PAGES
← all tools
◆ Reconnaissance & OSINT

pnscan

open-source

pnscan is a parallel network scanner tool used to survey IPv4 TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. network services such as SSH, FTP, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., and web servers.

Summary

pnscan is an open-source command-line network scanner, free to use, that surveys IPv4 TCP services by probing host and port ranges with a dynamically sized thread pool. You run it directly from a shell, feeding it CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. blocks, hostname ranges, or a list of hosts piped in via stdin, and pointing it at ports or service names to identify what is listening, such as SSH, FTP, SMTP, or web servers. It suits people doing manual network reconnaissance or inventory work rather than teams wanting a managed scanning platform, sitting in the same space as older Unix-style scanning utilities. First committed in 2015 with four contributors, it has had no commits in the past year, so treat it as stable but no longer actively maintained.

pnscan is a parallel network scanner tool used to survey IPv4 TCP network services such as SSH, FTP, SMTP, and web servers.

How pnscan helps

Which hosts on this network segment are actually alive and reachable?

sweeps a CIDR block, address range, or hostname range with TCP probes and reports which addresses respond, skipping the broadcast-reserved first and last addresses of a CIDR block

Which of these machines are running SSH, FTP, SMTP, or web servers I don't know about?

probes the given port or service-name range on every host in scope and reports which ports are open, letting you match responses against expected services

What software and version is actually answering on a given port, versus what it's supposed to be running?

sends the specified data to the port and matches the response, so a banner or reply string can confirm the real service and version rather than trusting the port number

Can I get a inventory of a host list I already have, instead of a fresh subnet sweep?

reads a list of hosts piped in via standard input and scans exactly that set, printing a descriptive line for each as it works through them

Which servers respond with a distinctive banner I can sort or diff against a known-good list?

scans the chosen ports across the range and can sort results by address, so responses like a server identification string can be compared host by host

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities

Built from pnscan's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

  • pnscan covers 1 of the 13 network discovery and scanning capabilities we track.
All capabilities 4 capabilities
Build and Packaging Configuration documented Provides build system files and packaging scripts (Makefile, configure, pkg specs) that allow the tool to be compiled and distributed across platforms. 9 other sources

docs 9 total

  • File tree Collapse file tree Open diff view settings Filter options Makefile.in configure.ac configure pkgs Makefile.port Collapse file tree Open diff view settings Collapse file Makefile.in Copy file name to clipboard Expand all lines: Makefile.in + - Lines changed: 5 additions & 5 deletions Original file line… seen Oct 2026 · source
  • File tree Collapse file tree Open diff view settings Filter options Makefile.in configure.ac configure pkgs Makefile.in Makefile.old Makefile pnscan.rb.in pnscan.rb Collapse file tree Open diff view settings Collapse file Makefile.in Copy file name to clipboard Expand all lines: Makefile.in + - Lines changed: 2… seen Oct 2026 · source
  • File tree Collapse file tree Open diff view settings Filter options Makefile.in pkgs Makefile.in Collapse file tree Open diff view settings Collapse file Makefile.in Copy file name to clipboard Expand all lines: Makefile.in + - Lines changed: 47 additions & 43 deletions Original file line number Diff line number… seen Oct 2026 · source
  • File tree Collapse file tree Open diff view settings Filter options pkgs Makefile.in Collapse file tree Open diff view settings Collapse file pkgs/Makefile.in Copy file name to clipboard Expand all lines: pkgs/Makefile.in + - Lines changed: 2 additions & 1 deletion Original file line number Diff line number Diff… seen Oct 2026 · source
  • File tree Collapse file tree Open diff view settings Filter options Makefile.in configure.ac configure pkgs Makefile.in Makefile.old pkg-descr.in pnscan.spec.in pnscan.spec Collapse file tree Open diff view settings Collapse file Makefile.in Copy file name to clipboard Expand all lines: Makefile.in + - Lines… seen Oct 2026 · source
  • File tree Collapse file tree Open diff view settings Filter options Makefile.in configure.ac configure pkgs Makefile.port Collapse file tree Open diff view settings Collapse file Makefile.in Copy file name to clipboard Expand all lines: Makefile.in + - Lines changed: 5 additions & 5 deletions Original file line… seen Oct 2026 · source
Service-Specific Scanning shipped Performs targeted scans for specific protocols or services, including SSH, daytime, HTTP (WWW), IDENT, and Roxen servers. 5 other sources

Shared capability: Attack surface inventory

example

  • Scan network for SSH on port 22 pnscan 192.168.0.0/24 22
  • Scan daytime servers and sort by IP pnscan arpanet/10 daytime | ipsort
  • Scan all ports for WWW servers pnscan -w"HEAD / HTTP/1.0\r\n\r\n" -r"Server:" 192.168.0.32 1:65525
  • Scan IDENT servers with 8 threads pnscan -n8 -w"VERSION" 192.168.10.34:192.168.10.98 113
  • Scan for Roxen servers, print Server line pnscan -l -w"HEAD / HTTP/1.0\r\n\r\n" -r"Roxen" localhost 1:65525
Binary Data Exchange shipped suggested Sends custom binary payloads to a target port and matches the response data. 1 other source

Suggested capability: Service and version detection. This is our guess, not confirmed.

example

  • Send and match binary data on port pnscan -W"05 5A 37" -R"FF 00 FF" 192.168.0.32 145
Parallel TCP Network Scanning documented Scans IPv4 addresses for open TCP ports and identifies running services such as SSH, FTP, SMTP, and web servers across specified host and port ranges. 1 other source

Shared capability: Attack surface inventory

docs

  • Parallel IPv4 TCP network scanner that surveys services like SSH, FTP, SMTP, and web across host and port ranges.

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for pnscan, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail pnscan puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Oct 10, 2026 · watching since Jun 24, 2026

Project health

Issue, contributor and maintainer activity in ptrrkssn/pnscan, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

  1. Contributors 0 ±0 vs prior 12 months
  2. Maintainers 0 +0 joined · −0 left, last 12 months
  3. Bus factor 0 committers behind half the commits
  4. Community-filed not measured of issues opened, last 12 months
  5. Median time to close not measured issues closed, last 12 months
  6. Open backlog 0 of 4 issues ever filed
  1. Issues opened / month 0 · 0 communitymaintainers
  2. Open backlog 0
  3. Contributors / month 0
  4. Commits / month 0
  5. Stars 133
Issue themes, last 12 months not measured

Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

Libraries its release ships

What its latest release locks, checked against known advisories.

None of its release's images build from a lockfile we can read.

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Tracked by Cyber Toolchain Choose a badge style and copy the code →
browse all tools → score card for your toolchain →