Certified Ethical Hacker (CEH) Practice Question

Masscan was designed for Internet-scale reconnaissance and routinely achieves multi-million-packet-per-second throughput by performing asynchronous, stateless TCP SYN scans. It transmits only the initial SYN and identifies open ports from SYN-ACK replies, never completing the handshake, so packet count per host stays minimal. Nmap can perform half-open scans, but its per-probe state tracking and default rate limiting make it far slower on large networks. Hping3 is a flexible packet crafter rather than a purpose-built port scanner and lacks masscan's performance optimizations. Netcat's scan mode initiates full TCP connections, producing more packets and violating the "no three-way handshake" requirement. Therefore, masscan is the most appropriate tool for the described task.