agent masscan run timed out and the agent failed parsing partial output

TL;DR

masscan can be resumed and its partial output is usable, but only if the agent asks for both. Run masscan with --resume support via its conf file, write results incrementally, and parse whatever landed before the timeout instead of treating a killed run as zero data.

agent masscan run timed out and the agent failed parsing partial output

Use this when

• masscan is killed by timeout or the agent step limit and the agent reports no findings.
• The agent discards the run because the output file looks incomplete.
• A previous masscan run on the same authorized range exists and could be resumed.

Not for this skill when

• masscan fails immediately with a permissions error (raw sockets need elevated privileges). That is a setup problem.
• masscan completes normally but the agent misreads the output. That is a parsing bug, not a timeout.
• The engagement scope does not permit masscan's speed. Respect the scope.

Steps

1. Launch masscan with a conf file (--conf scan.conf) so the --resume state (paused.conf) is written automatically; run it under an explicit timeout. Verify: interrupting the scan leaves a paused.conf file behind.
2. Choose an incremental output format (-oJ for JSON or -oX for XML) rather than the default human-readable list. Verify: the output file grows while the scan runs.
3. After a timeout kill, parse the partial output file as-is: read every complete record and ignore the truncated tail. Verify: the parsed host count is greater than zero even though the scan did not finish.
4. Resume with the same command plus --resume; masscan picks up where paused.conf says it stopped. Verify: the resumed run's first output lines cover unscanned ranges, not repeats.
5. Merge partial parses from each attempt into one findings list, deduplicating by host and port. Verify: the final list has no duplicate host/port pairs.

Variant phrasings

masscan timeout left agent with no results

Same resume pattern.

agent cannot read partial masscan output

Parsing-focused variant.

resume masscan after agent step timeout

Resume-focused phrasing.

Compatibility: masscan 1.3.x. The --resume/paused.conf mechanism is built into masscan and needs no extra tooling.

Why it happens

Agents treat a killed process as a failed process, and masscan's default output gives them nothing until the end. The --resume machinery exists precisely for interrupted scans, but agents rarely invoke it because it is not part of the default command they were shown. Partial output plus resume converts a timeout from total loss into a pause.

Edge cases / pitfalls

• paused.conf is written on clean interrupts (SIGINT); a hard SIGKILL may skip it. Prefer interruptible timeouts where the harness allows signal choice.
• masscan's speed can overwhelm small authorized targets. Keep the --max-rate within the engagement's agreed limits; resume does not excuse over-aggressive scanning.
• Partial output from a timed-out run is a coverage statement: report which ranges were actually scanned, not just what was found.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fCROcfoMlyV6dEzhS49FLw