CEH Footprinting, Reconnaissance and Scanning Practice Question

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

⚠ Common exam trap

Watch out — candidates often choose Nmap because it is the most familiar and versatile scanning tool, but the question specifically emphasizes 'high-speed' scanning of a massive IP range, which is Masscan's unique strength due to its asynchronous raw packet design and ability to achieve millions of packets per second.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Masscan

Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
OpenVAS
Why it's wrong here
OpenVAS (Open Vulnerability Assessment System) is primarily designed for comprehensive vulnerability scanning, which involves identifying known security weaknesses and misconfigurations on target systems. While it performs port scanning as an initial phase to discover open services, its core function is deep analysis and reporting, making it inherently slow and resource-intensive for rapid, wide-area port discovery across massive IP ranges, unlike dedicated high-speed port scanners.
✗
hping3
Why it's wrong here
hping3 is a versatile command-line tool for crafting and sending custom TCP/IP packets, often used for firewall testing, network troubleshooting, and manual port scanning with fine-grained control over packet headers. However, its strength lies in precise, low-level packet manipulation and individual host interaction rather than the highly optimized, parallelized architecture required for scanning millions of IP addresses and thousands of ports per second, which is necessary for high-speed reconnaissance.
✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is an industry-standard, powerful network discovery and security auditing tool capable of scanning large IP ranges and identifying open ports, services, and operating systems. While highly effective for detailed host enumeration and service version detection, Nmap's design prioritizes accuracy, reliability, and comprehensive script execution, which inherently limits its raw packet-per-second throughput compared to tools specifically engineered for extreme speed over vast network segments.
✓
Masscan
Why this is correct
Masscan is purpose-built for ultra-fast port scanning, capable of scanning the entire internet in minutes by employing an asynchronous, stateless design that sends packets at an extremely high rate. It achieves this speed by operating like a network driver, transmitting packets directly and listening for responses, making it exceptionally efficient for quickly discovering open ports across massive IP address ranges, which is crucial for rapid reconnaissance in large-scale penetration tests.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question