Farsight
Farsight is a free, self-hosted Linux scanner that uses SYN-based TCP scanning to collect service banners.
What Farsight is
Farsight is a free, self-hosted Linux scanner that uses SYN-based TCP scanning to collect service banners. It can scan the IPv4 address space or a configured subset and runs as a long-lived daemon alternating full sweeps and rescans. Results are written to ClickHouse, which also provides accumulated history for its PMap-derived targeting strategy to prioritize ports and IP prefixes. Minecraft Server List Ping is the only application protocol currently implemented, though parser and payload traits provide a way to add others.
The scanner can identify hosts that return identical banners across ports and abandon their remaining per-address port budget. Operators can set a global packet-rate ceiling, exclude CIDR ranges, IP ranges, or individual addresses, and configure that port budget. Farsight requires Linux with AF_XDP support, Rust nightly, a supported network card and driver, root or equivalent runtime capabilities, and a reachable self-hosted or managed ClickHouse server. The project reports saturating a 1 Gbps link in a test with an Intel I225-V NIC and igc driver. Its current scope is IPv4 only. The documentation advises honoring opt-outs and keeping scan rates reasonable; exclusion requests can be sent to [email protected] or submitted through a change to exclude.conf.
Good
- Free and self-hosted
- Adaptive targeting uses accumulated ClickHouse results
- Supports configurable rate ceilings and address exclusions
- Parser and payload traits allow protocol additions
Watch out
- Supports IPv4 only
- Minecraft Server List Ping is the only implemented protocol
- Requires Rust nightly and AF_XDP support
- Requires a reachable ClickHouse server
Who it suits
Farsight may suit Linux operators who can provide AF_XDP-compatible hardware and a ClickHouse server for internet-scale or targeted IPv4 scanning. It is geared toward users comfortable configuring a long-running self-hosted daemon and managing scan exclusions and rates.
Verdict
Farsight offers configurable, history-guided TCP scanning, but running it requires Linux networking support, suitable hardware, and ClickHouse. Its current IPv4 and protocol limits are important to consider before deployment.
The facts
Each one read from Farsight's own pages, with the date it was checked.
What it does
- Adaptive scanning
- Its PMap-derived targeting strategy uses accumulated ClickHouse results to guide which ports and IPv4 prefixes to scan.checked 9 Oct 2026
- Adaptive targeting
- Its PMap-derived targeting strategy learns from accumulated ClickHouse results to prioritize ports and IP prefixes.checked 8 Oct 2026
- Configuration
- The scanner is configuration-driven and runs as a long-lived daemon that alternates full sweeps and rescans.checked 8 Oct 2026
- Database requirement
- A reachable self-hosted or managed ClickHouse server is required to store results and seed targeting graphs.checked 8 Oct 2026
- Data storage
- Farsight writes scan results to ClickHouse, which it also uses as the source of historical data for its targeting strategy.checked 9 Oct 2026
- Exclusions
- Operators can exclude CIDR ranges, IP ranges, or individual addresses using exclude.conf.checked 9 Oct 2026
- Extensibility
- Other protocols can be added through parser and payload traits.checked 8 Oct 2026
- Honeypot detection
- It detects hosts returning identical banners repeatedly and abandons the remaining port budget for those hosts.checked 9 Oct 2026
- License
- The repository identifies its license as MIT.checked 9 Oct 2026
- Opt-out
- The maintainer says to request exclusion from mainstream Farsight scanning by emailing [email protected] or submitting a pull request to exclude.conf.checked 8 Oct 2026
- Opt-out contact
- The README says to contact [email protected] or submit a pull request changing exclude.conf to request scanning-range opt-out.checked 9 Oct 2026
- Performance
- The project reports saturating a 1 Gbps link in a test using an Intel I225-V with the igc driver.checked 9 Oct 2026
- Protocol support
- Minecraft Server List Ping is the only implemented application protocol; the README describes traits for adding others.checked 9 Oct 2026
- Purpose
- Farsight is a stateless SYN-based TCP scanner and banner grabber built on Linux AF_XDP.checked 9 Oct 2026
- Rate limiting
- The configurable controller.max_rate sets a global packets-per-second ceiling.checked 9 Oct 2026
- Requirements
- It requires Linux with AF_XDP support, a compatible XDP-capable NIC and driver, Rust nightly, bpf-linker, runtime capabilities, and a reachable ClickHouse server.checked 9 Oct 2026
- Results storage
- Farsight writes scan results to ClickHouse, which also supplies history for its targeting strategy.checked 8 Oct 2026
- Safety controls
- It supports address exclusion lists and a configurable per-address port budget, and its documentation advises honoring opt-outs and keeping scan rates reasonable.checked 8 Oct 2026
- Scanning
- It can scan the entire IPv4 address space or a configured subset.checked 8 Oct 2026
- Scope limit
- Farsight currently supports IPv4 only.checked 8 Oct 2026
- Scope limitation
- The README lists IPv4 only and Minecraft SLP only as current limitations.checked 9 Oct 2026
Alternatives to Farsight
- 1
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan - 2
Masscan
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 3
Nmap
Free planLinuxmacOSSelf-hostedWindows7.0From $9,980 a month - 4
Naabu
Free planAPILinuxmacOSSelf-hosted6.8Free plan - 5
Pentest-Tools Port Scanner
Free planWebAPI6.8From $95 a month - 6
ScanSearch
Free planWebAPILinux6.8From $0.30 a month