socket.AF_INET, sock_type)
+                if os.name != "nt":
+                    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                try:
+                    sock.bind((address, port))
+                except OSError:
+                    sock.close()
+                    bound["busy"].setdefault(f"{kind} {address}", []).append(port)
+                    continue
+                if kind == "tcp":
+                    sock.listen(1024)
+                sock.setblocking(False)
+                selector.register(sock, selectors.EVENT_READ, kind)
+                bound[kind].setdefault(address, []).append(port)
+
+    print(json.dumps(bound), flush=True)
+
+    while True:
+        for key, _ in selector.select(timeout=1.0):
+            sock = key.fileobj
+            if key.data == "tcp":
+                while True:
+                    try:
+                        conn, _ = sock.accept()
+                    except OSError:  # BlockingIOError once the queue is empty
+                        break
+                    conn.close()
+            else:
+                while True:
+                    try:
+                        _, peer = sock.recvfrom(4096)
+                    except ConnectionResetError:
+                        # Windows reports an earlier ICMP error here; skip it.
+                        continue
+                    except OSError:  # BlockingIOError once the queue is empty
+                        break
+                    try:
+                        sock.sendto(b"rustscan-benchmark\n", peer)
+                    except OSError:
+                        pass
+
+
+def start_server(addresses: list[str]) -> tuple[subprocess.Popen, dict]:
+    args = [arg for address in addresses for arg in ("--address", address)]
+    proc = subprocess.Popen(
+        [sys.executable, os.path.abspath(__file__), "serve", *args],
+        stdout=subprocess.PIPE,
+        stdin=subprocess.DEVNULL,
+        text=True,
+    )
+    line = proc.stdout.readline()
+    if not line:
+        raise SystemExit("the listener process exited before it was ready")
+    return proc, json.loads(line)
+
+
+# --------------------------------------------------------------------------
+# Scenarios
+# --------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class Scenario:
+    name: str
+    title: str
+    addresses: tuple[str, ...]
+    ranges: tuple[tuple[int, int], ...] = ()
+    ports: tuple[int, ...] = ()
+    batch: int = 4500
+    timeout_ms: int = 1500
+    udp: bool = False
+    repeat: int = 1  # extra samples for very short scenarios
+
+    @property
+    def sockets(self) -> int:
+        span = sum(end - start + 1 for start, end in self.ranges)
+        return len(self.addresses) * (len(self.ports) + span)
+
+    def covers(self, port: int) -> bool:
+        return port in self.ports or any(s <= port <= e for s, e in self.ranges)
+
+    def args(self) -> list[str]:
+        args = ["-a", ",".join(self.addresses)]
+        if self.ports:
+            args += ["-p", ",".join(map(str, self.ports))]
+        else:
+            args += ["-r", ",".join(f"{s}-{e}" for s, e in self.ranges)]
+        args += ["-b", str(self.batch), "-t", str(self.timeout_ms)]
+        if self.udp:
+            args.append("--udp")
+        return args
+
+    def expected(self, listeners: dict) -> set[str]:
+        by_address = listeners["udp" if self.udp else "tcp"]
+        return {
+            f"{address}:{port}"
+            for address in self.addresses
+            for port in by_address.get(address, [])
+            if self.covers(port)
+        }
+
+    def describe(self) -> str:
+        hosts = f"{len(self.addresses)} addresses" if len(self.addresses) > 1 else self.addresses[0]
+        return f"{self.title}: `{' '.join(self.args()[2:])}` on {hosts}"
+
+
+def build_scenarios(
+    system: str, filtered: tuple[int, int] | None, delayed: str | None, delay_ms: int
+) -> list[Scenario]:
+    lo = (LOOPBACK,)
+    if system == "Windows":
+        # Windows retries a refused connection for about a second, so every
+        # closed port there takes as long as a filtered one: sweep fewer.
+        sweep, small_sweep = ((1, 8191),), ((1, 2047),)
+    else:
+        sweep = small_sweep = (SWEEP,)
+
+    def ports(ranges: tuple[tuple[int, int], ...]) -> str:
+        return f"{sum(e - s + 1 for s, e in ranges):,} ports"
+
+    scenarios = [
+        Scenario("tcp-1-port", "TCP, 1 open port", lo, ports=(TCP_PORTS[0],), repeat=3),
+        Scenario("tcp-sweep", f"TCP, {ports(sweep)}, default batch", lo, sweep),
+        Scenario(
+            "tcp-sweep-b500", f"TCP, {ports(small_sweep)}, small batch", lo, small_sweep, batch=500
+        ),
+        Scenario("tcp-sweep-b10000", f"TCP, {ports(sweep)}, large batch", lo, sweep, batch=10000),
+    ]
+    if system == "Linux":
+        # Linux answers on all of 127.0.0.0/8; other systems only on 127.0.0.1.
+        hosts = tuple(f"127.0.0.{i}" for i in range(1, 9))
+        scenarios.append(
+            Scenario("tcp-8-hosts", "TCP, 8 hosts x 4,096 ports", hosts, ((1, 4096),))
+        )
+    if delayed:
+        scenarios.append(
+            Scenario("tcp-delayed", f"TCP, {ports(sweep)}, {delay_ms} ms away", (delayed,), sweep)
+        )
+    if filtered:
+        dropped = (filtered,)
+        scenarios += [
+            Scenario(
+                "tcp-filtered", "TCP, 2,000 filtered ports", lo, dropped, batch=500, timeout_ms=250
+            ),
+            Scenario(
+                "tcp-mixed",
+                f"TCP, {ports(sweep)} + 2,000 filtered ports",
+                lo,
+                sweep + dropped,
+                timeout_ms=500,
+            ),
+        ]
+    scenarios.append(
+        Scenario("udp-sweep", f"UDP, {ports(sweep)}", lo, sweep, timeout_ms=500, udp=True)
+    )
+    if delayed:
+        scenarios.append(
+            Scenario(
+                "udp-delayed",
+                f"UDP, {ports(sweep)}, {delay_ms} ms away",
+                (delayed,),
+                sweep,
+                timeout_ms=500,
+                udp=True,
+            )
+        )
+    if filtered:
+        scenarios.append(
+            Scenario(
+                "udp-filtered",
+                "UDP, 2,000 filtered ports",
+                lo,
+                (filtered,),
+                batch=500,
+                timeout_ms=250,
+                udp=True,
+            )
+        )
+    return scenarios
+
+
+# --------------------------------------------------------------------------
+# Running one scan
+# --------------------------------------------------------------------------
+
+
+@dataclass
+class RunResult:
+    build: str
+    scenario: str
+    sockets: int = 0
+    ok: bool = True
+    error: str = ""
+    returncode: int | None = None
+    wall_s: float | None = None
+    scan_s: float | None = None
+    first_open_s: float | None = None
+    rss_kb: int | None = None
+    cpu_s: float | None = None
+    peak_fds: int | None = None
+    peak_threads: int | None = None
+    open: list[str] = field(default_factory=list)
+
+    @property
+    def rate(self) -> float | None:
+        return self.sockets / self.scan_s if self.scan_s else None
+
+
+SCAN_TIME = re.compile(r"Portscan\s*\|\s*([0-9.]+)\s*s")
+OPEN_LINE = re.compile(r"^Open (\S+)$")
+SUMMARY_LINE = re.compile(r"^(\S+) -> \[([0-9,]*)\]$")
+
+
+class Sampler(threading.Thread):
+    """Samples the open descriptors and the threads of a running process."""
+
+    def __init__(self, proc: subprocess.Popen):
+        super().__init__(daemon=True)
+        self.proc = proc
+        self.done = threading.Event()
+        self.peak_fds: int | None = None
+        self.peak_threads: int | None = None
+        self.system = platform.system()
+        self.libproc = darwin_libproc() if self.system == "Darwin" else None
+
+    def sample(self) -> tuple[int | None, int | None]:
+        pid = self.proc.pid
+        if self.system == "Linux":
+            fds = len(os.listdir(f"/proc/{pid}/fd"))
+            threads = None
+            with open(f"/proc/{pid}/status", encoding="ascii", errors="replace") as status:
+                for line in status:
+                    if line.startswith("Threads:"):
+                        threads = int(line.split()[1])
+                        break
+            return fds, threads
+        if self.libproc is not None:
+            return darwin_fds_and_threads(self.libproc, pid)
+        if self.system == "Windows":
+            return windows_handle_count(self.proc), None
+        return None, None
+
+    def run(self) -> None:
+        while not self.done.is_set():
+            try:
+                fds, threads = self.sample()
+            except (OSError, ValueError):
+                return  # the process is gone
+            if fds is not None:
+                self.peak_fds = max(self.peak_fds or 0, fds)
+            if threads is not None:
+                self.peak_threads = max(self.peak_threads or 0, threads)
+            self.done.wait(SAMPLE_INTERVAL)
+
+
+def darwin_libproc():
+    import ctypes
+
+    try:
+        libproc = ctypes.CDLL("/usr/lib/libproc.dylib")
+    except OSError:
+        return None
+    libproc.proc_pidinfo.argtypes = [
+        ctypes.c_int,
+        ctypes.c_int,
+        ctypes.c_uint64,
+        ctypes.c_void_p,
+        ctypes.c_int,
+    ]
+    libproc.proc_pidinfo.restype = ctypes.c_int
+    return libproc
+
+
+def darwin_fds_and_threads(libproc, pid: int) -> tuple[int | None, int | None]:
+    import ctypes
+
+    proc_pidlistfds, proc_pidtaskinfo = 1, 4
+    size = libproc.proc_pidinfo(pid, proc_pidlistfds, 0, None, 0)
+    if size <= 0:
+        raise OSError("process is gone")
+    buf = ctypes.create_string_buffer(size)
+    used = libproc.proc_pidinfo(pid, proc_pidlistfds, 0, ctypes.addressof(buf), size)
+    if used <= 0:
+        raise OSError("process is gone")
+    fds = used // 8  # sizeof(struct proc_fdinfo)
+
+    class TaskInfo(ctypes.Structure):  # struct proc_taskinfo
+        _fields_ = [
+            *((name, ctypes.c_uint64) for name in ("vsize", "rsize", "user", "system", "tu", "ts")),
+            *(
+                (name, ctypes.c_int32)
+                for name in (
+                    "policy",
+                    "faults",
+                    "pageins",
+                    "cow_faults",
+                    "messages_sent",
+                    "messages_received",
+                    "syscalls_mach",
+                    "syscalls_unix",
+                    "csw",
+                    "threadnum",
+                    "numrunning",
+                    "priority",
+                )
+            ),
+        ]
+
+    info = TaskInfo()
+    got = libproc.proc_pidinfo(
+        pid, proc_pidtaskinfo, 0, ctypes.addressof(info), ctypes.sizeof(info)
+    )
+    return fds, (info.threadnum if got == ctypes.sizeof(info) else None)
+
+
+def windows_handle_count(proc: subprocess.Popen) -> int | None:
+    import ctypes
+    from ctypes import wintypes
+
+    count = wintypes.DWORD()
+    handle = wintypes.HANDLE(int(proc._handle))  # Popen keeps the handle open
+    if not ctypes.windll.kernel32.GetProcessHandleCount(handle, ctypes.byref(count)):
+        raise OSError("process is gone")
+    return count.value
+
+
+def windows_memory_and_cpu(proc: subprocess.Popen) -> tuple[int | None, float | None]:
+    import ctypes
+    from ctypes import wintypes
+
+    class Counters(ctypes.Structure):  # PROCESS_MEMORY_COUNTERS
+        _fields_ = [
+            ("cb", wintypes.DWORD),
+            ("PageFaultCount", wintypes.DWORD),
+            ("PeakWorkingSetSize", ctypes.c_size_t),
+            ("WorkingSetSize", ctypes.c_size_t),
+            ("QuotaPeakPagedPoolUsage", ctypes.c_size_t),
+            ("QuotaPagedPoolUsage", ctypes.c_size_t),
+            ("QuotaPeakNonPagedPoolUsage", ctypes.c_size_t),
+            ("QuotaNonPagedPoolUsage", ctypes.c_size_t),
+            ("PagefileUsage", ctypes.c_size_t),
+            ("PeakPagefileUsage", ctypes.c_size_t),
+        ]
+
+    handle = wintypes.HANDLE(int(proc._handle))
+    counters = Counters()
+    counters.cb = ctypes.sizeof(counters)
+    rss_kb = None
+    if ctypes.windll.psapi.GetProcessMemoryInfo(handle, ctypes.byref(counters), counters.cb):
+        rss_kb = counters.PeakWorkingSetSize // 1024
+
+    times = [wintypes.FILETIME() for _ in range(4)]  # creation, exit, kernel, user
+    cpu_s = None
+    if ctypes.windll.kernel32.GetProcessTimes(handle, *(ctypes.byref(t) for t in times)):
+        ticks = sum((t.dwHighDateTime << 32) | t.dwLowDateTime for t in times[2:])
+        cpu_s = ticks / 1e7  # 100 ns units
+    return rss_kb, cpu_s
+
+
+def run_once(name: str, binary: str, scenario: Scenario) -> RunResult:
+    result = RunResult(build=name, scenario=scenario.name, sockets=scenario.sockets)
+    cmd = [
+        binary,
+        *scenario.args(),
+        "--scripts",
+        "none",
+        "--accessible",
+        "--no-banner",
+        "--no-config",
+    ]
+    env = dict(os.environ, RUST_LOG="rustscan=info")
+    stdout_lines: list[str] = []
+    stderr_chunks: list[bytes] = []
+
+    start = time.perf_counter()
+    proc = subprocess.Popen(
+        cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.DEVNULL, env=env
+    )
+
+    def read_stdout() -> None:
+        for raw in proc.stdout:
+            line = raw.decode("utf-8", "replace").rstrip("\r\n")
+            if result.first_open_s is None and line.startswith("Open "):
+                result.first_open_s = time.perf_counter() - start
+            stdout_lines.append(line)
+
+    readers = [
+        threading.Thread(target=read_stdout, daemon=True),
+        threading.Thread(target=lambda: stderr_chunks.append(proc.stderr.read()), daemon=True),
+    ]
+    for reader in readers:
+        reader.start()
+    sampler = Sampler(proc)
+    sampler.start()
+    # On Unix the child is reaped with os.wait4 below, so the watchdog must
+    # not go through Popen (which would try to reap it as well).
+    kill = proc.kill if os.name == "nt" else lambda: os.kill(proc.pid, signal.SIGKILL)
+    watchdog = threading.Timer(RUN_TIMEOUT, kill)
+    watchdog.start()
+
+    try:
+        if hasattr(os, "wait4"):
+            _, status, usage = os.wait4(proc.pid, 0)
+            result.wall_s = time.perf_counter() - start
+            proc.returncode = os.waitstatus_to_exitcode(status)
+            maxrss = usage.ru_maxrss  # KiB on Linux, bytes on macOS
+            result.rss_kb = maxrss // 1024 if platform.system() == "Darwin" else maxrss
+            result.cpu_s = usage.ru_utime + usage.ru_stime
+        else:
+            proc.wait()
+            result.wall_s = time.perf_counter() - start
+            result.rss_kb, result.cpu_s = windows_memory_and_cpu(proc)
+    finally:
+        watchdog.cancel()
+        sampler.done.set()
+        sampler.join()
+        for reader in readers:
+            reader.join()
+
+    result.returncode = proc.returncode
+    result.peak_fds = sampler.peak_fds
+    result.peak_threads = sampler.peak_threads
+    stderr = b"".join(stderr_chunks).decode("utf-8", "replace")
+
+    opened: set[str] = set()
+    summarised: set[str] = set()
+    for line in stdout_lines:
+        if match := OPEN_LINE.match(line):
+            opened.add(match.group(1))
+        elif match := SUMMARY_LINE.match(line):
+            summarised.update(f"{match.group(1)}:{p}" for p in match.group(2).split(",") if p)
+    result.open = sorted(opened)
+
+    if scan_time := SCAN_TIME.search(stderr):
+        result.scan_s = float(scan_time.group(1))
+
+    problems = []
+    if proc.returncode != 0:
+        problems.append(f"exit code {proc.returncode}")
+    if result.scan_s is None:
+        problems.append("no 'Portscan' timer in the log")
+    if summarised != opened:
+        problems.append(f"'Open' lines and the summary disagree: {sorted(summarised ^ opened)[:5]}")
+    if problems:
+        result.ok = False
+        tail = "\n".join(stderr.strip().splitlines()[-15:])
+        result.error = "; ".join(problems) + (f"\nstderr tail:\n{tail}" if tail else "")
+    return result
+
+
+# --------------------------------------------------------------------------
+# Environment
+# --------------------------------------------------------------------------
+
+
+def sysctl(*names: str) -> list[str]:
+    return subprocess.run(
+        ["sysctl", "-n", *names], capture_output=True, text=True, check=True
+    ).stdout.split("\n")
+
+
+def ephemeral_range() -> tuple[int, int] | None:
+    system = platform.system()
+    try:
+        if system == "Linux":
+            with open("/proc/sys/net/ipv4/ip_local_port_range", encoding="ascii") as f:
+                low, high = map(int, f.read().split())
+            return low, high
+        if system == "Darwin":
+            first, last = sysctl("net.inet.ip.portrange.first", "net.inet.ip.portrange.last")[:2]
+            return int(first), int(last)
+    except (OSError, ValueError, subprocess.CalledProcessError):
+        return None
+    return (49152, 65535) if system == "Windows" else None
+
+
+def environment() -> dict[str, object]:
+    system = platform.system()
+    info: dict[str, object] = {
+        "system": system,
+        "release": platform.release(),
+        "machine": platform.machine(),
+        "cpus": os.cpu_count(),
+        "cpu": platform.processor(),
+        "python": platform.python_version(),
+        "ephemeral_ports": ephemeral_range(),
+    }
+    try:
+        if system == "Linux":
+            with open("/proc/cpuinfo", encoding="ascii", errors="replace") as f:
+                for line in f:
+                    if line.lower().startswith(("model name", "cpu model")):
+                        info["cpu"] = line.split(":", 1)[1].strip()
+                        break
+        elif system == "Darwin":
+            info["cpu"] = sysctl("machdep.cpu.brand_string")[0].strip()
+    except (OSError, subprocess.CalledProcessError):
+        pass
+    try:
+        import resource
+
+        info["open_file_limit"] = resource.getrlimit(resource.RLIMIT_NOFILE)[0]
+    except (ImportError, OSError, ValueError):
+        pass
+    return info
+
+
+# --------------------------------------------------------------------------
+# Analysis and reporting
+# --------------------------------------------------------------------------
+
+Results = dict[str, dict[str, list[RunResult]]]
+
+# key, title, formatter, higher is better
+METRICS = (
+    ("rate", "Throughput (sockets/s, from RustScan's scan timer)", lambda v: f"{v:,.0f}", True),
+    ("wall_s", "Wall time of the whole process", lambda v: f"{v * 1000:,.0f} ms", False),
+    ("first_open_s", "Time to the first open port", lambda v: f"{v * 1000:,.1f} ms", False),
+    ("rss_kb", "Peak RSS", lambda v: f"{v / 1024:,.1f} MiB", False),
+    ("cpu_s", "CPU time (user + system)", lambda v: f"{v * 1000:,.0f} ms", False),
+    ("peak_fds", "Peak open descriptors (sampled; Windows: handles)", lambda v: f"{v:,.0f}", False),
+    ("peak_threads", "Peak threads (sampled)", lambda v: f"{v:,.0f}", False),
+)
+FLAG_WORSE = 10.0  # percent
+
+
+def metric_values(runs: list[RunResult], key: str) -> list[float]:
+    return [float(getattr(r, key)) for r in runs if r.ok and getattr(r, key) is not None]
+
+
+def median(values: list[float]) -> float | None:
+    return statistics.median(values) if values else None
+
+
+def worse_by(value: float, base: float, higher_is_better: bool) -> float:
+    """How much worse `value` is than `base`, in percent (negative: better)."""
+    pct = (value / base - 1.0) * 100.0
+    return -pct if higher_is_better else pct
+
+
+def check_open_ports(
+    results: Results, scenarios: list[Scenario], listeners: dict, baseline: str
+) -> tuple[list[str], list[str], list[str]]:
+    """Returns (failed runs, open-port mismatches, notes).
+
+    No build may miss more listeners than the baseline: none at all if the
+    baseline found every listener in every run, or barely more if it did not
+    either (a runner too slow for the scenario's timeout). Ports that are
+    open beyond the listeners (services already running on the runner) must
+    match what the baseline found: a build may not miss a port the baseline
+    found in every run, nor report one the baseline never found.
+    """
+    failures, mismatches, notes = [], [], []
+    for sc in scenarios:
+        expected = sc.expected(listeners)
+        per_build = results[sc.name]
+
+        def missed(runs: list[RunResult]) -> int:
+            return sum(len(expected - set(r.open)) for r in runs if r.ok)
+
+        base_missed = missed(per_build[baseline])
+        allowed = base_missed + max(3, base_missed // 4) if base_missed else 0
+        if base_missed:
+            notes.append(
+                f"`{sc.name}`: `{baseline}` itself missed {base_missed} of "
+                f"{len(expected) * len(per_build[baseline])} listener answers"
+            )
+
+        base_extra = [set(r.open) - expected for r in per_build[baseline] if r.ok]
+        always = set.intersection(*base_extra) if base_extra else set()
+        ever = set.union(*base_extra) if base_extra else set()
+        for name, runs in per_build.items():
+            for index, res in enumerate(runs, start=1):
+                if not res.ok:
+                    failures.append(f"`{sc.name}` `{name}` run {index}: {res.error.splitlines()[0]}")
+            if name == baseline:
+                continue
+            if (count := missed(runs)) > allowed:
+                mismatches.append(
+                    f"`{sc.name}` `{name}`: missed {count} listener answers "
+                    f"(`{baseline}`: {base_missed})"
+                )
+            for index, res in enumerate(runs, start=1):
+                if not res.ok:
+                    continue
+                found = set(res.open)
+                where = f"`{sc.name}` `{name}` run {index}"
+                if lost := always - found:
+                    mismatches.append(f"{where}: missed ports `{baseline}` always found {sorted(lost)[:5]}")
+                if bogus := (found - expected) - ever:
+                    mismatches.append(f"{where}: reported ports `{baseline}` never found {sorted(bogus)[:5]}")
+    return failures, mismatches, notes
+
+
+def gate(
+    results: Results,
+    scenarios: list[Scenario],
+    baseline: str,
+    candidate: str,
+    max_slowdown: float,
+    max_memory: float,
+) -> list[str]:
+    """Scenarios where `candidate` is clearly worse than `baseline`."""
+    problems = []
+    for sc in scenarios:
+        checks = [("wall_s", False, max_slowdown, 0.002), ("rss_kb", False, max_memory, 1024)]
+        if sc.sockets >= 1000:  # throughput is meaningless for a handful of sockets
+            checks.append(("rate", True, max_slowdown, 0))
+        for key, higher, limit, floor in checks:
+            base = median(metric_values(results[sc.name][baseline], key))
+            value = median(metric_values(results[sc.name][candidate], key))
+            if not base or value is None or abs(value - base) <= floor:
+                continue
+            if (worse := worse_by(value, base, higher)) > limit:
+                problems.append(f"{sc.name}: {key} {worse:+.1f}% worse than {baseline} (limit {limit}%)")
+    return problems
+
+
+def render_markdown(report: dict, results: Results, scenarios: list[Scenario]) -> str:
+    builds = report["builds"]
+    baseline = report["baseline"]
+    env = report["environment"]
+    out = [f"### Scan benchmark: {env['system']} {env['machine']}", ""]
+    out.append(
+        "; ".join(f"`{b['name']}`: {b['label']}" for b in builds)
+        + f". {report['runs']} interleaved runs per build and scenario (`tcp-1-port`: x3), medians."
+        f" Runner: {env.get('cpu') or '?'}, {env['cpus']} CPUs, {env['system']} {env['release']},"
+        f" open-file limit {env.get('open_file_limit', 'n/a')}."
+    )
+    out.append("")
+
+    problems = report["failures"] + report["mismatches"]
+    tcp = sum(len(ports) for ports in report["listeners"]["tcp"].values())
+    udp = sum(len(ports) for ports in report["listeners"]["udp"].values())
+    if not problems:
+        out.append(
+            f"✅ Every run of every build exited cleanly; no build missed more of the {tcp} TCP "
+            f"and {udp} UDP listeners than `{baseline}`, or disagreed with it about other ports."
+        )
+    else:
+        out.append(f"❌ {len(report['failures'])} failed runs, {len(report['mismatches'])} open-port mismatches:")
+        out += [f"- {p}" for p in problems[:25]]
+    if report["notes"]:
+        out.append("")
+        out += [f"- ⚠️ {note}" for note in report["notes"]]
+    out.append("")
+    out.append("| Scenario | What is scanned |")
+    out.append("|---|---|")
+    out += [f"| `{sc.name}` | {sc.describe()} ({sc.sockets:,} sockets) |" for sc in scenarios]
+    out.append("")
+    out.append(f"Changes are relative to `{baseline}`; ❗ marks a median more than {FLAG_WORSE:.0f}% worse.")
+    out.append("")
+
+    for key, title, fmt, higher in METRICS:
+        rows = []
+        for sc in scenarios:
+            base_value = median(metric_values(results[sc.name][baseline], key))
+            cells = []
+            for build in builds:
+                value = median(metric_values(results[sc.name][build["name"]], key))
+                if value is None:
+                    cells.append("–")
+                    continue
+                cell = fmt(value)
+                if build["name"] != baseline and base_value:
+                    pct = (value / base_value - 1.0) * 100.0
+                    flag = " ❗" if worse_by(value, base_value, higher) > FLAG_WORSE else ""
+                    cell += f" ({pct:+.1f}%{flag})"
+                cells.append(cell)
+            if any(c != "–" for c in cells):
+                rows.append(f"| `{sc.name}` | " + " | ".join(cells) + " |")
+        out.append(f"**{title}**")
+        out.append("")
+        if rows:
+            out.append("| Scenario | " + " | ".join(f"`{b['name']}`" for b in builds) + " |")
+            out.append("|---|" + "---:|" * len(builds))
+            out += rows
+        else:
+            out.append("_Not measured on this platform._")
+        out.append("")
+    return "\n".join(out)
+
+
+# --------------------------------------------------------------------------
+# Main
+# --------------------------------------------------------------------------
+
+
+def parse_pairs(values: list[str], option: str) -> dict[str, str]:
+    pairs = {}
+    for value in values:
+        name, sep, rest = value.partition("=")
+        if not sep or not name or not rest:
+            raise SystemExit(f"--{option} expects NAME=VALUE, got {value!r}")
+        pairs[name] = rest
+    return pairs
+
+
+def run(args: argparse.Namespace) -> int:
+    builds = parse_pairs(args.build, "build")
+    labels = parse_pairs(args.label, "label")
+    baseline = args.baseline or next(iter(builds))
+    if baseline not in builds:
+        raise SystemExit(f"unknown baseline build {baseline!r}")
+    for name, path in builds.items():
+        if not os.path.isfile(path):
+            raise SystemExit(f"build {name!r}: {path} does not exist")
+    if args.gate and args.gate not in builds:
+        raise SystemExit(f"unknown --gate build {args.gate!r}")
+    if args.delayed_host and not args.delayed_listeners:
+        raise SystemExit("--delayed-host needs --delayed-listeners")
+
+    filtered = None
+    if args.filtered:
+        low, _, high = args.filtered.partition("-")
+        filtered = (int(low), int(high))
+
+    scenarios = build_scenarios(platform.system(), filtered, args.delayed_host, args.delay_ms)
+    if args.only:
+        wanted = set(args.only.split(","))
+        scenarios = [sc for sc in scenarios if sc.name in wanted]
+
+    if ephemeral := ephemeral_range():
+        low, high = ephemeral
+        for sc in scenarios:
+            for start, end in sc.ranges:
+                if start <= high and end >= low:
+                    raise SystemExit(
+                        f"scenario {sc.name} scans {start}-{end}, which overlaps the ephemeral "
+                        f"port range {low}-{high}: a scan could connect a socket to itself"
+                    )
+
+    server, listeners = start_server([LOOPBACK])
+    if args.delayed_host:
+        # The workflow runs a second `serve` on the delayed host (inside a
+        # network namespace) and stores its first line in this file.
+        with open(args.delayed_listeners, encoding="utf-8") as f:
+            far = json.loads(f.readline())
+        for kind in ("tcp", "udp"):
+            listeners[kind][args.delayed_host] = far[kind].get(args.delayed_host, [])
+    for kind in ("tcp", "udp"):
+        counts = {address: len(ports) for address, ports in listeners[kind].items()}
+        print(f"{kind} listeners: {counts}", flush=True)
+    if listeners["busy"]:
+        print(f"already in use: {listeners['busy']}", flush=True)
+
+    names = list(builds)
+    results: Results = {sc.name: {name: [] for name in names} for sc in scenarios}
+    try:
+        warmup = next((sc for sc in scenarios if sc.name == "tcp-sweep"), scenarios[0])
+        for name in names:
+            run_once(name, builds[name], warmup)
+
+        rounds = args.runs * max(sc.repeat for sc in scenarios)
+        for index in range(rounds):
+            shift = index % len(names)
+            order = names[shift:] + names[:shift]
+            for sc in scenarios:
+                if index >= args.runs * sc.repeat:
+                    continue
+                for name in order:
+                    res = run_once(name, builds[name], sc)
+                    results[sc.name][name].append(res)
+                    print(
+                        f"[{index + 1}/{rounds}] {sc.name:<17} {name:<14} ok={res.ok} "
+                        f"scan={res.scan_s} wall={res.wall_s} first={res.first_open_s} "
+                        f"rss={res.rss_kb} cpu={res.cpu_s} fds={res.peak_fds} "
+                        f"threads={res.peak_threads} open={len(res.open)}",
+                        flush=True,
+                    )
+                    if not res.ok:
+                        print(f"    {res.error}", flush=True)
+    finally:
+        server.kill()
+        server.wait()
+
+    failures, mismatches, notes = check_open_ports(results, scenarios, listeners, baseline)
+    report = {
+        "environment": environment(),
+        "baseline": baseline,
+        "builds": [{"name": n, "label": labels.get(n, n), "path": builds[n]} for n in names],
+        "runs": args.runs,
+        "listeners": listeners,
+        "scenarios": [asdict(sc) | {"sockets": sc.sockets} for sc in scenarios],
+        "results": {
+            sc: {n: [asdict(r) | {"rate": r.rate} for r in runs] for n, runs in per.items()}
+            for sc, per in results.items()
+        },
+        "failures": failures,
+        "mismatches": mismatches,
+        "notes": notes,
+    }
+    markdown = render_markdown(report, results, scenarios)
+    if args.json:
+        with open(args.json, "w", encoding="utf-8") as f:
+            json.dump(report, f, indent=1)
+    if args.markdown:
+        with open(args.markdown, "w", encoding="utf-8") as f:
+            f.write(markdown + "\n")
+    print(markdown)
+
+    status = 1 if failures or mismatches else 0
+    if args.gate:
+        for problem in gate(results, scenarios, baseline, args.gate, args.max_slowdown, args.max_memory):
+            print(f"::error::performance regression: {problem}", flush=True)
+            status = 1
+    return status
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+    listen = sub.add_parser("serve", help="run the loopback listeners (started by `run`)")
+    listen.add_argument("--address", action="append", default=[], help="address to listen on")
+    bench = sub.add_parser("run", help="benchmark the given builds")
+    bench.add_argument("--build", action="append", required=True, metavar="NAME=PATH")
+    bench.add_argument("--label", action="append", default=[], metavar="NAME=TEXT")
+    bench.add_argument("--baseline", help="build the others are compared with (default: the first)")
+    bench.add_argument("--runs", type=int, default=9, help="interleaved runs per build and scenario")
+    bench.add_argument(
+        "--filtered", metavar="START-END", help="ports the runner drops; enables filtered scenarios"
+    )
+    bench.add_argument(
+        "--delayed-host",
+        metavar="ADDRESS",
+        help="address behind an artificial delay, with its own `serve`; enables delayed scenarios",
+    )
+    bench.add_argument(
+        "--delayed-listeners", metavar="FILE", help="first output line of that host's `serve`"
+    )
+    bench.add_argument("--delay-ms", type=int, default=5, help="that delay, for the summary")
+    bench.add_argument("--only", metavar="NAMES", help="comma-separated scenarios to run")
+    bench.add_argument("--json", help="write the raw results to this file")
+    bench.add_argument("--markdown", help="write the Markdown summary to this file")
+    bench.add_argument("--gate", metavar="NAME", help="fail if this build regresses against the baseline")
+    bench.add_argument("--max-slowdown", type=float, default=15.0, help="percent, throughput and wall time")
+    bench.add_argument("--max-memory", type=float, default=25.0, help="percent, peak RSS")
+    args = parser.parse_args()
+    # The summary contains emoji; Windows runners default to a legacy code page.
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    return serve(args.address or [LOOPBACK]) if args.command == "serve" else run(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/workflows/build.yml

@@ -0,0 +1,201 @@
+name: CD Pipeline
+
+on:
+  push:
+    branches:
+      - "master"
+    tags:
+      - "*"
+
+# Build jobs only need to read the repository. The publish job below is the
+# only job that gets write access, and it only runs for tag pushes.
+permissions:
+  contents: read
+
+jobs:
+  build-nix:
+    env:
+      IN_PIPELINE: true
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        type: [ubuntu-x64, ubuntu-x86, armv7, aarch64]
+        include:
+          - type: ubuntu-x64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+            name: x86_64-linux-rustscan
+            path: target/x86_64-unknown-linux-musl/release/rustscan
+            pkg_config_path: /usr/lib/x86_64-linux-gnu/pkgconfig
+          - type: ubuntu-x86
+            os: ubuntu-latest
+            target: i686-unknown-linux-musl
+            name: x86-linux-rustscan
+            path: target/i686-unknown-linux-musl/release/rustscan
+            pkg_config_path: /usr/lib/i686-linux-gnu/pkgconfig
+          - type: armv7
+            os: ubuntu-latest
+            target: armv7-unknown-linux-gnueabihf
+            name: armv7-linux-rustscan
+            path: target/armv7-unknown-linux-gnueabihf/release/rustscan
+            pkg_config_path: /usr/lib/x86_64-linux-gnu/pkgconfig
+          - type: aarch64
+            os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            name: aarch64-linux-rustscan
+            path: target/aarch64-unknown-linux-gnu/release/rustscan
+            pkg_config_path: /usr/lib/x86_64-linux-gnu/pkgconfig
+    steps:
+      - uses: actions/checkout@v7
+      - name: Cache cargo & target directories
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Build binary
+        uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
+        with:
+          command: build
+          target: ${{ matrix.target }}
+          args: "--locked --release"
+          strip: true
+          toolchain: stable
+      - name: Package and upload artifacts
+        uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
+        with:
+          executable-name: rustscan
+          target: ${{ matrix.target }}
+          archive-name: ${{ matrix.name }}
+          changes-file: ""
+
+  build-deb:
+    needs: [build-nix]
+    runs-on: ubuntu-latest
+    env:
+      IN_PIPELINE: true
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install cargo-deb
+        run: cargo install -f cargo-deb
+      - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: musl-tools # provides musl-gcc
+          version: 1.0
+      - name: Install musl toolchain
+        run: rustup target add x86_64-unknown-linux-musl
+      - name: Deb Build
+        run: cargo deb --target=x86_64-unknown-linux-musl
+      - name: Upload Deb Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: rustscan.deb
+          path: ./target/x86_64-unknown-linux-musl/debian/*
+
+  build-macos:
+    env:
+      IN_PIPELINE: true
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Cache cargo & target directories
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Build binary
+        uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
+        with:
+          command: build
+          target: x86_64-apple-darwin
+          args: "--locked --release"
+          strip: true
+          toolchain: stable
+      - name: Package and upload artifacts
+        uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
+        with:
+          executable-name: rustscan
+          target: x86_64-apple-darwin
+          archive-name: x86_64-macos-rustscan
+          changes-file: ""
+
+  build-macos-aarch64:
+    env:
+      IN_PIPELINE: true
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Cache cargo & target directories
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Build binary
+        uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
+        with:
+          command: build
+          target: aarch64-apple-darwin
+          args: "--locked --release"
+          strip: true
+          toolchain: stable
+      - name: Package and upload artifacts
+        uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
+        with:
+          executable-name: rustscan
+          target: aarch64-apple-darwin
+          archive-name: aarch64-macos-rustscan
+          changes-file: ""
+
+  build-windows:
+    env:
+      IN_PIPELINE: true
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        type: [windows-x64, windows-x86]
+        include:
+          - type: windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            name: x86_64-windows-rustscan
+          - type: windows-x86
+            os: windows-latest
+            target: i686-pc-windows-msvc
+            name: x86-windows-rustscan
+    steps:
+      - uses: actions/checkout@v7
+      - name: Cache cargo & target directories
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Build binary
+        uses: houseabsolute/actions-rust-cross@21b0f18dc621b25bfae556ff2791fca4173121e8 # v1.0.8
+        with:
+          command: build
+          target: ${{ matrix.target }}
+          args: "--locked --release"
+          strip: true
+          toolchain: stable
+      - name: Package and upload artifacts
+        uses: houseabsolute/actions-rust-release@9e126fd5fc18f4cecf358b3909f3991ad59663dc # v1.0.1
+        with:
+          executable-name: rustscan
+          target: ${{ matrix.target }}
+          archive-name: ${{ matrix.name }}
+          changes-file: ""
+
+  # Runs only for tag pushes (tags can only be created by maintainers), and
+  # only after every build job succeeded, so a release never ships partially.
+  publish:
+    if: github.ref_type == 'tag'
+    needs:
+      - build-nix
+      - build-deb
+      - build-macos
+      - build-macos-aarch64
+      - build-windows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the release / upload release assets
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          merge-multiple: true
+      - name: Publish artifacts to GitHub release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          fail_on_unmatched_files: true
+          files: |
+            *.deb
+            *.sha256
+            *.tar.gz
+            *.zip

.github/workflows/mlc_config.json

@@ -0,0 +1,14 @@
+{
+    "_comment": "Config for markdown-link-check. Resolves issue #540.",
+    "ignorePatterns": [
+      {
+        "pattern": "^https://github.com/RustScan/RustScan/workflows/Continuous%20integration/badge.svg"
+      },
+      {
+        "pattern": "^https://crates.io/crates/rustscan/"
+      },
+      {
+        "pattern": "^https://bees.substack.com/p/making-hacking-accessible"
+      }
+    ]
+  }

.github/workflows/scan-benchmark.yml

@@ -0,0 +1,247 @@
+name: Scan benchmark
+
+# Compares the scanning speed and resource use of a change with its base.
+#
+# Each run builds both versions in release mode and runs
+# .github/scan-benchmark/scan_bench.py, which scans listeners it opens on
+# 127.0.0.1 inside the runner (plus closed and, on Linux, filtered ports) and
+# reports medians over interleaved runs. Nothing outside the runner is
+# scanned. The unit tests deliberately never open sockets; this workflow is
+# where scanning behaviour and performance are measured.
+#
+# It only runs for pull requests that touch the scanner, its runtime or its
+# dependencies, or when started by hand, so it does not slow down normal CI.
+
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - "src/scanner/**"
+      - "src/main.rs"
+      - "src/lib.rs"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/scan-benchmark/**"
+      - ".github/workflows/scan-benchmark.yml"
+  workflow_dispatch:
+    inputs:
+      base:
+        description: "Branch, tag or commit to compare against"
+        default: "master"
+      runs:
+        description: "Interleaved runs per build and scenario"
+        default: "9"
+      extra:
+        description: "More builds to compare, as space-separated NAME=REF pairs"
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scan-benchmark-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    name: Benchmark (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+    defaults:
+      run:
+        shell: bash
+    env:
+      # Ports the Linux runners drop, to measure filtered ports (timeouts).
+      # They lie above Linux's ephemeral port range (32768-60999).
+      FILTERED_PORTS: "61000-62999"
+      # The Linux runners' host behind a 5 ms delay (see "Set up a host 5 ms away").
+      DELAYED_HOST: "10.200.0.2"
+      RUNS: ${{ inputs.runs || '9' }}
+      EXTRA: ${{ inputs.extra }}
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Check the benchmark script
+        run: python -m py_compile .github/scan-benchmark/scan_bench.py
+
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+          # build.rs formats the generated payload table with rustfmt.
+          components: rustfmt
+          # Caching is handled by Swatinem/rust-cache below.
+          cache: false
+          rustflags: ""
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: Build the change
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          exe=""
+          if [ "$RUNNER_OS" = Windows ]; then exe=".exe"; fi
+          echo "EXE=$exe" >> "$GITHUB_ENV"
+          mkdir -p "$RUNNER_TEMP/bin"
+          cargo build --release --locked
+          cp "target/release/rustscan$exe" "$RUNNER_TEMP/bin/head$exe"
+          if [ -n "$PR_NUMBER" ]; then
+            label="#$PR_NUMBER at ${PR_HEAD::7}, merged into its base"
+          else
+            label="$(git log -1 --format='%h %s' HEAD)"
+          fi
+          echo "HEAD_LABEL=$label" >> "$GITHUB_ENV"
+
+      - name: Build the base and any extra builds
+        env:
+          EVENT: ${{ github.event_name }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          INPUT_BASE: ${{ inputs.base }}
+        run: |
+          build_ref() {
+            local name="$1" ref="$2"
+            if [[ ! "$name" =~ ^[A-Za-z0-9._+-]+$ ]]; then
+              echo "::error::invalid build name '$name'"
+              exit 1
+            fi
+            git fetch --no-tags --depth=1 origin "$ref"
+            git worktree add --detach "$RUNNER_TEMP/src-$name" FETCH_HEAD
+            cargo build --release --locked \
+              --manifest-path "$RUNNER_TEMP/src-$name/Cargo.toml" --target-dir target
+            cp "target/release/rustscan$EXE" "$RUNNER_TEMP/bin/$name$EXE"
+            echo "$name=$(git log -1 --format='%h %s' FETCH_HEAD)" >> "$RUNNER_TEMP/labels"
+          }
+
+          if [ "$EVENT" = pull_request ]; then base="$PR_BASE"; else base="${INPUT_BASE:-master}"; fi
+          build_ref base "$base"
+          for spec in $EXTRA; do
+            build_ref "${spec%%=*}" "${spec#*=}"
+          done
+          cat "$RUNNER_TEMP/labels"
+
+      - name: Drop traffic to the filtered ports
+        if: runner.os == 'Linux'
+        run: |
+          if ! command -v iptables >/dev/null; then
+            echo "::warning::iptables is not available; skipping the filtered-port scenarios"
+            exit 0
+          fi
+          for proto in tcp udp; do
+            sudo iptables -I INPUT -i lo -p "$proto" --dport "${FILTERED_PORTS/-/:}" -j DROP
+          done
+          sudo iptables -S INPUT
+          echo "FILTERED_OK=1" >> "$GITHUB_ENV"
+
+      - name: Set up a host 5 ms away
+        if: runner.os == 'Linux'
+        run: |
+          # A network namespace on the runner, reached over a veth pair whose
+          # outbound side delays every packet. Its answers (SYN-ACKs, resets,
+          # ICMP errors, UDP replies) arrive a round trip after the probe, as
+          # from a remote host, instead of while the probe is being sent.
+          skip() {
+            echo "::warning::$1; skipping the delayed-host scenarios"
+            exit 0
+          }
+          sudo ip netns add far || skip "cannot create a network namespace"
+          sudo ip link add rs-near type veth peer name rs-far || skip "cannot create a veth pair"
+          sudo ip link set rs-far netns far || skip "cannot move the veth end"
+          sudo ip addr add 10.200.0.1/30 dev rs-near || skip "cannot address the veth pair"
+          sudo ip link set rs-near up || skip "cannot bring up the veth pair"
+          sudo ip netns exec far ip addr add "$DELAYED_HOST/30" dev rs-far || skip "cannot address the namespace"
+          sudo ip netns exec far ip link set rs-far up || skip "cannot bring up the namespace"
+          sudo ip netns exec far ip link set lo up || true
+          # Answer every probe to a closed UDP port, like the loopback
+          # interface does (ICMP errors are rate limited everywhere else).
+          for setting in icmp_ratelimit=0 icmp_msgs_per_sec=100000000 icmp_msgs_burst=100000000; do
+            sudo ip netns exec far sysctl -qw "net.ipv4.$setting" || true
+          done
+          sudo tc qdisc add dev rs-near root netem delay 5ms limit 1000000 || skip "netem is not available"
+          tc qdisc show dev rs-near
+
+          sudo ip netns exec far "$(command -v python)" .github/scan-benchmark/scan_bench.py \
+            serve --address "$DELAYED_HOST" > "$RUNNER_TEMP/far.json" 2> "$RUNNER_TEMP/far.log" &
+          for _ in $(seq 100); do
+            if [ -s "$RUNNER_TEMP/far.json" ]; then break; fi
+            sleep 0.1
+          done
+          if [ ! -s "$RUNNER_TEMP/far.json" ]; then
+            cat "$RUNNER_TEMP/far.log" || true
+            skip "the delayed host's listeners did not start"
+          fi
+          head -c 200 "$RUNNER_TEMP/far.json"; echo
+          echo "DELAYED_OK=1" >> "$GITHUB_ENV"
+
+      - name: Describe the runner
+        continue-on-error: true
+        run: |
+          uname -a
+          if [ "$RUNNER_OS" = Linux ]; then
+            nproc
+            grep -m1 'model name' /proc/cpuinfo || true
+            sysctl net.ipv4.ip_local_port_range net.ipv4.tcp_tw_reuse net.core.somaxconn || true
+            ss -Hltnu | sort -k5 | head -n 50 || true
+          elif [ "$RUNNER_OS" = macOS ]; then
+            for oid in hw.ncpu machdep.cpu.brand_string kern.maxfilesperproc \
+              net.inet.ip.portrange.first net.inet.ip.portrange.last; do
+              sysctl "$oid" || true
+            done
+          fi
+
+      - name: Run the benchmark
+        run: |
+          # Allow the largest batch size without RustScan shrinking it to fit
+          # the descriptor limit (macOS defaults to 256, and caps processes at
+          # kern.maxfilesperproc, 10240 on its runners).
+          if [ "$RUNNER_OS" != Windows ]; then
+            for limit in 65536 24576 10240; do
+              ulimit -n "$limit" 2>/dev/null && break
+            done
+            echo "open-file limit: $(ulimit -n)"
+          fi
+
+          # Fail on wrong results, or if the change is clearly slower or
+          # bigger than its base (see --max-slowdown/--max-memory).
+          args=(--runs "$RUNS" --gate head --json bench-results.json --markdown bench-results.md)
+          if [ -n "${FILTERED_OK:-}" ]; then args+=(--filtered "$FILTERED_PORTS"); fi
+          if [ -n "${DELAYED_OK:-}" ]; then
+            args+=(--delayed-host "$DELAYED_HOST" --delayed-listeners "$RUNNER_TEMP/far.json")
+          fi
+          args+=(--build "base=$RUNNER_TEMP/bin/base$EXE")
+          args+=(--build "head=$RUNNER_TEMP/bin/head$EXE" --label "head=$HEAD_LABEL")
+          while IFS= read -r line; do
+            name="${line%%=*}"
+            args+=(--label "$line")
+            if [ "$name" != base ]; then
+              args+=(--build "$name=$RUNNER_TEMP/bin/$name$EXE")
+            fi
+          done < "$RUNNER_TEMP/labels"
+
+          python .github/scan-benchmark/scan_bench.py run "${args[@]}"
+
+      - name: Publish the summary
+        if: always()
+        run: |
+          if [ -f bench-results.md ]; then cat bench-results.md >> "$GITHUB_STEP_SUMMARY"; fi
+
+      - name: Upload the results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: scan-benchmark-${{ matrix.os }}
+          path: |
+            bench-results.json
+            bench-results.md
+          if-no-files-found: ignore

.github/workflows/test.yml

@@ -0,0 +1,45 @@
+name: Test
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test Suite
+    strategy:
+      matrix:
+        # ubuntu-24.04-arm is the GitHub-hosted arm64 Linux runner;
+        # macos-latest already runs on Apple Silicon (arm64).
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        rust: [stable]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v7
+
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: ${{ matrix.rust }}
+          components: clippy, rustfmt
+          # Caching is handled by Swatinem/rust-cache below.
+          cache: false
+          # Keep RUSTFLAGS unset; `just test` already denies Clippy warnings.
+          rustflags: ""
+
+      - uses: taiki-e/install-action@nextest
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install Just
+        uses: extractions/setup-just@v4
+
+      - name: Run tests
+        run: just test

.gitignore

@@ -1,10 +1,11 @@
 # Generated by Cargo
 # will have compiled files and executables
 /target/
+# generated file by build.rs for mapping nmap-payloads to rust
+src/generated.rs
 
 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
@@ -30,7 +31,6 @@ Cargo.lock
 *.sig
 
 pkg/
-src/
 
 ### Rust ###
 # Generated by Cargo
@@ -39,9 +39,88 @@ src/
 
 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
 
 # End of https://www.toptal.com/developers/gitignore/api/rust,archlinuxpackages
+*.deb
+
+
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+.idea/*
+.idea
+.idea*
+
+settings.json

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "src/rustscan_scripting_engine"]
+	path = src/rustscan_scripting_engine
+	url = https://github.com/RustScan/rustscan_scripting_engine

.travis.yml

@@ -0,0 +1,33 @@
+language: rust
+os:
+- linux
+- osx
+arch:
+- amd64
+- arm64
+services:
+- docker
+before_install:
+- rustup component add rustfmt
+rust:
+- stable
+- beta
+jobs:
+  fast_finish: true
+script:
+- cargo build
+- cargo test
+- cargo fmt -- --check
+after_success: |
+  if [ -n "${GITHUB_TOKEN}" ]; then
+    [ "${TRAVIS_BRANCH} " = master ] &&
+    [ "${TRAVIS_PULL_REQUEST}" = false ] &&
+    cargo doc &&
+    echo "<meta http-equiv=refresh content=0;url=rustscan/index.html>" > target/doc/index.html &&
+    sudo pip install ghp-import &&
+    ghp-import -n target/doc &&
+    git push -fq https://${GITHUB_TOKEN}@github.com/${TRAVIS_REPO_SLUG}.git gh-pages
+  fi
+env:
+  global:
+    secure: Gf24LG7Hr3Q0drWyPrvISTL35Z57DxdS/wIOo7v+ZdauzY3Qjvv3Lh4TY//C4sdN0g1CLj4yjg7LQOqF4XRdh2Qah7JZPv/i2B5uz9nwjTsoRzmmMWML9VtfT1u53nSFqsNeXbvpmoNG9rfMXcoiyd+Lv+EgniHphDEBlXvS9n9KMcpOi1F2x7bsH0EK37wQYKMTpCCd5TPUPdZou7BJNiZS3ikRLpTRFF7uIN4gYtRH9kU5uBSphWgnJ6eBm2ItzZcUPOgrjAoF4RkmZAzGG4idDh1Qkf3No3nZwT3U5NSk8h7owtJ4oADlRgYqYKCB4YcC9cAKCJgDsyMlKKMkEyagvw1seFnBLCY3ljsW4EklpVEZ0rVqZOx4pTkIaxIxytLTC9pHmdDSnhdhFknOcVAQQWjg+nAZfD07QUeAqUdr0i/vxQoZitvbNY0znzEarycE1waKvwlkiB4gt385U1CBfYldydnOnRKkdtLNrCLClu13HU0djmSXMhojQJhTuNxTHtZAf5fKcWIWwkVbNZ5MNKYjQh4rKufqW3o1iHphB8dfAGsDEPv0RQMtVbu6H4+clCouLkFlxHOIrrOJ5SXQ8cIATPhnJR7y4cSDdRaN0DRLRjeLAIKlbOGBtNuFC+BftocaTY5qN42aKAMqQcT30ycfiLuRVJNiQJ5pkto=

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at our discord via a private message to any of the owners. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant homepage, version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+homepage: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

Cargo.toml

@@ -1,25 +1,69 @@
 [package]
 name = "rustscan"
-version = "1.2.0"
-authors = ["Bee <brando[email protected]>"]
+version = "2.4.1"
+authors = ["Autumn <autum[email protected]>"]
 edition = "2018"
 description = "Faster Nmap Scanning with Rust"
-homepage = "https://github.com/brandonskerritt/rustscan"
-repository = "https://github.com/brandonskerritt/rustscan"
-license = "MIT"
+homepage = "https://github.com/rustscan/rustscan"
+repository = "https://github.com/rustscan/rustscan"
+license = "GPL-3.0-only"
 keywords = ["port", "scanning", "nmap"]
 categories = ["command-line-utilities"]
-readme="README.md"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+readme = "README.md"
+exclude = [
+    ".github/*",
+    "pictures/*",
+    "rustscan-debbuilder/*",
+]
 
 [dependencies]
-colored = "1.9.3"
-clap = "2.33.0"
-rayon = "1.3.1"
-async-std = "1.6.2"
-futures = "0.3"
-rlimit = "0.3.0"
+clap = { version = "4.6.1", features = ["derive", "wrap_help"] }
+colored = "3.1.1"
+# Async runtime for the scanner. hickory-resolver already depends on tokio, so
+# this adds no crates; only the features the scanner itself uses are listed.
+tokio = { version = "1.44.2", features = ["rt", "net", "time"] }
+# Only `FuturesUnordered`/`StreamExt` are used; the executor is not needed.
+futures = { version = "0.3", default-features = false, features = ["std"] }
+rlimit = "0.11.0"
+log = "0.4.32"
+env_logger = "0.11.10"
+anstream = "=1.0.0"
+dirs = "7.0.0"
+gcd = "2.0.1"
+rand = "0.10.1"
+colorful = "0.3.2"
+ansi_term = "0.12.1"
+toml = "1.1.2"
+serde = "1.0.124"
+serde_derive = "1.0.116"
+cidr-utils = "0.7.1"
+itertools = "0.15.0"
+hickory-resolver = { version = "0.24.3", features = ["dns-over-rustls"] }
+anyhow = "1.0.40"
+text_placeholder = { version = "0.5", features = ["struct_context"] }
+once_cell = "1.21.4"
+
+[dev-dependencies]
+parameterized = "2.0.0"
+criterion = { version = "0.8", features = ["html_reports"] }
 
 [package.metadata.deb]
 depends = "$auto, nmap"
+section = "rust"
+
+[profile.release]
+lto = true
+panic = 'abort'
+strip = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[[bin]]
+name = "rustscan"
+path = "src/main.rs"
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ["cfg(tarpaulin_include)"] }
+
+[[bench]]
+name = "benchmark_helpers"
+harness = false

Makefile

@@ -0,0 +1,21 @@
+install:
+	cargo install cross
+
+build:
+	make build-linux
+	make build-mac
+
+	make shasum
+
+build-linux:
+	@echo 'Building for Linux... 🐧'
+	cross build --release --target=x86_64-unknown-linux-musl
+	mkdir -p target/release-archives && tar -C target/x86_64-unknown-linux-musl/release -czf target/release-archives/rustscan-linux.tar.gz rustscan
+
+build-mac:
+	@echo 'Building for MacOS... 🍏'
+	cross build --release --target=x86_64-apple-darwin
+	mkdir -p target/release-archives && tar -C target/x86_64-apple-darwin/release -czf target/release-archives/rustscan-mac.tar.gz rustscan
+
+shasum:
+	shasum -a 256 target/release-archives/rustscan-*.tar.gz

PKGBUILD

@@ -1,14 +0,0 @@
-# Maintainer: Bee <[email protected]>
-pkgname=rustscan-bin
-pkgver=1.1.0
-pkgrel=1
-pkgdesc="Faster Nmap Scanning with Rust"
-url="https://github.com/brandonskerritt/rustscan"
-license=("MIT")
-arch=("x86_64")
-provides=("rustscan")
-depends=('rustup')
-
-package() {
-	rustup toolchain install stable && cargo install rustscan
-}

README.md

@@ -1,269 +1,143 @@
-<p align="center">
-<img src="pictures/rustscan.png"><br>
-<u><b> Turns a 17 minutes Nmap scan into 19 seconds. </b></u><br> Find all open ports <b>fast</b> with Rustscan, automatically pipe them into Nmap. 
-</p>
-<p align="center">
-<img alt="AUR version" src="https://img.shields.io/aur/version/rustscan-bin">
-<img src="https://img.shields.io/badge/Built%20with-Rust-Purple">
-<img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/w/brandonskerritt/rustscan">
-</p>
-<hr>
+<div align="center" markdown="1">
 
+➡️ [Discord][discord] | [Installation Guide][toc-install] | [Usage Guide][usage-guide] ⬅️
 
-| <p align="center"><a href="https://crates.io/crates/rustscan">🔧 Cargo (Universal) </a></p> | <p align="center"><a href="https://crates.io/crates/rust_scan"> Arch </a></p> | <p align="center"><a href="https://crates.io/crates/rust_scan"> HomeBrew </a></p> | <p align="center"><a href="https://crates.io/crates/rust_scan"> Kali / Debian </p> |
-| ---- | ---- | ---- | --- |
-| <p align="center"><img src="pictures/rust.png" /></p>  | <p align="center"><img src="pictures/arch.png" /></p> | <p align="center"><img src="pictures/apple.png" /></p> | <p align="center"><img src="pictures/kali.png" /></p> |
-| `cargo install rustscan` | `yay -S rustscan-bin` | `brew tap brandonskerritt/rustscan && brew install rustscan` | [Read the install guide](https://github.com/brandonskerritt/RustScan/blob/master/README.md#%EF%B8%8F-debian--kali) |
+<img src="pictures/rustscan.png" height=400px width=400px>
 
-<hr>
+<!--<u>**The Modern Port Scanner.**</u>-->
+**Fast, smart, effective.**
+
+![Arch Linux package][badge-1] ![Built with Rust][badge-2] ![GitHub All Releases][badge-3] ![Crates.io][badge-4] ![Discord][badge-5] ![Actions][badge-6]
+
+</div>
 
 # 🤔 What is this?
-1. Find ports quickly using Rustscan (**8 seconds at its fastest**).
-2. Automatically runs `nmap` on those ports.
-3. Profit???
 
-<table>
-  <tr>
-  <th>Name</th>
-    <th>⚡ Nmap <b>with RustScan</b> ⚡ </th>
-    <th>🐢 Nmap 🐢</th>
-  </tr>
-  <tr>
-  <th>Gif</th>
-    <td><img src="pictures/with_rustscan.gif" alt="The guy she tells you not to worry about"></td>
-    <td><img src="pictures/without_rustscan.gif" alt="You"></td>
-  </tr>
-  <tr>
-  <th>Time</th>
-    <td><b>39 seconds</b></td>
-    <td><b>17 minutes and 41 seconds</b></td>
-  </tr>
-</table>
+![fast][speed-1]
 
-<sub><b>Note</b> This is an older gif. RustScan's current top speed is 8 seconds for all 65k ports. This gif is 26 seconds.</sub><br>
+The Modern Port Scanner. **Find ports quickly (3 seconds at its fastest)**. Run scripts through our scripting engine (Python, Lua, Shell supported).
 
-RustScans **only** job is to reduce the friction between finding open ports and inputting them into nmap.
+# 🛠️ Installation
+
+You can install RustScan's binary from our [releases page](https://github.com/RustScan/RustScan/releases).
+
+We would prefer you to install with a package manager so it is tested and works for your system.
+
+RustScan is in many repositories already. Install it with whatever tools you wish:
+
+[![Packaging status](https://repology.org/badge/vertical-allrepos/rustscan.svg)](https://repology.org/project/rustscan/versions)
+
+RustScan only officially supports Cargo installations, if you want to use that please install Rust and then `cargo install rustscan`
+
+Example installations include:
+
+MacOS:
+
+```
+  brew install rustscan
+```
+
+Arch:
+
+```
+  pacman -S rustscan
+```
 
 # ✨ Features
-* Scans all 65k ports in **8 seconds** (on 10k batch size).
-* Saves you time by automatically piping it into Nmap. No more manual copying and pasting!
-* Does one thing and does it well. **Only** purpose is to improve Nmap, not replace it!
-* Let's you choose what Nmap commands to run, or uses the default.
+
+- Scans all 65k ports in **3 seconds**.
+- Full scripting engine support. Automatically pipe results into Nmap, or use our scripts (or write your own) to do whatever you want.
+- Adaptive learning. RustScan improves the more you use it. No bloated machine learning here, just basic maths.
+- The usuals you would expect. IPv6, CIDR, file input and more.
+- Automatically pipes ports into Nmap.
+
+## ‼️ Important Links
+
+|         <!--Installation Guide-->          |          <!--Documentation-->          |       <!--Discord-->        |
+| :----------------------------------------: | :------------------------------------: | :-------------------------: |
+| :book: [Installation Guide][toc-install] | :books: [Documentation][links-table-2] | :parrot: [Discord][discord] |
+|                                          | :penguin: [ARM Support](docs/arm-support.md) |                           |
+
+## 🙋 Table of Contents
+
+- 📖 [Installation Guide][toc-install]
+- 🐋 [Docker Usage][toc-docker-usage]
+- 🐧 [ARM Support](docs/arm-support.md)
+- 🦜 [Discord][discord]
+- 🤸 [Usage][usage-1]
 
 # 🔭 Why RustScan?
-Why spend time running fast scans and manually copying the ports, or waiting for a 20 minute scan to finish when you can just do all 65k ports in less than a minute?
 
-![gif](pictures/8seconds.gif)
+RustScan is a modern take on the port scanner. Sleek & fast. All while providing extensive extendability to you.
 
-**RustScan running in 8 seconds and finding all open ports out of 65k.**
+Not to mention RustScan uses Adaptive Learning to improve itself over time, making it the best port scanner for **you**.
 
-## 📊 RustScan vs Nmap vs MassScan
+## 🧋 Speed
 
-| **Name**                                                                                   | RustScan | Nmap | Masscan |
-| ------------------------------------------------------------------------------------------ | -------- | ---- | ------- |
-| Fast                                                                                       | ✅        | ❌    | ✅       |
-| Actually useful                                                                            | ❌        | ✅    | ❌       |
-| Realises it's not useful, and pipes the only useful data into the only useful port scanner | ✅        | ❌    | ❌       |
+![fast][speed-1]
 
+Speed is guaranteed via RustScan. However, if you want to run a slow scan due to stealth, that is possible too.
 
-## 🙋 FAQ
-> I think this would be a great port scanner on its own without Nmap!
+Firstly, let's talk code.
 
-No. If you want a fast port scanner, use Masscan.
-> I have this great idea for a script to get information on ports / hosts
+We have tests that check to see if RustScan is significantly slower than the previous version. If it is, the continuous integration fails, and we can't commit code to master unless we make it faster.
 
-Great. Contribute it to Nmap! :D
-> Not everyone has nmap installed....
+[HyperFine][speed-2] is used to monitor RustScan's performance over time to answer the question, "Are we getting faster? Are we getting slower?".
 
-If you're a pentester, then yes, you have Nmap installed. 
+Every pull request is reviewed by **one** person, but more often than not, **two** people review it. We test it manually and ensure the code doesn't negatively affect performance.
 
-> I want to contribute!
+[Read more here][speed-3].
 
-Great! I'd love some help with this. Read the [contributing.md file](contributing.md) file for more information!
+## ⚙️ Extensible
 
-# 📖 Full Installation Guide
-**You need Nmap**. If you have Kali Linux or Parrot OS installed, you already have Nmap. If not, [follow the nmap install guide](https://nmap.org/download.html).
+![scripts][extensible-1]
 
-The easiest way to install RustScan is to use one of the packages provided for your system, such as HomeBrew or Yay for Arch Linux.
+### _RustScan piping results into the custom Python script_
 
-The most universal way is to use `cargo`, Rust's built in package manager (think Pip but for Rust). [Follow this guide to installing Rust & Cargo](https://doc.rust-lang.org/cargo/getting-started/installation.html).
+RustScan has a new scripting engine that allows anyone to write scripts in most languages. Python, Lua, and Shell are all supported.
 
-If you face any issues at all, please leave a GitHub issue. I have only tested this on Linux, so there may be issues for Mac OS or Windows. 
+Want to take your found ports and pipe them into Nmap for further analysis? That's possible. Want to run `smb-enum` if SMB is found open? Possible.
 
-## 🖥️ Debian / Kali
+The possibilities are endless -- and you can write scripts in whatever language you feel comfortable with.
 
-Download the .deb file from the releases page:
-[https://github.com/brandonskerritt/RustScan/releases](https://github.com/brandonskerritt/RustScan/releases)
-Run the commpand `dpkg -i` on the file. Note: sometimes you can double click the file to achieve the same result.
+[Read more here][extensible-2].
 
-### 🥧 .deb file not working?
-The .deb file only works on AMD64 CPUs. If yours is different (such as a Raspberry Pi) or the .deb file doesn't work, it is easy to build the .deb file yourself.
-**Note**: It is easier to install Rust and install via Cargo, then it is to build the .deb file. But this is just in case!
+## 🌊 Adaptive
 
-1. Install Rust You can do this with `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` which I took from the Rust website https://www.rust-lang.org/tools/install
-2. `cargo install rustscan` if you want the easiest method possible. Otherwise, to build the .deb file `cargo install cargo-deb`
-3. Git clone this repo `git clone https://github.com/brandonskerritt/RustScan`
-4. cd RustScan (into the git cloned repo) `cd RustScan`
-5. Run `cargo deb`
-6. Your .deb file is now located in `target/releases/Debian/`
+![adaptive][adaptive-1]
 
-## 🍺 HomeBrew
+### _RustScan automatically fine-tunes itself to match the host OS_
 
-Tap the brew:
+RustScan has a cool set of features called "Adaptive Learning". These features "learn" about the environment you are scanning and how _you_ use RustScan to **improve itself over time**.
 
-```
-brew tap brandonskerritt/rustscan
-```
+We use this umbrella term for any feature that fits this criterion. The list constantly changes, so [check out our wiki for more information][adaptive-learning].
 
-Install it:
+## 👩‍🦯 Accessible
 
-```
-brew install rustscan
-```
+![fast][accessible-1]
 
-## 🔧 Building it yourself
+RustScan is one of the first penetration testing tools that aims to be entirely accessible.
 
-1. Git clone the repo.
-2. Install Rust. You can do this with `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` which I took from the Rust website https://www.rust-lang.org/tools/install
-3. cd into the Git repo, and run `cargo build --release`
-4. The binary is located at `target/release/rustscan`
-5. Symlink to the binary or something. Whatever you want!
+[Most penetration testing tools are not accessible][accessible-2], which negatively affects the whole industry.
+
+RustScan has continuous integration testing that aims to ensure it is accessible, and we are constantly working on ways to improve our accessibility and ensure _everyone_ can use RustScan.
 
 # 🤸 Usage
 
-```
-rustscan -h
-```
+We have 2 usage guides. [Basic Usage][usage-1] and [Things you may want to do][usage-2].
 
-```
-RustScan 1.2.0
-Bee https://github.com/brandonskerritt
-Fast Port Scanner built in Rust
+We also have documentation about our config file [here][config-file-here].
 
-USAGE:
-    rustscan [OPTIONS] <ip> [command]...
+# 🎪 Community
 
-FLAGS:
-    -h, --help       Prints help information
-    -V, --version    Prints version information
+[Contributing][community-1] Read this to learn how.
 
-OPTIONS:
-    -T, --timeout <T>    The timeout before a port is assumed to be close. In MS. [default: 1500]
-    -b, --batch <b>      Increases speed of scanning. The batch size for port scanning. Depends on your open file limit
-                         of OS. If you do 65535 it will do every port at the same time. Although, your OS may not
-                         support this. [default: 4500]
-
-ARGS:
-    <ip>            The IP address to scan
-    <command>...    The Nmap arguments to run. To use the argument -A, end RustScan's args with '-- -A'. To run
-                    EXAMPLE: 'rustscan -T 1500 127.0.0.1 -- -A -sC'. This argument auto runs nmap {your commands}
-                    -vvv -p $PORTS 
-```
-
-The format is `rustscan -b 500 -T 1500 192.168.0.1` to scan 192.168.0.1 with 500 batch size with a timeout of 1500ms. The timeout is how long RustScan waits for a response until it assumes the port is closed.
-
-The batch size determines how fast RustScan is. Set it to 65k, and it will scan all 65k ports at the same time. This means at at 65k batch size, RustScan will take TIMEOUT long to scan all ports. Essentially, if timeout is 1000ms, **RustScan can scan in 1 second**. 
-
-Your operating system may not support this, but it is worth it to play around and see where your open file limit is. Shortly I will be releasing a dockerised version with a much larger open file limit, so this will be possible.
-
-## ⚠️ WARNING
-
-This program, by default, scans 5000 ports at a time (5000 per second). 
-
-This may cause damage to a server, or may make it incredibly obvious you are scanning the server.
-
-There are 2 ways to deal with this;
-1. Decrease batch size
-`rustscan -b 10` will run 10 port scans for 1 second, and then another 10 for 1 second and so on.
-2. Increase timeout
-`rustscan -T 5000` will mean RustScan waits 5 seconds until it scans the next ports.
-
-You can also use both of these at the same time, to make it as slow or as fast as you want. A fun favourite is 65535 batch size with 1 second timeout. Theoretically, this scans all 65535 ports in 1 second.
-
-**Please** do not use this tool against sensitive servers. It is designed mainly for Capture the Flag events, not real world servers with sensitive data.
-
-## 🚨 Thread Paniced at Main: Too Many Open Files
-This is the most common error found in RustScan.
-
-The open file limit is how many open sockets you can have at any given time.
-
-This limit changes from OS to OS.
-
-RustScan does not automatically create defaults (other than 5000) like Nmap does with their -T1, -T2 system.
-
-By figuring out for yourself the optimal batch size, you will know that RustScan is the most optimised port scanner for your system. 
-
-There are 2 things you can do:
-1. Decrease batch size
-2. Increase open file limit
-
-Decreasing batch size slows down the program, so as long as it isn't too drastic, this is a good option.
-
-Run these 3 commands:
-
-```
-ulimit -a
-ulimit -Hn
-ulimit -Sn
-```
-
-They will give you an idea on the open file limit of your OS.
-
-If it says "250", run `rustscan -b 240` for a batch size of 240.
-
-Increasing the open file limit increases speed, but poses danger. Although, **opening more file sockets on the specified IP address may damage it**.
-
-To open more, set the ulimit to a higher number:
-
-```
-ulimit -n 5000
-```
-
-**Mac OS**
-Mac OS has, from what I can tell, a naturally very low open file descriptor limit. The limit for Ubuntu is 8800. The limit for Mac OS is 255! 
-
-In this case, I would say it is safe to increase the open file limit. As most Linux based OS' have limits in the thousands. 
-
-Although, if this breaks anything, please don't blame me. 
-
-**Windows Subsystem for Linux**
-Windows Subsystem for Linux does not support ulimt (see issue #39). 
-
-The best way is to use it on a host computer, in Docker, or in a VM that isn't WSL. 
-
-**Automatic Ulimit updating**
-We are currently working on automatic Ulimit updating. If it is too high, it will lower itself. If it is too low, it will suggest a higher Ulimit. Watch [this issue](https://github.com/brandonskerritt/RustScan/issues/25) for more.
-
-## 🔌 Nmap Custom Flags
-To run your own nmap commands, end the RustScan command with `-- -A` where `--` indicates "end of RustScan flags, please do not parse anything further" and any flags after that will be entered into nmap.
-
-RustScan automatically runs `nmap -vvv -p $PORTS $IP`. To make it run `-A`, execute the command `rustscan 127.0.0.1 -- -A`. 
-
-**Note**: due to how Nmap behaves, sometimes you cannot SIGINT ctrl+c to end the scan and it acts like it is running in the background, but printing to STD::OUT. There is nothing I can do about this, unless I create a TTY shell for the sole purpose of running Nmap. Sorry 😓 I'll try to fix in an upcoming release. If any Rust experts want to help, please do!
-
-## 🎯 Increasing speed / accuracy
-* Batch size
-
-This increases speed, by allowing us to process more at once. Something experimental I am working on is changing the open file limit. You can do this manually with `ulimit -n 70000` and then running rustscan with `-b 65535`. This _should_ scan all 65535 ports at the exact same time. But this is extremely experimental.
-
-For non-experimental speed increases, slowly increase the batch size until it no longer gets open ports, or it breaks.
-
-* Accuracy (and some speed)
-
-To increase accuracy, the easiest way is to increase the timeout. The default is 1.5 seconds, by setting it to 4 seconds (4000) we are telling RustScan "if we do not hear back from a port in 4 seconds, assume it is closed".
-
-Decreasing accuracy gives some speed bonus, but my testing found that batch size dramatically changed the speed whereas timeout did, but not so much.
-
-# 🎪 Contributing
-Please read the [contributing.md file](contributing.md)
-
-# 💻 Other Hacking Projects By This Author
-## 🧮 Ciphey
-Ciphey is an automated decryption tool using artifical intelligence & natural language processing.
-[Check it out here!](https://github.com/ciphey/ciphey)
 ## Contributors ✨
+
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-3-orange.svg?style=flat-square)](#contributors-)
+
+[![All Contributors](https://img.shields.io/badge/all_contributors-26-orange.svg?style=flat-square)](#contributors-)
+
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -273,14 +147,91 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
 <!-- markdownlint-disable -->
 <table>
   <tr>
-    <td align="center"><a href="https://skerritt.blog"><img src="https://avatars3.githubusercontent.com/u/10378052?v=4" width="100px;" alt=""/><br /><sub><b>Brandon</b></sub></a><br /><a href="#infra-brandonskerritt" title="Infrastructure (Hosting, Build-Tools, etc)">🚇</a> <a href="https://github.com/brandonskerritt/RustScan/commits?author=brandonskerritt" title="Tests">⚠️</a> <a href="https://github.com/brandonskerritt/RustScan/commits?author=brandonskerritt" title="Code">💻</a> <a href="#design-brandonskerritt" title="Design">🎨</a></td>
-    <td align="center"><a href="https://sakiir.ovh"><img src="https://avatars1.githubusercontent.com/u/9950578?v=4" width="100px;" alt=""/><br /><sub><b>SakiiR</b></sub></a><br /><a href="https://github.com/brandonskerritt/RustScan/commits?author=SakiiR" title="Code">💻</a> <a href="https://github.com/brandonskerritt/RustScan/issues?q=author%3ASakiiR" title="Bug reports">🐛</a></td>
+    <td align="center"><a href="https://skerritt.blog"><img src="https://avatars3.githubusercontent.com/u/10378052?v=4" width="100px;" alt=""/><br /><sub><b>Bee</b></sub></a><br /><a href="#infra-beeskerritt" title="Infrastructure (Hosting, Build-Tools, etc)">🚇</a> <a href="https://github.com/RustScan/RustScan/commits?author=beeskerritt" title="Tests">⚠️</a> <a href="https://github.com/RustScan/RustScan/commits?author=beesan" title="Code">💻</a> <a href="#design-beeskerritt" title="Design">🎨</a></td>
+    <td align="center"><a href="https://sakiir.ovh"><img src="https://avatars1.githubusercontent.com/u/9950578?v=4" width="100px;" alt=""/><br /><sub><b>SakiiR</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=SakiiR" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3ASakiiR" title="Bug reports">🐛</a></td>
     <td align="center"><a href="https://github.com/smackhack"><img src="https://avatars2.githubusercontent.com/u/48143394?v=4" width="100px;" alt=""/><br /><sub><b>smackhack</b></sub></a><br /><a href="#ideas-smackhack" title="Ideas, Planning, & Feedback">🤔</a> <a href="#example-smackhack" title="Examples">💡</a></td>
+    <td align="center"><a href="http://bernardoamc.github.io/"><img src="https://avatars0.githubusercontent.com/u/428984?v=4" width="100px;" alt=""/><br /><sub><b>Bernardo Araujo</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=bernardoamc" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3Abernardoamc" title="Bug reports">🐛</a> <a href="#design-bernardoamc" title="Design">🎨</a></td>
+    <td align="center"><a href="https://github.com/Isona"><img src="https://avatars2.githubusercontent.com/u/11759523?v=4" width="100px;" alt=""/><br /><sub><b>Izzy Whistlecroft</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/issues?q=author%3AIsona" title="Bug reports">🐛</a></td>
+    <td align="center"><a href="https://imlonghao.com"><img src="https://avatars1.githubusercontent.com/u/4951333?v=4" width="100px;" alt=""/><br /><sub><b>imlonghao</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/issues?q=author%3Aimlonghao" title="Bug reports">🐛</a> <a href="#maintenance-imlonghao" title="Maintenance">🚧</a></td>
+    <td align="center"><a href="https://github.com/royharoush"><img src="https://avatars3.githubusercontent.com/u/8113056?v=4" width="100px;" alt=""/><br /><sub><b>royharoush</b></sub></a><br /><a href="#ideas-royharoush" title="Ideas, Planning, & Feedback">🤔</a> <a href="#design-royharoush" title="Design">🎨</a></td>
+  </tr>
+  <tr>
+    <td align="center"><a href="https://github.com/Atul9"><img src="https://avatars1.githubusercontent.com/u/3390330?v=4" width="100px;" alt=""/><br /><sub><b>Atul Bhosale</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=Atul9" title="Code">💻</a></td>
+    <td align="center"><a href="https://tgotwig.dev"><img src="https://avatars0.githubusercontent.com/u/30773779?v=4" width="100px;" alt=""/><br /><sub><b>Thomas Gotwig</b></sub></a><br /><a href="#platform-TGotwig" title="Packaging/porting to new platform">📦</a></td>
+    <td align="center"><a href="https://github.com/remigourdon"><img src="https://avatars3.githubusercontent.com/u/2874133?v=4" width="100px;" alt=""/><br /><sub><b>Rémi Gourdon</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=remigourdon" title="Documentation">📖</a> <a href="https://github.com/RustScan/RustScan/commits?author=remigourdon" title="Code">💻</a></td>
+    <td align="center"><a href="https://cmnatic.co.uk"><img src="https://avatars3.githubusercontent.com/u/4163116?v=4" width="100px;" alt=""/><br /><sub><b>Ben (CMNatic)</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=cmnatic" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/commits?author=cmnatic" title="Documentation">📖</a> <a href="#design-cmnatic" title="Design">🎨</a></td>
+    <td align="center"><a href="https://github.com/Ferryistaken"><img src="https://avatars3.githubusercontent.com/u/47927670?v=4" width="100px;" alt=""/><br /><sub><b>Alessandro Ferrari</b></sub></a><br /><a href="#content-Ferryistaken" title="Content">🖋</a></td>
+    <td align="center"><a href="https://github.com/Phenomite"><img src="https://avatars2.githubusercontent.com/u/8285537?v=4" width="100px;" alt=""/><br /><sub><b>Phenomite</b></sub></a><br /><a href="#content-Phenomite" title="Content">🖋</a></td>
+    <td align="center"><a href="https://supersandro.de/"><img src="https://avatars2.githubusercontent.com/u/7258858?v=4" width="100px;" alt=""/><br /><sub><b>Sandro</b></sub></a><br /><a href="#content-SuperSandro2000" title="Content">🖋</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3ASuperSandro2000" title="Bug reports">🐛</a> <a href="https://github.com/RustScan/RustScan/commits?author=SuperSandro2000" title="Code">💻</a></td>
+  </tr>
+  <tr>
+    <td align="center"><a href="https://swag.lgbt"><img src="https://avatars2.githubusercontent.com/u/25358963?v=4" width="100px;" alt=""/><br /><sub><b>Cass</b></sub></a><br /><a href="#platform-caass" title="Packaging/porting to new platform">📦</a> <a href="https://github.com/RustScan/RustScan/commits?author=caass" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3Acaass" title="Bug reports">🐛</a></td>
+    <td align="center"><a href="https://github.com/niklasmohrin"><img src="https://avatars0.githubusercontent.com/u/47574893?v=4" width="100px;" alt=""/><br /><sub><b>Niklas Mohrin</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=niklasmohrin" title="Documentation">📖</a> <a href="https://github.com/RustScan/RustScan/commits?author=niklasmohrin" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3Aniklasmohrin" title="Bug reports">🐛</a></td>
+    <td align="center"><a href="https://liberapay.com/Artem4/"><img src="https://avatars0.githubusercontent.com/u/5614476?v=4" width="100px;" alt=""/><br /><sub><b>Artem Polishchuk</b></sub></a><br /><a href="#platform-tim77" title="Packaging/porting to new platform">📦</a></td>
+    <td align="center"><a href="https://github.com/buermarc"><img src="https://avatars2.githubusercontent.com/u/44375277?v=4" width="100px;" alt=""/><br /><sub><b>buermarc</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=buermarc" title="Code">💻</a></td>
+    <td align="center"><a href="https://github.com/bergabman"><img src="https://avatars1.githubusercontent.com/u/44554109?v=4" width="100px;" alt=""/><br /><sub><b>bergabman</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=bergabman" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/issues?q=author%3Abergabman" title="Bug reports">🐛</a> <a href="#design-bergabman" title="Design">🎨</a></td>
+    <td align="center"><a href="https://github.com/dmitris"><img src="https://avatars0.githubusercontent.com/u/31205?v=4" width="100px;" alt=""/><br /><sub><b>Dmitry Savintsev</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=dmitris" title="Code">💻</a></td>
+    <td align="center"><a href="https://github.com/bofh69"><img src="https://avatars3.githubusercontent.com/u/1444315?v=4" width="100px;" alt=""/><br /><sub><b>Sebastian Andersson</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=bofh69" title="Code">💻</a></td>
+  </tr>
+  <tr>
+    <td align="center"><a href="https://github.com/mattcorbin"><img src="https://avatars3.githubusercontent.com/u/6537765?v=4" width="100px;" alt=""/><br /><sub><b>Matt Corbin</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=mattcorbin" title="Code">💻</a></td>
+    <td align="center"><a href="http://rootsploit.com"><img src="https://avatars2.githubusercontent.com/u/67270834?v=4" width="100px;" alt=""/><br /><sub><b>RootSploit</b></sub></a><br /><a href="#blog-rootsploit" title="Blogposts">📝</a></td>
+    <td align="center"><a href="https://github.com/eiffel-fl"><img src="https://avatars2.githubusercontent.com/u/12171754?v=4" width="100px;" alt=""/><br /><sub><b>eiffel-fl</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=eiffel-fl" title="Code">💻</a></td>
+    <td align="center"><a href="https://github.com/u5surf"><img src="https://avatars1.githubusercontent.com/u/14180225?v=4" width="100px;" alt=""/><br /><sub><b>Y.Horie</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=u5surf" title="Code">💻</a></td>
+    <td align="center"><a href="https://github.com/okrplay"><img src="https://avatars3.githubusercontent.com/u/32576280?v=4" width="100px;" alt=""/><br /><sub><b>Oskar</b></sub></a><br /><a href="https://github.com/RustScan/RustScan/commits?author=okrplay" title="Code">💻</a> <a href="https://github.com/RustScan/RustScan/commits?author=okrplay" title="Tests">⚠️</a></td>
   </tr>
 </table>
 
 <!-- markdownlint-enable -->
 <!-- prettier-ignore-end -->
+
 <!-- ALL-CONTRIBUTORS-LIST:END -->
 
 This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!
+
+<!--Links-->
+
+[Docker]: https://hub.docker.com/r/cmnatic/rustscan "This is the recommended distribution of rustscan"
+[kali]: https://github.com/RustScan/RustScan/wiki/Installation-Guide#%EF%B8%8F-debian--kali "Read the install guide"
+[Kali/Debian]: https://github.com/RustScan/RustScan/releases "Kali Debian"
+[Arch-Linux]: https://archlinux.org/packages/extra/x86_64/rustscan/ "Arch Linux installation of Rustscan"
+[Homebrew]: https://formulae.brew.sh/formula/rustscan "Homebrew install of Rustscan"
+[usage-1]: https://github.com/RustScan/RustScan/wiki/Usage "Basic Usage of Rustscan"
+[usage-0]: https://github.com/RustScan/RustScan/wiki/Installation-Guide#docker-whale "Use Docker Rustscan"
+[config-file-here]: https://github.com/RustScan/RustScan/wiki/Config-File "RustScan Configuration File"
+[usage-2]: https://github.com/RustScan/RustScan/wiki/Things-you-may-want-to-do-with-RustScan-but-don't-understand-how "Things you may want to do with rustscan but don't know how"
+[community-1]: https://github.com/RustScan/RustScan/wiki/Contributing "Learn how to contribute"
+[distributions-1]: https://software.opensuse.org/package/rustscan?search_term=rustscan "Open Suse rustscan distribution"
+[distributions-2]: https://copr.fedorainfracloud.org/coprs/atim/rustscan/ "Rustscan in Fedora"
+[repology-1]: https://repology.org/project/rustscan/versions "Packaging Status"
+[install-1]: https://github.com/RustScan/RustScan/wiki/Installation-Guide "Installation guide"
+[accessible-2]: https://bees.substack.com/p/making-hacking-accessible "Making Hacking Accessible"
+[extensible-2]: https://github.com/RustScan/RustScan/wiki/RustScan-Scripting-Engine "Scripting Engine"
+[speed-2]: https://github.com/sharkdp/hyperfine "Hyperfine"
+[speed-3]: https://github.com/RustScan/RustScan/wiki/Increasing-Speed-&-Accuracy "Increasing Speed & Accuracy"
+[toc-community]: https://github.com/RustScan/RustScan#-community "Community"
+[links-table-1]: https://github.com/RustScan/RustScan#-full-installation-guide "Full installation guide"
+[links-table-2]: https://github.com/bee-san/RustScan/wiki "Rustscan"
+[discord]: http://discord.skerritt.blog "Discord blog"
+[toc-install]: https://github.com/RustScan/RustScan/wiki/Installation-Guide "Installation Guide Wiki"
+[toc-docker-usage]: https://github.com/RustScan/RustScan/wiki/Installation-Guide#docker- "Docker Installation Guide Wiki"
+[usage-guide]: https://github.com/RustScan/RustScan#-usage
+[adaptive-learning]: https://github.com/RustScan/RustScan/wiki/Adaptive-Learning "Adaptive Learning"
+
+<!--Pictures-->
+
+[DockerPic]: https://github.com/RustScan/RustScan/blob/master/pictures/docker.png?raw=true "Docker install"
+[Kali1]: https://github.com/RustScan/RustScan/blob/master/pictures/kali.png?raw=true "Kali Picture"
+[Arch]: https://github.com/RustScan/RustScan/blob/master/pictures/arch.png?raw=true "Arch Linux"
+[Apple]: https://raw.githubusercontent.com/RustScan/RustScan/master/pictures/apple.png?size "Apple"
+[rustscan-svg]: https://repology.org/badge/vertical-allrepos/rustscan.svg "Picture of rustscan repology"
+[accessible-1]: pictures/accessible.gif "Fast"
+[adaptive-1]: pictures/adaptive.gif "Adaptive"
+[extensible-1]: pictures/scripts.gif "Scripts"
+[speed-1]: pictures/fast.gif "Speed"
+[badge-1]: https://img.shields.io/archlinux/v/extra/x86_64/rustscan?style=plastic&logo=archlinux&link=https%3A%2F%2Farchlinux.org%2Fpackages%2Fextra%2Fx86_64%2Frustscan%2F
+[badge-2]: https://img.shields.io/badge/Built%20with-Rust-Purple
+[badge-3]: https://img.shields.io/github/downloads/rustscan/rustscan/total?label=GitHub%20Downloads
+[badge-4]: https://img.shields.io/crates/d/rustscan?label=Cargo%20Downloads
+[badge-5]: https://img.shields.io/discord/754001738184392704
+[badge-6]: https://github.com/RustScan/RustScan/actions/workflows/build.yml/badge.svg?branch=master

benches/benchmark_helpers.rs

@@ -0,0 +1,89 @@
+use criterion::{criterion_group, criterion_main, Criterion};
+use rustscan::generated::get_parsed_data;
+use rustscan::input::{Opts, PortRanges, ScanOrder};
+use rustscan::port_strategy::PortStrategy;
+use rustscan::scanner::build_udp_payload_lookup;
+use std::collections::BTreeMap;
+use std::hint::black_box;
+use std::net::IpAddr;
+use std::time::Duration;
+
+fn bench_address() {
+    let _addrs = ["127.0.0.1".parse::<IpAddr>().unwrap()];
+}
+
+fn bench_port_strategy() {
+    let range = PortRanges(vec![(1, 1_000)]);
+    let _strategy = PortStrategy::pick(&Some(range.clone()), None, ScanOrder::Serial);
+}
+
+fn bench_address_parsing() {
+    let opts = Opts {
+        addresses: vec![
+            "127.0.0.1".to_owned(),
+            "10.2.0.1".to_owned(),
+            "192.168.0.0/24".to_owned(),
+        ],
+        exclude_addresses: Some(vec![
+            "10.0.0.0/8".to_owned(),
+            "172.16.0.0/12".to_owned(),
+            "192.168.0.0/16".to_owned(),
+            "172.16.0.1".to_owned(),
+        ]),
+        ..Default::default()
+    };
+    let _ips = rustscan::address::parse_addresses(&opts);
+}
+
+// Replicates the old UDP payload selection behavior:
+// scan the whole UDP payload map and find the last payload whose port list contains `port`.
+fn old_payload_for_port(udp_map: &'static BTreeMap<Vec<u16>, Vec<u8>>, port: u16) -> &'static [u8] {
+    let mut payload: &'static [u8] = b"";
+    for (ports, value) in udp_map.iter() {
+        if ports.contains(&port) {
+            payload = value.as_slice();
+        }
+    }
+    payload
+}
+
+fn criterion_benchmark(c: &mut Criterion) {
+    // Benching helper functions
+    c.bench_function("parse address", |b| b.iter(bench_address));
+
+    c.bench_function("port strategy", |b| b.iter(bench_port_strategy));
+
+    let mut address_group = c.benchmark_group("address parsing");
+    address_group.measurement_time(Duration::from_secs(10));
+    address_group.bench_function("parse addresses with exclusions", |b| {
+        b.iter(bench_address_parsing)
+    });
+    address_group.finish();
+
+    // UDP payload lookup micro-benchmark: compares the old linear scan of the
+    // payload map with the precomputed port -> payload lookup. No sockets.
+    let udp_map = get_parsed_data();
+    let lookup = build_udp_payload_lookup(udp_map);
+    let ports: Vec<u16> = (1..=4096).collect();
+
+    c.bench_function("udp payload lookup/old scan map 1..4096", |b| {
+        b.iter(|| {
+            for &p in ports.iter() {
+                let payload = old_payload_for_port(black_box(udp_map), black_box(p));
+                black_box(payload);
+            }
+        })
+    });
+
+    c.bench_function("udp payload lookup/new hashmap 1..4096", |b| {
+        b.iter(|| {
+            for &p in ports.iter() {
+                let payload = lookup.get(&p).copied().unwrap_or(b"");
+                black_box(payload);
+            }
+        })
+    });
+}
+
+criterion_group!(benches, criterion_benchmark);
+criterion_main!(benches);

build.rs

@@ -0,0 +1,306 @@
+use std::collections::BTreeMap;
+use std::fs::{self, File};
+
+use std::env;
+use std::io::{BufReader, Read};
+use std::path::PathBuf;
+use std::process::Command;
+
+// Reads in a file with payloads based on port
+pub fn main() {
+    let mut file_path = env::current_dir().expect("cant find curr dir");
+    file_path.push("./nmap-payloads");
+
+    let mut data = String::new();
+    let file = File::open(&file_path).expect("File not found.");
+    let mut file_buf = BufReader::new(file);
+    file_buf
+        .read_to_string(&mut data)
+        .expect("unable to read file");
+
+    let mut fp_map: BTreeMap<i32, String> = BTreeMap::new();
+
+    let mut count = 0;
+    let mut capturing = false;
+    let mut curr = String::new();
+
+    for line in data.trim().split('\n') {
+        // Strip a trailing carriage return so CRLF checkouts parse
+        // identically to LF ones (otherwise `\r` pollutes port tokens and
+        // blank lines stop looking blank).
+        let line = line.strip_suffix('\r').unwrap_or(line);
+        if line.contains('#') || line.is_empty() {
+            continue;
+        }
+
+        if line.starts_with("udp") {
+            if !curr.is_empty() {
+                fp_map.insert(count, curr);
+                curr = String::new();
+            }
+            capturing = true;
+            count += 1;
+        }
+
+        if capturing {
+            if !curr.is_empty() {
+                curr.push(' ');
+            }
+            curr.push_str(line);
+        }
+    }
+
+    let pb_linenr = ports_v(&fp_map);
+    let payb_linenr = payloads_v(&fp_map);
+    let map = port_payload_map(pb_linenr, payb_linenr);
+
+    generate_code(map);
+}
+
+/// Generates a file called Generated.rs and calls cargo fmt from the command line
+///
+/// # Arguments
+///
+/// * `port_payload_map` - A BTreeMap mapping port numbers to payload data
+fn generate_code(port_payload_map: BTreeMap<Vec<u16>, Vec<u8>>) {
+    let dest_path = PathBuf::from("src/generated.rs");
+
+    let mut generated_code = String::new();
+    generated_code.push_str("use std::collections::BTreeMap;\n");
+    generated_code.push_str("use once_cell::sync::Lazy;\n\n");
+
+    generated_code.push_str("fn generated_data() -> BTreeMap<Vec<u16>, Vec<u8>> {\n");
+    generated_code.push_str("    let mut map = BTreeMap::new();\n");
+
+    for (ports, payloads) in port_payload_map {
+        generated_code.push_str("    map.insert(vec![");
+        generated_code.push_str(
+            &ports
+                .iter()
+                .map(|&p| p.to_string())
+                .collect::<Vec<_>>()
+                .join(","),
+        );
+        generated_code.push_str("], vec![");
+        generated_code.push_str(
+            &payloads
+                .iter()
+                .map(|&p| p.to_string())
+                .collect::<Vec<_>>()
+                .join(","),
+        );
+        generated_code.push_str("]);\n");
+    }
+
+    generated_code.push_str("    map\n");
+    generated_code.push_str("}\n\n");
+
+    generated_code.push_str(
+        "static PARSED_DATA: Lazy<BTreeMap<Vec<u16>, Vec<u8>>> = Lazy::new(generated_data);\n",
+    );
+    generated_code.push_str("pub fn get_parsed_data() -> &'static BTreeMap<Vec<u16>, Vec<u8>> {\n");
+    generated_code.push_str("    &PARSED_DATA\n");
+    generated_code.push_str("}\n");
+
+    fs::write(dest_path, generated_code).unwrap();
+
+    // format the generated code
+    Command::new("cargo")
+        .arg("fmt")
+        .arg("--all")
+        .output()
+        .expect("Failed to execute cargo fmt");
+}
+
+/// Creates a BTreeMap of line numbers mapped to a Vec<u16> of ports
+///
+/// # Arguments
+///
+/// * `fp_map` - A BTreeMap containing the parsed file data
+///
+/// # Returns
+///
+/// A BTreeMap where keys are line numbers and values are vectors of ports
+fn ports_v(fp_map: &BTreeMap<i32, String>) -> BTreeMap<i32, Vec<u16>> {
+    let mut pb_linenr: BTreeMap<i32, Vec<u16>> = BTreeMap::new();
+    let mut port_list: Vec<u16> = Vec::new();
+
+    for (&line_nr, ports) in fp_map {
+        if ports.contains("udp ") {
+            let remain = &ports[4..];
+            let mut start = remain.split(' ');
+
+            let ports = start.next().unwrap();
+            let port_segments: Vec<&str> = ports.split(',').collect();
+
+            for segment in port_segments {
+                if segment.contains('-') {
+                    let range: Vec<&str> = segment.trim().split('-').collect();
+                    let start = range[0].parse::<u16>().unwrap();
+                    let end = range[1].parse::<u16>().unwrap();
+
+                    for port in start..end {
+                        port_list.push(port);
+                    }
+                } else if !segment.is_empty() {
+                    match segment.parse::<u16>() {
+                        Ok(port) => port_list.push(port),
+                        Err(_) => println!("Error parsing port: {segment}"),
+                    }
+                }
+            }
+        }
+
+        pb_linenr.insert(line_nr, port_list.clone());
+        port_list.clear();
+    }
+
+    pb_linenr
+}
+
+/// Parses out the Payloads into a BTreeMap of line numbers mapped to vectors of payload bytes
+///
+/// # Arguments
+///
+/// * `fp_map` - A BTreeMap containing the parsed file data
+///
+/// # Returns
+///
+/// A BTreeMap where keys are line numbers and values are vectors of payload bytes
+fn payloads_v(fp_map: &BTreeMap<i32, String>) -> BTreeMap<i32, Vec<u8>> {
+    let mut payb_linenr: BTreeMap<i32, Vec<u8>> = BTreeMap::new();
+
+    for (&line_nr, data) in fp_map {
+        if data.contains('"') {
+            let start = data.find('"').expect("payload opening \" not found");
+            // Pass from the opening quote: the decoder pairs quotes itself
+            // to split multi-line segments.
+            payb_linenr.insert(line_nr, parser(data[start..].trim()));
+        }
+    }
+
+    payb_linenr
+}
+
+/// Converts a quoted Nmap payload block to bytes.
+///
+/// # Arguments
+///
+/// * `payload` - The raw block text starting at its first opening quote:
+///   one or more `"..."` segments separated by whitespace
+///
+/// # Returns
+///
+/// The decoded probe bytes: segments are decoded with [`decode_segment`]
+/// and concatenated with no separators, so multi-line probes reassemble
+/// exactly.
+fn parser(payload: &str) -> Vec<u8> {
+    let mut bytes: Vec<u8> = Vec::new();
+    let mut rest = payload.trim();
+    while let Some(open) = rest.find('"') {
+        let after_open = &rest[open + 1..];
+        match split_segment(after_open) {
+            Some((segment, remainder)) => {
+                decode_segment(segment, &mut bytes);
+                rest = remainder;
+            }
+            None => {
+                // Unterminated trailing quote: decode what's left literally.
+                decode_segment(after_open, &mut bytes);
+                break;
+            }
+        }
+    }
+
+    bytes
+}
+
+/// Splits off the first `"..."` segment: `text` must start just after an
+/// opening quote. Escaped quotes (`\"`) do not terminate the segment.
+///
+/// Returns the segment body and the remainder after the closing quote.
+fn split_segment(text: &str) -> Option<(&str, &str)> {
+    let mut escaped = false;
+    for (i, c) in text.char_indices() {
+        if escaped {
+            escaped = false;
+            continue;
+        }
+        if c == '\\' {
+            escaped = true;
+            continue;
+        }
+        if c == '"' {
+            return Some((&text[..i], &text[i + 1..]));
+        }
+    }
+    None
+}
+
+/// Decodes one quoted Nmap payload segment in C-style escape format:
+/// `\xNN` becomes a byte, common single-char escapes (`\\`, `\"`,
+/// `\0`, `\n`, `\r`, `\t`) decode to their value, and every other
+/// character contributes its literal bytes.
+///
+/// Preserving literal text matters: several probes embed plain-text
+/// protocol words (the SNMP `public` community string, NetBIOS names,
+/// LDAP `objectClass`, SSDP headers). The previous hexdigits-only
+/// decoding mangled them into wrong bytes, so agents never answered.
+fn decode_segment(segment: &str, bytes: &mut Vec<u8>) {
+    let mut chars = segment.chars();
+    while let Some(c) = chars.next() {
+        if c != '\\' {
+            let mut buf = [0; 4];
+            bytes.extend_from_slice(c.encode_utf8(&mut buf).as_bytes());
+            continue;
+        }
+        match chars.next() {
+            Some('x') => {
+                let hi = chars.next().unwrap_or('0');
+                let lo = chars.next().unwrap_or('0');
+                let hex: String = [hi, lo].iter().collect();
+                bytes.push(u8::from_str_radix(&hex, 16).unwrap_or(0));
+            }
+            Some('0') => bytes.push(0),
+            Some('n') => bytes.push(b'\n'),
+            Some('r') => bytes.push(b'\r'),
+            Some('t') => bytes.push(b'\t'),
+            Some('\\') => bytes.push(b'\\'),
+            Some('"') => bytes.push(b'"'),
+            // Unknown escape: keep the character literally, matching Nmap,
+            // which passes unrecognized escapes through untouched.
+            Some(other) => {
+                let mut buf = [0; 4];
+                bytes.extend_from_slice(other.encode_utf8(&mut buf).as_bytes());
+            }
+            None => bytes.push(b'\\'),
+        }
+    }
+}
+
+/// Combines the ports BTreeMap and the Payloads BTreeMap
+///
+/// # Arguments
+///
+/// * `pb_linenr` - A BTreeMap mapping line numbers to vectors of ports
+/// * `payb_linenr` - A BTreeMap mapping line numbers to vectors of payload bytes
+///
+/// # Returns
+///
+/// A BTreeMap mapping vectors of ports to vectors of payload bytes
+fn port_payload_map(
+    pb_linenr: BTreeMap<i32, Vec<u16>>,
+    payb_linenr: BTreeMap<i32, Vec<u8>>,
+) -> BTreeMap<Vec<u16>, Vec<u8>> {
+    let mut ppm_fin: BTreeMap<Vec<u16>, Vec<u8>> = BTreeMap::new();
+
+    for (port_linenr, ports) in pb_linenr {
+        for (pay_linenr, payloads) in &payb_linenr {
+            if pay_linenr == &port_linenr {
+                ppm_fin.insert(ports.to_vec(), payloads.to_vec());
+            }
+        }
+    }
+
+    ppm_fin
+}

contributing.Dockerfile

@@ -0,0 +1,5 @@
+# Dockerfile for RustScan development environment
+# Provides a containerized setup with Rust and development tools
+FROM rust
+# Install rustfmt for code formatting and clippy for linting.
+RUN rustup component add rustfmt clippy

contributing.md

@@ -1,9 +1,83 @@
-This is my first Rust project! As such, I expect there are many, many bugs involved or things that can be sped up.
+Howdy Space Cow-Person 🤠🌌
 
-In particular, here is my roadmap:
-* Tokio async
-* Better UX
-* Optimised code
+RustScan is always looking for contributors. Whether that's spelling mistakes or major changes, your help is **wanted** and welcomed here.
 
+Before contributing, read our [code of conduct](https://github.com/RustScan/RustScan/blob/master/CODE_OF_CONDUCT.md).
 
-Please leave issues / pull requests, I'd love to learn more about this amazing language :) 
+TL;DR if you abuse members of our community you will be **perma-banned** with no chance to get unbanned. No warnings either. 🤗
+
+RustScan has 2 major labels for GitHub issues you should look at:
+
+- Good First issue
+  These are issues for newcomers to open source!
+  [https://github.com/RustScan/RustScan/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22](https://github.com/RustScan/RustScan/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22)
+- Help wanted
+  These are issues that aren't really for newcomers, but we could still do with help!
+  [https://github.com/RustScan/RustScan/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22+label%3A%22help+wanted%22](https://github.com/RustScan/RustScan/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22+label%3A%22help+wanted%22)
+
+If you want to, solve the issue or comment on the issue for help.
+
+The flow for contributing to open source software is:
+
+- Fork the repo
+- Make changes
+- Pull request to the repo
+
+And then comment on the issue that you've done.
+
+RustScan also has some `// TODO`'s in the codebase, which are meant more for the core team but we wouldn't say no to help with these issues.
+
+If you have any feature suggestions or bugs, leave a GitHub issue. We welcome any and all support :D
+
+## Rewarding you
+
+I cannot pay you :-( But, I can place your GitHub profile on the README under `#Contributors` as a thank you! :)
+
+## Contributing development environment
+
+To ease contribution to RustScan, you can use the `contributing.Dockerfile` to create a Docker image ready to build and play with RustScan.
+To build it you just need to run:
+
+```bash
+you@home:~/RustScan$ docker build -t rustscan_contributing -f contributing.Dockerfile
+```
+
+Then you need to run the container with a volume so it can access, _with read and write permissions_, to RustScan files:
+
+```bash
+you@home:~/RustScan$ docker run -ti --rm -v "$PWD":/rustscan -w /rustscan rustscan_contributing bash
+```
+
+You can now modify RustScan files with your favorite editor, once you want to compile and test your modifications, type the following in the container prompt:
+
+```bash
+root@container:/rustscan# cargo build
+```
+
+You can check the command-line interface without starting a scan:
+
+```bash
+root@container:/rustscan# cargo run -- --help
+```
+
+You can also format, lint with `clippy` and test the code with the following commands:
+
+```bash
+root@container:/rustscan# cargo fmt
+root@container:/rustscan# cargo clippy
+root@container:/rustscan# cargo test
+```
+
+Automated tests and benchmarks must run without network traffic or external script
+execution. Keep coverage focused on parsing, configuration, port ordering, socket
+address iteration, and timing helpers. Do not add tests that run TCP/UDP scans
+(including localhost), resolve hostnames, or launch Nmap or other scripts.
+
+Scanning behaviour and speed are measured separately, by the opt-in "Scan benchmark"
+GitHub Actions workflow (`.github/workflows/scan-benchmark.yml`). It runs for pull
+requests that touch the scanner, its runtime or its dependencies, and can be started
+by hand from the Actions tab. It builds the change and its base in release mode,
+scans listeners that it opens on 127.0.0.1 inside the runner, checks that both
+builds find the same open ports, and adds a comparison table to the job summary. Its
+script (`.github/scan-benchmark/scan_bench.py`) port-scans the loopback interface,
+so it is meant for disposable CI runners only.

docs/arm-support.md

@@ -0,0 +1,38 @@
+# ARM support
+
+This page covers which ARM targets RustScan's CI builds and tests, and how to build ARM binaries yourself.
+
+## What CI covers
+
+| Target | Built by | Tested by |
+| --- | --- | --- |
+| `aarch64-unknown-linux-gnu` (64-bit ARM Linux) | `build-nix` job in [build.yml](../.github/workflows/build.yml) | `Test Suite (ubuntu-24.04-arm)` in [test.yml](../.github/workflows/test.yml) |
+| `armv7-unknown-linux-gnueabihf` (32-bit ARM Linux) | `build-nix` job in [build.yml](../.github/workflows/build.yml) | not tested in CI |
+| `aarch64-apple-darwin` (Apple Silicon macOS) | `build-macos-aarch64` job in [build.yml](../.github/workflows/build.yml) | `Test Suite (macos-latest)` in [test.yml](../.github/workflows/test.yml) |
+
+- **Builds** use [`houseabsolute/actions-rust-cross`](https://github.com/houseabsolute/actions-rust-cross). It cross-compiles the Linux ARM targets with [`cross`](https://github.com/cross-rs/cross) on x86_64 runners.
+- **Tests** run natively on GitHub-hosted arm64 runners: `ubuntu-24.04-arm` for Linux, and `macos-latest`, which runs on Apple Silicon. They run the same `just test` recipe as every other platform.
+
+## Building ARM binaries locally
+
+The simplest option is `cross`, which runs the build in a container that already has the right toolchain and linker. It needs Docker or Podman.
+
+```sh
+cargo install cross
+cross build --locked --release --target aarch64-unknown-linux-gnu
+# or, for 32-bit ARM:
+cross build --locked --release --target armv7-unknown-linux-gnueabihf
+```
+
+The binary ends up at `target/<target>/release/rustscan`.
+
+On an ARM machine (for example a Raspberry Pi running a 64-bit OS, or an Apple Silicon Mac) you don't need `cross`; a normal native build works:
+
+```sh
+cargo build --locked --release
+```
+
+## Troubleshooting
+
+- **`error[E0463]: can't find crate for std`, or linker errors:** you're cross-compiling with plain `cargo`. Either use `cross`, or install the target (`rustup target add <target>`) along with a matching cross linker.
+- **`cross` can't pull its image:** check that Docker or Podman is running and that your user can reach it.

fixtures/.rustscan_scripts.toml

@@ -0,0 +1,4 @@
+tags = ["core_approved", "example"]
+ports = ["80", "443", "8080"]
+developer = ["example", "https://example.org"]
+directory = "fixtures/.rustscan_scripts" 

fixtures/.rustscan_scripts/test_script.txt

@@ -0,0 +1,7 @@
+Metadata-only test fixture; not executable.
+#tags = ["core_approved", "example"]
+#developer = [ "example", "https://example.org" ]
+#ports_separator = ","
+#call_format = "fixture {{ip}} {{port}}"
+
+The parser reads only the metadata above. This file contains no script body.

fixtures/.rustscan_scripts/test_script_invalid_headers.txt

@@ -0,0 +1,7 @@
+Metadata-only test fixture; not executable.
+#tags = "core_approved"
+#developer = [ "example", "https://example.org" ]
+#ports_separator = ","
+#call_format = "fixture {{ip}} {{port}}"
+
+# tags has to be an array, thus this file won't be parsed

fixtures/naughty_strings.txt

@@ -0,0 +1,42 @@
+# https://github.com/minimaxir/big-list-of-naughty-strings
+
+
+­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹󠀺󠀻󠀼󠀽󠀾󠀿󠁀󠁁󠁂󠁃󠁄󠁅󠁆󠁇󠁈󠁉󠁊󠁋󠁌󠁍󠁎󠁏󠁐󠁑󠁒󠁓󠁔󠁕󠁖󠁗󠁘󠁙󠁚󠁛󠁜󠁝󠁞󠁟󠁠󠁡󠁢󠁣󠁤󠁥󠁦󠁧󠁨󠁩󠁪󠁫󠁬󠁭󠁮󠁯󠁰󠁱󠁲󠁳󠁴󠁵󠁶󠁷󠁸󠁹󠁺󠁻󠁼󠁽󠁾󠁿
+
+Ω≈ç√∫˜µ≤≥÷
+åß∂ƒ©˙∆˚¬…æ
+œ∑´®†¥¨ˆøπ“‘
+¡™£¢∞§¶•ªº–≠
+¸˛Ç◊ı˜Â¯˘¿
+ÅÍÎÏ˝ÓÔÒÚÆ☃
+Œ„´‰ˇÁ¨ˆØ∏”’
+`⁄€‹›fifl‡°·‚—±
+⅛⅜⅝⅞
+ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя
+٠١٢٣٤٥٦٧٨٩
+
+
+
+⁰⁴⁵
+₀₁₂
+⁰⁴⁵₀₁₂
+ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็
+
+田中さんにあげて下さい
+パーティーへ行かないか
+和製漢語
+部落格
+사회과학원 어학연구소
+찦차를 타고 온 펲시맨과 쑛다리 똠방각하
+社會科學院語學研究所
+울란바토르
+𠜎𠜱𠝹𠱓𠱸𠲖𠳏
+𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠
+𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌
+𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈
+𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰
+𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘
+𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐
+⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢
+
+ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو.

fixtures/test_rustscan_scripts.toml

@@ -0,0 +1,14 @@
+# Test/Example ScriptConfig file
+
+# Tags to filter on scripts. Only scripts containing all these tags will run.
+tags = ["core_approved", "example"]
+
+# If it's present then only those scripts will run which has a tag ports = "80". Not yet implemented.
+#
+# ex.:
+# ports = ["80"]
+# ports = ["80","81","8080"]
+ports = ["80"]
+
+# Only this developer(s) scripts to run. Not yet implemented.
+developer = ["example"]

justfile

@@ -0,0 +1,18 @@
+test:
+    cargo test
+    cargo clippy -- --deny warnings
+    cargo clippy --tests -- --deny warnings
+    cargo fmt --check
+    cargo doc --workspace --all-features --no-deps --document-private-items
+
+fix:
+    cargo fmt
+    cargo clippy --fix
+
+# release only runs if test runs
+release: test
+    git checkout master
+    git pull
+    cargo generate-lockfile
+    cargo publish 
+    git push

nmap-payloads

@@ -0,0 +1,500 @@
+# Nmap nmap payload database -*- mode: fundamental; -*-
+# $Id$
+#
+# These payloads are sent with every host discovery or port scan probe
+# by default. This database should only include payloads that are
+# unlikely to crash services, trip IDS alerts, or change state on the
+# server. The idea behind these is to evoke a response using a payload.
+# Some of them are taken from nmap-service-probes.
+#
+# This collection of data is (C) 1996-2022 by Nmap Software LLC.  It
+# is distributed under the Nmap Public Source license as provided in
+# the LICENSE file of the source distribution or at
+# https://nmap.org/npsl/.  Note that this free license does not allow
+# incorporation of Nmap or its data files within proprietary
+# software. We sell a separate Nmap OEM for that as described
+# (including pricing) at https://nmap.org/npsl/.
+#
+# Each entry begins with a protocol (only "udp" is supported) followed
+# by a comma-separated list of ports, followed by one or more quoted
+# strings containing the payload. These elements may be broken across
+# several lines. For future expansion, additional keywords may follow
+# the payload data. Any data following one of these keywords must be on
+# the same line as the keyword so that unknown keywords can be ignored
+# by the parser. Currently this file contains some entries with the
+# "source" keyword to specify a desired source port, but it is not
+# honored by Nmap.
+#
+# Multiple payloads may be defined for a single protocol and port, in
+# which case they will be all be sent concurrently. There is a limit
+# of 255 payloads per port.
+#
+# Lines longer than 1024 characters will be ignored.
+#
+# Example:
+# udp 1234 "payloaddatapayloaddata"
+#   "payloaddatapayloaddata"
+# source 5678
+
+# GenericLines. Use for the echo service.
+udp 7 "\x0D\x0A\x0D\x0A"
+# DNSStatusRequest
+# Sent for TFTP (69) as well due to its ability to provoke an error response
+udp 53,69,5353,26198 "\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+# DNS VER
+udp 53,5353,26198
+  "\x77\x77\x01\x00\x00"
+  "\x01\x00\x00\x00\x00\x00\x00\x07version\x04bind\x00\x00\x10\x00\x03"
+
+# DHCP INFORM
+udp 67
+  "\x01\x01\x06\x00"
+  "\x01\x23\x45\x67\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x35\xd4\xd8\x51\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x63\x82\x53\x63\x35\x01"
+  "\x08\xff"
+
+# TFTP GET
+udp 69 "\x00\x01r7tftp.txt\x00octet\x00"
+
+# QUIC packet with unsupported version Q999
+# Also found on 443, but need to check whether DTLS or QUIC is more prevalent
+udp 80 "\r12345678Q999\x00"
+# RPCCheck
+udp 111
+  "\x72\xFE\x1D\x13\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xA0"
+  "\x00\x01\x97\x7C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00"
+# ONCRPC CALL
+udp 111,2049,4045,32768-65535
+  "\x3e\xec\xe3\xca\x00\x00\x00\x00\x00\x00\x00\x02\x00"
+  "\xbc\x61\x4e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+# NTPRequest
+udp 123
+  "\xE3\x00\x04\xFA\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\xC5\x4F\x23\x4B\x71\xB1\x52\xF3"
+# NTP REQ
+udp 123
+  "\xd9\x00\x0a\xfa\x00\x00\x00"
+  "\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc6"
+  "\xf1\x5e\xdb\x78\x00\x00\x00"
+# DCERPC CALL
+udp 135,1025-1199
+  "\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00"
+  "\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00"
+  "\x00\x00\x00\x01\x00\x01\x23\x45\x67\x89\xab\xcd\xef\x01\x23\x45\x67"
+  "\x89\xab\xcd\xef\xe7\x03\x00\x00\xfe\xdc\xba\x98\x76\x54\x32\x10\x01"
+  "\x23\x45\x67\x89\xab\xcd\xef\xe7\x03\x00\x00"
+# NBTStat
+udp 137
+  "\x80\xF0\x00\x10\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00\x21\x00\x01"
+# CIFS NS NAME QUERY UC
+udp 137
+  "\x01\x91\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00\x21\x00\x01"
+# CIFS NS NAME QUERY BC
+udp 137
+  "\x01\x91\x00\x10\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00\x21\x00\x01"
+# SNMPv3GetRequest
+udp 161,260,3401
+  "\x30\x3A\x02\x01\x03\x30\x0F\x02\x02\x4A\x69\x02\x03\x00\xFF\xE3"
+  "\x04\x01\x04\x02\x01\x03\x04\x10\x30\x0E\x04\x00\x02\x01\x00\x02"
+  "\x01\x00\x04\x00\x04\x00\x04\x00\x30\x12\x04\x00\x04\x00\xA0\x0C"
+  "\x02\x02\x37\xF0\x02\x01\x00\x02\x01\x00\x30\x00"
+# SNMP PUBLIC WALK
+udp 161,260,3401
+  "\x30\x1f\x02\x01\x00\x04\x06public\xa1\x12\x02\x01\x00\x02"
+  "\x01\x00\x02\x01\x00\x30\x07\x30\x05\x06\x01\x00\x05\x00"
+
+# Sqlping - disabled because it trips a Snort rule with SID 2049
+# ("MS-SQL ping attempt").
+# udp 1434 "\x02"
+
+# xdmcp - X Display Manager Control Protocol. Version 1, packet type
+# Query (2), no authorization names. We expect a Willing or Unwilling
+# packet in reply.
+# http://cgit.freedesktop.org/xorg/doc/xorg-docs/plain/hardcopy/XDMCP/xdmcp.PS.gz
+udp 177 "\x00\x01\x00\x02\x00\x01\x00"
+
+# Connectionless LDAP - used by Microsoft Active Directory
+udp 389
+  "\x30\x84\x00\x00\x00\x2d\x02\x01\x07\x63\x84\x00\x00\x00\x24\x04\x00"
+  "\x0a\x01\x00\x0a\x01\x00\x02\x01\x00\x02\x01\x64\x01\x01\x00\x87\x0b"
+  "objectClass0\x84\x00\x00\x00\x00"
+
+
+# svrloc
+udp 427
+  "\x02\x01\x00\x006 \x00\x00\x00\x00\x00\x01\x00\x02en\x00\x00\x00\x15"
+  "service:service-agent\x00\x07default\x00\x00\x00\x00"
+
+# DTLS
+udp 443,853,3391,4433,4740,5349,5684,5868,6514,6636,8232,10161,10162,12346,12446,12546,12646,12746,12846,12946,13046
+  # DTLS 1.0, length 52
+  "\x16\xfe\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36"
+  # ClientHello, length 40, sequence 0, offset 0
+  "\x01\x00\x00\x2a\x00\x00\x00\x00\x00\x00\x00\x2a"
+  # DTLS 1.2
+  "\xfe\xfd"
+  # Random
+  "\x00\x00\x00\x00\x7c\x77\x40\x1e\x8a\xc8\x22\xa0\xa0\x18\xff\x93"
+  "\x08\xca\xac\x0a\x64\x2f\xc9\x22\x64\xbc\x08\xa8\x16\x89\x19\x3f"
+  # Session id length 0, cookie length 0
+  "\x00\x00"
+  # Cipher suites, mandatory TLS_RSA_WITH_AES_128_CBC_SHA
+  "\x00\x02\x00\x2f"
+  # Compressors (NULL)
+  "\x01\x00"
+
+# Internet Key Exchange version 1, phase 1 Main Mode. We offer every
+# combination of (DES, 3DES) and (MD5, SHA) in the hope that one of them will
+# be acceptable. Because we use a fixed cookie, we set the association lifetime
+# to 1 second to reduce the chance that repeated probes will look like
+# retransmissions (and therefore not get a response). This payload comes from
+#   ike-scan --lifetime 1 --cookie 0011223344556677 --trans=5,2,1,2 --trans=5,1,1,2 --trans=1,2,1,2 --trans=1,1,1,2
+# We expect another phase 1 message in response. This payload works better with
+# a source port of 500 or a randomized initiator cookie.
+udp 500
+  # Initiator cookie 0x0011223344556677, responder cookie 0x0000000000000000.
+  "\x00\x11\x22\x33\x44\x55\x66\x77\x00\x00\x00\x00\x00\x00\x00\x00"
+  # Version 1, Main Mode, flags 0x00, message ID 0x00000000, length 192.
+  "\x01\x10\x02\x00\x00\x00\x00\x00\x00\x00\x00\xC0"
+  # Security Association payload, length 164, IPSEC, IDENTITY.
+  "\x00\x00\x00\xA4\x00\x00\x00\x01\x00\x00\x00\x01"
+  # Proposal 1, length 152, ISAKMP, 4 transforms.
+  "\x00\x00\x00\x98\x01\x01\x00\x04"
+  # Transform 1, 3DES-CBC, SHA, PSK, group 2.
+  "\x03\x00\x00\x24\x01\x01\x00\x00\x80\x01\x00\x05\x80\x02\x00\x02"
+  "\x80\x03\x00\x01\x80\x04\x00\x02"
+  "\x80\x0B\x00\x01\x00\x0C\x00\x04\x00\x00\x00\x01"
+  # Transform 2, 3DES-CBC, MD5, PSK, group 2.
+  "\x03\x00\x00\x24\x02\x01\x00\x00\x80\x01\x00\x05\x80\x02\x00\x01"
+  "\x80\x03\x00\x01\x80\x04\x00\x02"
+  "\x80\x0B\x00\x01\x00\x0C\x00\x04\x00\x00\x00\x01"
+  # Transform 3, DES-CBC, SHA, PSK, group 2.
+  "\x03\x00\x00\x24\x03\x01\x00\x00\x80\x01\x00\x01\x80\x02\x00\x02"
+  "\x80\x03\x00\x01\x80\x04\x00\x02"
+  "\x80\x0B\x00\x01\x00\x0C\x00\x04\x00\x00\x00\x01"
+  # Transform 4, DES-CBC, MD5, PSK, group 2.
+  "\x00\x00\x00\x24\x04\x01\x00\x00\x80\x01\x00\x01\x80\x02\x00\x01"
+  "\x80\x03\x00\x01\x80\x04\x00\x02"
+  "\x80\x0B\x00\x01\x00\x0C\x00\x04\x00\x00\x00\x01"
+# IPSEC START
+udp 500,4500
+  "\x31\x27\xfc"
+  "\xb0\x38\x10\x9e\x89\x00\x00\x00\x00\x00\x00\x00\x00\x01\x10\x02\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\xcc\x0d\x00\x00\x5c\x00\x00\x00\x01\x00"
+  "\x00\x00\x01\x00\x00\x00\x50\x01\x01\x00\x02\x03\x00\x00\x24\x01\x01"
+  "\x00\x00\x80\x01\x00\x05\x80\x02\x00\x02\x80\x04\x00\x02\x80\x03\x00"
+  "\x03\x80\x0b\x00\x01\x00\x0c\x00\x04\x00\x00\x0e\x10\x00\x00\x00\x24"
+  "\x02\x01\x00\x00\x80\x01\x00\x05\x80\x02\x00\x01\x80\x04\x00\x02\x80"
+  "\x03\x00\x03\x80\x0b\x00\x01\x00\x0c\x00\x04\x00\x00\x0e\x10\x0d\x00"
+  "\x00\x18\x1e\x2b\x51\x69\x05\x99\x1c\x7d\x7c\x96\xfc\xbf\xb5\x87\xe4"
+  "\x61\x00\x00\x00\x04\x0d\x00\x00\x14\x40\x48\xb7\xd5\x6e\xbc\xe8\x85"
+  "\x25\xe7\xde\x7f\x00\xd6\xc2\xd3\x0d\x00\x00\x14\x90\xcb\x80\x91\x3e"
+  "\xbb\x69\x6e\x08\x63\x81\xb5\xec\x42\x7b\x1f\x00\x00\x00\x14\x26\x24"
+  "\x4d\x38\xed\xdb\x61\xb3\x17\x2a\x36\xe3\xd0\xcf\xb8\x19"
+
+# Routing Information Protocol version 1. Special-case request for the entire
+# routing table (address family 0, address 0.0.0.0, metric 16). RFC 1058,
+# section 3.4.1.
+udp 520
+  "\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x10"
+
+# RMCP ASF ping
+udp 623
+  "\x06\x00\xff\x06" # RMCP version 6, sequence 0xff, normal RMCP class ASF
+  "\x00\x00\x11\xbe" # IAN ASF code 4542
+  "\x80\x00\x00\x00" # payload-less ASF presence ping
+
+# IPMI
+# RMCP Get Channel Auth Capabilities
+udp 623
+  "\x06\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x20\x18"
+  "\xc8\x81\x00\x38\x8e\x04\xb5"
+
+# serialnumberd. This service runs on Mac OS X Server. This probe
+# requests the serial number of another server. In response we expect a
+# packet starting with "SNRESPS:", followed by some data whose purpose
+# is not known.
+udp 626 "SNQUERY: 127.0.0.1:AAAAAA:xsvr"
+
+# OpenVPN P_CONTROL_HARD_RESET_CLIENT_V2
+# Byte 0; 0x38 opcode
+# Byte 1-8: Session ID, random
+# Byte 9: Message packet-id array length (0)
+# Byte 10-13: Message packet-id (0)
+udp 1194 "8d\xc1x\x01\xb8\x9b\xcb\x8f\0\0\0\0\0"
+# OpenVPN when in PKI mode and without the "HMAC Firewall" setting enabled
+# (tls-auth) should respond to the following probe, which is
+# 0x38<8 random bytes><4 null bytes>
+udp 1194
+  "\x38\x01\x02\x03\x04\x05\x06\x07\x08\x00\x00\x00\x00"
+
+# Citrix MetaFrame application browser service
+# Original idea from http://sh0dan.org/oldfiles/hackingcitrix.html
+# Payload contents copied from Wireshark capture of Citrix Program
+# Neighborhood client application.  The application uses this payload to
+# locate Citrix servers on the local network.  Response to this probe is
+# a 48 byte UDP payload as shown here:
+#
+# 0000   30 00 02 31 02 fd a8 e3 02 00 06 44 c0 a8 80 55
+# 0010   00 00 00 00 00 00 00 00 00 00 00 00 02 00 06 44
+# 0020   c0 a8 80 56 00 00 00 00 00 00 00 00 00 00 00 00
+#
+# The first 12 bytes appear to be the same in all responses.
+#
+# Bytes 0x00 appears to be a packet length field
+# Bytes 0x0C - 0x0F are the IP address of the server
+# Bytes 0x10 - 0x13 may vary, 0x14 - 0x1F do not appear to
+# Bytes 0x20 - 0x23 are the IP address of the primary system in a server farm
+#                   configuration
+# Bytes 0x24 - 0x27 can vary, 0x28 - 0x2F do not appear to
+udp 1604
+  "\x1e\x00\x01\x30\x02\xfd\xa8\xe3\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# RADIUS Access-Request. This is a degenerate packet with no username or
+# password; we expect an Access-Reject in response. The Identifier and Request
+# Authenticator are both 0. It was generated by running
+#   echo 'User-Password = ""' | radclient <ip> auth ""
+# and then manually stripping out the password.
+#
+# Section 2 of the RFC says "A request from a client for which the
+# RADIUS server does not have a shared secret MUST be silently
+# discarded." So this payload only works when the server is configured
+# (or misconfigured) to know the scanning machine as a client.
+#
+# RFC 2865: "The early deployment of RADIUS was done using UDP port
+# number 1645, which conflicts with the "datametrics" service. The
+# officially assigned port number for RADIUS is 1812.
+udp 1645,1812
+  "\x01\x00\x00\x14"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# L2TP ICRQ
+udp 1701
+  "\xc8\x02"
+  "\x00\x3c\x00\x00\x00\x00\x00\x00\x00\x00\x80\x08\x00\x00\x00\x00\x00"
+  "\x01\x80\x08\x00\x00\x00\x02\x01\x00\x80\x0e\x00\x00\x00\x07"
+  "nxp-scan\x80\x0a\x00\x00\x00\x03\x00\x00\x00\x03\x80"
+  "\x08\x00\x00\x00\x09\x00\x00"
+
+# UPNP MSEARCH
+udp 1900
+  "M-SEARCH * HTTP/1.1\r\nHost: 239.255.255.250:1900\r\n"
+  "Man: \"ssdp:discover\"\r\nMX: 5\r\nST: ssdp:all\r\n\r\n"
+
+# NFS version 2, RFC 1831. XID 0x00000000, program 100003 (NFS), procedure
+# NFSPROC_NULL (does nothing, see section 2.2.1), null authentication (see
+# section 9.1).
+udp 2049
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xA3"
+  "\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+  "\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# GPRS Tunneling Protocol (GTP)
+udp 2123,2152
+# GTPv1, protocol 1
+"\x32"
+# EchoRequest
+"\x01"
+# message length
+"\x00\x04"
+# Tunnel endpoint identifier
+"\x00\x00\x42\x00"
+# sequence number
+"\x13\x37"
+# N-PDU number
+"\x00"
+# next extension header type
+"\x00"
+
+# GPRS Tunneling Protocol (GTP) "prime" v2
+# This same packet can be used for GTP v2 on ports 2123 and 2152 if you change
+# the first byte from \x4e to \x40
+udp 3386
+# GTP'v2
+"\x4e"
+# EchoRequest
+"\x01"
+# message length
+"\x00\x04"
+# sequence number
+"\xde\xfe\xc8\x00"
+
+# Freelancer game server status query
+# http://sourceforge.net/projects/gameq/
+# (relevant files: games.ini, packets.ini, freelancer.php)
+udp 2302 "\x00\x02\xf1\x26\x01\x26\xf0\x90\xa6\xf0\x26\x57\x4e\xac\xa0\xec\xf8\x68\xe4\x8d\x21"
+
+# Apple Remote Desktop (ARD)
+udp 3283 "\0\x14\0\x01\x03"
+
+# STUN Binding request, see RFC 5389 Section 6
+# message type = 0x001, Binding (see Section 18.1)
+# message length = 0
+# magic cookie = 0x2112a442
+# transaction ID = "\x00"*12
+udp 3478 "\x00\x01\x00\x00\x21\x12\xa4\x42\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# Sun Service Tag Discovery protocol (stdiscover)
+# http://arc.opensolaris.org/caselog/PSARC/2006/638/stdiscover_protocolv2.pdf
+# Would work better with a varying cookie; the second and later sends of this
+# probe will be interpreted as resends by the server and will be ignored.
+udp 6481 "[PROBE] 0000"
+
+# NAT-PMP external IP address request. See section 3.2 of
+# http://files.dns-sd.org/draft-cheshire-nat-pmp.txt.
+udp 5351 "\x00\x00"
+
+# DNS Service Discovery (DNS-SD) service query, as used in Zeroconf.
+# Transaction ID 0x0000, flags 0x0000, 1 question: PTR query for
+# _services._dns-sd._udp.local. If the remote host supports DNS-SD it will send
+# back a list of all its services. This is the same as a packet capture of
+#   dns-sd -B _services._dns-sd._udp .
+# See section 9 of
+# http://files.dns-sd.org/draft-cheshire-dnsext-dns-sd.txt.
+# This first probe is a QU probe, meaning a unicast response is desired
+udp 5353
+  "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x09_services\x07_dns-sd\x04_udp\x05local\x00\x00\x0C\x80\x01"
+# This second probe is a QM probe, meaning a unicast response is desired
+udp 5353
+  "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
+  "\x09_services\x07_dns-sd\x04_udp\x05local\x00\x00\x0C\x00\x01"
+
+# PCANY STATUS
+udp 5632 "ST"
+
+# CoAP GET .well-known/core
+udp 5683 "@\x01\x01\xce\xbb.well-known\x04core"
+
+# UT2K PING
+udp 7777 "None\x00"
+
+# Ubiquiti Discovery Service - v1
+udp 10001 "\x01\x00\x00\x00"
+
+# Amanda backup service noop request. I think that this does nothing on the
+# server but only asks it to send back its feature list. In reply we expect an
+# ACK or (more likely) an ERROR. I couldn't find good online documentation of
+# the Amanda network protocol. There is parsing code in the Amanda source at
+# common-src/security-util.c. This is based on a packet capture of
+#   amcheck <config> <host>
+udp 10080
+  "Amanda 2.6 REQ HANDLE 000-00000000 SEQ 0\n"
+  "SERVICE noop\n"
+
+# VxWorks Wind River Debugger
+udp 17185
+# Random XID
+"\x00\x00\x00\x00"
+# RPC version 2 procedure call
+"\x00\x00\x00\x00\x00\x00\x00\x02"
+# WDB version 1
+"\x55\x55\x55\x55\x00\x00\x00\x01"
+# WDB_TARGET_PING
+"\x00\x00\x00\x00"
+# RPC Auth NULL
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+# Checksum
+"\xff\xff\x55\x13"
+# WDB wrapper (length and sequence number)
+"\x00\x00\x00\x30\x00\x00\x00\x01"
+# Empty data?
+"\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"
+# VXWORKS DEBUG (alternative?)
+udp 17185
+  "\x72\x37\x72\x37\x00\x00\x00"
+  "\x00\x00\x00\x00\x02\x55\x55\x55\x55\x00\x00\x00\x01\x00\x00\x00\x01"
+  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff"
+  "\xff\x55\x10\x00\x00\x00\x3c\x00\x00\x00\x03\x00\x00\x00\x02\x00\x00"
+  "\x00\x00\x00\x00\x00\x00"
+
+# Quake 2 and Quake 3 game servers (and servers of derived games like Nexuiz).
+# Gets game information from the server (see probe responses in
+# nmap-service-probes). These services typically run on a base port or a
+# few numbers higher.
+# Quake 2. Typical ports: 27910-27914.
+udp 27910-27914 "\xff\xff\xff\xffstatus"
+# Quake 3. Typical ports:
+# 26000-26004: Nexuiz
+# 27960-27964: Various games
+# 30720-30724: Tremulous
+# 44400: Warsow
+udp 26000-26004,27960-27964,30720-30724,44400 "\xff\xff\xff\xffgetstatus"
+
+# Murmur 1.2.X (Mumble server)
+# UDP ping. "abcdefgh" is an identifier. See
+# http://mumble.sourceforge.net/Protocol.
+udp 64738 "\x00\x00\x00\x00abcdefgh"
+
+# Ventrilo 2.1.2+
+# UDP general status request (encrypted).
+# See http://aluigi.altervista.org/papers.htm#ventrilo
+udp 3784
+"\x01\xe7\xe5\x75\x31\xa3\x17\x0b\x21\xcf\xbf\x2b\x99\x4e\xdd\x19\xac\xde\x08\x5f\x8b\x24\x0a\x11\x19\xb6\x73\x6f\xad\x28\x13\xd2\x0a\xb9\x12\x75"
+
+# Kademlia (kad) as used by various P2P applications.  Send a Kademlia ping
+# 4665, 4666, 4672, 6429: eDonkey/eMule and variants
+udp 4665,4666,4672,6429 "\xE4\x60"
+
+# TeamSpeak 2
+# UDP login request
+# See http://wiki.wireshark.org/TeamSpeak2
+udp 8767
+"\xf4\xbe\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x002x\xba\x85\tTeamSpeak\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\nWindows XP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00 \x00<\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08nickname\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# TS3INIT1
+udp 9987
+"TS3INIT1\x00\x65\x00\x00\x88\x0a\x39\x7b\x0f\x00\x5b\x55\x72\xef\xdc\x78\x32\x6b\x00\x00\x00\x00\x00\x00\x00\x00"
+
+# TeamSpeak 3
+# UDP login request (encrypted)
+# http://seclists.org/nmap-dev/2013/q3/72
+udp 9987
+"\x05\xca\x7f\x16\x9c\x11\xf9\x89\x00\x00\x00\x00\x02\x9d\x74\x8b\x45\xaa\x7b\xef\xb9\x9e\xfe\xad\x08\x19\xba\xcf\x41\xe0\x16\xa2\x32\x6c\xf3\xcf\xf4\x8e\x3c\x44\x83\xc8\x8d\x51\x45\x6f\x90\x95\x23\x3e\x00\x97\x2b\x1c\x71\xb2\x4e\xc0\x61\xf1\xd7\x6f\xc5\x7e\xf6\x48\x52\xbf\x82\x6a\xa2\x3b\x65\xaa\x18\x7a\x17\x38\xc3\x81\x27\xc3\x47\xfc\xa7\x35\xba\xfc\x0f\x9d\x9d\x72\x24\x9d\xfc\x02\x17\x6d\x6b\xb1\x2d\x72\xc6\xe3\x17\x1c\x95\xd9\x69\x99\x57\xce\xdd\xdf\x05\xdc\x03\x94\x56\x04\x3a\x14\xe5\xad\x9a\x2b\x14\x30\x3a\x23\xa3\x25\xad\xe8\xe6\x39\x8a\x85\x2a\xc6\xdf\xe5\x5d\x2d\xa0\x2f\x5d\x9c\xd7\x2b\x24\xfb\xb0\x9c\xc2\xba\x89\xb4\x1b\x17\xa2\xb6"
+
+# Memcached
+# version request (shorter response than stats)
+# https://github.com/memcached/memcached/blob/master/doc/protocol.txt
+udp 11211
+"\0\x01\0\0\0\x01\0\0version\r\n"
+
+# Steam, typically using a port in 27015-27030.  Send a "Source Engine query"
+udp 27015-27030
+  "\xff\xff\xff\xffTSource Engine Query\x00"
+
+# TRIN00 UNIX PING
+udp 27444 "png l44adsl"
+
+# BO PING
+udp 31337
+  "\xce\x63\xd1\xd2\x16\xe7\x13\xcf\x38"
+  "\xa5\xa5\x86\xb2\x75\x4b\x99\xaa\x32\x58"
+
+# TRIN00 WIN PING
+udp 34555 "png []..Ks"
+
+# Beckhoff ADS discovery request
+# https://github.com/ONE75/adsclient/blob/master/src/AdsClient.Finder/DeviceFinder.cs#L49-L64
+udp 48899
+"\x03\x66\x14\x71\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x01\x10\x27\x00\x00\x00\x00"

pictures/accessible.yml

@@ -0,0 +1,131 @@
+# The configurations that used for the recording, feel free to edit them
+config:
+
+  # Specify a command to be executed
+  # like `/bin/bash -l`, `ls`, or any other commands
+  # the default is bash for Linux
+  # or powershell.exe for Windows
+  command: zsh
+  
+  # Specify the current working directory path
+  # the default is the current working directory path
+  cwd: /home/bee/Documents/RustScan
+  
+  # Export additional ENV variables
+  env:
+    recording: true
+  
+  # Explicitly set the number of columns
+  # or use `auto` to take the current
+  # number of columns of your shell
+  cols: 107
+  
+  # Explicitly set the number of rows
+  # or use `auto` to take the current
+  # number of rows of your shell
+  rows: 43
+  
+  # Amount of times to repeat GIF
+  # If value is -1, play once
+  # If value is 0, loop indefinitely
+  # If value is a positive number, loop n times
+  repeat: 0
+  
+  # Quality
+  # 1 - 100
+  quality: 100
+  
+  # Delay between frames in ms
+  # If the value is `auto` use the actual recording delays
+  frameDelay: auto
+  
+  # Maximum delay between frames in ms
+  # Ignored if the `frameDelay` isn't set to `auto`
+  # Set to `auto` to prevent limiting the max idle time
+  maxIdleTime: 2000
+  
+  # The surrounding frame box
+  # The `type` can be null, window, floating, or solid`
+  # To hide the title use the value null
+  # Don't forget to add a backgroundColor style with a null as type
+  frameBox:
+    type: floating
+    title: Terminalizer
+    style:
+      border: 0px black solid
+      # boxShadow: none
+      # margin: 0px
+  
+  # Add a watermark image to the rendered gif
+  # You need to specify an absolute path for
+  # the image on your machine or a URL, and you can also
+  # add your own CSS styles
+  watermark:
+    imagePath: null
+    style:
+      position: absolute
+      right: 15px
+      bottom: 15px
+      width: 100px
+      opacity: 0.9
+  
+  # Cursor style can be one of
+  # `block`, `underline`, or `bar`
+  cursorStyle: block
+  
+  # Font family
+  # You can use any font that is installed on your machine
+  # in CSS-like syntax
+  fontFamily: "Monaco, Lucida Console, Ubuntu Mono, Monospace"
+  
+  # The size of the font
+  fontSize: 12
+  
+  # The height of lines
+  lineHeight: 1
+  
+  # The spacing between letters
+  letterSpacing: 0
+  
+  # Theme
+  theme:
+    background: "transparent"
+    foreground: "#afafaf"
+    cursor: "#c7c7c7"
+    black: "#232628"
+    red: "#fc4384"
+    green: "#b3e33b"
+    yellow: "#ffa727"
+    blue: "#75dff2"
+    magenta: "#ae89fe"
+    cyan: "#708387"
+    white: "#d5d5d0"
+    brightBlack: "#626566"
+    brightRed: "#ff7fac"
+    brightGreen: "#c8ed71"
+    brightYellow: "#ebdf86"
+    brightBlue: "#75dff2"
+    brightMagenta: "#ae89fe"
+    brightCyan: "#b1c6ca"
+    brightWhite: "#f9f9f4"
+  
+# Records, feel free to edit them
+records:
+  - delay: 436
+    content: "\e[1m\e[7m%\e[27m\e[1m\e[0m                                                                                                          \r \r\e]2;bee@beehive:~/Documents/RustScan\a\e]1;..ents/RustScan\a"
+  - delay: 162
+    content: "\r\e[0m\e[27m\e[24m\e[J\r\n\e[1m\e[0m\e[1m\e[36mRustScan\e[0m\e[36m\e[39m\e[1m \e[0m\e[1mon \e[0m\e[1m\e[37m\e[1m\e[37m\e[0m\e[37m\e[1m\e[37m\e[35m master\e[0m\e[35m\e[39m\e[1m\e[0m\e[1m\e[0m\e[1m\e[31m [?]\e[0m\e[31m\e[39m\e[1m\e[0m\e[0m\e[39m\e[1m \e[0m\e[1mis \e[0m\e[1m\e[31m\U0001F4E6 vrustscan:1.10.0\e[0m\e[31m\e[39m\e[1m \e[0m\e[1mvia \e[0m\e[1m\e[31m\U0001D5E5 v1.46.0\e[0m\e[31m\e[39m\e[1m \e[0m\r\n\e[1m\e[0m\e[1m\e[32m➜ \e[0m\e[32m\e[39m\e[1m\e[0m\e[K\e[?1h\e=\e[?2004h"
+  - delay: 471
+    content: "r\brustscan 127.0.0.1 --accessible --no-nmap --ulimit 5000\e[55D\e[7mr\e[7mu\e[7ms\e[7mt\e[7ms\e[7mc\e[7ma\e[7mn\e[7m \e[7m1\e[7m2\e[7m7\e[7m.\e[7m0\e[7m.\e[7m0\e[7m.\e[7m1\e[7m \e[7m-\e[7m-\e[7ma\e[7mc\e[7mc\e[7me\e[7ms\e[7ms\e[7mi\e[7mb\e[7ml\e[7me\e[7m \e[7m-\e[7m-\e[7mn\e[7mo\e[7m-\e[7mn\e[7mm\e[7ma\e[7mp\e[7m \e[7m-\e[7m-\e[7mu\e[7ml\e[7mi\e[7mm\e[7mi\e[7mt\e[7m \e[7m5\e[7m0\e[7m0\e[7m0\e[27m"
+  - delay: 269
+    content: "\e[55D\e[27mr\e[27mu\e[27ms\e[27mt\e[27ms\e[27mc\e[27ma\e[27mn\e[27m \e[27m1\e[27m2\e[27m7\e[27m.\e[27m0\e[27m.\e[27m0\e[27m.\e[27m1\e[27m \e[27m-\e[27m-\e[27ma\e[27mc\e[27mc\e[27me\e[27ms\e[27ms\e[27mi\e[27mb\e[27ml\e[27me\e[27m \e[27m-\e[27m-\e[27mn\e[27mo\e[27m-\e[27mn\e[27mm\e[27ma\e[27mp\e[27m \e[27m-\e[27m-\e[27mu\e[27ml\e[27mi\e[27mm\e[27mi\e[27mt\e[27m \e[27m5\e[27m0\e[27m0\e[27m0\e[?1l\e>\e[?2004l\r\r\n\e]2;rustscan 127.0.0.1 --accessible --no-nmap --ulimit 5000\a\e]1;rustscan\aAutomatically increasing ulimit value to 5000.\r\n"
+  - delay: 1536
+    content: "Open 127.0.0.1:38602\r\n"
+  - delay: 395
+    content: "Open 127.0.0.1:50078\r\n"
+  - delay: 450
+    content: "127.0.0.1 -> [38602,50078]\r\n\e[1m\e[7m%\e[27m\e[1m\e[0m                                                                                                          \r \r\e]2;bee@beehive:~/Documents/RustScan\a\e]1;..ents/RustScan\a"
+  - delay: 143
+    content: "\r\e[0m\e[27m\e[24m\e[J\r\n\e[1m\e[0m\e[1m\e[36mRustScan\e[0m\e[36m\e[39m\e[1m \e[0m\e[1mon \e[0m\e[1m\e[37m\e[1m\e[37m\e[0m\e[37m\e[1m\e[37m\e[35m master\e[0m\e[35m\e[39m\e[1m\e[0m\e[1m\e[0m\e[1m\e[31m [?]\e[0m\e[31m\e[39m\e[1m\e[0m\e[0m\e[39m\e[1m \e[0m\e[1mis \e[0m\e[1m\e[31m\U0001F4E6 vrustscan:1.10.0\e[0m\e[31m\e[39m\e[1m \e[0m\e[1mvia \e[0m\e[1m\e[31m\U0001D5E5 v1.46.0\e[0m\e[31m\e[39m\e[1m \e[0m\e[1mtook \e[0m\e[1m\e[33m2s\e[0m\e[33m\e[39m\e[1m \e[0m\r\n\e[1m\e[0m\e[1m\e[32m➜ \e[0m\e[32m\e[39m\e[1m\e[0m\e[K\e[?1h\e=\e[?2004h"
+  - delay: 563
+    content: "\e[?2004l\r\r\n"

release.sh

@@ -0,0 +1 @@
+cargo publish && cargo build --release && git add Cargo.lock && git commit -m 'Updating lock file' && gpsup

rustscan-debbuilder/Dockerfile

@@ -1,20 +0,0 @@
-FROM rust:latest
-
-RUN git clone https://github.com/brandonskerritt/RustScan
-WORKDIR "/RustScan"
-RUN git pull --force
-RUN cargo install cargo-deb
-
-RUN apt update -y && apt upgrade -y
-RUN apt install libc6-dev-i386 -y
-RUN git clone --depth=1 https://github.com/raspberrypi/tools /raspberrypi-tools
-ENV PATH=/raspberrypi-tools/arm-bcm2708/gcc-linaro-arm-linux-gnueabihf-raspbian-x64/bin/:$PATH
-ENV CARGO_TARGET_ARM_UNKNOWN_LINUX_GNUEABIHF_LINKER=arm-linux-gnueabihf-gcc
-RUN mkdir /root/.cargo
-RUN echo "[target.arm-unknown-linux-gnueabihf]" >> /root/.cargo/config
-RUN echo "strip = { path = \"arm-linux-gnueabihf-strip\" }" >> /root/.cargo/config
-RUN echo "objcopy = { path = \"arm-linux-gnueabihf-objcopy\" }" >> /root/.cargo/config
-
-COPY ./entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]

rustscan-debbuilder/entrypoint.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-
-cd /RustScan
-git pull --force
-
-#amd64
-cargo deb
-
-#arm64
-rustup target add arm-unknown-linux-gnueabihf
-cargo deb --target=arm-unknown-linux-gnueabihf
-
-#i386
-rustup target add i686-unknown-linux-gnu
-cargo deb --target=i686-unknown-linux-gnu
-
-find target/ -name \*.deb -exec cp {} /debs \;

rustscan-debbuilder/run.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-docker build -t rustscan-builder . || exit
-
-# This creates a volume which binds your currentdirectory/debs to 
-# the location where the deb files get spat out in the container.
-# You don't need to worry about it. Just chmod +x run.sh && ./run.sh and
-# you'll get yer .deb file in a few minutes. It runs faster after you've used it the first time.
-docker run -v "$(pwd)/debs:/debs" rustscan-builder

src/address.rs

@@ -0,0 +1,479 @@
+//! Provides functions to parse input IP addresses, CIDRs or files.
+use std::collections::BTreeSet;
+use std::fs::{self, File};
+use std::io::{prelude::*, BufReader};
+use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
+use std::path::Path;
+use std::str::FromStr;
+
+use cidr_utils::cidr::{IpCidr, IpInet};
+use hickory_resolver::{
+    config::{NameServerConfig, Protocol, ResolverConfig, ResolverOpts},
+    Resolver,
+};
+use log::debug;
+
+use crate::input::Opts;
+use crate::warning;
+
+/// Parses the string(s) into IP addresses.
+///
+/// Goes through all possible IP inputs (files or via argparsing).
+///
+/// ```rust
+/// # use rustscan::input::Opts;
+/// # use rustscan::address::parse_addresses;
+/// let mut opts = Opts::default();
+/// opts.addresses = vec!["192.168.0.0/30".to_owned()];
+///
+/// let ips = parse_addresses(&opts);
+/// ```
+///
+/// Finally, any duplicates are removed to avoid excessive scans.
+///
+/// # Blocking
+///
+/// This function blocks: it reads files and resolves host names, and
+/// hickory's synchronous [`Resolver`] runs a Tokio runtime of its own, which
+/// Tokio refuses to drop inside an asynchronous context. Call it before you
+/// start your runtime (as the `rustscan` binary does) or from
+/// `tokio::task::spawn_blocking`, not directly from async code.
+pub fn parse_addresses(input: &Opts) -> Vec<IpAddr> {
+    let mut ips: Vec<IpAddr> = Vec::new();
+    let mut unresolved_addresses: Vec<&str> = Vec::new();
+    let backup_resolver = get_resolver(&input.resolver);
+
+    for address in &input.addresses {
+        let parsed_ips = parse_address(address, &backup_resolver);
+        if !parsed_ips.is_empty() {
+            ips.extend(parsed_ips);
+        } else {
+            unresolved_addresses.push(address);
+        }
+    }
+
+    // If we got to this point this can only be a file path or the wrong input.
+    for file_path in unresolved_addresses {
+        let file_path = Path::new(file_path);
+
+        if !file_path.is_file() {
+            warning!(
+                format!("Host {file_path:?} could not be resolved."),
+                input.greppable,
+                input.accessible
+            );
+
+            continue;
+        }
+
+        if let Ok(x) = read_ips_from_file(file_path, &backup_resolver) {
+            ips.extend(x);
+        } else {
+            warning!(
+                format!("Host {file_path:?} could not be resolved."),
+                input.greppable,
+                input.accessible
+            );
+        }
+    }
+
+    let excluded_cidrs = parse_excluded_networks(&input.exclude_addresses, &backup_resolver);
+
+    // Remove duplicated/excluded IPs.
+    let mut seen = BTreeSet::new();
+    ips.retain(|ip| seen.insert(*ip) && !excluded_cidrs.iter().any(|cidr| cidr.contains(ip)));
+
+    ips
+}
+
+/// Given a string, parse it as a host, IP address, or CIDR.
+///
+/// This allows us to pass files as hosts or cidr or IPs easily
+/// Call this every time you have a possible IP-or-host.
+///
+/// If the address is a domain, we can self-resolve the domain locally
+/// or resolve it by dns resolver list.
+///
+/// ```rust
+/// # use rustscan::address::parse_address;
+/// # use hickory_resolver::Resolver;
+/// let ips = parse_address("127.0.0.1", &Resolver::default().unwrap());
+/// ```
+pub fn parse_address(address: &str, resolver: &Resolver) -> Vec<IpAddr> {
+    if let Ok(addr) = IpAddr::from_str(address) {
+        // `address` is an IP string
+        vec![addr]
+    } else if let Ok(net_addr) = IpInet::from_str(address) {
+        // `address` is a CIDR string
+        net_addr.network().into_iter().addresses().collect()
+    } else {
+        // `address` is a hostname or DNS name
+        // attempt default DNS lookup
+        match format!("{address}:80").to_socket_addrs() {
+            Ok(mut iter) => vec![iter.next().unwrap().ip()],
+            // default lookup didn't work, so try again with the dedicated resolver
+            Err(_) => resolve_ips_from_host(address, resolver),
+        }
+    }
+}
+
+/// Uses DNS to get the IPS associated with host
+fn resolve_ips_from_host(source: &str, backup_resolver: &Resolver) -> Vec<IpAddr> {
+    let mut ips: Vec<IpAddr> = Vec::new();
+
+    if let Ok(addrs) = source.to_socket_addrs() {
+        for ip in addrs {
+            ips.push(ip.ip());
+        }
+    } else if let Ok(addrs) = backup_resolver.lookup_ip(source) {
+        ips.extend(addrs.iter());
+    }
+
+    ips
+}
+
+/// Parses excluded networks from a list of addresses.
+///
+/// This function handles three types of inputs:
+/// 1. CIDR notation (e.g. "192.168.0.0/24")
+/// 2. Single IP addresses (e.g. "192.168.0.1")
+/// 3. Hostnames that need to be resolved (e.g. "example.com")
+///
+/// ```rust
+/// # use rustscan::address::parse_excluded_networks;
+/// # use hickory_resolver::Resolver;
+/// let resolver = Resolver::default().unwrap();
+/// let excluded = parse_excluded_networks(&Some(vec!["192.168.0.0/24".to_owned()]), &resolver);
+/// ```
+pub fn parse_excluded_networks(
+    exclude_addresses: &Option<Vec<String>>,
+    resolver: &Resolver,
+) -> Vec<IpCidr> {
+    exclude_addresses
+        .iter()
+        .flatten()
+        .flat_map(|addr| parse_single_excluded_address(addr, resolver))
+        .collect()
+}
+
+/// Parses a single address into an IpCidr, handling CIDR notation, IP addresses, and hostnames.
+fn parse_single_excluded_address(addr: &str, resolver: &Resolver) -> Vec<IpCidr> {
+    if let Ok(cidr) = IpCidr::from_str(addr) {
+        return vec![cidr];
+    }
+
+    if let Ok(ip) = IpAddr::from_str(addr) {
+        return vec![IpCidr::new_host(ip)];
+    }
+
+    resolve_ips_from_host(addr, resolver)
+        .into_iter()
+        .map(IpCidr::new_host)
+        .collect()
+}
+
+/// Derive a DNS resolver.
+///
+/// 1. if the `resolver` parameter has been set:
+///     1. assume the parameter is a path and attempt to read IPs.
+///     2. parse the input as a comma-separated list of IPs.
+/// 2. if `resolver` is not set:
+///    1. attempt to derive a resolver from the system config. (e.g.
+///       `/etc/resolv.conf` on *nix).
+///    2. finally, build a CloudFlare-based resolver (default
+///       behaviour).
+fn get_resolver(resolver: &Option<String>) -> Resolver {
+    match resolver {
+        Some(r) => {
+            let mut config = ResolverConfig::new();
+            let resolver_ips = match read_resolver_from_file(r) {
+                Ok(ips) => ips,
+                Err(_) => r
+                    .split(',')
+                    .filter_map(|r| IpAddr::from_str(r).ok())
+                    .collect::<Vec<_>>(),
+            };
+            for ip in resolver_ips {
+                config.add_name_server(NameServerConfig::new(
+                    SocketAddr::new(ip, 53),
+                    Protocol::Udp,
+                ));
+            }
+            Resolver::new(config, resolver_opts()).unwrap()
+        }
+        None => match system_resolver() {
+            Ok(resolver) => resolver,
+            Err(_) => Resolver::new(ResolverConfig::cloudflare_tls(), resolver_opts()).unwrap(),
+        },
+    }
+}
+
+/// `true` on Windows when the `SystemRoot` environment variable is unset.
+///
+/// hickory-resolver locates the hosts file via
+/// `std::env::var_os("SystemRoot").expect(...)`, which panics when the
+/// variable is missing. Processes spawned with a minimal environment
+/// (services, scheduled tasks, WMI) can lack `SystemRoot`, and the panic is
+/// fatal under this crate's `panic = "abort"` release profile.
+fn windows_system_root_missing() -> bool {
+    cfg!(windows) && std::env::var_os("SystemRoot").is_none()
+}
+
+/// Derives a resolver from the system configuration, e.g. `/etc/resolv.conf`
+/// on *nix or the registry on Windows.
+///
+/// Returns an error without touching the system configuration when doing so
+/// would panic inside hickory-resolver (see [`windows_system_root_missing`]).
+fn system_resolver() -> std::io::Result<Resolver> {
+    if windows_system_root_missing() {
+        debug!("SystemRoot is not set; skipping system resolver configuration");
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::NotFound,
+            "SystemRoot environment variable is not set",
+        ));
+    }
+
+    Resolver::from_system_conf()
+}
+
+/// Resolver options that are safe to use in the current environment.
+///
+/// hickory-resolver eagerly loads the hosts file when `use_hosts_file` is set
+/// (the default), which hits the same missing-`SystemRoot` panic described in
+/// [`windows_system_root_missing`]; disable it in that case.
+fn resolver_opts() -> ResolverOpts {
+    let mut opts = ResolverOpts::default();
+    if windows_system_root_missing() {
+        opts.use_hosts_file = false;
+    }
+    opts
+}
+
+/// Parses and input file of IPs for use in DNS resolution.
+fn read_resolver_from_file(path: &str) -> Result<Vec<IpAddr>, std::io::Error> {
+    let ips = fs::read_to_string(path)?
+        .lines()
+        .filter_map(|line| IpAddr::from_str(line.trim()).ok())
+        .collect();
+
+    Ok(ips)
+}
+
+#[cfg(not(tarpaulin_include))]
+/// Parses an input file of IPs and uses those
+fn read_ips_from_file(
+    ips: &std::path::Path,
+    backup_resolver: &Resolver,
+) -> Result<Vec<IpAddr>, std::io::Error> {
+    let file = File::open(ips)?;
+    let reader = BufReader::new(file);
+
+    let mut ips: Vec<IpAddr> = Vec::new();
+
+    for address_line in reader.lines() {
+        if let Ok(address) = address_line {
+            ips.extend(parse_address(&address, backup_resolver));
+        } else {
+            debug!("Line in file is not valid");
+        }
+    }
+
+    Ok(ips)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{parse_addresses, Opts};
+    use std::net::{IpAddr, Ipv4Addr};
+
+    #[test]
+    fn parse_correct_addresses() {
+        let opts = Opts {
+            addresses: vec!["127.0.0.1".to_owned(), "192.168.0.0/30".to_owned()],
+            ..Default::default()
+        };
+
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(127, 0, 0, 1),
+                Ipv4Addr::new(192, 168, 0, 0),
+                Ipv4Addr::new(192, 168, 0, 1),
+                Ipv4Addr::new(192, 168, 0, 2),
+                Ipv4Addr::new(192, 168, 0, 3)
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_addresses_with_address_exclusions() {
+        let opts = Opts {
+            addresses: vec!["192.168.0.0/30".to_owned()],
+            exclude_addresses: Some(vec!["192.168.0.1".to_owned()]),
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(192, 168, 0, 0),
+                Ipv4Addr::new(192, 168, 0, 2),
+                Ipv4Addr::new(192, 168, 0, 3)
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_addresses_with_cidr_exclusions() {
+        let opts = Opts {
+            addresses: vec!["192.168.0.0/29".to_owned()],
+            exclude_addresses: Some(vec!["192.168.0.0/30".to_owned()]),
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(192, 168, 0, 4),
+                Ipv4Addr::new(192, 168, 0, 5),
+                Ipv4Addr::new(192, 168, 0, 6),
+                Ipv4Addr::new(192, 168, 0, 7),
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_addresses_with_incorrect_address_exclusions() {
+        let opts = Opts {
+            addresses: vec!["192.168.0.0/30".to_owned()],
+            exclude_addresses: Some(vec!["192.168.0.1".to_owned()]),
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(192, 168, 0, 0),
+                Ipv4Addr::new(192, 168, 0, 2),
+                Ipv4Addr::new(192, 168, 0, 3)
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_duplicate_cidrs() {
+        let opts = Opts {
+            addresses: vec!["79.98.104.0/21".to_owned(), "79.98.104.0/24".to_owned()],
+            ..Default::default()
+        };
+
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(ips.len(), 2_048);
+    }
+
+    #[test]
+    fn parse_overspecific_cidr() {
+        // a canonical CIDR string has 0 in all host bits, but we want to treat any CIDR-like string as CIDR
+        let opts = Opts {
+            addresses: vec!["192.128.1.1/24".to_owned()],
+            ..Default::default()
+        };
+
+        let ips = parse_addresses(&opts);
+
+        assert_eq!(ips.len(), 256);
+    }
+
+    #[test]
+    fn parse_non_canonical_cidr_mid_block() {
+        // 192.168.1.13/29: .13 = 0000 1101, mask clears last 3 bits → .8 = 0000 1000
+        // network is 192.168.1.8/29, spanning .8 through .15
+        let opts = Opts {
+            addresses: vec!["192.168.1.13/29".to_owned()],
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(192, 168, 1, 8),
+                Ipv4Addr::new(192, 168, 1, 9),
+                Ipv4Addr::new(192, 168, 1, 10),
+                Ipv4Addr::new(192, 168, 1, 11),
+                Ipv4Addr::new(192, 168, 1, 12),
+                Ipv4Addr::new(192, 168, 1, 13),
+                Ipv4Addr::new(192, 168, 1, 14),
+                Ipv4Addr::new(192, 168, 1, 15),
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_non_canonical_cidr_last_in_block() {
+        // 192.168.1.15/29: last address in the block, should still resolve to same .8–.15 network
+        let opts = Opts {
+            addresses: vec!["192.168.1.15/29".to_owned()],
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(192, 168, 1, 8),
+                Ipv4Addr::new(192, 168, 1, 9),
+                Ipv4Addr::new(192, 168, 1, 10),
+                Ipv4Addr::new(192, 168, 1, 11),
+                Ipv4Addr::new(192, 168, 1, 12),
+                Ipv4Addr::new(192, 168, 1, 13),
+                Ipv4Addr::new(192, 168, 1, 14),
+                Ipv4Addr::new(192, 168, 1, 15),
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_non_canonical_cidr_crosses_third_octet() {
+        // 192.168.1.5/23: host bits span into the third octet
+        // .1.5 in 23-bit context → network is 192.168.0.0/23, spanning .0.0 through .1.255 (512 addresses)
+        let opts = Opts {
+            addresses: vec!["192.168.1.5/23".to_owned()],
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+        assert_eq!(
+            ips.first(),
+            Some(&IpAddr::V4(Ipv4Addr::new(192, 168, 0, 0)))
+        );
+        assert_eq!(
+            ips.last(),
+            Some(&IpAddr::V4(Ipv4Addr::new(192, 168, 1, 255)))
+        );
+        assert_eq!(ips.len(), 512);
+    }
+
+    #[test]
+    fn parse_non_canonical_cidr_slash30() {
+        // 10.0.0.7/30: .7 = 0000 0111, mask clears last 2 bits → .4 = 0000 0100
+        // network is 10.0.0.4/30, spanning .4 through .7
+        let opts = Opts {
+            addresses: vec!["10.0.0.7/30".to_owned()],
+            ..Default::default()
+        };
+        let ips = parse_addresses(&opts);
+        assert_eq!(
+            ips,
+            [
+                Ipv4Addr::new(10, 0, 0, 4),
+                Ipv4Addr::new(10, 0, 0, 5),
+                Ipv4Addr::new(10, 0, 0, 6),
+                Ipv4Addr::new(10, 0, 0, 7),
+            ]
+        );
+    }
+}

src/benchmark/mod.rs

@@ -0,0 +1,92 @@
+//! Provides functionality to capture timing information for scans.
+//!
+//! # Usage
+//!
+//! ```rust
+//! // Initiate Benchmark vector
+//! # use rustscan::benchmark::{Benchmark, NamedTimer};
+//! # use log::info;
+//! let mut bm = Benchmark::init();
+//! // Start named timer with name
+//! let mut example_bench = NamedTimer::start("Example Bench");
+//! // Stop named timer
+//! example_bench.end();
+//! // Add named timer to Benchmarks
+//! bm.push(example_bench);
+//! // Print Benchmark Summary
+//! info!("{}", bm.summary());
+//! ```
+use std::time::Instant;
+
+/// A Benchmark struct to hold NamedTimers with name, start and end Instants,
+#[derive(Debug)]
+pub struct Benchmark {
+    named_timers: Vec<NamedTimer>,
+}
+
+impl Benchmark {
+    pub fn init() -> Self {
+        Self {
+            named_timers: Vec::new(),
+        }
+    }
+    pub fn push(&mut self, timer: NamedTimer) {
+        self.named_timers.push(timer);
+    }
+
+    /// Summary of the benchmarks will destruct the vector,
+    /// formats every element the same way and return
+    /// a single String with all the available information
+    /// for easy printing
+    pub fn summary(&self) -> String {
+        let mut summary = String::from("\nRustScan Benchmark Summary");
+
+        for timer in &self.named_timers {
+            if let Some(start) = timer.start {
+                if let Some(end) = timer.end {
+                    let runtime_secs = end.saturating_duration_since(start).as_secs_f32();
+                    summary.push_str(&format!("\n{0: <10} | {1: <10}s", timer.name, runtime_secs));
+                }
+            }
+        }
+        summary
+    }
+}
+
+/// The purpose of NamedTimer is to hold a name,
+/// start Instant and end Instant for a specific timer.
+/// The given name will be presented in the benchmark summary,
+/// start and end Instants will be used for calculating runtime.
+#[derive(Debug)]
+pub struct NamedTimer {
+    name: &'static str,
+    start: Option<Instant>,
+    end: Option<Instant>,
+}
+
+impl NamedTimer {
+    pub fn start(name: &'static str) -> Self {
+        Self {
+            name,
+            start: Some(Instant::now()),
+            end: None,
+        }
+    }
+    pub fn end(&mut self) {
+        self.end = Some(Instant::now());
+    }
+}
+
+#[test]
+fn benchmark() {
+    let mut benchmarks = Benchmark::init();
+    let mut test_timer = NamedTimer::start("test");
+    std::thread::sleep(std::time::Duration::from_millis(100));
+    test_timer.end();
+    benchmarks.push(test_timer);
+    benchmarks.push(NamedTimer::start("only_start"));
+    assert!(benchmarks
+        .summary()
+        .contains("\nRustScan Benchmark Summary\ntest       | 0."));
+    assert!(!benchmarks.summary().contains("only_start"));
+}

src/input.rs

@@ -0,0 +1,707 @@
+//! Provides a means to read, parse and hold configuration options for scans.
+use clap::{Parser, ValueEnum};
+use serde_derive::Deserialize;
+use std::fs;
+use std::path::PathBuf;
+
+const LOWEST_PORT_NUMBER: u16 = 1;
+const TOP_PORT_NUMBER: u16 = 65535;
+
+/// Represents the strategy in which the port scanning will run.
+///   - Serial will run from start to end, for example 1 to 1_000.
+///   - Random will randomize the order in which ports will be scanned.
+#[derive(Deserialize, Debug, ValueEnum, Clone, Copy, PartialEq, Eq)]
+pub enum ScanOrder {
+    Serial,
+    Random,
+}
+
+/// Represents the scripts variant.
+///   - none will avoid running any script, only portscan results will be shown.
+///   - default will run the default embedded nmap script, that's part of RustScan since the beginning.
+///   - custom will read the ScriptConfig file and the available scripts in the predefined folders
+#[derive(Deserialize, Debug, ValueEnum, Clone, PartialEq, Eq, Copy)]
+pub enum ScriptsRequired {
+    None,
+    Default,
+    Custom,
+}
+
+/// The port ranges to scan, as inclusive `(start, end)` pairs.
+///
+/// Parsed from `-r/--range` (e.g. `1-500,1000-2500`) and from the `range`
+/// key of the configuration file.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PortRanges(pub Vec<(u16, u16)>);
+
+/// Accepted spellings of `range` in the configuration file.
+#[derive(Deserialize)]
+#[serde(untagged)]
+enum PortRangesConfig {
+    /// `range = { start = 1, end = 1000 }`: the format used before multiple
+    /// ranges were supported, kept so existing configuration files still work.
+    Single { start: u16, end: u16 },
+    /// `range = "1-500,1000-2500"`: the same syntax as `--range`.
+    Text(String),
+    /// `range = [[1, 500], [1000, 2500]]`.
+    Pairs(Vec<(u16, u16)>),
+}
+
+impl<'de> serde::Deserialize<'de> for PortRanges {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let pairs = match PortRangesConfig::deserialize(deserializer)? {
+            PortRangesConfig::Single { start, end } => vec![(start, end)],
+            PortRangesConfig::Text(text) => {
+                return parse_ranges(&text).map_err(serde::de::Error::custom)
+            }
+            PortRangesConfig::Pairs(pairs) => pairs,
+        };
+
+        if pairs.is_empty() {
+            return Err(serde::de::Error::custom("expected at least one port range"));
+        }
+        if let Some(&(start, end)) = pairs.iter().find(|&&(start, end)| start > end) {
+            return Err(serde::de::Error::custom(format!(
+                "invalid port range {start}-{end}: start must not be greater than end"
+            )));
+        }
+
+        Ok(PortRanges(pairs))
+    }
+}
+
+#[cfg(not(tarpaulin_include))]
+/// Parse a single `start-end` token (e.g. "100-200") into `(start, end)`.
+/// Returns `None` when the token is malformed, cannot be parsed as `u16`,
+/// or `start > end`.
+fn parse_range(input: &str) -> Option<(u16, u16)> {
+    let mut parts = input.trim().splitn(2, '-').map(str::trim);
+    let a = parts.next()?;
+    let b = parts.next()?;
+
+    let start = a.parse::<u16>().ok()?;
+    let end = b.parse::<u16>().ok()?;
+
+    if start <= end {
+        Some((start, end))
+    } else {
+        None
+    }
+}
+#[cfg(not(tarpaulin_include))]
+/// Parse a comma-separated list of `start-end` ranges into `PortRanges`.
+///
+/// Errors with a helpful message identifying the bad token.
+fn parse_ranges(input: &str) -> Result<PortRanges, String> {
+    let s = input.trim();
+    if s.is_empty() {
+        return Err("empty input: expected one or more comma-separated 'start-end' pairs".into());
+    }
+
+    let ranges_res: Result<Vec<(u16, u16)>, String> = s
+        .split(',')
+        .map(|token| {
+            let t = token.trim();
+            parse_range(t).ok_or_else(|| {
+                format!(
+                    "invalid range token `{}` — expected `start-end` with 0 <= start <= end <= 65535",
+                    t
+                )
+            })
+        })
+        .collect();
+
+    ranges_res.map(PortRanges)
+}
+
+#[derive(Parser, Debug, Clone)]
+#[command(
+    name = "rustscan",
+    version = env!("CARGO_PKG_VERSION"),
+    max_term_width = 120,
+    help_template = "{bin} {version}\n{about}\n\nUSAGE:\n    {usage}\n\nOPTIONS:\n{options}",
+)]
+#[allow(clippy::struct_excessive_bools)]
+/// Fast Port Scanner built in Rust.
+/// WARNING Do not use this program against sensitive infrastructure since the
+/// specified server may not be able to handle this many socket connections at once.
+/// - Discord  <http://discord.skerritt.blog>
+/// - GitHub <https://github.com/RustScan/RustScan>
+pub struct Opts {
+    /// A comma-delimited list or newline-delimited file of separated CIDRs, IPs, or hosts to be scanned.
+    #[arg(short, long, value_delimiter = ',')]
+    pub addresses: Vec<String>,
+
+    /// A list of comma separated ports to be scanned. Example: 80,443,8080.
+    #[arg(short, long, value_delimiter = ',')]
+    pub ports: Option<Vec<u16>>,
+
+    /// Ranges of ports as comma-separated start-end pairs. Example: 1-500,1000-2500,4000-7000
+    #[arg(short, long, conflicts_with = "ports", value_parser = parse_ranges)]
+    pub range: Option<PortRanges>,
+
+    /// Whether to ignore the configuration file or not.
+    #[arg(short, long)]
+    pub no_config: bool,
+
+    /// Hide the banner
+    #[arg(long)]
+    pub no_banner: bool,
+
+    /// Custom path to config file
+    #[arg(short, long, value_parser)]
+    pub config_path: Option<PathBuf>,
+
+    /// Greppable mode. Only output the ports. No Nmap. Useful for grep or outputting to a file.
+    #[arg(short, long)]
+    pub greppable: bool,
+
+    /// Accessible mode. Turns off features which negatively affect screen readers.
+    #[arg(long)]
+    pub accessible: bool,
+
+    /// A comma-delimited list or file of DNS resolvers.
+    #[arg(long)]
+    pub resolver: Option<String>,
+
+    /// The batch size for port scanning, it increases or slows the speed of
+    /// scanning. Depends on the open file limit of your OS.  If you do 65535
+    /// it will do every port at the same time. Although, your OS may not
+    /// support this.
+    #[arg(short, long, default_value = "4500")]
+    pub batch_size: usize,
+
+    /// The timeout in milliseconds before a port is assumed to be closed.
+    #[arg(short, long, default_value = "1500")]
+    pub timeout: u32,
+
+    /// The number of tries before a port is assumed to be closed.
+    /// If set to 0, rustscan will correct it to 1.
+    #[arg(long, default_value = "1")]
+    pub tries: u8,
+
+    /// Automatically increases the Unix file-descriptor limit.
+    #[cfg_attr(not(unix), arg(hide = true))]
+    #[arg(short, long)]
+    pub ulimit: Option<usize>,
+
+    /// The order of scanning to be performed. The "serial" option will
+    /// scan ports in ascending order while the "random" option will scan
+    /// ports randomly.
+    #[arg(long, value_enum, ignore_case = true, default_value = "serial")]
+    pub scan_order: ScanOrder,
+
+    /// Level of scripting required for the run.
+    #[arg(long, value_enum, ignore_case = true, default_value = "default")]
+    pub scripts: ScriptsRequired,
+
+    /// Use the top 1000 ports.
+    #[arg(long)]
+    pub top: bool,
+
+    /// The Script arguments to run.
+    /// To use the argument -A, end RustScan's args with '-- -A'.
+    /// Example: 'rustscan -t 1500 -a 127.0.0.1 -- -A -sC'.
+    /// This command adds -Pn -vvv -p $PORTS automatically to nmap.
+    /// For things like --script '(safe and vuln)' enclose it in quotations marks \"'(safe and vuln)'\"
+    #[arg(last = true)]
+    pub command: Vec<String>,
+
+    /// A list of comma separated ports to be excluded from scanning. Example: 80,443,8080.
+    #[arg(short, long, value_delimiter = ',')]
+    pub exclude_ports: Option<Vec<u16>>,
+
+    /// A list of comma separated CIDRs, IPs, or hosts to be excluded from scanning.
+    #[arg(short = 'x', long = "exclude-addresses", value_delimiter = ',')]
+    pub exclude_addresses: Option<Vec<String>>,
+
+    /// UDP scanning mode, finds UDP ports that send back responses
+    #[arg(long)]
+    pub udp: bool,
+
+    /// Also list TCP ports that actively refused the connection (closed).
+    /// Closed ports are only printed; scripts are never run against them.
+    #[arg(long)]
+    pub closed: bool,
+
+    /// Milliseconds to wait after scanning a port (on every address) before
+    /// scanning the next one, for slow, low-noise scans. 0 disables the delay.
+    #[arg(long, default_value = "0", value_name = "MS")]
+    pub interval: u64,
+}
+
+#[cfg(not(tarpaulin_include))]
+impl Opts {
+    pub fn read() -> Self {
+        let mut opts = Opts::parse();
+
+        if opts.ports.is_none() && opts.range.is_none() {
+            opts.range = Some(PortRanges(vec![(LOWEST_PORT_NUMBER, TOP_PORT_NUMBER)]));
+        }
+
+        opts
+    }
+
+    /// Validates options whose availability or semantics depend on the
+    /// operating system.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when an option is unsupported on the current platform.
+    pub fn validate_platform(&self) -> Result<(), String> {
+        #[cfg(not(unix))]
+        {
+            if self.ulimit.is_some() {
+                return Err(
+                    "--ulimit is only supported on Unix-like operating systems. \
+                     On Windows, use --batch-size (-b) to control scan concurrency."
+                        .to_owned(),
+                );
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Reads the command line arguments into an Opts struct and merge
+    /// values found within the user configuration file.
+    pub fn merge(&mut self, config: &Config) {
+        if !self.no_config {
+            self.merge_required(config);
+            self.merge_optional(config);
+        }
+    }
+
+    fn merge_required(&mut self, config: &Config) {
+        macro_rules! merge_required {
+            ($($field: ident),+) => {
+                $(
+                    if let Some(e) = &config.$field {
+                        self.$field = e.clone();
+                    }
+                )+
+            }
+        }
+
+        merge_required!(
+            addresses, greppable, accessible, batch_size, timeout, tries, scan_order, scripts,
+            command, udp, no_banner, closed, interval
+        );
+    }
+
+    fn merge_optional(&mut self, config: &Config) {
+        macro_rules! merge_optional {
+            ($($field: ident),+) => {
+                $(
+                    if config.$field.is_some() {
+                        self.$field = config.$field.clone();
+                    }
+                )+
+            }
+        }
+
+        // Only use top ports when the user asks for them
+        if self.top && config.ports.is_some() {
+            self.ports = config.ports.clone();
+        }
+
+        merge_optional!(range, resolver, ulimit, exclude_ports, exclude_addresses);
+    }
+}
+
+impl Default for Opts {
+    fn default() -> Self {
+        Self {
+            addresses: vec![],
+            ports: None,
+            range: None,
+            greppable: true,
+            batch_size: 0,
+            timeout: 0,
+            tries: 0,
+            ulimit: None,
+            command: vec![],
+            accessible: false,
+            resolver: None,
+            scan_order: ScanOrder::Serial,
+            no_config: true,
+            no_banner: false,
+            top: false,
+            scripts: ScriptsRequired::Default,
+            config_path: None,
+            exclude_ports: None,
+            exclude_addresses: None,
+            udp: false,
+            closed: false,
+            interval: 0,
+        }
+    }
+}
+
+/// Struct used to deserialize the options specified within our config file.
+/// These will be further merged with our command line arguments in order to
+/// generate the final Opts struct.
+#[cfg(not(tarpaulin_include))]
+#[derive(Debug, Deserialize)]
+pub struct Config {
+    addresses: Option<Vec<String>>,
+    ports: Option<Vec<u16>>,
+    range: Option<PortRanges>,
+    greppable: Option<bool>,
+    accessible: Option<bool>,
+    batch_size: Option<usize>,
+    timeout: Option<u32>,
+    tries: Option<u8>,
+    ulimit: Option<usize>,
+    resolver: Option<String>,
+    scan_order: Option<ScanOrder>,
+    command: Option<Vec<String>>,
+    scripts: Option<ScriptsRequired>,
+    exclude_ports: Option<Vec<u16>>,
+    exclude_addresses: Option<Vec<String>>,
+    udp: Option<bool>,
+    no_banner: Option<bool>,
+    closed: Option<bool>,
+    interval: Option<u64>,
+}
+
+#[cfg(not(tarpaulin_include))]
+#[allow(clippy::doc_link_with_quotes)]
+#[allow(clippy::manual_unwrap_or_default)]
+impl Config {
+    /// Reads the configuration file with TOML format and parses it into a
+    /// Config struct.
+    ///
+    /// # Format
+    ///
+    /// addresses = ["127.0.0.1", "127.0.0.1"]
+    /// ports = [80, 443, 8080]
+    /// greppable = true
+    /// scan_order = "Serial"
+    /// exclude_ports = [8080, 9090, 80]
+    /// udp = false
+    /// closed = false
+    /// interval = 0
+    ///
+    pub fn read(custom_config_path: Option<PathBuf>) -> Self {
+        let mut content = String::new();
+        let config_path = custom_config_path.unwrap_or_else(|| {
+            // Try the XDG-idiomatic location first, then fall back to legacy
+            // paths so existing users keep working unchanged.
+            for path in [
+                default_config_path(),
+                legacy_dot_config_path(),
+                old_default_config_path(),
+            ] {
+                if path.exists() {
+                    return path;
+                }
+            }
+            default_config_path()
+        });
+
+        if config_path.exists() {
+            content = match fs::read_to_string(config_path) {
+                Ok(content) => content,
+                Err(_) => String::new(),
+            }
+        }
+
+        let config: Config = match toml::from_str(&content) {
+            Ok(config) => config,
+            Err(e) => {
+                crate::tui::println_safe(format_args!(
+                    "Found {e} in configuration file.\nAborting scan.\n"
+                ));
+                std::process::exit(1);
+            }
+        };
+
+        config
+    }
+}
+
+/// Returns the preferred config file path: `$XDG_CONFIG_HOME/rustscan/config.toml`
+/// on Linux (with the usual `~/.config` fallback when the variable is unset),
+/// and the platform-equivalent `dirs::config_dir()` location on macOS / Windows.
+pub fn default_config_path() -> PathBuf {
+    let Some(mut config_path) = dirs::config_dir() else {
+        panic!("Could not infer config file path.");
+    };
+    config_path.push("rustscan");
+    config_path.push("config.toml");
+    config_path
+}
+
+/// Returns the transitional `$XDG_CONFIG_HOME/.rustscan.toml` path that older
+/// builds wrote to. Kept readable for backwards compatibility.
+pub fn legacy_dot_config_path() -> PathBuf {
+    let Some(mut config_path) = dirs::config_dir() else {
+        panic!("Could not infer config file path.");
+    };
+    config_path.push(".rustscan.toml");
+    config_path
+}
+
+/// Returns the deprecated home directory config path used for backwards compatibility.
+pub fn old_default_config_path() -> PathBuf {
+    let Some(mut config_path) = dirs::home_dir() else {
+        panic!("Could not infer config file path.");
+    };
+    config_path.push(".rustscan.toml");
+    config_path
+}
+
+#[cfg(test)]
+mod tests {
+    use clap::{CommandFactory, Parser};
+    use parameterized::parameterized;
+
+    use super::{Config, Opts, PortRanges, ScanOrder, ScriptsRequired};
+
+    impl Config {
+        fn default() -> Self {
+            Self {
+                addresses: Some(vec!["127.0.0.1".to_owned()]),
+                ports: None,
+                range: None,
+                greppable: Some(true),
+                batch_size: Some(25_000),
+                timeout: Some(1_000),
+                tries: Some(1),
+                ulimit: None,
+                command: Some(vec!["-A".to_owned()]),
+                accessible: Some(true),
+                resolver: None,
+                scan_order: Some(ScanOrder::Random),
+                scripts: None,
+                exclude_ports: None,
+                exclude_addresses: None,
+                udp: Some(false),
+                no_banner: None,
+                closed: Some(false),
+                interval: None,
+            }
+        }
+    }
+
+    #[test]
+    fn verify_cli() {
+        Opts::command().debug_assert();
+    }
+
+    #[parameterized(input = {
+        vec!["rustscan", "--addresses", "127.0.0.1"],
+        vec!["rustscan", "--addresses", "127.0.0.1", "--", "-sCV"],
+        vec!["rustscan", "--addresses", "127.0.0.1", "--", "-A"],
+        vec!["rustscan", "-t", "1500", "-a", "127.0.0.1", "--", "-A", "-sC"],
+        vec!["rustscan", "--addresses", "127.0.0.1", "--", "--script", r#""'(safe and vuln)'""#],
+    }, command = {
+        vec![],
+        vec!["-sCV".to_owned()],
+        vec!["-A".to_owned()],
+        vec!["-A".to_owned(), "-sC".to_owned()],
+        vec!["--script".to_owned(), "\"'(safe and vuln)'\"".to_owned()],
+    })]
+    fn parse_trailing_command(input: Vec<&str>, command: Vec<String>) {
+        let opts = Opts::parse_from(input);
+
+        assert_eq!(vec!["127.0.0.1".to_owned()], opts.addresses);
+        assert_eq!(command, opts.command);
+    }
+
+    #[test]
+    fn parses_explicit_batch_size() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "-b", "1234"]);
+
+        assert_eq!(opts.batch_size, 1234);
+    }
+
+    #[test]
+    fn parses_explicit_long_batch_size() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "--batch-size", "4321"]);
+
+        assert_eq!(opts.batch_size, 4321);
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_platform_validation_accepts_batch_size() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "--batch-size", "500"]);
+
+        assert!(opts.validate_platform().is_ok());
+        assert_eq!(opts.batch_size, 500);
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_rejects_ulimit() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "--ulimit", "5000"]);
+
+        let error = opts
+            .validate_platform()
+            .expect_err("Windows must reject --ulimit");
+
+        assert!(error.contains("--ulimit"));
+        assert!(error.contains("Unix"));
+        assert!(error.contains("--batch-size"));
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_hides_ulimit_from_help() {
+        let help = Opts::command().render_long_help().to_string();
+
+        assert!(
+            !help.contains("--ulimit"),
+            "--ulimit should not be advertised on Windows"
+        );
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_rejects_ulimit_from_config_merge() {
+        let mut opts = Opts {
+            no_config: false,
+            ..Default::default()
+        };
+        let mut config = Config::default();
+        config.ulimit = Some(5_000);
+
+        opts.merge(&config);
+
+        let error = opts
+            .validate_platform()
+            .expect_err("Windows must reject --ulimit supplied by configuration");
+
+        assert!(error.contains("--ulimit"));
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn unix_platform_validation_accepts_ulimit() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "--ulimit", "5000"]);
+
+        assert!(opts.validate_platform().is_ok());
+        assert_eq!(opts.ulimit, Some(5_000));
+    }
+
+    #[test]
+    fn opts_no_merge_when_config_is_ignored() {
+        let mut opts = Opts::default();
+        let config = Config::default();
+
+        opts.merge(&config);
+
+        assert_eq!(opts.addresses, vec![] as Vec<String>);
+        assert!(opts.greppable);
+        assert!(!opts.accessible);
+        assert_eq!(opts.timeout, 0);
+        assert_eq!(opts.command, vec![] as Vec<String>);
+        assert_eq!(opts.scan_order, ScanOrder::Serial);
+    }
+
+    #[test]
+    fn opts_merge_required_arguments() {
+        let mut opts = Opts::default();
+        let config = Config::default();
+
+        opts.merge_required(&config);
+
+        assert_eq!(opts.addresses, config.addresses.unwrap());
+        assert_eq!(opts.greppable, config.greppable.unwrap());
+        assert_eq!(opts.timeout, config.timeout.unwrap());
+        assert_eq!(opts.command, config.command.unwrap());
+        assert_eq!(opts.accessible, config.accessible.unwrap());
+        assert_eq!(opts.scan_order, config.scan_order.unwrap());
+        assert_eq!(opts.scripts, ScriptsRequired::Default);
+    }
+
+    #[test]
+    fn opts_merge_optional_arguments() {
+        let mut opts = Opts::default();
+        let mut config = Config::default();
+        config.range = Some(PortRanges(vec![(1, 1_000)]));
+        config.ulimit = Some(1_000);
+        config.resolver = Some("1.1.1.1".to_owned());
+
+        opts.merge_optional(&config);
+
+        assert_eq!(opts.range, config.range);
+        assert_eq!(opts.ulimit, config.ulimit);
+        assert_eq!(opts.resolver, config.resolver);
+    }
+
+    #[test]
+    fn parses_comma_separated_ranges() {
+        let opts = Opts::parse_from([
+            "rustscan",
+            "-a",
+            "127.0.0.1",
+            "-r",
+            "1-100, 200-300,5000-5100",
+        ]);
+
+        assert_eq!(
+            opts.range,
+            Some(PortRanges(vec![(1, 100), (200, 300), (5_000, 5_100)]))
+        );
+    }
+
+    #[test]
+    fn rejects_malformed_ranges() {
+        for range in ["", "300-200", "1-100,", "1-2-3", "a-b", "1-70000"] {
+            assert!(
+                Opts::try_parse_from(["rustscan", "-a", "127.0.0.1", "-r", range]).is_err(),
+                "{:?} should be rejected",
+                range
+            );
+        }
+    }
+
+    #[test]
+    fn config_range_accepts_legacy_table() {
+        let config: Config = toml::from_str("range = { start = 1, end = 1000 }").unwrap();
+
+        assert_eq!(config.range, Some(PortRanges(vec![(1, 1_000)])));
+    }
+
+    #[test]
+    fn config_range_accepts_string_and_pairs() {
+        let expected = Some(PortRanges(vec![(1, 100), (200, 300)]));
+
+        let config: Config = toml::from_str("range = \"1-100,200-300\"").unwrap();
+        assert_eq!(config.range, expected);
+
+        let config: Config = toml::from_str("range = [[1, 100], [200, 300]]").unwrap();
+        assert_eq!(config.range, expected);
+    }
+
+    #[test]
+    fn config_range_rejects_invalid_ranges() {
+        for range in [
+            "range = { start = 10, end = 1 }",
+            "range = [[10, 1]]",
+            "range = []",
+            "range = \"10-1\"",
+        ] {
+            assert!(
+                toml::from_str::<Config>(range).is_err(),
+                "{:?} should be rejected",
+                range
+            );
+        }
+    }
+
+    #[test]
+    fn parses_interval_in_milliseconds() {
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1", "--interval", "250"]);
+        assert_eq!(opts.interval, 250);
+
+        let opts = Opts::parse_from(["rustscan", "-a", "127.0.0.1"]);
+        assert_eq!(opts.interval, 0);
+    }
+}

src/lib.rs

@@ -0,0 +1,68 @@
+//! This crate exposes the internal functionality of the
+//! [RustScan](https://rustscan.github.io/RustScan) port scanner.
+//!
+//! ## Example: perform a scan against localhost
+//!
+//! The core scanning behaviour is managed by
+//! [`Scanner`](crate::scanner::Scanner) which in turn requires a
+//! [`PortStrategy`](crate::port_strategy::PortStrategy).
+//!
+//! The scanner is asynchronous and runs on [Tokio](https://docs.rs/tokio):
+//! await [`Scanner::run`](crate::scanner::Scanner::run) from a Tokio runtime
+//! with the I/O and time drivers enabled. It never spawns tasks, so a
+//! current-thread runtime is enough (see [`Scanner`](crate::scanner::Scanner)
+//! for details).
+//!
+//! This example is compiled but never executed by the test suite.
+//!
+//! ```no_run
+//! use std::{net::IpAddr, time::Duration};
+//!
+//! use rustscan::input::{PortRanges, ScanOrder};
+//! use rustscan::port_strategy::PortStrategy;
+//! use rustscan::scanner::Scanner;
+//!
+//! fn main() {
+//!     let addrs = vec!["127.0.0.1".parse::<IpAddr>().unwrap()];
+//!     let range = PortRanges(vec![(1, 1_000)]);
+//!     let strategy = PortStrategy::pick(&Some(range), None, ScanOrder::Random); // can be serial, random or manual https://github.com/RustScan/RustScan/blob/master/src/port_strategy/mod.rs
+//!     let scanner = Scanner::new(
+//!         &addrs, // the addresses to scan
+//!         10, // batch_size is how many ports at a time should be scanned
+//!         Duration::from_millis(100), //T imeout is the time RustScan should wait before declaring a port closed. As datatype Duration.
+//!         1, // Tries, how many retries should RustScan do?
+//!         true, // greppable is whether or not RustScan should print things, or wait until the end to print only the ip
+//!         strategy, // the port strategy used
+//!         true, // accessible, should the output be A11Y compliant?
+//!         vec![9000], // What ports should RustScan exclude?
+//!         false, // is this a UDP scan?
+//!     );
+//!
+//!     // Inside an async context (e.g. `#[tokio::main]`) this is simply
+//!     // `scanner.run().await`.
+//!     let runtime = tokio::runtime::Builder::new_current_thread()
+//!         .enable_all()
+//!         .build()
+//!         .unwrap();
+//!     let scan_result = runtime.block_on(scanner.run());
+//!
+//!     println!("{:?}", scan_result);
+//! }
+//! ```
+#![allow(clippy::needless_doctest_main)]
+
+pub mod tui;
+
+pub mod input;
+
+pub mod scanner;
+
+pub mod port_strategy;
+
+pub mod benchmark;
+
+pub mod scripts;
+
+pub mod address;
+
+pub mod generated;

src/main.rs

@@ -1,292 +1,481 @@
-use async_std::io;
-use async_std::net::TcpStream;
-use clap::{App, Arg, AppSettings};
-use colored::*;
-use std::process::{exit, Command};
+#![deny(clippy::all)]
+#![warn(clippy::pedantic)]
+#![allow(clippy::doc_markdown, clippy::if_not_else, clippy::non_ascii_literal)]
+
+use rustscan::benchmark::{Benchmark, NamedTimer};
+use rustscan::input::{self, Config, Opts, ScriptsRequired};
+use rustscan::port_strategy::PortStrategy;
+use rustscan::scanner::{PortStatus, Scanner};
+use rustscan::scripts::{init_scripts, Script, ScriptFile};
+use rustscan::tui::println_safe;
+use rustscan::{detail, funny_opening, output, warning};
+
+use colorful::{Color, Colorful};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::string::ToString;
 use std::time::Duration;
-use std::{
-    net::{SocketAddr, Shutdown},
-    io::ErrorKind, convert::TryInto,
-};
-use async_std::prelude::*;
-use futures::stream::FuturesUnordered;
-use futures::executor::block_on;
-use rlimit::Resource;
-use rlimit::{setrlimit, getrlimit};
+
+use rustscan::address::parse_addresses;
+
+extern crate colorful;
+extern crate dirs;
+
+// Average value for Ubuntu
+#[cfg(unix)]
+const DEFAULT_FILE_DESCRIPTORS_LIMIT: usize = 8000;
+// Safest batch size based on experimentation
+#[cfg(unix)]
+const AVERAGE_BATCH_SIZE: usize = 3000;
+
+#[macro_use]
+extern crate log;
+
+#[cfg(not(tarpaulin_include))]
+#[allow(clippy::too_many_lines)]
 /// Faster Nmap scanning with Rust
+/// If you're looking for the actual scanning, check out the module Scanner
 fn main() {
-    let matches = App::new("RustScan")
-        .author("Bee https://github.com/brandonskerritt")
-        .about("Fast Port Scanner built in Rust\nWARNING Do not use this program against sensitive infrastructure. The specified server may not be able to handle this many socket connections at once.")
-        .version("1.2.0")
-        .setting(AppSettings::TrailingVarArg)
-        
-        // IP address is a required argument
-        .arg(Arg::with_name("ip")
-            .required(true)
-            .index(1)
-            .long("ip-address")
-            .help("The IP address to scan"))
-        .arg(Arg::with_name("b")
-            .short("b")
-            .long("batch")
-            .takes_value(true)
-            .default_value("4500")
-            .help("Increases speed of scanning. The batch size for port scanning. Depends on your open file limit of OS. If you do 65535 it will do every port at the same time. Although, your OS may not support this."))
-        .arg(Arg::with_name("T")
-            .short("T")
-            .long("timeout")
-            .takes_value(true)
-            .default_value("1500")
-            .help("The timeout before a port is assumed to be close. In MS."))
-        .arg(Arg::with_name("q")
-            .short("-q")
-            .long("quiet")
-            .takes_value(false)
-            .help("Quiet mode. Only output the ports. No Nmap. Useful for grep or outputting to a file."))
-        .arg(Arg::with_name("u")
-            .short("u")
-            .long("ulimit")
-            .help("Automatically ups the ULIMIT with the value you provided.")
-            .takes_value(true))
-        .arg(
-            Arg::with_name("command")
-                .help("The Nmap arguments to run. To use the argument -A, end RustScan's args with '-- -A'. To run EXAMPLE: 'rustscan -T 1500 127.0.0.1 -- -A -sC'. This argument auto runs nmap {your commands} -vvv -p $PORTS ")
-                .takes_value(true)
-                .multiple(true),
-        )
-        .get_matches();
+    #[cfg(not(unix))]
+    let _ = ansi_term::enable_ansi_support();
 
-    
-    let ip = matches.value_of("ip").unwrap_or("None");
-    let ulimit_arg = matches.value_of("u").unwrap_or("None");
-    let quiet = if matches.is_present("q") { true } else { false };
-    let command_matches= matches.values_of("command");
-    let command_run: String = match command_matches {
-        // We use the user supplied args
-        Some(x) => {
-            // TODO x is the same as below, use that instead
-            matches.values_of("command").unwrap().collect::<Vec<_>>().join(" ")
+    env_logger::init();
+    let mut benchmarks = Benchmark::init();
+    let mut rustscan_bench = NamedTimer::start("RustScan");
+
+    let mut opts: Opts = Opts::read();
+    let config = Config::read(opts.config_path.clone());
+    opts.merge(&config);
+
+    if let Err(message) = opts.validate_platform() {
+        eprintln!("error: {message}");
+        std::process::exit(2);
+    }
+
+    debug!("Main() `opts` arguments are {opts:?}");
+
+    let scripts_to_run: Vec<ScriptFile> = match init_scripts(&opts.scripts) {
+        Ok(scripts_to_run) => scripts_to_run,
+        Err(e) => {
+            warning!(
+                format!("Initiating scripts failed!\n{e}"),
+                opts.greppable,
+                opts.accessible
+            );
+            std::process::exit(1);
         }
-        // we default
-        None    => "-A -vvv".to_string()
-
     };
 
-    let mut batch_size: u64 = matches
-                        .value_of("b")
-                        .unwrap_or("None")
-                        .parse::<u64>()
-                        .unwrap();
-    
-    if !quiet {
-        print_opening();
+    debug!("Scripts initialized {scripts_to_run:?}");
+
+    if !opts.greppable && !opts.accessible && !opts.no_banner {
+        print_opening(&opts);
     }
-    
-    // checks ulimit
-    
-    // change ulimit size
-    if !(ulimit_arg == "None") {
-        let limit = ulimit_arg.parse::<u64>().unwrap();
-        if !quiet{
-            println!("Automatically upping ulimit to {}", ulimit_arg);
+
+    let ips: Vec<IpAddr> = parse_addresses(&opts);
+
+    if ips.is_empty() {
+        warning!(
+            "No IPs could be resolved, aborting scan.",
+            opts.greppable,
+            opts.accessible
+        );
+        std::process::exit(1);
+    }
+
+    let batch_size = effective_batch_size(&opts);
+    debug!("Effective batch size: {batch_size}");
+
+    let mut scanner = Scanner::new(
+        &ips,
+        batch_size,
+        Duration::from_millis(opts.timeout.into()),
+        opts.tries,
+        opts.greppable,
+        PortStrategy::pick(&opts.range, opts.ports, opts.scan_order),
+        opts.accessible,
+        opts.exclude_ports.unwrap_or_default(),
+        opts.udp,
+    )
+    .with_open_port_output();
+    if opts.closed {
+        scanner = scanner.with_closed_ports();
+    }
+    if opts.interval > 0 {
+        scanner = scanner.with_interval(Duration::from_millis(opts.interval));
+    }
+    debug!("Scanner finished building: {scanner:?}");
+
+    let mut portscan_bench = NamedTimer::start("Portscan");
+    let scan_result = match run_scan(&scanner) {
+        Ok(scan_result) => scan_result,
+        Err(e) => {
+            eprintln!("error: could not start the scan: {e}");
+            std::process::exit(1);
         }
-        setrlimit(Resource::NOFILE, limit, limit);
+    };
+    portscan_bench.end();
+    benchmarks.push(portscan_bench);
+
+    let mut ports_per_ip: HashMap<IpAddr, Vec<u16>> = HashMap::new();
+    let mut closed_ports_per_ip: HashMap<IpAddr, Vec<u16>> = HashMap::new();
+
+    for status in scan_result {
+        let (map, socket) = match status {
+            PortStatus::Open(socket) => (&mut ports_per_ip, socket),
+            PortStatus::Closed(socket) => (&mut closed_ports_per_ip, socket),
+        };
+        map.entry(socket.ip()).or_default().push(socket.port());
     }
 
-    let (x, _) = getrlimit(Resource::NOFILE).unwrap(); 
+    for ip in ips {
+        if ports_per_ip.contains_key(&ip) {
+            continue;
+        }
 
-    // if maximum limit is lower than batch size
-    // automatically re-adjust the batch size
-    if x < batch_size.into() {
-        if !quiet{
-            println!("{}", "WARNING: Your file description limit is lower than selected batch size. Please considering upping this (how to is on the README). NOTE: this may be dangerous and may cause harm to sensitive servers. Automatically reducing Batch Size to match your limit, this process isn't harmful but reduces speed.".red());
-            // TODO this is a joke please fix
+        // If we got here it means the IP was not found within the HashMap, this
+        // means the scan couldn't find any open ports for it.
 
-            // if the OS supports high file limits like 8000
-            // but the user selected a batch size higher than this
-            // reduce to a lower number
-            // basically, ubuntu is 8000 
-            // but i can only get it to work on < 5k in testing
-            // 5k is default, so 3000 seems safe
-            if x > 8000{
-                batch_size = 3000
+        let x = format!("Looks like I didn't find any open ports for {:?}. This is usually caused by a high batch size.
+        \n*I used {} batch size, consider lowering it with {} or a comfortable number for your system.
+        \n Alternatively, increase the timeout if your ping is high. Rustscan -t 2000 for 2000 milliseconds (2s) timeout.\n",
+        ip,
+        batch_size,
+        "'rustscan -b <batch_size> -a <ip address>'");
+        warning!(x, opts.greppable, opts.accessible);
+    }
+
+    let mut script_bench = NamedTimer::start("Scripts");
+    for (ip, ports) in &ports_per_ip {
+        let vec_str_ports: Vec<String> = ports.iter().map(ToString::to_string).collect();
+
+        // nmap port style is 80,443. Comma separated with no spaces.
+        let ports_str = vec_str_ports.join(",");
+
+        // if option scripts is none, no script will be spawned
+        if opts.greppable || opts.scripts == ScriptsRequired::None {
+            println_safe(format_args!("{ip} -> [{ports_str}]"));
+            continue;
+        }
+        detail!("Starting Script(s)", opts.greppable, opts.accessible);
+
+        // Run all the scripts we found and parsed based on the script config file tags field.
+        for script_f in &scripts_to_run {
+            // Clone only the script being run instead of the whole list per IP.
+            let mut script_f = script_f.clone();
+            // This part allows us to add commandline arguments to the Script call_format, appending them to the end of the command.
+            if !opts.command.is_empty() {
+                let user_extra_args = &opts.command.join(" ");
+                debug!("Extra args vec {user_extra_args:?}");
+                if script_f.call_format.is_some() {
+                    let mut call_f = script_f.call_format.unwrap();
+                    call_f.push(' ');
+                    call_f.push_str(user_extra_args);
+                    output!(
+                        format!("Running script {:?} on ip {}\nDepending on the complexity of the script, results may take some time to appear.", call_f, &ip),
+                        opts.greppable,
+                        opts.accessible
+                    );
+                    debug!("Call format {call_f}");
+                    script_f.call_format = Some(call_f);
+                }
             }
-            else {
-                let ten: u64 = 100;
-                batch_size = x - ten;
+
+            // Building the script with the arguments from the ScriptFile, and ip-ports.
+            let script = Script::build(
+                script_f.path,
+                *ip,
+                ports.clone(),
+                script_f.port,
+                script_f.ports_separator,
+                script_f.tags,
+                script_f.call_format,
+            );
+            match script.run() {
+                Ok(script_result) => {
+                    detail!(script_result.clone(), opts.greppable, opts.accessible);
+                }
+                Err(e) => {
+                    warning!(&format!("Error {e}"), opts.greppable, opts.accessible);
+                }
             }
         }
     }
-    // else if the ulimit is higher than batch size
-    // tell the user they can increase batch size
-    // if the user set ulimit arg they probably know what they are doing so don't print this
-    else if x + 2 > batch_size.into() && (ulimit_arg == "None"){
-        if !quiet{
-            // TODO this is a joke please fix
-            let one: u64 = 1;
-            println!("Your file description limit is higher than the batch size. You can potentially increase the speed by increasing the batch size, but this may cause harm to sensitive servers. Your limit is {}, try batch size {}.", x, x - one);
+
+    // Closed ports are only listed; scripts are never run against them.
+    if opts.closed {
+        println_safe(format_args!("closed ports:"));
+        for (ip, ports) in &closed_ports_per_ip {
+            let ports_str = ports
+                .iter()
+                .map(ToString::to_string)
+                .collect::<Vec<_>>()
+                .join(",");
+            println_safe(format_args!("{ip} -> [{ports_str}]"));
         }
     }
-    // the user has asked to automatically up the ulimit
 
-                            
-    // gets timeout
-    let duration_timeout =
-        matches
-            .value_of("T")
-            .unwrap_or("None")
-            .parse::<u64>()
-            .unwrap();
+    // To use the runtime benchmark, run the process as: RUST_LOG=info ./rustscan
+    script_bench.end();
+    benchmarks.push(script_bench);
+    rustscan_bench.end();
+    benchmarks.push(rustscan_bench);
+    debug!("Benchmarks raw {benchmarks:?}");
+    info!("{}", benchmarks.summary());
+}
 
-
-
-    // 65535 + 1 because of 0 indexing
-    let test = run_batched(ip.to_string(), 1, 65536, Duration::from_millis(duration_timeout,),  batch_size.try_into().unwrap(), quiet);
-    let reports_fullsult = block_on(test);
-
-
-    // prints ports and places them into nmap string
-    let mut nmap_str_ports: Vec<String> = Vec::new();
-
-    // makes vector of open ports
-    for i in reports_fullsult.iter() {
-            // appends it to port
-            nmap_str_ports.push(i.to_string());
+/// Determines the actual batch size used by the scanner.
+///
+/// Unix systems may reduce the requested batch size according to the process
+/// file-descriptor limit. Other platforms, including Windows, use the batch
+/// size explicitly requested by the user.
+fn effective_batch_size(opts: &Opts) -> usize {
+    #[cfg(unix)]
+    {
+        infer_batch_size(opts, adjust_ulimit_size(opts))
     }
 
-    // if no ports are found, suggest running with less 
-    if nmap_str_ports.is_empty() {
-        panic!("{} Looks like I didn't find any open ports. This is usually caused by a high batch size.
-        \n*I used {} threads, consider lowering to {} with {} or a comfortable number lfor your system. 
-        \n Alternatively, increase the timeout if your ping is high. Rustscan -T 2000 for 2000 second timeout.", "ERROR".red(), batch_size, (batch_size / 2).to_string().green(), "'rustscan -b <batch_size> <ip address>'".green());
+    #[cfg(not(unix))]
+    {
+        opts.batch_size
     }
+}
 
-    // Tells the user we are now switching to Nmap
-    if !quiet{
-        println!(
-            "{}",
-            "Starting nmap.".blue(),
+/// Runs the scan to completion on a current-thread Tokio runtime.
+///
+/// The scanner drives every socket from a single future and never spawns
+/// tasks, so one thread is all it can use: a current-thread runtime runs the
+/// scan, the I/O driver and the timers on the calling thread, without the
+/// worker threads and cross-thread wake-ups of a multi-threaded runtime.
+///
+/// The runtime only exists for the duration of the scan. Address resolution
+/// (blocking DNS lookups and file reads) happens before it is created, so it
+/// can never stall the scan, and scripts run after it is gone.
+fn run_scan(scanner: &Scanner) -> std::io::Result<Vec<PortStatus>> {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_io()
+        .enable_time()
+        .build()?;
+
+    Ok(runtime.block_on(scanner.run_with_status()))
+}
+
+/// Prints the opening title of RustScan
+#[allow(clippy::items_after_statements, clippy::needless_raw_string_hashes)]
+fn print_opening(opts: &Opts) {
+    debug!("Printing opening");
+    let s = r#".----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
+| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
+| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
+`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
+The Modern Day Port Scanner."#;
+
+    println_safe(format_args!("{}", s.gradient(Color::Green).bold()));
+    let info = r#"________________________________________
+: http://discord.skerritt.blog         :
+: https://github.com/RustScan/RustScan :
+ --------------------------------------"#;
+    println_safe(format_args!("{}", info.gradient(Color::Yellow).bold()));
+    funny_opening!();
+
+    let config_path = opts
+        .config_path
+        .clone()
+        .unwrap_or_else(input::default_config_path);
+
+    detail!(
+        format!("The config file is expected to be at {config_path:?}"),
+        opts.greppable,
+        opts.accessible
+    );
+
+    if opts.config_path.is_none() {
+        let old_config_path = input::old_default_config_path();
+        detail!(
+            format!(
+                "For backwards compatibility, the config file may also be at {old_config_path:?}"
+            ),
+            opts.greppable,
+            opts.accessible
         );
     }
-
-
-    // nmap port style is 80,443. Comma seperated with no spaces.
-    let ports_str = nmap_str_ports.join(",");
-
-    // if quiet mode is on, return ports and exit
-    if quiet{
-        println!("{:?}", ports_str);
-        exit(1);
-    }
-
-    let string_format = format!("{} {} {} {} {}", command_run, "-vvv", "-p", &ports_str, ip);
-    let command_list = string_format.split_whitespace();
-    let vec = command_list.collect::<Vec<&str>>();
-
-    // Runs the nmap command and spawns it as a process.
-    Command::new("nmap")
-        .args(&vec)
-        .spawn()
-        .expect("failed to execute process");
 }
 
-pub async fn run_batched(
-    host: String,
-    port_start: u32,
-    port_end: u32,
-    timeout: Duration,
-    batch: u32,
-    quiet: bool,
-) -> Vec<u32> {
-    // run the scans in batches
-    let mut begin = port_start;
-    let mut end = begin + batch;
-    let mut all_addrs: std::vec::Vec<u32> = Vec::new();
+#[cfg(unix)]
+fn adjust_ulimit_size(opts: &Opts) -> usize {
+    use rlimit::Resource;
+    use std::convert::TryInto;
 
-    while end <= port_end {
-        let mut batch_addrs = execute(host.clone(), begin, end, timeout, quiet).await;
-        all_addrs.append(&mut batch_addrs);
-        begin = end+1;
-        end += batch;
-    }
-    all_addrs
-}
-async fn execute(
-    host: String,
-    port_start: u32,
-    port_end: u32,
-    timeout: Duration,
-    quiet: bool,
-) -> Vec<u32> {
-    // runs a scan against a range of ports
-    let mut ftrs = FuturesUnordered::new();
-    // TODO can I make this async?
-    for port in port_start..port_end {
-        ftrs.push(try_connect(host.clone(), port, timeout, quiet));
-    }
-
-    let mut open_addrs: Vec<u32> = Vec::new();
-    // TODO can I make this async?
-    while let Some(result) = ftrs.next().await {
-        match result {
-            Ok(addr) => open_addrs.push(addr),
-            Err(_) => {}
+    if let Some(limit) = opts.ulimit {
+        let limit = limit as u64;
+        if Resource::NOFILE.set(limit, limit).is_ok() {
+            detail!(
+                format!("Automatically increasing ulimit value to {limit}."),
+                opts.greppable,
+                opts.accessible
+            );
+        } else {
+            warning!(
+                "ERROR. Failed to set ulimit value.",
+                opts.greppable,
+                opts.accessible
+            );
         }
     }
-    open_addrs
+
+    let (soft, _) = Resource::NOFILE.get().unwrap();
+    // On 32-bit targets the soft limit (e.g. RLIM_INFINITY) may not fit in a
+    // usize. Fall back to the conservative default rather than usize::MAX,
+    // which would skip every batch-size adjustment in infer_batch_size.
+    soft.try_into().unwrap_or(DEFAULT_FILE_DESCRIPTORS_LIMIT)
 }
 
-async fn try_connect(host: String, port: u32, timeout: Duration, quiet: bool) -> io::Result<u32> {
-    let addr = host.to_string() + ":" + &port.to_string();
-    match addr.parse() {
-        Ok(sock_addr) => match connect(sock_addr, timeout).await {
-            Ok(stream_result) => {
-                match stream_result.shutdown(Shutdown::Both) {
-                    _ => {}
-                }
-                if !quiet {
-                    println!("Open {}", port.to_string().purple());
-                }
-                
-                Ok(port)
-            }
-            Err(e) => match e.kind() {
-                ErrorKind::Other => {
-                    eprintln!("{:?}", e); // in case we get too many open files
-                    panic!("Too many open files. Please reduce batch size. The default is 5000. Try -b 2500.");
-                    Err(e)
-                }
-                _ => Err(io::Error::new(io::ErrorKind::Other, e.to_string())),
-            },
-        },
-        Err(e) => {
-            eprintln!("Unable to convert to socket address {:?}", e);
-            panic!("Unable to convert to socket address");
-            Err(io::Error::new(io::ErrorKind::Other, e.to_string()))
+#[cfg(unix)]
+fn infer_batch_size(opts: &Opts, ulimit: usize) -> usize {
+    let mut batch_size = opts.batch_size;
+
+    // Adjust the batch size when the ulimit value is lower than the desired batch size
+    if ulimit < batch_size {
+        warning!("File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers",
+            opts.greppable, opts.accessible
+        );
+
+        // When the OS supports high file limits like 8000, but the user
+        // selected a batch size higher than this we should reduce it to
+        // a lower number.
+        if ulimit < AVERAGE_BATCH_SIZE {
+            // ulimit is smaller than average batch size
+            // user must have very small ulimit
+            // decrease batch size to half of ulimit
+            warning!("Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. ", opts.greppable, opts.accessible);
+            info!("Halving batch_size because ulimit is smaller than average batch size");
+            batch_size = ulimit / 2;
+        } else if ulimit > DEFAULT_FILE_DESCRIPTORS_LIMIT {
+            info!("Batch size is now average batch size");
+            batch_size = AVERAGE_BATCH_SIZE;
+        } else {
+            batch_size = ulimit - 100;
         }
     }
+    // When the ulimit is higher than the batch size let the user know that the
+    // batch size can be increased unless they specified the ulimit themselves.
+    else if ulimit + 2 > batch_size && (opts.ulimit.is_none()) {
+        detail!(format!("File limit higher than batch size. Can increase speed by increasing batch size '-b {}'.", ulimit - 100),
+        opts.greppable, opts.accessible);
+    }
+
+    batch_size
 }
 
+#[cfg(test)]
+mod tests {
+    #[cfg(windows)]
+    use super::effective_batch_size;
+    #[cfg(unix)]
+    use super::{adjust_ulimit_size, infer_batch_size};
+    use super::{print_opening, Opts};
 
-async fn connect(addr: SocketAddr, timeout: Duration) -> io::Result<TcpStream> {
-    let stream = io::timeout(timeout, async move { TcpStream::connect(addr).await }).await?;
-    Ok(stream)
-}
+    #[test]
+    #[cfg(unix)]
+    fn batch_size_lowered() {
+        let opts = Opts {
+            batch_size: 50_000,
+            ..Default::default()
+        };
+        let batch_size = infer_batch_size(&opts, 120);
 
-fn print_opening() {
-    let s = "
-     _____           _    _____                 
-    |  __ \\         | |  / ____|                
-    | |__) |   _ ___| |_| (___   ___ __ _ _ __  
-    |  _  / | | / __| __|\\___ \\ / __/ _` | '_ \\ 
-    | | \\ \\ |_| \\__ \\ |_ ____) | (_| (_| | | | |
-    |_|  \\_\\__,_|___/\\__|_____/ \\___\\__,_|_| |_|
-    Faster nmap scanning with rust.";
-    println!(
-        "{} \n {} \n {}",
-        s.green(),
-        "Automated Decryption Tool - https://github.com/ciphey/ciphey".green(),
-        "Creator https://github.com/brandonskerritt".green()
-    );
+        assert!(batch_size < opts.batch_size);
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn batch_size_lowered_average_size() {
+        let opts = Opts {
+            batch_size: 50_000,
+            ..Default::default()
+        };
+        let batch_size = infer_batch_size(&opts, 9_000);
+
+        assert_eq!(batch_size, 3_000);
+    }
+    #[test]
+    #[cfg(unix)]
+    fn batch_size_equals_ulimit_lowered() {
+        // because ulimit and batch size are same size, batch size is lowered
+        // to ULIMIT - 100
+        let opts = Opts {
+            batch_size: 50_000,
+            ..Default::default()
+        };
+        let batch_size = infer_batch_size(&opts, 5_000);
+
+        assert_eq!(batch_size, 4_900);
+    }
+    #[test]
+    #[cfg(unix)]
+    fn batch_size_adjusted_2000() {
+        // ulimit == batch_size
+        let opts = Opts {
+            batch_size: 50_000,
+            ulimit: Some(2_000),
+            ..Default::default()
+        };
+        let batch_size = adjust_ulimit_size(&opts);
+
+        assert_eq!(batch_size, 2_000);
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn test_high_ulimit_no_greppable_mode() {
+        let opts = Opts {
+            batch_size: 10,
+            greppable: false,
+            ..Default::default()
+        };
+
+        let batch_size = infer_batch_size(&opts, 1_000_000);
+
+        assert_eq!(batch_size, opts.batch_size);
+    }
+
+    #[test]
+    fn test_print_opening_no_panic() {
+        let opts = Opts::default();
+        // print opening should not panic
+        print_opening(&opts);
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_batch_size_uses_requested_value() {
+        let opts = Opts {
+            batch_size: 50,
+            ..Default::default()
+        };
+
+        assert_eq!(effective_batch_size(&opts), 50);
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_batch_size_preserves_large_requested_value() {
+        let opts = Opts {
+            batch_size: 12_345,
+            ..Default::default()
+        };
+
+        assert_eq!(effective_batch_size(&opts), 12_345);
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_batch_size_preserves_single_connection() {
+        let opts = Opts {
+            batch_size: 1,
+            ..Default::default()
+        };
+
+        assert_eq!(effective_batch_size(&opts), 1);
+    }
 }

src/port_strategy/mod.rs

@@ -0,0 +1,150 @@
+//! Provides a means to hold configuration options specifically for port scanning.
+mod range_iterator;
+use crate::input::{PortRanges, ScanOrder};
+use rand::rng;
+use rand::seq::SliceRandom;
+use range_iterator::RangeIterator;
+
+/// Represents options of port scanning.
+///
+/// Right now all these options involve ranges, but in the future
+/// it will also contain custom lists of ports.
+#[derive(Debug)]
+pub enum PortStrategy {
+    Manual(Vec<u16>),
+    Serial(SerialRange),
+    Random(RandomRange),
+}
+
+impl PortStrategy {
+    pub fn pick(range: &Option<PortRanges>, ports: Option<Vec<u16>>, order: ScanOrder) -> Self {
+        match order {
+            ScanOrder::Serial if ports.is_none() => {
+                let port_ranges = range.as_ref().unwrap();
+                PortStrategy::Serial(SerialRange {
+                    range: port_ranges.0.clone(),
+                })
+            }
+            ScanOrder::Random if ports.is_none() => {
+                let port_ranges = range.as_ref().unwrap();
+                PortStrategy::Random(RandomRange {
+                    range: port_ranges.0.clone(),
+                })
+            }
+            ScanOrder::Serial => PortStrategy::Manual(ports.unwrap()),
+            ScanOrder::Random => {
+                let mut rng = rng();
+                let mut ports = ports.unwrap();
+                ports.shuffle(&mut rng);
+                PortStrategy::Manual(ports)
+            }
+        }
+    }
+
+    pub fn order(&self) -> Vec<u16> {
+        match self {
+            PortStrategy::Manual(ports) => ports.clone(),
+            PortStrategy::Serial(range) => range.generate(),
+            PortStrategy::Random(range) => range.generate(),
+        }
+    }
+}
+
+/// Trait associated with a port strategy. Each PortStrategy must be able
+/// to generate an order for future port scanning.
+trait RangeOrder {
+    fn generate(&self) -> Vec<u16>;
+}
+
+/// As the name implies SerialRange will always generate a vector in
+/// ascending order.
+#[derive(Debug)]
+pub struct SerialRange {
+    range: Vec<(u16, u16)>,
+}
+
+impl RangeOrder for SerialRange {
+    fn generate(&self) -> Vec<u16> {
+        RangeIterator::new_serial(&self.range).collect()
+    }
+}
+
+/// As the name implies RandomRange will always generate a vector with
+/// a random order. This vector is built following the LCG algorithm.
+#[derive(Debug)]
+pub struct RandomRange {
+    range: Vec<(u16, u16)>,
+}
+
+impl RangeOrder for RandomRange {
+    // Right now using RangeIterator and generating a range + shuffling the
+    // vector is pretty much the same. The advantages of it will come once
+    // we have to generate different ranges for different IPs without storing
+    // actual vectors.
+    //
+    // Another benefit of RangeIterator is that it always generate a range with
+    // a certain distance between the items in the Array. The chances of having
+    // port numbers close to each other are pretty slim due to the way the
+    // algorithm works.
+    fn generate(&self) -> Vec<u16> {
+        RangeIterator::new_random(&self.range).collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::PortStrategy;
+    use crate::input::{PortRanges, ScanOrder};
+    use std::collections::HashSet;
+
+    fn expected_ports_from_ranges(input: &[(u16, u16)]) -> Vec<u16> {
+        let mut s = HashSet::new();
+        for &(start, end) in input {
+            for p in start..=end {
+                s.insert(p);
+            }
+        }
+        let mut v: Vec<u16> = s.into_iter().collect();
+        v.sort_unstable();
+        v
+    }
+    #[test]
+    fn serial_strategy_with_range() {
+        let ranges = PortRanges(vec![(1u16, 10u16), (20u16, 30u16), (100u16, 110u16)]);
+        let strategy = PortStrategy::pick(&Some(ranges.clone()), None, ScanOrder::Serial);
+        let result = strategy.order();
+        let expected = expected_ports_from_ranges(&ranges.0);
+
+        assert_eq!(expected, result);
+    }
+    #[test]
+    fn random_strategy_with_range() {
+        let ranges = PortRanges(vec![(1u16, 10u16), (20u16, 30u16), (100u16, 110u16)]);
+        let strategy = PortStrategy::pick(&Some(ranges.clone()), None, ScanOrder::Random);
+        let mut result = strategy.order();
+        let expected = expected_ports_from_ranges(&ranges.0);
+
+        assert_ne!(expected, result);
+        result.sort_unstable();
+
+        assert_eq!(expected, result);
+    }
+
+    #[test]
+    fn serial_strategy_with_ports() {
+        let strategy = PortStrategy::pick(&None, Some(vec![80, 443]), ScanOrder::Serial);
+        let result = strategy.order();
+        assert_eq!(vec![80, 443], result);
+    }
+
+    #[test]
+    fn random_strategy_with_ports() {
+        let strategy = PortStrategy::pick(&None, Some((1..10).collect()), ScanOrder::Random);
+        let mut result = strategy.order();
+        let expected = (1..10).collect::<Vec<u16>>();
+        assert_ne!(expected, result);
+
+        result.sort_unstable();
+        assert_eq!(expected, result);
+    }
+}

src/port_strategy/range_iterator.rs

@@ -0,0 +1,327 @@
+use gcd::Gcd;
+use rand::RngExt;
+use std::convert::TryInto;
+
+/// Yields ports produced from a collection of (possibly overlapping)
+/// inclusive `u16` ranges in two modes:
+///
+/// **Randomized** — created by `RangeIterator::new_random`:
+///    - The algorithm generates a permutation of indices `0..N-1` using the
+///      additive congruential step `x_{i+1} = (x_i + step) % N`.
+///    - `step` is chosen so `gcd(step, N) == 1` to ensure the sequence is a
+///      full-length cycle (visits each index exactly once).
+///    - `x_0` (the seed stored as `normalized_first_pick`) is chosen uniformly
+///      in `0..N`.
+///
+///      For more information: <https://en.wikipedia.org/wiki/Linear_congruential_generator>
+///
+/// **Serial** — `RangeIterator::new_serial`:
+///     Iterates the input ranges in the **original input order** and yields
+///     each port the first time it is encountered. Duplicate ports (from
+///     overlapping ranges) are skipped using a 65_536-entry "seen" table.
+pub struct RangeIterator {
+    active: bool,
+    total: u32,
+    normalized_first_pick: u32,
+    normalized_pick: u32,
+    step: u32,
+    ranges: Vec<(u32, u32)>,
+    prefix: Vec<u32>,
+    serial_itr: Option<Box<dyn Iterator<Item = u16>>>,
+    /// `seen[port]` is true once `port` has been yielded (serial mode only).
+    serial_seen: Option<Vec<bool>>,
+}
+
+impl RangeIterator {
+    /// Construct a randomized iterator (LCG permutation).
+    ///
+    /// Preconditions:
+    /// - `input` must contain at least one `(u16,u16)`
+    ///   and each pair must satisfy `start <= end`.
+    pub fn new_random(input: &[(u16, u16)]) -> Self {
+        // normalize & merge into (start, len) u32 pairs
+        // Example: [(10,12),(11,15)] -> merged [(10,6)]
+        let mut ranges: Vec<(u32, u32)> = input
+            .iter()
+            .map(|(s, e)| {
+                let start = *s as u32;
+                let end_excl = (*e as u32) + 1; // convert inclusive -> exclusive
+                (start, end_excl)
+            })
+            .collect();
+
+        ranges.sort_unstable_by_key(|&(s, _)| s);
+
+        let mut merged: Vec<(u32, u32)> = Vec::with_capacity(ranges.len());
+        if !ranges.is_empty() {
+            let mut iter = ranges.into_iter();
+            let (mut cur_s, mut cur_end) = iter.next().unwrap(); // cur_end exclusive
+            for (s, end_excl) in iter {
+                if s <= cur_end {
+                    // overlap/adjacent -> extend
+                    if end_excl > cur_end {
+                        cur_end = end_excl;
+                    }
+                } else {
+                    // push disjoint segment as (start, len)
+                    merged.push((cur_s, cur_end - cur_s)); // len = excl - start
+                    cur_s = s;
+                    cur_end = end_excl;
+                }
+            }
+            merged.push((cur_s, cur_end - cur_s));
+        }
+        // build prefix sums (prefix[0] = 0; prefix.len() == merged.len() + 1)
+        let prefix = merged.iter().fold(vec![0u32], |mut acc, (_, len)| {
+            let last = acc.last().unwrap();
+            acc.push(last.saturating_add(*len));
+            acc
+        });
+
+        // total is guaranteed > 0 by precondition (input.len() >= 1)
+        let total = *prefix.last().unwrap();
+
+        // pick step and seed
+        let step = pick_random_coprime(total);
+        let mut rng = rand::rng();
+        let first = rng.random_range(0..total);
+
+        Self {
+            active: true,
+            total,
+            normalized_first_pick: first,
+            normalized_pick: first,
+            step,
+            ranges: merged,
+            prefix,
+            serial_itr: None,
+            serial_seen: None,
+        }
+    }
+
+    /// Construct a serial iterator that yields ports in original input order,
+    /// skipping duplicates. The deduplication is done on the fly with a seen-table.
+    ///
+    /// Preconditions:
+    /// - `input` must contain at least one `(u16,u16)` and each pair must satisfy `start <= end`.
+    pub fn new_serial(input: &[(u16, u16)]) -> Self {
+        // Build a serial iterator that yields ports in *input order* (start..=end).
+        // We keep the merged ranges/prefix empty here (they are not needed for serial mode).
+        let input = input.to_vec();
+        let serial_itr = input.into_iter().flat_map(|(start, end)| start..=end);
+
+        let serial_itr_boxed: Box<dyn Iterator<Item = u16>> = Box::new(serial_itr);
+        // One entry per possible port (0..=65535).
+        let seen = vec![false; usize::from(u16::MAX) + 1];
+
+        Self {
+            active: true,
+            total: 0,
+            normalized_first_pick: 0,
+            normalized_pick: 0,
+            step: 0,
+            ranges: Vec::new(),
+            prefix: Vec::new(),
+            serial_itr: Some(serial_itr_boxed),
+            serial_seen: Some(seen),
+        }
+    }
+}
+impl Iterator for RangeIterator {
+    type Item = u16;
+
+    /// Advance the iterator by one port.
+    ///
+    /// 1. Read the current normalized index `cur`.
+    /// 2. Compute `next = (cur + step) % total` and update `normalized_pick`.
+    /// 3. If `next == normalized_first_pick` mark `active = false` (we completed the cycle).
+    /// 4. Map the returned index `cur` into the merged ranges via the prefix array:
+    ///    - find the range index `idx` where `prefix[idx] <= cur < prefix[idx+1]`,
+    ///    - offset = `cur - prefix[idx]`,
+    ///    - port = `ranges[idx].0 + offset`.
+    /// 5. Return `port as u16`.
+    ///
+    fn next(&mut self) -> Option<Self::Item> {
+        if !self.active {
+            return None;
+        }
+
+        // SERIAL iterator fast-path: preserve original input order but skip duplicates.
+        if let (Some(it), Some(seen)) = (self.serial_itr.as_mut(), self.serial_seen.as_mut()) {
+            for p in it.by_ref() {
+                // Yield each port only the first time it is seen.
+                if !std::mem::replace(&mut seen[usize::from(p)], true) {
+                    return Some(p);
+                }
+                // otherwise skip duplicate and continue
+            }
+            // serial iterator exhausted: drop it and mark inactive
+            self.serial_itr = None;
+            self.serial_seen = None;
+            self.active = false;
+            return None;
+        }
+
+        // RANDOMIZED (LCG) path
+        let cur = self.normalized_pick;
+        let next = (cur + self.step) % self.total;
+
+        // if next equals the original seed we finished the cycle after returning cur
+        if next == self.normalized_first_pick {
+            self.active = false;
+        }
+
+        self.normalized_pick = next;
+
+        // Map cur -> port using prefix + ranges (binary search)
+        let mut lo: usize = 0;
+        let mut hi: usize = self.ranges.len();
+        while lo < hi {
+            let mid = (lo + hi) / 2;
+            if self.prefix[mid + 1] > cur {
+                hi = mid;
+            } else {
+                lo = mid + 1;
+            }
+        }
+        let idx = lo;
+        let offset = cur - self.prefix[idx];
+        let (start, _len) = self.ranges[idx];
+        let port = (start + offset)
+            .try_into()
+            .expect("Could not convert u32 to u16");
+        Some(port)
+    }
+}
+
+/// The probability that two random integers are coprime to one another
+/// works out to be around 61%, given that we can safely pick a random
+/// number and test it. Just in case we are having a bad day and we cannot
+/// pick a coprime number after 10 tries we just return "end - 1" which
+/// is guaranteed to be a coprime, but won't provide ideal randomization.
+///
+/// We pick between "lower_range" and "upper_range" since values too close to
+/// the boundaries, which in these case are the "start" and "end" arguments
+/// would also provide non-ideal randomization as discussed on the paragraph
+/// above.
+fn pick_random_coprime(end: u32) -> u32 {
+    let range_boundary = end / 4;
+    let lower_range = range_boundary;
+    let upper_range = end - range_boundary;
+    let mut rng = rand::rng();
+    let mut candidate = rng.random_range(lower_range..upper_range);
+
+    for _ in 0..10 {
+        if end.gcd(candidate) == 1 {
+            return candidate;
+        }
+        candidate = rng.random_range(lower_range..upper_range);
+    }
+
+    end - 1
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    // Helper: collect, sort and return ports produced by randomized RangeIterator
+    fn generate_sorted_from_ranges_random(input: &[(u16, u16)]) -> Vec<u16> {
+        let mut it = RangeIterator::new_random(input);
+        let mut v: Vec<u16> = it.by_ref().collect();
+        v.sort_unstable();
+        v
+    }
+
+    // Helper: collect, sort and return ports produced by serial RangeIterator
+    fn generate_sorted_from_ranges_serial(input: &[(u16, u16)]) -> Vec<u16> {
+        let mut it = RangeIterator::new_serial(input);
+        let mut v: Vec<u16> = it.by_ref().collect();
+        v.sort_unstable();
+        v
+    }
+
+    // Build expected sorted unique ports from input ranges (inclusive)
+    fn expected_ports_from_ranges(input: &[(u16, u16)]) -> Vec<u16> {
+        let mut s = HashSet::new();
+        for &(start, end) in input {
+            for p in start..=end {
+                s.insert(p);
+            }
+        }
+        let mut v: Vec<u16> = s.into_iter().collect();
+        v.sort_unstable();
+        v
+    }
+
+    #[test]
+    fn random_range_iterator_test() {
+        // small disjoint ranges
+        let input = &[(1u16, 10u16), (20u16, 30u16), (100u16, 110u16)];
+        let result = generate_sorted_from_ranges_random(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // larger disjoint ranges
+        let input = &[(1u16, 100u16), (200u16, 500u16)];
+        let result = generate_sorted_from_ranges_random(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // overlapping and adjacent
+        let input = &[(10u16, 20u16), (15u16, 25u16), (26u16, 30u16)];
+        let result = generate_sorted_from_ranges_random(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // near-full domain (heavy): we only assert lengths & equality
+        let input = &[(1u16, 65_535u16)];
+        let result = generate_sorted_from_ranges_random(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected.len(), result.len());
+        assert_eq!(expected, result);
+
+        // multiple disjoint ranges - check dedupe & coverage
+        let input = &[(50u16, 100u16), (1000u16, 2000u16), (30000u16, 30010u16)];
+        let result = generate_sorted_from_ranges_random(input);
+        let set_len = result.iter().copied().collect::<HashSet<u16>>().len();
+        assert_eq!(set_len, result.len());
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+    }
+
+    #[test]
+    fn serial_range_iterator_test() {
+        // serial should preserve input-order semantics but here we only assert
+        // coverage (no duplicates) by sorting results and comparing expected set.
+
+        // small disjoint ranges
+        let input = &[(1u16, 10u16), (20u16, 30u16), (100u16, 110u16)];
+        let result = generate_sorted_from_ranges_serial(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // overlapping and adjacent
+        let input = &[(10u16, 20u16), (15u16, 25u16), (26u16, 30u16)];
+        let result = generate_sorted_from_ranges_serial(input);
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // multiple disjoint ranges
+        let input = &[(50u16, 100u16), (1000u16, 2000u16), (30000u16, 30010u16)];
+        let result = generate_sorted_from_ranges_serial(input);
+        let set_len = result.iter().copied().collect::<HashSet<u16>>().len();
+        assert_eq!(set_len, result.len());
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+
+        // all possible inputs
+        let input = &[(u16::MIN, u16::MAX)];
+        let result = generate_sorted_from_ranges_serial(input);
+        let set_len = result.iter().copied().collect::<HashSet<u16>>().len();
+        assert_eq!(set_len, result.len());
+        let expected = expected_ports_from_ranges(input);
+        assert_eq!(expected, result);
+    }
+}

src/scanner/mod.rs

@@ -0,0 +1,732 @@
+//! Core functionality for actual scanning behaviour.
+use crate::generated::get_parsed_data;
+use crate::port_strategy::PortStrategy;
+use crate::tui::println_safe;
+use log::debug;
+
+mod socket_iterator;
+use socket_iterator::SocketIterator;
+
+use colored::Colorize;
+use futures::stream::{FuturesUnordered, StreamExt};
+use std::collections::BTreeMap;
+use std::future::poll_fn;
+use std::task::Poll;
+use std::{
+    collections::{HashMap, HashSet},
+    io,
+    net::{IpAddr, Ipv4Addr, Ipv6Addr, Shutdown, SocketAddr},
+    num::NonZeroU8,
+    sync::Arc,
+    time::Duration,
+};
+use tokio::io::Interest;
+use tokio::net::{TcpStream, UdpSocket};
+use tokio::time::{sleep, timeout};
+
+/// How many sockets the scan starts or finishes (counted together) between
+/// two polls of the runtime's I/O driver; see `Scanner::scan_sockets`.
+///
+/// Every round ends with a non-blocking poll of the OS selector, so this
+/// keeps the overhead far below 1% while bounding the time between two
+/// polls to about a millisecond on Linux.
+const WORK_PER_TURN: usize = 128;
+
+/// UDP payload lookup: port -> payload bytes
+///
+/// `get_parsed_data()` returns a `&'static BTreeMap<...>`, so we can store
+/// references to the payload bytes without cloning them.
+#[doc(hidden)]
+pub type UdpPayloadLookup = HashMap<u16, &'static [u8]>;
+
+#[doc(hidden)]
+pub fn build_udp_payload_lookup(udp_map: &'static BTreeMap<Vec<u16>, Vec<u8>>) -> UdpPayloadLookup {
+    let mut lookup: UdpPayloadLookup = HashMap::new();
+
+    for (ports, payload_vec) in udp_map.iter() {
+        let payload: &'static [u8] = payload_vec.as_slice();
+        for &port in ports.iter() {
+            // Preserve existing behavior: if duplicates exist, last insert wins.
+            lookup.insert(port, payload);
+        }
+    }
+
+    lookup
+}
+
+/// The class for the scanner
+/// IP is data type IpAddr and is the IP address
+/// start & end is where the port scan starts and ends
+/// batch_size is how many ports at a time should be scanned
+/// Timeout is the time RustScan should wait before declaring a port closed. As datatype Duration.
+/// greppable is whether or not RustScan should print things, or wait until the end to print only the ip and open ports.
+///
+/// # Runtime
+///
+/// The futures returned by [`Scanner::run`] and [`Scanner::run_with_status`]
+/// use Tokio sockets and timers, so they must be polled from within a
+/// [Tokio](https://docs.rs/tokio) runtime that has both the I/O and the time
+/// drivers enabled (for example `#[tokio::main]`, or a runtime built with
+/// `enable_all()`). Polling them from another executor panics.
+///
+/// The scan never spawns tasks: every socket is driven from the one future
+/// you await, so a current-thread runtime is enough (it is what the
+/// `rustscan` binary uses), and the future is `Send` if you prefer to spawn
+/// it on a multi-threaded runtime.
+#[cfg(not(tarpaulin_include))]
+#[derive(Debug)]
+pub struct Scanner {
+    ips: Vec<IpAddr>,
+    batch_size: usize,
+    timeout: Duration,
+    tries: NonZeroU8,
+    greppable: bool,
+    port_strategy: PortStrategy,
+    accessible: bool,
+    exclude_ports: Vec<u16>,
+    udp: bool,
+    print_open_ports: bool,
+    report_closed: bool,
+    interval: Duration,
+}
+
+/// The outcome for a single socket, as returned by [`Scanner::run_with_status`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PortStatus {
+    /// The TCP connection succeeded, or the UDP target answered.
+    Open(SocketAddr),
+    /// The target actively refused the TCP connection (for example with a
+    /// RST). Only reported when [`Scanner::with_closed_ports`] is enabled.
+    Closed(SocketAddr),
+}
+
+// Allowing too many arguments for clippy.
+#[allow(clippy::too_many_arguments)]
+impl Scanner {
+    pub fn new(
+        ips: &[IpAddr],
+        batch_size: usize,
+        timeout: Duration,
+        tries: u8,
+        greppable: bool,
+        port_strategy: PortStrategy,
+        accessible: bool,
+        exclude_ports: Vec<u16>,
+        udp: bool,
+    ) -> Self {
+        Self {
+            batch_size,
+            timeout,
+            tries: NonZeroU8::new(std::cmp::max(tries, 1)).unwrap(),
+            greppable,
+            port_strategy,
+            ips: ips.iter().map(ToOwned::to_owned).collect(),
+            accessible,
+            exclude_ports,
+            udp,
+            print_open_ports: false,
+            report_closed: false,
+            interval: Duration::ZERO,
+        }
+    }
+
+    /// Enables the CLI's incremental open-port output.
+    ///
+    /// Library callers are quiet by default and can inspect the sockets returned by [`Self::run`].
+    #[must_use]
+    pub fn with_open_port_output(mut self) -> Self {
+        self.print_open_ports = true;
+        self
+    }
+
+    /// Also reports TCP ports that actively refuse the connection, as
+    /// [`PortStatus::Closed`] from [`Self::run_with_status`].
+    ///
+    /// Ports that time out are still treated as filtered and are not reported.
+    /// UDP scans never report closed ports.
+    #[must_use]
+    pub fn with_closed_ports(mut self) -> Self {
+        self.report_closed = true;
+        self
+    }
+
+    /// Waits `interval` after scanning one port (on every address) before
+    /// scanning the next port, for slow, low-noise scans.
+    ///
+    /// Within a port, up to `batch_size` addresses are still scanned
+    /// concurrently. A zero interval (the default) scans all sockets in
+    /// batches without any delay.
+    #[must_use]
+    pub fn with_interval(mut self, interval: Duration) -> Self {
+        self.interval = interval;
+        self
+    }
+
+    /// Runs scan_range with chunk sizes
+    /// If you want to run RustScan normally, this is the entry point used
+    /// Returns all open sockets.
+    pub async fn run(&self) -> Vec<SocketAddr> {
+        self.run_with_status()
+            .await
+            .into_iter()
+            .filter_map(|status| match status {
+                PortStatus::Open(socket) => Some(socket),
+                PortStatus::Closed(_) => None,
+            })
+            .collect()
+    }
+
+    /// Like [`Self::run`], but returns the status of every socket that gave a
+    /// definitive answer: open sockets, plus closed sockets when
+    /// [`Self::with_closed_ports`] is enabled.
+    pub async fn run_with_status(&self) -> Vec<PortStatus> {
+        // Every in-flight socket is polled from this single future through a
+        // `FuturesUnordered`. Under Tokio's cooperative budget the future
+        // would be forced to yield after ~128 sockets made progress, and the
+        // `FuturesUnordered` would then re-poll every other ready socket just
+        // to have it return `Pending` again. Opt out; `scan_sockets` yields to
+        // the runtime by itself, in rounds of `WORK_PER_TURN` sockets.
+        tokio::task::unconstrained(self.scan()).await
+    }
+
+    async fn scan(&self) -> Vec<PortStatus> {
+        let ports: Vec<u16> = self
+            .port_strategy
+            .order()
+            .iter()
+            .filter(|&port| !self.exclude_ports.contains(port))
+            .copied()
+            .collect();
+        let mut found_sockets: Vec<PortStatus> = Vec::new();
+        let mut errors: HashSet<String> = HashSet::new();
+
+        // Build UDP payload lookup once (only if we are scanning UDP).
+        // This avoids cloning a big map into every spawned future and turns
+        // payload selection from O(n) to O(1).
+        let udp_payloads: Option<Arc<UdpPayloadLookup>> = if self.udp {
+            Some(Arc::new(build_udp_payload_lookup(get_parsed_data())))
+        } else {
+            None
+        };
+
+        debug!("Start scanning sockets. \nBatch size {}\nNumber of ip-s {}\nNumber of ports {}\nTargets all together {}\nInterval between ports {:?}",
+            self.batch_size,
+            self.ips.len(),
+            ports.len(),
+            (self.ips.len() * ports.len()),
+            self.interval);
+
+        if self.interval.is_zero() {
+            let sockets = SocketIterator::new(&self.ips, &ports);
+            self.scan_sockets(sockets, &udp_payloads, &mut found_sockets, &mut errors)
+                .await;
+        } else {
+            // Scan one port (on every address) at a time and wait `interval`
+            // before moving on to the next port.
+            for (i, port) in ports.iter().enumerate() {
+                if i > 0 {
+                    sleep(self.interval).await;
+                }
+                let sockets = SocketIterator::new(&self.ips, std::slice::from_ref(port));
+                self.scan_sockets(sockets, &udp_payloads, &mut found_sockets, &mut errors)
+                    .await;
+            }
+        }
+
+        debug!("Typical socket connection errors {errors:?}");
+        debug!("Sockets found: {:?}", found_sockets);
+        found_sockets
+    }
+
+    /// Scans every socket yielded by `sockets`, keeping at most `batch_size`
+    /// connection attempts in flight.
+    ///
+    /// Starts sockets and handles finished ones in rounds of at most
+    /// [`WORK_PER_TURN`] of either, and lets the runtime poll for I/O and fire
+    /// timers between rounds. One poll of the scan future otherwise lasts
+    /// until no socket is ready, which can take long: starting a whole large
+    /// batch at once, or a run of UDP probes that all finish straight away.
+    /// Sockets that finish in the meantime are only noticed once the poll
+    /// ends, so their results come late, and if the poll outlasts the timeout
+    /// their timers fire before their answers are seen.
+    async fn scan_sockets(
+        &self,
+        mut sockets: SocketIterator<'_>,
+        udp_payloads: &Option<Arc<UdpPayloadLookup>>,
+        found_sockets: &mut Vec<PortStatus>,
+        errors: &mut HashSet<String>,
+    ) {
+        let mut ftrs = FuturesUnordered::new();
+
+        loop {
+            let mut work = 0;
+            while work < WORK_PER_TURN {
+                let mut started = false;
+                if ftrs.len() < self.batch_size {
+                    if let Some(socket) = sockets.next() {
+                        ftrs.push(self.scan_socket(socket, udp_payloads.clone()));
+                        started = true;
+                        work += 1;
+                    }
+                }
+
+                // Poll once without waiting; this starts the new socket.
+                match poll_fn(|cx| Poll::Ready(ftrs.poll_next_unpin(cx))).await {
+                    Poll::Ready(Some(result)) => {
+                        self.record(result, found_sockets, errors);
+                        work += 1;
+                    }
+                    // Nothing in flight and nothing left to start.
+                    Poll::Ready(None) => return,
+                    // Nothing has finished; keep starting sockets while there is room.
+                    Poll::Pending if started => {}
+                    Poll::Pending => break,
+                }
+            }
+
+            if work >= WORK_PER_TURN {
+                tokio::task::yield_now().await;
+            } else {
+                // The batch is full (or complete) and every socket in it is
+                // waiting on the network.
+                match ftrs.next().await {
+                    Some(result) => self.record(result, found_sockets, errors),
+                    None => return,
+                }
+            }
+        }
+    }
+
+    /// Records the outcome of one socket.
+    fn record(
+        &self,
+        result: io::Result<PortStatus>,
+        found_sockets: &mut Vec<PortStatus>,
+        errors: &mut HashSet<String>,
+    ) {
+        match result {
+            Ok(status) => found_sockets.push(status),
+            Err(e) => {
+                let error_string = e.to_string();
+                if errors.len() < self.ips.len() * 1000 {
+                    errors.insert(error_string);
+                }
+            }
+        }
+    }
+
+    /// Given a socket, scan it self.tries times.
+    /// Turns the address into a SocketAddr
+    /// Deals with the `<result>` type
+    /// If it experiences error ErrorKind::Other then too many files are open and it Panics!
+    /// Else any other error, it returns the error in Result as a string
+    /// If no errors occur, it returns the port number in Result to signify the port is open.
+    /// This function mainly deals with the logic of Results handling.
+    /// # Example
+    ///
+    /// ```compile_fail
+    /// scanner.scan_socket(socket)
+    /// ```
+    ///
+    /// Note: `self` must contain `self.ip`.
+    async fn scan_socket(
+        &self,
+        socket: SocketAddr,
+        udp_payloads: Option<Arc<UdpPayloadLookup>>,
+    ) -> io::Result<PortStatus> {
+        if self.udp {
+            return self.scan_udp_socket(socket, udp_payloads).await;
+        }
+
+        let tries = self.tries.get();
+        for nr_try in 1..=tries {
+            match self.connect(socket).await {
+                Ok(tcp_stream) => {
+                    debug!("Connection was successful, shutting down stream {}", socket);
+                    if let Err(e) = shutdown_both(tcp_stream) {
+                        debug!("Shutdown stream error {}", e);
+                    }
+                    self.fmt_ports(socket);
+
+                    debug!("Return Ok after {nr_try} tries");
+                    return Ok(PortStatus::Open(socket));
+                }
+                Err(e) => {
+                    // A refused connection is a definitive answer, so there is
+                    // no point in retrying it.
+                    if self.report_closed && e.kind() == io::ErrorKind::ConnectionRefused {
+                        self.fmt_closed_port(socket);
+                        return Ok(PortStatus::Closed(socket));
+                    }
+
+                    let mut error_string = e.to_string();
+
+                    assert!(!error_string.to_lowercase().contains("too many open files"), "Too many open files. Please reduce batch size. The default is 5000. Try -b 2500.");
+
+                    if nr_try == tries {
+                        error_string.push(' ');
+                        error_string.push_str(&socket.ip().to_string());
+                        return Err(io::Error::other(error_string));
+                    }
+                }
+            };
+        }
+        unreachable!();
+    }
+
+    async fn scan_udp_socket(
+        &self,
+        socket: SocketAddr,
+        udp_payloads: Option<Arc<UdpPayloadLookup>>,
+    ) -> io::Result<PortStatus> {
+        let payload: &[u8] = udp_payloads
+            .as_ref()
+            .and_then(|m| m.get(&socket.port()).copied())
+            .unwrap_or(b"");
+
+        let tries = self.tries.get();
+        for _ in 1..=tries {
+            match self.udp_scan(socket, payload, self.timeout).await {
+                Ok(true) => return Ok(PortStatus::Open(socket)),
+                Ok(false) => continue,
+                Err(e) => return Err(e),
+            }
+        }
+
+        Err(io::Error::other(format!(
+            "UDP scan timed-out for all tries on socket {socket}"
+        )))
+    }
+
+    /// Performs the connection to the socket with timeout
+    /// # Example
+    ///
+    /// ```compile_fail
+    /// # use std::net::{IpAddr, Ipv6Addr, SocketAddr};
+    /// let port: u16 = 80;
+    /// // ip is an IpAddr type
+    /// let ip = IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 1));
+    /// let socket = SocketAddr::new(ip, port);
+    /// scanner.connect(socket);
+    /// // returns Result which is either Ok(stream) for port is open, or Er for port is closed.
+    /// // Timeout occurs after self.timeout seconds
+    /// ```
+    ///
+    async fn connect(&self, socket: SocketAddr) -> io::Result<TcpStream> {
+        timeout(self.timeout, TcpStream::connect(socket))
+            .await
+            .unwrap_or_else(|_elapsed| Err(timed_out()))
+    }
+
+    /// Binds a non-blocking UDP socket on the unspecified address of the
+    /// target's address family, so we can send and receive packets.
+    fn udp_bind(socket: SocketAddr) -> io::Result<std::net::UdpSocket> {
+        let local_addr = match socket {
+            SocketAddr::V4(_) => SocketAddr::from((Ipv4Addr::UNSPECIFIED, 0)),
+            SocketAddr::V6(_) => SocketAddr::from((Ipv6Addr::UNSPECIFIED, 0)),
+        };
+
+        let udp_socket = std::net::UdpSocket::bind(local_addr)?;
+        udp_socket.set_nonblocking(true)?;
+        Ok(udp_socket)
+    }
+
+    /// Performs a UDP scan on the specified socket with a payload and wait duration
+    /// # Example
+    ///
+    /// ```compile_fail
+    /// # use std::net::{IpAddr, Ipv6Addr, SocketAddr};
+    /// # use std::time::Duration;
+    /// let port: u16 = 123;
+    /// // ip is an IpAddr type
+    /// let ip = IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 1));
+    /// let socket = SocketAddr::new(ip, port);
+    /// let payload = vec![0, 1, 2, 3];
+    /// let wait = Duration::from_secs(1);
+    /// let result = scanner.udp_scan(socket, payload, wait).await;
+    /// // returns Result which is either Ok(true) if response received, or Ok(false) if timed out.
+    /// // Err is returned for other I/O errors.
+    async fn udp_scan(
+        &self,
+        socket: SocketAddr,
+        payload: &[u8],
+        wait: Duration,
+    ) -> io::Result<bool> {
+        let udp_socket = match Self::udp_bind(socket) {
+            Ok(udp_socket) => udp_socket,
+            Err(e) => {
+                debug!("Error binding UDP socket: {e:?}");
+                return Err(e);
+            }
+        };
+        let mut buf = [0u8; 1024];
+
+        udp_socket.connect(socket)?;
+
+        // Send the probe and try the first receive straight away, as
+        // async-std did. Tokio's readiness-based I/O would first wait for the
+        // reactor to report the socket ready, costing every probe extra trips
+        // through the event loop, while the probe can almost always be sent
+        // immediately and, on the local host, the answer (often an ICMP "port
+        // unreachable", seen as a refused connection) is usually already
+        // there when the send returns. The socket is only registered with
+        // Tokio when we really have to wait.
+        let sent = match udp_socket.send(payload) {
+            Ok(_) => true,
+            Err(e) if e.kind() == io::ErrorKind::WouldBlock => false,
+            Err(e) => return Err(e),
+        };
+        let early = if sent {
+            udp_socket.recv(&mut buf)
+        } else {
+            Err(io::ErrorKind::WouldBlock.into())
+        };
+
+        let received = match early {
+            Err(e) if e.kind() == io::ErrorKind::WouldBlock => {
+                let udp_socket = UdpSocket::from_std(udp_socket)?;
+                if !sent {
+                    udp_socket.send(payload).await?;
+                }
+                match timeout(wait, recv_or_error(&udp_socket, &mut buf)).await {
+                    Ok(received) => received,
+                    // Nothing came back in time.
+                    Err(_elapsed) => return Ok(false),
+                }
+            }
+            early => early,
+        };
+
+        match received {
+            Ok(size) => {
+                debug!("Received {size} bytes");
+                self.fmt_ports(socket);
+                Ok(true)
+            }
+            Err(e) if e.kind() == io::ErrorKind::TimedOut => Ok(false),
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Formats and prints the port status
+    fn fmt_ports(&self, socket: SocketAddr) {
+        if self.print_open_ports && !self.greppable {
+            if self.accessible {
+                println_safe(format_args!("Open {socket}"));
+            } else {
+                println_safe(format_args!("Open {}", socket.to_string().purple()));
+            }
+        }
+    }
+
+    /// Prints a closed port (CLI output only, never in greppable mode).
+    fn fmt_closed_port(&self, socket: SocketAddr) {
+        if self.print_open_ports && !self.greppable {
+            if self.accessible {
+                println_safe(format_args!("Closed {socket}"));
+            } else {
+                println_safe(format_args!("Closed {}", socket.to_string().red()));
+            }
+        }
+    }
+}
+
+/// Shuts down both halves of a connected stream before it is closed, as the
+/// async-std implementation did (`TcpStream::shutdown(Shutdown::Both)`).
+///
+/// Tokio only offers an asynchronous write-side shutdown, so take the socket
+/// back from the reactor and shut it down synchronously instead.
+fn shutdown_both(stream: TcpStream) -> io::Result<()> {
+    stream.into_std()?.shutdown(Shutdown::Both)
+}
+
+/// Waits for a datagram on a connected UDP socket, or for the error the
+/// system queued for it: an ICMP "port unreachable" is reported as a refused
+/// connection, which is how closed UDP ports are told apart from filtered
+/// ones.
+///
+/// `UdpSocket::recv` alone does not do this on Linux: a queued ICMP error
+/// only raises `EPOLLERR`, which Tokio does not count as readable, so `recv`
+/// would sleep until the timeout. async-io treated `EPOLLERR` as readable.
+async fn recv_or_error(socket: &UdpSocket, buf: &mut [u8]) -> io::Result<usize> {
+    loop {
+        let ready = socket.ready(Interest::READABLE | Interest::ERROR).await?;
+
+        if ready.is_readable() {
+            match socket.try_recv(buf) {
+                // A spurious wake-up; wait again (unless the socket is closed
+                // for reading, which would wake us up forever).
+                Err(e) if e.kind() == io::ErrorKind::WouldBlock && !ready.is_read_closed() => {}
+                received => return received,
+            }
+        }
+
+        if ready.is_error() {
+            // Take (and clear) the queued error. `WouldBlock` when there is
+            // none makes Tokio clear the error readiness, so this cannot spin.
+            let queued = socket.try_io(Interest::ERROR, || {
+                socket
+                    .take_error()?
+                    .map_or_else(|| Err(io::ErrorKind::WouldBlock.into()), Ok)
+            });
+            match queued {
+                Ok(error) => return Err(error),
+                Err(e) if e.kind() == io::ErrorKind::WouldBlock => {}
+                Err(e) => return Err(e),
+            }
+        }
+    }
+}
+
+/// The error reported for a connection attempt that hit the timeout; the same
+/// kind and message async-std's `io::timeout` used.
+fn timed_out() -> io::Error {
+    io::Error::new(io::ErrorKind::TimedOut, "future timed out")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    use crate::input::{PortRanges, ScanOrder};
+
+    // These tests never open sockets: they only build a `Scanner` (and its
+    // futures), run a scan that has no socket to scan, or inspect the payload
+    // table generated by build.rs.
+
+    fn test_scanner() -> Scanner {
+        let addrs = vec!["127.0.0.1".parse::<IpAddr>().unwrap()];
+        let strategy = PortStrategy::pick(&Some(PortRanges(vec![(1, 1)])), None, ScanOrder::Serial);
+        Scanner::new(
+            &addrs,
+            1,
+            Duration::from_millis(100),
+            1,
+            false,
+            strategy,
+            false,
+            Vec::new(),
+            false,
+        )
+    }
+
+    #[test]
+    fn library_scanner_is_quiet_by_default() {
+        let scanner = test_scanner();
+
+        assert!(!scanner.print_open_ports);
+    }
+
+    #[test]
+    fn cli_can_enable_open_port_output() {
+        let scanner = test_scanner().with_open_port_output();
+
+        assert!(scanner.print_open_ports);
+    }
+
+    #[test]
+    fn closed_ports_are_not_reported_by_default() {
+        assert!(!test_scanner().report_closed);
+    }
+
+    #[test]
+    fn closed_port_reporting_is_opt_in() {
+        assert!(test_scanner().with_closed_ports().report_closed);
+    }
+
+    #[test]
+    fn no_interval_by_default() {
+        assert!(test_scanner().interval.is_zero());
+    }
+
+    #[test]
+    fn with_interval_sets_the_delay_between_ports() {
+        let scanner = test_scanner().with_interval(Duration::from_millis(250));
+
+        assert_eq!(scanner.interval, Duration::from_millis(250));
+    }
+
+    /// Embedders may spawn the scan on a multi-threaded runtime, which needs
+    /// `Send` futures. The futures are only created here, never polled, so
+    /// no socket is opened.
+    #[test]
+    fn scan_futures_are_send() {
+        fn assert_send<T: Send>(_: &T) {}
+
+        let scanner = test_scanner();
+        assert_send(&scanner.run());
+        assert_send(&scanner.run_with_status());
+    }
+
+    /// Drives a scan on the same kind of runtime the CLI builds. Every port
+    /// is excluded, so the scan has no socket to open and returns at once.
+    #[test]
+    fn scan_without_sockets_completes_on_a_current_thread_runtime() {
+        let addrs = vec!["127.0.0.1".parse::<IpAddr>().unwrap()];
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_io()
+            .enable_time()
+            .build()
+            .unwrap();
+
+        for interval in [Duration::ZERO, Duration::from_millis(10)] {
+            let scanner = Scanner::new(
+                &addrs,
+                10,
+                Duration::from_millis(100),
+                1,
+                true,
+                PortStrategy::Manual(vec![1, 2]),
+                true,
+                vec![1, 2],
+                false,
+            )
+            .with_interval(interval);
+
+            assert!(runtime.block_on(scanner.run_with_status()).is_empty());
+        }
+    }
+
+    #[test]
+    fn timeouts_are_reported_as_timed_out_errors() {
+        let error = timed_out();
+
+        assert_eq!(error.kind(), io::ErrorKind::TimedOut);
+        assert_eq!(error.to_string(), "future timed out");
+    }
+
+    /// Regression test for https://github.com/bee-san/RustScan/issues/933:
+    /// the SNMP public-walk probe must be the exact 33-byte BER packet, with
+    /// the literal `public` community string intact. The old hexdigits-only
+    /// decoding mangled it into a 28-byte probe that agents never answered.
+    #[test]
+    fn udp_snmp_probe_bytes_match_nmap() {
+        let payload = get_parsed_data()
+            .iter()
+            .find(|(ports, _)| ports.contains(&161))
+            .map(|(_, payload)| payload)
+            .expect("no UDP payload registered for port 161");
+        let expected: Vec<u8> = vec![
+            0x30, 0x1f, 0x02, 0x01, 0x00, 0x04, 0x06, b'p', b'u', b'b', b'l', b'i', b'c', 0xa1,
+            0x12, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x07, 0x30, 0x05,
+            0x06, 0x01, 0x00, 0x05, 0x00,
+        ];
+        assert_eq!(*payload, expected);
+    }
+
+    /// The SSDP probe mixes `\xNN` escapes, `\"` escapes and literal text
+    /// across two quoted segments: segments must decode and concatenate
+    /// with no separators.
+    #[test]
+    fn udp_ssdp_probe_decodes_escapes_and_literal_text() {
+        let payload = get_parsed_data()
+            .iter()
+            .find(|(ports, _)| ports.contains(&1900))
+            .map(|(_, payload)| payload)
+            .expect("no UDP payload registered for port 1900");
+        let expected =
+            b"M-SEARCH * HTTP/1.1\r\nHost: 239.255.255.250:1900\r\nMan: \"ssdp:discover\"\r\nMX: 5\r\nST: ssdp:all\r\n\r\n"
+                .to_vec();
+        assert_eq!(*payload, expected);
+    }
+}

src/scanner/socket_iterator.rs

@@ -0,0 +1,147 @@
+use itertools::{iproduct, Product};
+use std::iter::FusedIterator;
+use std::net::{IpAddr, SocketAddr};
+use std::slice;
+
+/// An iterator that receives a slice of IPs and ports and returns a
+/// [`SocketAddr`] for each IP/port pair until all combinations are exhausted.
+///
+/// The goal of this iterator is to walk every IP and port combination
+/// *without* allocating a big intermediate buffer — the alternative would be
+/// materialising a `Vec<SocketAddr>` of every pair up front.
+///
+/// # Ordering
+///
+/// The IP/port order is intentionally reversed inside `product_it`: we want
+/// `iproduct!` to iterate *all IPs for one port* before advancing to the next
+/// port ("hold the port, go through all the IPs, then advance the port").
+///
+/// # Example
+///
+/// `SocketIterator` lives in a private module, so this example is not run as
+/// a doctest; `goes_through_every_ip_port_combination` checks the same order.
+///
+/// ```ignore
+/// # use std::net::IpAddr;
+/// let ips = [
+///     "127.0.0.1".parse::<IpAddr>().unwrap(),
+///     "192.168.0.1".parse::<IpAddr>().unwrap(),
+/// ];
+/// let ports = [80u16, 443];
+///
+/// let mut it = SocketIterator::new(&ips, &ports);
+/// assert_eq!(it.next(), Some("127.0.0.1:80".parse().unwrap()));
+/// assert_eq!(it.next(), Some("192.168.0.1:80".parse().unwrap()));
+/// assert_eq!(it.next(), Some("127.0.0.1:443".parse().unwrap()));
+/// assert_eq!(it.next(), Some("192.168.0.1:443".parse().unwrap()));
+/// assert_eq!(it.next(), None);
+/// ```
+#[derive(Clone)]
+pub struct SocketIterator<'s> {
+    // No boxing: the iterator owns the concrete slice iterators directly.
+    // This keeps `SocketIterator` allocation-free and makes `Clone` free too.
+    product_it: Product<slice::Iter<'s, u16>, slice::Iter<'s, IpAddr>>,
+}
+
+impl<'s> SocketIterator<'s> {
+    pub fn new(ips: &'s [IpAddr], ports: &'s [u16]) -> Self {
+        Self {
+            // `iproduct!` calls `.into_iter()` on each argument; `slice::Iter`
+            // is already an iterator, so this is a no-op (no allocation).
+            product_it: iproduct!(ports.iter(), ips.iter()),
+        }
+    }
+}
+
+impl Iterator for SocketIterator<'_> {
+    type Item = SocketAddr;
+
+    /// Returns the next socket, or `None` when all combinations are exhausted.
+    /// Every IP is paired with the same port until the port advances.
+    fn next(&mut self) -> Option<Self::Item> {
+        self.product_it
+            .next()
+            .map(|(port, ip)| SocketAddr::new(*ip, *port))
+    }
+
+    // Delegate the size hint so callers like `collect()` can pre-size buffers.
+    fn size_hint(&self) -> (usize, Option<usize>) {
+        self.product_it.size_hint()
+    }
+}
+
+// `Product` and `slice::Iter` are both fused, so we are too.
+impl FusedIterator for SocketIterator<'_> {}
+
+#[cfg(test)]
+mod tests {
+    use super::SocketIterator;
+    use std::net::{IpAddr, SocketAddr};
+
+    #[test]
+    fn goes_through_every_ip_port_combination() {
+        let addrs = vec![
+            "127.0.0.1".parse::<IpAddr>().unwrap(),
+            "192.168.0.1".parse::<IpAddr>().unwrap(),
+        ];
+        let ports: Vec<u16> = vec![22, 80, 443];
+        let mut it = SocketIterator::new(&addrs, &ports);
+
+        assert_eq!(Some(SocketAddr::new(addrs[0], ports[0])), it.next());
+        assert_eq!(Some(SocketAddr::new(addrs[1], ports[0])), it.next());
+        assert_eq!(Some(SocketAddr::new(addrs[0], ports[1])), it.next());
+        assert_eq!(Some(SocketAddr::new(addrs[1], ports[1])), it.next());
+        assert_eq!(Some(SocketAddr::new(addrs[0], ports[2])), it.next());
+        assert_eq!(Some(SocketAddr::new(addrs[1], ports[2])), it.next());
+        assert_eq!(None, it.next());
+    }
+
+    #[test]
+    fn size_hint_is_exact() {
+        let addrs = ["127.0.0.1".parse::<IpAddr>().unwrap()];
+        let ports: Vec<u16> = vec![22, 80, 443];
+        let mut it = SocketIterator::new(&addrs, &ports);
+
+        assert_eq!(it.size_hint(), (3, Some(3)));
+        it.next();
+        assert_eq!(it.size_hint(), (2, Some(2)));
+    }
+
+    #[test]
+    fn clone_resumes_independently() {
+        let addrs = [
+            "127.0.0.1".parse::<IpAddr>().unwrap(),
+            "192.168.0.1".parse::<IpAddr>().unwrap(),
+        ];
+        let ports: Vec<u16> = vec![22, 80];
+
+        let mut a = SocketIterator::new(&addrs, &ports);
+        assert_eq!(a.next(), Some(SocketAddr::new(addrs[0], ports[0])));
+        let b = a.clone(); // b starts where a is now
+
+        // 2 IPs x 2 ports = 4 sockets, one of which was consumed before cloning.
+        let rest = [
+            SocketAddr::new(addrs[1], ports[0]),
+            SocketAddr::new(addrs[0], ports[1]),
+            SocketAddr::new(addrs[1], ports[1]),
+        ];
+        assert_eq!(a.collect::<Vec<_>>(), rest);
+        assert_eq!(b.collect::<Vec<_>>(), rest);
+    }
+
+    #[test]
+    fn empty_inputs_yield_nothing() {
+        let addrs = ["127.0.0.1".parse::<IpAddr>().unwrap()];
+        let ports = [22u16];
+
+        for mut it in [
+            SocketIterator::new(&[], &ports),
+            SocketIterator::new(&addrs, &[]),
+        ] {
+            assert_eq!(it.size_hint(), (0, Some(0)));
+            assert_eq!(it.next(), None);
+            // Stays exhausted, as promised by the `FusedIterator` impl.
+            assert_eq!(it.next(), None);
+        }
+    }
+}

src/scripts/mod.rs

@@ -0,0 +1,498 @@
+//! Scripting Engine to run scripts based on tags.
+//!
+//! This module serves to filter and run the scripts selected by the user.
+//!
+//! A new commandline and configuration file option was added.
+//!
+//! ## `--scripts`
+//!
+//! ### `default`
+//!
+//! This is the default behavior, like as it was from the beginning of RustScan.
+//!
+//! The user do not have to chose anything for this. This is the only script
+//! embedded in RustScan running as default.
+//!
+//! ### `none`
+//!
+//! The user have to use the `--scripts none` commandline argument or `scripts =
+//! "none"` in the config file.
+//!
+//! None of the scripts will run, this replaces the removed `--no-nmap` option.
+//!
+//! ### `custom`
+//!
+//! The user have to use the `--scripts custom` commandline argument or
+//! `scripts = "custom"` in the config file.
+//!
+//! RustScan will look for the script configuration file in the user's home
+//! dir: `home_dir/.rustscan_scripts.toml`
+//!
+//! The config file have 3 optional fields: `tag`, `developer` and `port`. Just
+//! the `tag` field will be used forther in the process.
+//!
+//! RustScan will also look for available scripts in the user's home dir:
+//! `home_dir/.rustscan_scripts` and will try to read all the files, and parse
+//! them into a vector of [`ScriptFile`].
+//!
+//! Filtering on tags means the tags found in the `rustscan_scripts.toml` file
+//! will also have to be present in the [`ScriptFile`], otherwise the script
+//! will not be selected.
+//!
+//! All of the `rustscan_script.toml` tags have to be present at minimum in a
+//! [`ScriptFile`] to get selected, but can be also more.
+//!
+//! Config file example:
+//!
+//! - `fixtures/test_rustscan_scripts.toml`
+//!
+//! Metadata-only test fixture:
+//!
+//! - `fixtures/.rustscan_scripts/test_script.txt`
+//!
+//! `call_format` in script files can be of 2 variants:
+//!
+//! One is where all of the possible tags `{{script}}`, `{{ip}}` and `{{port}}`
+//! are there.
+//!
+//! - The `{{script}}` part will be replaced with the scriptfile full path
+//!   gathered while parsing available scripts.
+//! - The `{{ip}}` part will be replaced with the ip we got from the scan.
+//! - The `{{port}}` part will be reaplced with the ports separated with the
+//!   `ports_separator` found in the script file
+//!
+//! And when there is only `{{ip}}` and `{{port}}` is in the format, only those
+//! will be replaced with the arguments from the scan.
+//!
+//! This makes it easy to run a system installed command like `nmap`, and give
+//! any kind of arguments to it.
+//!
+//! If the format is different, the script will be silently discarded and will
+//! not run. With the `Debug` option it's possible to see where it goes wrong.
+
+#![allow(clippy::module_name_repetitions)]
+
+use crate::input::ScriptsRequired;
+use anyhow::{anyhow, Result};
+use log::debug;
+use serde_derive::{Deserialize, Serialize};
+use std::fs::{self, File};
+use std::io::{self, prelude::*};
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::string::ToString;
+use text_placeholder::Template;
+
+#[cfg(unix)]
+use std::os::unix::process::ExitStatusExt;
+
+static DEFAULT: &str = r#"tags = ["core_approved", "RustScan", "default"]
+developer = [ "RustScan", "https://github.com/RustScan" ]
+ports_separator = ","
+call_format = "nmap -vvv -p {{port}} -{{ipversion}} {{ip}}"
+"#;
+
+#[cfg(not(tarpaulin_include))]
+pub fn init_scripts(scripts: &ScriptsRequired) -> Result<Vec<ScriptFile>> {
+    let mut scripts_to_run: Vec<ScriptFile> = Vec::new();
+
+    match scripts {
+        ScriptsRequired::None => {}
+        ScriptsRequired::Default => {
+            let default_script =
+                toml::from_str::<ScriptFile>(DEFAULT).expect("Failed to parse Script file.");
+            scripts_to_run.push(default_script);
+        }
+        ScriptsRequired::Custom => {
+            let script_config = ScriptConfig::read_config()?;
+            debug!("Script config \n{script_config:?}");
+
+            let script_dir_base = if let Some(config_directory) = &script_config.directory {
+                PathBuf::from(config_directory)
+            } else {
+                dirs::home_dir().ok_or_else(|| anyhow!("Could not infer scripts path."))?
+            };
+
+            let script_paths = find_scripts(script_dir_base)?;
+            debug!("Scripts paths \n{script_paths:?}");
+
+            let parsed_scripts = parse_scripts(script_paths);
+            debug!("Scripts parsed \n{parsed_scripts:?}");
+
+            // Only Scripts that contain all the tags found in ScriptConfig will be selected.
+            if let Some(config_hashset) = script_config.tags {
+                for script in parsed_scripts {
+                    if let Some(script_hashset) = &script.tags {
+                        if script_hashset
+                            .iter()
+                            .all(|tag| config_hashset.contains(tag))
+                        {
+                            scripts_to_run.push(script);
+                        } else {
+                            debug!(
+                                "\nScript tags does not match config tags {:?} {}",
+                                script_hashset,
+                                script.path.unwrap().display()
+                            );
+                        }
+                    }
+                }
+            }
+            debug!("\nScript(s) to run {scripts_to_run:?}");
+        }
+    }
+
+    Ok(scripts_to_run)
+}
+
+pub fn parse_scripts(scripts: Vec<PathBuf>) -> Vec<ScriptFile> {
+    let mut parsed_scripts: Vec<ScriptFile> = Vec::with_capacity(scripts.len());
+    for script in scripts {
+        debug!("Parsing script {}", script.display());
+        if let Some(script_file) = ScriptFile::new(script) {
+            parsed_scripts.push(script_file);
+        }
+    }
+    parsed_scripts
+}
+
+#[derive(Clone, Debug)]
+#[allow(dead_code)]
+pub struct Script {
+    // Path to the script itself.
+    path: Option<PathBuf>,
+
+    // Ip got from scanner.
+    ip: IpAddr,
+
+    // Ports found with portscan.
+    open_ports: Vec<u16>,
+
+    // Port found in ScriptFile, if defined only this will run with the ip.
+    trigger_port: Option<String>,
+
+    // Character to join ports in case we want to use a string format of them, for example nmap -p.
+    ports_separator: Option<String>,
+
+    // Tags found in ScriptFile.
+    tags: Option<Vec<String>>,
+
+    // The format how we want the script to run.
+    call_format: Option<String>,
+}
+
+#[derive(Serialize)]
+struct ExecPartsScript {
+    script: String,
+    ip: String,
+    port: String,
+    ipversion: String,
+}
+
+#[derive(Serialize)]
+struct ExecParts {
+    ip: String,
+    port: String,
+    ipversion: String,
+}
+
+impl Script {
+    pub fn build(
+        path: Option<PathBuf>,
+        ip: IpAddr,
+        open_ports: Vec<u16>,
+        trigger_port: Option<String>,
+        ports_separator: Option<String>,
+        tags: Option<Vec<String>>,
+        call_format: Option<String>,
+    ) -> Self {
+        Self {
+            path,
+            ip,
+            open_ports,
+            trigger_port,
+            ports_separator,
+            tags,
+            call_format,
+        }
+    }
+
+    // Some variables get changed before read, and compiler throws warning on warn(unused_assignments)
+    #[allow(unused_assignments)]
+    pub fn run(self) -> Result<String> {
+        debug!("run self {:?}", self);
+
+        let separator = self.ports_separator.unwrap_or_else(|| ",".into());
+
+        let mut ports_str = self
+            .open_ports
+            .iter()
+            .map(ToString::to_string)
+            .collect::<Vec<String>>()
+            .join(&separator);
+        if let Some(port) = self.trigger_port {
+            ports_str = port;
+        }
+
+        let mut final_call_format = String::new();
+        if let Some(call_format) = self.call_format {
+            final_call_format = call_format;
+        } else {
+            return Err(anyhow!("Failed to parse execution format."));
+        }
+        let default_template: Template = Template::new(&final_call_format);
+        let mut to_run = String::new();
+
+        if final_call_format.contains("{{script}}") {
+            let exec_parts_script: ExecPartsScript = ExecPartsScript {
+                script: self.path.unwrap().to_str().unwrap().to_string(),
+                ip: self.ip.to_string(),
+                port: ports_str,
+                ipversion: match &self.ip {
+                    IpAddr::V4(_) => String::from("4"),
+                    IpAddr::V6(_) => String::from("6"),
+                },
+            };
+            to_run = default_template.fill_with_struct(&exec_parts_script)?;
+        } else {
+            let exec_parts: ExecParts = ExecParts {
+                ip: self.ip.to_string(),
+                port: ports_str,
+                ipversion: match &self.ip {
+                    IpAddr::V4(_) => String::from("4"),
+                    IpAddr::V6(_) => String::from("6"),
+                },
+            };
+            to_run = default_template.fill_with_struct(&exec_parts)?;
+        }
+        debug!("\nScript format to run {to_run}");
+        execute_script(&to_run)
+    }
+}
+
+#[cfg(not(tarpaulin_include))]
+fn execute_script(script: &str) -> Result<String> {
+    debug!("\nScript arguments {script}");
+
+    let (cmd, arg) = if cfg!(unix) {
+        ("sh", "-c")
+    } else {
+        ("cmd.exe", "/c")
+    };
+
+    match Command::new(cmd)
+        .args([arg, script])
+        .stdin(Stdio::piped())
+        .stderr(Stdio::piped())
+        .output()
+    {
+        Ok(output) => {
+            let status = output.status;
+
+            let es = match status.code() {
+                Some(code) => code,
+                _ => {
+                    #[cfg(unix)]
+                    {
+                        status.signal().unwrap()
+                    }
+
+                    #[cfg(windows)]
+                    {
+                        return Err(anyhow!("Unknown exit status"));
+                    }
+                }
+            };
+
+            if es != 0 {
+                return Err(anyhow!("Exit code = {}", es));
+            }
+            Ok(String::from_utf8_lossy(&output.stdout).into_owned())
+        }
+        Err(error) => {
+            debug!("Command error {error}",);
+            Err(anyhow!(error.to_string()))
+        }
+    }
+}
+
+pub fn find_scripts(path: PathBuf) -> Result<Vec<PathBuf>> {
+    if path.is_dir() {
+        debug!("Scripts folder found {}", path.display());
+        let mut files_vec: Vec<PathBuf> = Vec::new();
+        for entry in fs::read_dir(path)? {
+            let entry = entry?;
+            files_vec.push(entry.path());
+        }
+        Ok(files_vec)
+    } else {
+        Err(anyhow!("Can't find scripts folder {}", path.display()))
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ScriptFile {
+    pub path: Option<PathBuf>,
+    pub tags: Option<Vec<String>>,
+    pub developer: Option<Vec<String>>,
+    pub port: Option<String>,
+    pub ports_separator: Option<String>,
+    pub call_format: Option<String>,
+}
+
+impl ScriptFile {
+    fn new(script: PathBuf) -> Option<ScriptFile> {
+        let real_path = script.clone();
+        let mut lines_buf = String::new();
+        if let Ok(file) = File::open(script) {
+            for mut line in io::BufReader::new(file).lines().skip(1).flatten() {
+                if line.starts_with('#') {
+                    line.retain(|c| c != '#');
+                    line = line.trim().to_string();
+                    line.push('\n');
+                    lines_buf.push_str(&line);
+                } else {
+                    break;
+                }
+            }
+        } else {
+            debug!("Failed to read file: {}", real_path.display());
+            return None;
+        }
+        debug!("ScriptFile {} lines\n{}", real_path.display(), lines_buf);
+
+        match toml::from_str::<ScriptFile>(&lines_buf) {
+            Ok(mut parsed) => {
+                debug!("Parsed ScriptFile{} \n{:?}", real_path.display(), parsed);
+                parsed.path = Some(real_path);
+                // parsed_scripts.push(parsed);
+                Some(parsed)
+            }
+            Err(e) => {
+                debug!("Failed to parse ScriptFile headers {e}");
+                None
+            }
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Clone)]
+pub struct ScriptConfig {
+    pub tags: Option<Vec<String>>,
+    pub ports: Option<Vec<String>>,
+    pub developer: Option<Vec<String>>,
+    pub directory: Option<String>,
+}
+
+#[cfg(not(tarpaulin_include))]
+impl ScriptConfig {
+    pub fn read_config() -> Result<ScriptConfig> {
+        let Some(mut home_dir) = dirs::home_dir() else {
+            return Err(anyhow!("Could not infer ScriptConfig path."));
+        };
+        home_dir.push(".rustscan_scripts.toml");
+
+        let content = fs::read_to_string(home_dir)?;
+        let config = toml::from_str::<ScriptConfig>(&content)?;
+        Ok(config)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn find_and_parse_scripts() {
+        let scripts = find_scripts("fixtures/.rustscan_scripts".into()).unwrap();
+        let scripts = parse_scripts(scripts);
+        assert_eq!(scripts.len(), 1);
+    }
+
+    #[test]
+    #[should_panic]
+    fn find_invalid_folder() {
+        let _scripts = find_scripts("Cargo.toml".into()).unwrap();
+    }
+
+    #[test]
+    #[should_panic]
+    fn open_script_file_invalid_headers() {
+        ScriptFile::new("fixtures/.rustscan_scripts/test_script_invalid_headers.txt".into())
+            .unwrap();
+    }
+
+    #[test]
+    #[should_panic]
+    fn open_nonexisting_script_file() {
+        ScriptFile::new("qwertyuiop.txt".into()).unwrap();
+    }
+
+    #[test]
+    fn parse_txt_script() {
+        let script_f =
+            ScriptFile::new("fixtures/.rustscan_scripts/test_script.txt".into()).unwrap();
+        assert_eq!(
+            script_f.tags,
+            Some(vec!["core_approved".to_string(), "example".to_string()])
+        );
+        assert_eq!(
+            script_f.developer,
+            Some(vec![
+                "example".to_string(),
+                "https://example.org".to_string()
+            ])
+        );
+        assert_eq!(script_f.ports_separator, Some(",".to_string()));
+        assert_eq!(
+            script_f.call_format,
+            Some("fixture {{ip}} {{port}}".to_string())
+        );
+    }
+
+    #[test]
+    fn test_custom_directory_config() {
+        // Create test config
+        let config_str = r#"
+            tags = ["core_approved", "example"]
+            directory = "fixtures/.rustscan_scripts"
+        "#;
+
+        let config: ScriptConfig = toml::from_str(config_str).unwrap();
+        assert_eq!(
+            config.directory,
+            Some("fixtures/.rustscan_scripts".to_string())
+        );
+
+        // Test that the directory is actually used
+        let script_dir_base = PathBuf::from(config.directory.unwrap());
+        let scripts = find_scripts(script_dir_base).unwrap();
+
+        // Verify we found the test script
+        assert!(scripts.iter().any(|p| p
+            .file_name()
+            .and_then(|f| f.to_str())
+            .map(|s| s == "test_script.txt")
+            .unwrap_or(false)));
+    }
+
+    #[test]
+    fn test_default_directory_fallback() {
+        let config_str = r#"
+            tags = ["core_approved", "example"]
+        "#;
+
+        let config: ScriptConfig = toml::from_str(config_str).unwrap();
+        assert_eq!(config.directory, None);
+
+        // Test fallback to home directory
+        let script_dir_base = if let Some(config_directory) = &config.directory {
+            PathBuf::from(config_directory)
+        } else {
+            dirs::home_dir().unwrap()
+        };
+
+        assert_eq!(script_dir_base, dirs::home_dir().unwrap());
+    }
+}

src/tui.rs

@@ -0,0 +1,149 @@
+//! Utilities for terminal output during scanning.
+
+use std::io::Write;
+
+/// Prints a single line to stdout without ever panicking.
+///
+/// `println!` panics when writing to stdout fails, which is fatal under the
+/// `panic = "abort"` release profile. That includes the `BrokenPipe` error
+/// produced when a downstream consumer (e.g. `rustscan -g ... | head`)
+/// closes the pipe, so instead the process exits quietly when that happens.
+/// Other output errors are reported on stderr before exiting.
+///
+/// All user-facing output should go through this function (the `warning!`,
+/// `detail!`, `output!` and `funny_opening!` macros already do) instead of
+/// `println!`.
+pub fn println_safe(args: std::fmt::Arguments<'_>) {
+    match writeln!(std::io::stdout().lock(), "{args}") {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => {
+            // the reader end of the pipe is gone; nothing left to print to
+            std::process::exit(0);
+        }
+        Err(e) => {
+            let _ = writeln!(std::io::stderr(), "rustscan: failed writing to stdout: {e}");
+            std::process::exit(1);
+        }
+    }
+}
+
+/// Terminal User Interface Module for RustScan
+/// Defines macros to use
+#[macro_export]
+macro_rules! warning {
+    ($name:expr) => {
+        $crate::tui::println_safe(format_args!(
+            "{} {}",
+            ansi_term::Colour::Red.bold().paint("[!]"),
+            $name
+        ));
+    };
+    ($name:expr, $greppable:expr, $accessible:expr) => {
+        // if not greppable then print, otherwise no else statement so do not print.
+        if !$greppable {
+            if $accessible {
+                // Don't print the ascii art
+                $crate::tui::println_safe(format_args!("{}", $name));
+            } else {
+                $crate::tui::println_safe(format_args!(
+                    "{} {}",
+                    ansi_term::Colour::Red.bold().paint("[!]"),
+                    $name
+                ));
+            }
+        }
+    };
+}
+
+#[macro_export]
+macro_rules! detail {
+    ($name:expr) => {
+        $crate::tui::println_safe(format_args!(
+            "{} {}",
+            ansi_term::Colour::Blue.bold().paint("[~]"),
+            $name
+        ));
+    };
+    ($name:expr, $greppable:expr, $accessible:expr) => {
+        // if not greppable then print, otherwise no else statement so do not print.
+        if !$greppable {
+            if $accessible {
+                // Don't print the ascii art
+                $crate::tui::println_safe(format_args!("{}", $name));
+            } else {
+                $crate::tui::println_safe(format_args!(
+                    "{} {}",
+                    ansi_term::Colour::Blue.bold().paint("[~]"),
+                    $name
+                ));
+            }
+        }
+    };
+}
+
+#[macro_export]
+macro_rules! output {
+    ($name:expr) => {
+        $crate::tui::println_safe(format_args!(
+            "{} {}",
+            ansi_term::Colour::RGB(0, 255, 9).bold().paint("[>]"),
+            $name
+        ));
+    };
+    ($name:expr, $greppable:expr, $accessible:expr) => {
+        // if not greppable then print, otherwise no else statement so do not print.
+        if !$greppable {
+            if $accessible {
+                // Don't print the ascii art
+                $crate::tui::println_safe(format_args!("{}", $name));
+            } else {
+                $crate::tui::println_safe(format_args!(
+                    "{} {}",
+                    ansi_term::Colour::RGB(0, 255, 9).bold().paint("[>]"),
+                    $name
+                ));
+            }
+        }
+    };
+}
+
+#[macro_export]
+macro_rules! funny_opening {
+    // prints a funny quote / opening
+    () => {
+        use rand::seq::IndexedRandom;
+        let quotes = vec![
+            "Nmap? More like slowmap.🐢",
+            "🌍HACK THE PLANET🌍",
+            "Real hackers hack time ⌛",
+            "Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan",
+            "😵 https://admin.tryhackme.com",
+            "0day was here ♥",
+            "I don't always scan ports, but when I do, I prefer RustScan.",
+            "RustScan: Where scanning meets swagging. 😎",
+            "To scan or not to scan? That is the question.",
+            "RustScan: Because guessing isn't hacking.",
+            "Scanning ports like it's my full-time job. Wait, it is.",
+            "Open ports, closed hearts.",
+            "I scanned my computer so many times, it thinks we're dating.",
+            "Port scanning: Making networking exciting since... whenever.",
+            "You miss 100% of the ports you don't scan. - RustScan",
+            "Breaking and entering... into the world of open ports.",
+            "TCP handshake? More like a friendly high-five!",
+            "Scanning ports: The virtual equivalent of knocking on doors.",
+            "RustScan: Making sure 'closed' isn't just a state of mind.",
+            "RustScan: allowing you to send UDP packets into the void 1200x faster than NMAP",
+            "Port scanning: Because every port has a story to tell.",
+            "I scanned ports so fast, even my computer was surprised.",
+            "Scanning ports faster than you can say 'SYN ACK'",
+            "RustScan: Where '404 Not Found' meets '200 OK'.",
+            "RustScan: Exploring the digital landscape, one IP at a time.",
+            "TreadStone was here 🚀",
+            "With RustScan, I scan ports so fast, even my firewall gets whiplash 💨",
+            "Scanning ports so fast, even the internet got a speeding ticket!",
+        ];
+        let random_quote = quotes.choose(&mut rand::rng()).unwrap();
+
+        $crate::tui::println_safe(format_args!("{}\n", random_quote));
+    };
+}

tests/udp_payload_lookup.rs

@@ -0,0 +1,32 @@
+use rustscan::generated::get_parsed_data;
+use rustscan::scanner::build_udp_payload_lookup;
+
+#[test]
+fn udp_payload_lookup_contains_common_udp_ports() {
+    let udp_map = get_parsed_data();
+    let lookup = build_udp_payload_lookup(udp_map);
+
+    // These are common UDP services; the payload database should include them.
+    assert!(
+        lookup.contains_key(&53),
+        "expected UDP payload for DNS (53)"
+    );
+    assert!(
+        lookup.contains_key(&123),
+        "expected UDP payload for NTP (123)"
+    );
+}
+
+#[test]
+fn udp_payload_lookup_payloads_are_non_empty_for_known_ports() {
+    let udp_map = get_parsed_data();
+    let lookup = build_udp_payload_lookup(udp_map);
+
+    // Don't assert exact bytes (the generated payload set may evolve),
+    // but it should not be empty for these well-known protocols.
+    let dns = lookup.get(&53).expect("missing DNS payload");
+    assert!(!dns.is_empty(), "DNS payload should not be empty");
+
+    let ntp = lookup.get(&123).expect("missing NTP payload");
+    assert!(!ntp.is_empty(), "NTP payload should not be empty");
+}