Repolode
Submit
v-byte-cpu

v-byte-cpu/sx

Command-line network scanner in Go that supports ARP, ICMP, TCP, UDP and SOCKS5 scans with JSON output for automation.

Open-source alternative to:Nmap

View on GitHub
Stars
1,565
Forks
105
Open issues
12
Last commit
3 months ago

What is it?

sx is a command-line network scanner written in Go, built around the UNIX philosophy of composable tools. It covers local neighbor discovery with ARP for IPv4 and NDP or multicast ICMPv6 for IPv6, then runs higher-level scans such as TCP SYN, TCP FIN/NULL/Xmas, custom TCP flag combinations, UDP port probes and SOCKS5 proxy detection.

Instead of resolving link-layer addresses implicitly during each scan, sx reads a neighbor cache in JSONL format that is produced by an ARP or NDP scan and piped into later commands. Targets can be given as CIDR ranges, single addresses, files of IP and port pairs, or exclusion lists. Results for raw TCP scans report every reply's flags, which helps when interpreting firewall behavior.

Output can be plain text or JSON, and a live mode rescans the network on an interval. Building from source requires Go 1.25 or newer and libpcap, and prebuilt binaries are available from GitHub Releases.

Key features

  • 01ARP scans for IPv4 and NDP or ICMPv6 multicast discovery for IPv6 neighbors
  • 02TCP SYN, FIN, NULL, Xmas and custom-flag scans that report all reply TCP flags
  • 03UDP scan that reports ICMP replies such as port unreachable
  • 04SOCKS5 proxy detection across IP ranges or from an IP and port file
  • 05Rate limiting, exclusion lists and randomized target iteration
  • 06JSON output for piping results into other tools

Use cases

  • Inventorying devices and vendors on a local network with an ARP scan
  • Checking which TCP ports are open on hosts in a LAN or VPN network
  • Studying how firewalls respond to unusual TCP flag combinations
  • Finding exposed SOCKS5 proxies within an address range

Quick start

  1. 1

    Download the executable from GitHub Releases and place it in your PATH

  2. 2

    Run an ARP scan of your local network

    sx arp 192.168.0.1/24

Things to know

  • Raw-packet scans need elevated privileges and libpcap, which may require extra setup.
  • Building from source requires Go 1.25 or newer and libpcap.

In collections

CLI & terminal tools

Topics

#network-scanner#arp#tcp#udp#pentesting#recon#socks5#cli#docker#go

FAQ

What is sx?
Command-line network scanner in Go that supports ARP, ICMP, TCP, UDP and SOCKS5 scans with JSON output for automation. sx is a command-line network scanner written in Go, built around the UNIX philosophy of composable tools. It covers local neighbor discovery with ARP for IPv4 and NDP or multicast ICMPv6 for IPv6, then runs higher-level scans such as TCP SYN, TCP FIN/NULL/Xmas, custom TCP flag combinations, UDP port probes and SOCKS5 proxy detection.
Is sx free to use? What license does it have?
sx is open source under the MIT license. Check the license terms before using it in commercial products.
Is sx still maintained?
Updated within 6 months. The last commit to sx was on Aug 12, 2026.
What can I use sx for?
Inventorying devices and vendors on a local network with an ARP scan Checking which TCP ports are open on hosts in a LAN or VPN network Studying how firewalls respond to unusual TCP flag combinations Finding exposed SOCKS5 proxies within an address range
How do I install sx?
Download the executable from GitHub Releases and place it in your PATH Run an ARP scan of your local network: sx arp 192.168.0.1/24
Where can I get sx?
The source code and installation instructions are on GitHub: https://github.com/v-byte-cpu/sx

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects