Multi-Protocol Network Scanning with bgscan: A Hands-On Guide

Probing network perimeters across multiple protocols usually requires chaining distinct tools like nmap, masscan, and protocol-specific vulnerability checkers. bgscan consolidates this into a single CLI tool driven by a modular chained engine and interactive BubbleTea terminal interface. This guide demonstrates how to configure and execute multi-protocol scans using bgscan.

Step 1 – Install bgscan and verify module availability

Installing bgscan requires a Go environment or downloading a compiled binary release. Once installed, verifying available protocol modules ensures all scan engines load before launching network probes.

# Install via Go package manager
go install github.com/MohsenBg/bgscan@latest

# Verify installed binary and list supported scan modules
bgscan modules list

The module list displays supported network probes, including TCP SYN, TLS handshake verification, HTTP banner grabbing, and SSH host key inspection. Modules execute sequentially or in parallel depending on chain configuration.

Step 2 – Configure modular chained scan rules

Chained scanning allows filtering targets progressively. For instance, the engine can execute an initial lightweight port check and trigger protocol-specific probes only when an open port responds.

# Create a custom scan chain configuration
cat << 'EOF' > scan_chain.yaml
chain:
  - name: port_scan
    module: tcp_syn
    ports: [22, 80, 443, 8443]
  - name: service_id
    module: banner_grab
    condition: "port_scan.status == 'OPEN'"
  - name: tls_audit
    module: tls_cert
    condition: "port_scan.port in [443, 8443] && port_scan.status == 'OPEN'"
EOF

This YAML configuration stops unnecessary HTTP or TLS requests to closed ports, reducing total network bandwidth and scanning overhead across large IP ranges.

Step 3 – Run multi-protocol target discovery

With the chain defined, execute bgscan against target subnets or host files. Concurrency controls regulate packet transmission rates to prevent network congestion or firewall throttling.

# Execute scan chain against a target CIDR with 50 concurrent threads
bgscan run --config scan_chain.yaml --target 192.168.1.0/24 --threads 50

The scan engine dispatches probes according to the pipeline rules. As responses arrive, the engine evaluates conditions in real time, escalating matching targets to secondary verification modules.

Conditional protocol chaining prevents wasteful brute-force probes against unresponsive endpoints, focusing scan traffic strictly where services actively listen.

Step 4 – Filter and analyze interactive BubbleTea TUI output

bgscan features a terminal user interface built with the BubbleTea framework. Launching the interactive viewer lets operators inspect scan progress, filter open ports, and drill down into individual host responses without leaving the terminal session.

# Open interactive TUI session on scan results
bgscan ui --session latest

Use keyboard shortcuts to filter by protocol type, response status code, or certificate expiration windows. The interface separates network transport failures from actual application-level responses.

Step 5 – Export structured reports for vulnerability management

After completing discovery, export raw scan output into structured formats for integration with security information systems or offline audit records.

# Export scan results to JSON format
bgscan export --session latest --format json --output audit_report.json

The resulting JSON contains per-host target metadata, exact banner strings, TLS cipher details, and module execution timestamps. Security teams can parse this structured data into vulnerability trackers or automated alert pipelines.

Next steps

Incorporate bgscan into automated perimeter audits via scheduled cron tasks. Develop custom scan modules in Go to test internal API endpoints, and pair JSON output exports with log aggregators to flag unexpected open services on production networks.