Scanning

Use rmap scan to send packets with a specific probe and collect structured responses. Targets can come from flat files, generator outputs, or remote workers, and every run streams results as soon as they arrive.

Run a local scan

# Probe a file of IPv6 addresses with ICMP at 2k packets per second
rmap scan --path targets.txt --pps 2000 --timeout 6 icmp

Add --output-file and --columns to write CSV data while the scan runs:

rmap scan --path targets.txt --pps 1000 --output-file results.csv \
  --columns target,probe,alias icmp

Each probe adds its own columns (for example port for TCP/UDP, dns_response_code for DNS, or ntp_mode for NTP). Pick the columns you care about and leave the rest for ad‑hoc analysis.

Target sources

You can also pipe generators directly into scan by combining commands: rmap generate ... --output - | rmap scan --path - icmp.

Available probes

Switch the probe by appending a subcommand and its options:

rmap scan --path targets.txt --pps 500 tcp --port 443
rmap scan --path targets.txt udp --port 161
rmap scan --path targets.txt dns --domain example.com --query-type AAAA
rmap scan --path targets.txt tcp-syn-ack --port 80
rmap scan --path targets.txt ntp --mode client

Probe-specific pages in this section break down recommended defaults and tuning tips.

Transport controls

Remote workers

Need more capacity or a host closer to the targets? Start a worker with rmap serve and add --remote HOST:PORT to the scan command. The CLI streams the configuration and targets to the worker while results flow back to the local terminal. See the Remote Scans page for deployment patterns.