The best free network scanners for security teams


Knowing what’s connected to a network is important for securing your organization. There are a fair amount of free and commercial options out there. We see security teams using a mix of runZero, Nmap (sometimes with Zenmap), Angry IP and Masscan.

In this article, we compare and contrast several free tools and provide our take on why we believe runZero is best suited for corporate security teams – particularly teams that are looking to gain continuous visibility into their asset inventory for risk management, incident response, and penetration testing purposes.

Free network scanner comparison #

Nmap & Zenmap Angry IP Masscan
Best for Continuous and scalable cyber asset management Ad-hoc network discovery and security auditing Scanning local network for active IPs Research scans of the entire Internet
Graphical user interface
Internal database
Scalable deployment (distributed architecture)
Scan by IP range (internal & external)
Scan by domain
Scan by ASN
Identifies hardware platform
Covers managed on-premise assets
Covers unmanaged / IoT assets
Safely scans OT assets
Covers cloud assets
Covers remote assets
On-premise deployment
SaaS deployment
Free option available
Paid option available
Supported platforms Windows, Linux,
macOS, BSD
Windows, Linux, macOS, BSD JVM Windows, Linux, macOS, BSD
Programming language Go C Java C

runZero #

runZero UI

runZero was founded in 2018 by HD Moore, the creator of Metasploit, to help solve the problem of discovering both managed and unmanaged devices on the network. The product has grown to a full cyber asset management solution that covers managed and unmanaged IT/IoT, OT environments, cloud assets, and remote devices. runZero offers a fully-featured 21 day trial that downgrades to a free Community Edition, which is used by more than 20,000 individuals and organizations.

runZero is enterprise grade in terms of its user interface, query language, and ability to collect an inventory even in highly distributed environments without having to write scripts or maintain a custom database. Like all of the other scanners in this article, its scans are unauthenticated but yield a surprising amount of depth of information, such as fully searchable attributes for all services, hardware and firmware details, as well as layer 2 and 3 network topologies. In addition, the solution can use SNMP credentials as well as integrations with vulnerability scanners, EDR, MDM, directories and other solutions to provide deeper insights into cyber assets and their security posture. runZero also provides integrations with CMDB and SIEM solutions to enrich asset inventory on other platforms.

runZero’s scanning technology is safe to use in many OT environments, making it an ideal passive discovery option for critical infrastructure OT environments.

Best for
  • Continuous and scalable cyber asset management
  • Easy to deploy and scalable for larger organizations
  • Free Starter Edition for up to 256 assets (including commercial use)
  • Safe to use on fragile OT & IoT devices
  • Accurate OS & hardware fingerprinting
  • Paid editions offers integrations with security and IT infrastructure as well as coverage of cloud & remote assets in addition to on-premise devices
  • Use above 256 assets requires paid license (free trial available)

Nmap and Zenmap #

Nmap interface

Nmap has been around for 25 years and is the gold standard for ad-hoc network scanning. The free and open source utility is most often used for network discovery and security auditing. It integrates with many other security auditing tools, such as Metasploit.

Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap). The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write simple scripts for network discovery, more sophisticated version detection, and vulnerability detection. NSE can even be used for vulnerability exploitation.

Best for
  • Ad-hoc network discovery and security auditing
  • Security researchers that want to write nmap scripts for custom projects
  • Very well known and documented
  • Most flexible option of all tools due to configurability
  • Extensible through the Network Scanning Engine
  • Free for private and commercial use
  • Command line can be complex to use
  • Can disrupt fragile OT/IoT devices
  • Paid license required for hardware and software vendors that wish to distribute Nmap with their solution
  • Must be scripted for continuous use

Angry IP #

Angry IP interface

Angry IP Scanner is an open-source network scanner designed to be fast and simple to use. It scans IP addresses and ports. It is widely used by network administrators.

Angry IP is a good solution for teams that are looking for the fastest and easiest way to see which IPs are in use on a network. However the solution doesn’t provide a lot of information about each device, limited to IP, ping time, hostname, ports, TTL, MAC address, filtered ports, NetBIOS.

Best for
  • Easy scan of a local network to see which IPs are up
  • Very quick and easy to get going for an an ad-hoc scan
  • Little information about each asset
  • Not scalable for larger or distributed environments
  • Can disrupt fragile OT/IoT devices

Masscan #

Masscan interface

Masscan is a port scanner that can cover the entire Internet in under 5 minutes by using asynchronous transmission, sending 10 million packets per second from a single machine. It is purely a command-line tool and its usage is similar to Nmap. While Nmap is more often used to scan individual machines and smaller IP ranges, Masscan is primarily used for very large IP ranges.

Best for
  • Research scans of the entire Internet on a small handful of ports
  • Lightning-fast scans of large IP ranges
  • Command-line only
  • Very little information on each asset
  • Not suitable for internal asset inventory
  • Can disrupt fragile OT/IoT devices
  • Must be scripted for continuous use

Most free network scanners don’t scale easily out of the box, often requiring custom databases and scripts to make them suitable for continuous monitoring and collecting inventory from multiple segments or sites. Out of the mix of tools, only runZero comes with a central repository and a distributed system of Explorers to scan all parts of a network, from inside and outside the firewall.

While all of the scanners we looked at are robust and suitable for their specific use cases, runZero is the best option for corporate security teams. runZero wins on flexibility of deployment, ease of use, and scalability for larger organizations. If your security team consists of more than one person or your organization operates at more than one physical location, runZero is for you.

Written by Chris Kirsch

Chris Kirsch is a co-founder of runZero. Chris started his career at an InfoSec startup in Germany and has since worked for PGP, nCipher, Rapid7, and Veracode. He has a passion for OSINT and Social Engineering. In 2017, he earned the Black Badge for winning the Social Engineering Capture the Flag competition at DEF CON, the world’s largest hacker conference.

More about Chris Kirsch
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

runZero Insights
Using runZero to verify network segmentation
There are many benefits of network segmentation, and fact checking proper implementation can be a difficult, arduous task. runZero is here to help...
Life at runZero
Employee Spotlight: James McNulty
James is our website manager and dynamic SEO strategist! Read on to learn about James' journey on the Marketing team at runZero!
Product Release
Introducing the customizable dashboard, Wiz integration, and more!
Introducing the customizable dashboard, Wiz Integration, and other Q2 2024 enhancements to the runZero Platform.
Product Release
How to integrate your SIEM platform with runZero to create an actionable asset inventory
Learn how to combine runZero's real-time asset inventory with SIEM exports for comprehensive asset tracking and historical data analysis..

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved