The best free network scanners for security teams in 2023
Knowing what’s connected to a network is important for securing your organization. There are a fair amount of free and commercial options out there. We see security teams using a mix of runZero, Nmap (sometimes with Zenmap), Angry IP and Masscan.
In this article, we compare and contrast several free tools and provide our take on why we believe runZero is best suited for corporate security teams – particularly teams that are looking to gain continuous visibility into their asset inventory for risk management, incident response, and penetration testing purposes.
Best free network scanners compared (2023) #
|Nmap & Zenmap||Angry IP||Masscan|
|Best for||Continuous and scalable cyber asset management||Ad-hoc network discovery and security auditing||Easy scan of a local network to see which IPs are up||Research scans of the entire Internet|
|Graphical user interface||•||•||•||○|
|Scalable deployment (distributed architecture)||•||○||○||○|
|Scan by IP range (internal & external)||•||•||•||•|
|Scan by domain||•||○||○||○|
|Scan by ASN||•||○||○||○|
|Identifies hardware platform||•||○||○||○|
|Covers managed on-premise assets||•||•||•||•|
|Covers unmanaged / IoT assets||•||◐||◐||◐|
|Safely scans OT assets||•||○||○||○|
|Covers cloud assets||•||◐||◐||◐|
|Covers remote assets||•||○||○||○|
|Free option available||•||•||•||•|
|Paid option available||•||◐||○||○|
|Supported platforms||Windows, Linux,
|Windows, Linux, macOS, BSD||JVM||Windows, Linux, macOS, BSD|
runZero was founded in 2018 by HD Moore, the creator of Metasploit, to help solve the problem of discovering both managed and unmanaged devices on the network. The product has grown to a full cyber asset management solution that covers managed and unmanaged IT/IoT, OT environments, cloud assets, and remote devices. runZero offers a free enterprise trial that downgrades to the free Starter Edition, which is used by more than 20,000 individuals and organizations.
runZero is enterprise grade in terms of its user interface, query language, and ability to collect an inventory even in highly distributed environments without having to write scripts or maintain a custom database. Like all of the other scanners in this article, its scans are unauthenticated but yield a surprising amount of depth of information, such as fully searchable attributes for all services, hardware and firmware details, as well as layer 2 and 3 network topologies. In addition, the solution can use SNMP credentials as well as integrations with vulnerability scanners, EDR, MDM, directories and other solutions to provide deeper insights into cyber assets and their security posture. runZero also provides integrations with CMDB and SIEM solutions to enrich asset inventory on other platforms.
runZero’s scanning technology is safe to use in many OT environments, making it an ideal passive discovery option for critical infrastructure OT environments.
Nmap and Zenmap #
Nmap has been around for 25 years and is the gold standard for ad-hoc network scanning. The free and open source utility is most often used for network discovery and security auditing. It integrates with many other security auditing tools, such as Metasploit.
Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap). The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful and flexible features. It allows users to write simple scripts for network discovery, more sophisticated version detection, and vulnerability detection. NSE can even be used for vulnerability exploitation.
Angry IP #
Angry IP Scanner is an open-source network scanner designed to be fast and simple to use. It scans IP addresses and ports. It is widely used by network administrators.
Angry IP is a good solution for teams that are looking for the fastest and easiest way to see which IPs are in use on a network. However the solution doesn’t provide a lot of information about each device, limited to IP, ping time, hostname, ports, TTL, MAC address, filtered ports, NetBIOS.
Masscan is a port scanner that can cover the entire Internet in under 5 minutes by using asynchronous transmission, sending 10 million packets per second from a single machine. It is purely a command-line tool and its usage is similar to Nmap. While Nmap is more often used to scan individual machines and smaller IP ranges, Masscan is primarily used for very large IP ranges.
Recommended network scanner for security teams: runZero #
Most free network scanners don’t scale easily out of the box, often requiring custom databases and scripts to make them suitable for continuous monitoring and collecting inventory from multiple segments or sites. Out of the mix of tools, only runZero comes with a central repository and a distributed system of Explorers to scan all parts of a network, from inside and outside the firewall.
While all of the scanners we looked at are robust and suitable for their specific use cases, runZero is the best option for corporate security teams. runZero wins on flexibility of deployment, ease of use, and scalability for larger organizations. If your security team consists of more than one person or your organization operates at more than one physical location, runZero is for you.
July 26, 2023
Going beyond: The cybersecurity tools hindering effective cyber asset management
Each article in this roundup explains the downsides of common tools as they pertain to effective cyber asset management, and how runZero, a complete cyber asset management solution, provides a complete and detailed asset inventory beyond the scope of any tools discussed.
July 10, 2023
Why NACs are inadequate for cyber asset management
NACs aren’t the best at asset discovery. Allowing or denying access to the network on Layer 2 is their primary function, but finding everything on your network is a different problem. Let’s examine why.
June 29, 2023
Closing the gap: Power your CMDB with cyber asset management for better ROI
According to Gartner, only 25% of organizations achieve meaningful value with their CMDBs. Let’s dig into why and how a cyber asset management solution can improve the accuracy and fullness of your CMDB data.