IP Scanner
With the IP Scanner you can scan IP ranges, subnets and hostnames for active devices: a host is found if it answers the ping, a TCP port (open, or closed with a TCP reset), NetBIOS or SNMP; hosts in a local subnet that drop all of them (e.g. a firewall) are found by their ARP / NDP entry, see How hosts are found. For every host, the hostname (DNS, mDNS or NetBIOS), the MAC address and vendor and the open ports are shown, optionally also a guess of the operating system, the web page and the SNMP system information.
Example inputs
| Host | Description |
|---|---|
10.0.0.1 | Single IP address (10.0.0.1) |
10.0.0.100 - 10.0.0.199 | All IP addresses in a given range (10.0.0.100, 10.0.0.101, ..., 10.0.0.199) |
10.0.0.100-199 | All IP addresses in a given range, shorthand for the last octet (10.0.0.100, ..., 10.0.0.199) |
10.0.0.0/23 | All IP addresses in a subnet (10.0.0.0, ..., 10.0.1.255) |
10.0.0.0/255.255.254.0 | All IP addresses in a subnet (10.0.0.0, ..., 10.0.1.255) |
10.0.[0-9,20].[1-2] | Multiple IP addresses like (10.0.0.1, 10.0.0.2, 10.0.1.1, ...,10.0.9.2, 10.0.20.1) |
borntoberoot.net | Single IP address resolved from a host (10.0.0.1) |
borntoberoot.net/24 | All IP addresses in a subnet resolved from a host (10.0.0.0, ..., 10.0.0.255) |
borntoberoot.net/255.255.255.0 | All IP addresses in a subnet resolved from a host (10.0.0.0, ..., 10.0.0.255) |
!10.0.0.1 | Excludes an IP address (also a range, subnet or host, e.g. !10.0.0.0/28) from the other inputs |
Multiple inputs can be combined with a semicolon (;). A column pasted from Excel (one entry per line) is converted to the semicolon-separated form automatically.
An input starting with ! excludes its IP addresses from the other inputs, e.g. 10.0.0.0/24; !10.0.0.1; !10.0.0.200-254 (all formats of the table above; a hostname excludes all its IPv4 and IPv6 addresses, independent of the IPv4 preference). At least one input without ! is required; if the exclusions remove every IP address, a message is shown instead. If the hostname of an exclusion can't be resolved (also if only the IPv4 or the IPv6 lookup fails, e.g. a timeout), nothing is scanned (otherwise its IP addresses would be scanned).
Example: 10.0.0.0/24; 10.0.[10-20].1; 10.0.0.100-199
IP addresses that are part of multiple inputs (e.g. 10.0.0.1; 10.0.0.0/24) or entered with different hostnames (e.g. two names of one server) are scanned only once. The hostname is resolved via DNS (PTR), mDNS or NetBIOS, not taken from the input. The network and broadcast address of a subnet are scanned as well.
A scan of more than 65,536 IP addresses (e.g. a /15) must be confirmed, more than 16,777,216 IP addresses (a /8) cannot be scanned at once.
Toolbar
| Button | Description |
|---|---|
| Detect local subnet | Populates the host field with the IP address and subnet mask of the current network interface to scan the local subnet |
| Subnet of network interface > Subnet (Name) | Populates the host field with the IPv4 subnet of a network interface (e.g. 192.168.1.0/24), e.g. if there are multiple network interfaces (LAN, Wi-Fi, VPN, Hyper-V) |
| All local subnets | Populates the host field with the IPv4 subnets of all network interfaces (without the link-local subnet 169.254.0.0/16) |
The button opens a menu with these entries. The subnets of the network interfaces are read when the menu is opened; only connected network interfaces with an IPv4 address and subnet mask are listed (no single addresses like /32), the link-local subnet (169.254.0.0/16, no DHCP server answered) at the end.
The local IP address (and subnet mask) of Detect local subnet is determined by trying to route to a public IP address. If this fails (e.g.
no network connection), NETworkManager iterates over active network adapters and selects the first valid IPv4 address,
with link-local addresses (169.254.x.x) given lower priority.
The Options button next to Scan opens a menu to turn the most used settings on or off without opening the settings: Ping hosts, Resolve hostname, Scan ports, Read Windows host information (beta), Scan for NetBIOS, Find hosts in the local subnet, Resolve MAC address and vendor, Resolve mDNS hostname, Read web pages (only with the port scan), Read the SNMP system information, Show unreachable IP addresses and ports and Expand host view. Open settings... opens the IP Scanner settings. The menu stays open to change several options and is disabled while a scan is running. The credentials section below the options shows the credentials of the tab: the SNMP version and credentials of the profile / group it was opened with (e.g. SNMP version and credentials of "Site A") and its Windows credentials (e.g. Windows credentials of "Site A" (CORP\admin) or Windows credentials of this tab (CORP\admin)). Set Windows credentials... (with Read Windows host information enabled) sets the Windows credentials of the tab, also for a tab without a profile (e.g. another admin account for one scan): they replace the ones of the profile / group (or, with Use credentials off, the user running NETworkManager is used), are used for all following scans of the tab (also Automatically scan every and Rescan) and are not saved - closing the tab discards them. Credentials that were rejected (see Windows account lockout protection) are checked again after they were set here (the logon failures already counted for the account stay counted).
The menu changes the settings: they apply to all tabs and are shown in the settings. Changes apply to the next scan (Expand host view immediately), like a change in the settings.
Context menu
Right-clicking a result allows forwarding device information to another tool (e.g. Port Scanner, Remote Desktop), querying the registration data of its IP address or hostname via RDAP, creating a new profile, or executing a custom command.
| Action | Description |
|---|---|
| Rescan | Scans the selected host(s) again with the settings of the shown scan and updates their rows (a host that is unreachable now is shown as down). Read Windows host information turned off since then is not read (no logon with the credentials). A canceled rescan keeps the previous results. Not available while a scan is running |
| Port Scanner / Ping Monitor / Traceroute | Opens the host (DNS hostname if resolved, otherwise the IP address) in the tool |
| DNS lookup... > IP address / Hostname | Looks up the IP address (PTR) or the DNS hostname in DNS Lookup |
| RDAP... > IP address / Hostname | Queries the registration data of the IP address or the registered domain of the DNS hostname in RDAP |
| Remote Desktop / PowerShell / PuTTY / TigerVNC / SNMP | Opens the host (DNS hostname if resolved, otherwise the IP address) in the tool |
| Web Console | Opens the host in the Web Console: the port of the web page that was read (see Read web pages), otherwise https if port 443 is open, http on 80, 8443 (https) or 8080, http if none of them is open (or the port scan is disabled) |
| Wake on LAN | Sends a magic packet to the MAC address of the host with Wake on LAN (only with a MAC address) |
| Custom commands | Executes a custom command for the host |
| Add profile... | Creates a new profile with the host (IP address), the hostname as name and the MAC address for Wake on LAN |
| Copy | Copies the selected information to the clipboard (values only when the probe / lookup is finished), also OS, Open ports and Domain as shown in the columns; with the optional requests also mDNS hostname, Windows > Operating system / Time offset / Logged-on users, Web > Title / URL / Server and SNMP > Name / Description / Location |
| Export... | Exports the results shown (all or the selected ones) to a file in the order shown, see Export format |
A NetBIOS or mDNS name (shown as hostname if there is no DNS hostname) is not passed to other tools, because it may not be resolvable via DNS - the IP address is used instead. DNS lookup... / RDAP... > Hostname are only available with a DNS hostname. In custom commands, {{Hostname}} is the shown hostname (DNS, mDNS or NetBIOS).
If multiple results are selected, Rescan, Copy > IP address / Hostname / MAC address (one value per line, in the order shown, without duplicates) and Export... are available.
How hosts are found
The probes of a host run at the same time. A host is shown (and counted as up) as soon as it answers the first one, probes that answer later are added.
| Probe | Answer | Setting |
|---|---|---|
| Ping | ICMP echo reply | Ping hosts |
| TCP | A port is open or refused the connection (TCP reset) | Scan ports |
| NetBIOS | Answer to the NetBIOS request (UDP 137, IPv4 only) | Scan for NetBIOS |
| SNMP | Answer to the SNMP request (UDP 161) | Read the SNMP system information |
| ARP / NDP | Neighbor entry of a host in a local subnet that didn't answer any of the probes above | Find hosts in the local subnet |
The probes a host answered are shown in the tooltip of its status icon (e.g. Up (detected by Ping, TCP)) and as status icons in the headers of the row details. The export contains them as DetectedBy (e.g. ICMP, TCP or ARP).
Only reachable hosts are shown, unless Show unreachable IP addresses and ports is enabled; unreachable hosts are added when all their probes are finished.
Result
The number of reachable (up) and unreachable (down) IP addresses is shown below the Result header. A message below the input is shown if no reachable host was found, the scan was canceled, a hostname could not be resolved or an error occurred.
The columns are shown according to the settings the scan was started with, settings changed afterwards apply to the next scan:
| Column | Content |
|---|---|
| Status | Up / down, the tooltip shows the probes that answered |
| Role | Icon if the host has a role for this computer: This computer, Default-Gateway, DNS server or DHCP server of a connected network interface (all roles in the tooltip) |
| Since last scan | Change since the previous scan, see Changes since the last scan (only if the result is compared with one) |
| IP address | Scanned IP address |
| Hostname | DNS hostname (PTR), otherwise the mDNS hostname, otherwise the NetBIOS name |
| Time | Round trip time of the ping reply |
| OS | Windows version (e.g. Windows 11 25H2, edition and version number in the tooltip) if it was read, see Read Windows host information, otherwise the operating system guessed from the TTL of the ping reply, see Guess the operating system from the TTL |
| Open ports | Open ports (e.g. 22, 80, 443), the tooltip shows them with their service (e.g. Open: 22 (ssh), 443 (https), the first 10); sorted by the number of open ports |
| Domain | Domain (DNS name) or workgroup of the Windows host information, otherwise the workgroup / domain of the NetBIOS answer (shown with Read Windows host information or Scan for NetBIOS) |
| Time offset | Time of the host minus the local time (e.g. +1.2 s, -3 min 5 s), highlighted above 5 minutes (the Kerberos limit, the logon in a domain fails) |
| Logged-on users | Logged-on users (needs admin rights on the host), one per line in the tooltip or why they could not be read (e.g. Access is denied.) |
| Web | Title of the web page, otherwise the realm of a login prompt, the Server header or the target of a redirect; the URL in the tooltip, see Read web pages |
| SNMP name | sysName, see Read the SNMP system information |
| MAC address / Vendor | From the neighbor table (ARP / NDP), the NetBIOS answer as fallback |
Values arrive one after another while the scan is running:
...: the probe or lookup is still running. Hostname and MAC address / Vendor stay...until no source can change them any more (e.g. the NetBIOS name as fallback), Web until the port scan is finished (it needs the open ports), Windows until the port scan is finished if port445is in its ports (not after the other probes).-/-: finished, no result.- After Cancel, the lookups that were still running (hostname, MAC address, mDNS, web page, Windows) show
-/-; ping, ports, NetBIOS and SNMP that didn't finish stay....
A column you sorted by is not sorted again for values that arrive later, click the header again. Sorted by Time or MAC address, hosts without a value are always at the end; hosts with the same value are sorted by IP address.
The search box right of the Result header filters the results by IP address, hostname (DNS, mDNS, NetBIOS), MAC address, vendor, role, OS (guess), web page (title, headers, realm, redirect target, certificate), SNMP values, Windows values (operating system, version number, edition, computer name, domain, description, logged-on users) and open ports (number or service), also while the scan is running. Export... > all exports the filtered results; the up / down counters always count all hosts. Results can also be exported while the scan is running, values that are still ... are exported as empty values.
Changes since the last scan
A scan of the same input as the last completed scan in the tab shows what changed since then:
- New: the host is up now, it was not up in the last scan.
- Gone: the host was up in the last scan, it is not up now. The row is added at the end of the scan (as down, with the hostname and MAC address of the last scan), also if Show unreachable IP addresses and ports is disabled.
- MAC changed: the host is up with another MAC address than in the last scan (both known), e.g. a replaced device, an IP address conflict or ARP spoofing. The tooltip shows the previous MAC address.
The Since last scan column and the counters below the Result header (e.g. 2 New · 1 Gone) are only shown if the result is compared with a previous scan. Last scan at in the header shows when the last scan was completed (the tooltip shows the date).
Only completed scans are compared: a canceled scan or a scan with another input starts over (the next scan of this input is compared with it). Rescan of selected hosts updates their rows and their changes against the same previous scan (e.g. a gone host that is up again), but is not a scan of the input. The last scan is only kept in memory, as long as the tab is open. The change is also in the search and the export (Change, PreviousMACAddress).
Repeat the scan
Automatically scan every right of the Result header repeats the scan after the selected interval (1 min to 1 h, the pause after a scan, so scans don't overlap) - e.g. to watch a network for new devices, see Changes since the last scan. The repetition starts with the next completed scan; while it waits, the header shows the countdown (Next scan in 04:32, the tooltip shows the last scan).
A repeated scan keeps the rows and updates them in place (selection, scroll position, expanded details and search stay): new hosts are added, hosts that are down now are shown as Gone. The input is not asked to be confirmed again (large scans) and is not added to the history again.
The repetition stops when a scan is canceled, the input is changed (also while a scan is running) or the tab is closed; a manual Scan starts the interval again after the scan. If a repeated scan fails (e.g. a hostname can't be resolved for a moment), the message is shown and the scan is tried again after the interval, so a short network problem doesn't end the monitoring. The scan is also repeated while another tab or application is shown. The checkbox is per tab and not saved (a new tab doesn't repeat), the interval is saved.
Row details
Expand a row with the button in front of it to see all values of the host, or enable Expand host view to expand all hosts:
| Ping details | Ports | Windows | Web | NetBIOS |
|---|---|---|---|---|
| Hostnames | (ports) | (Windows) | (web) | SNMP |
| Section | Content |
|---|---|
| Ping details | Timestamp, time, TTL and bytes of the ping reply |
| Ports | Open ports (all scanned ports with Show unreachable IP addresses and ports) with protocol, service and description |
| Web | URL, status code, title, Server and X-Powered-By header, realm of a login prompt, redirect target and TLS certificate (subject, issuer, valid until) |
| NetBIOS | Computer name, domain / workgroup and user |
| Hostnames | DNS and mDNS hostname |
| SNMP | Name, description and location; with SNMP v3 the error if the credentials are wrong (e.g. Unknown user name.) |
| Windows | Operating system, edition, version (with patch level if read from the registry), role, computer name, domain, description, time offset, logged-on users (one per line), SMB version, SMB signing (Required / Not required: a setting of the host, not an error - hosts that don't require signing can be targets of relay attacks); the error of the NetApi requests (e.g. Access is denied., wrong password) |
The headers of the probes that can find a host (Ping details, Ports, NetBIOS, SNMP) show a status icon: a green check if the host answered the probe, a red cross if not (not while the probe is running). A section of a disabled setting shows a note (e.g. SNMP is disabled!).
Keyboard shortcuts
| Key | Action |
|---|---|
Enter | Start the scan (in the search box: filter the results) |
Esc | Cancel the running scan |
Ctrl+T | Open a new tab |
Profile
Inherit host from general
Inherit the host from the general settings.
Type: Boolean
Default: Enabled
Host
Hostname or IP range to scan for active devices.
Type: String
Default: Empty
Example:
10.0.0.0/24; 10.0.[10-20].1server-01.borntoberoot.net
See also the IP Scanner example inputs for more information about the supported host formats.
SNMP version and credentials
Version under Override default settings uses the SNMP version and credentials of the profile for Read the SNMP system information instead of the ones of its group or of the settings, e.g. another community per site or SNMP v3:
| Version | Values |
|---|---|
V1, V2C | Community |
V3 | Security (NoAuthNoPriv, AuthNoPriv, AuthPriv), Username, Auth (provider and password), Priv (provider and password) |
Same values as the SNMP tool. The passwords are only saved for the selected version and security level; an empty password box keeps the saved password (Not changed).
Type: Boolean (override) and the values above
Default: Disabled
Only for a tab opened with the profile, also if its input is changed later (like the ports of a profile in the Port Scanner). Enabling the request itself stays a setting.
Passwords are stored in plain text in the profile file unless Profile file encryption is enabled.
Windows credentials
Use credentials under Windows uses the Username, Domain and Password of the profile for Read Windows host information instead of the ones of its group or of the user running NETworkManager. There are no Windows credentials in the settings: a scan without a profile uses the user running NETworkManager, unless credentials are set for the tab (Options > Set Windows credentials...). Scan as... in the context menu of a profile (with Read Windows host information enabled) asks for the credentials (the ones of the profile / group as default) and scans the profile with them in a new tab, without changing the profile (like Connect as... of the Remote Desktop).
The domain is optional: . for a local account of the scanned hosts, empty if the username contains it (CORP\admin or admin@corp.example.com, then the domain of the username is used). An empty password box keeps the saved password (Not changed).
Type: Boolean and the values above
Default: Disabled
Only for a tab opened with the profile, also if its input is changed later. The credentials are only used for the network logon to the scanned hosts (like runas /netonly), not for the application itself.
Passwords are stored in plain text in the profile file unless Profile file encryption is enabled.
Group
SNMP version and credentials
SNMP version and credentials for the profiles of the group, see the profile. A profile that overrides them uses its own.
Type: Boolean (override) and the values of the profile
Default: Disabled
Windows credentials
Windows credentials for the profiles of the group, see the profile. A profile that uses its own credentials uses them instead.
Type: Boolean and the values of the profile
Default: Disabled
Settings
Show unreachable IP addresses and ports
Show the scan result for all IP addresses and ports including the ones that are not active.
Type: Boolean
Default: Disabled
Expand host view
Show the row details of every host in the result, also of hosts that are added while the scan is running. A host that was expanded or collapsed with the button in front of the row keeps its state. Applies immediately.
Type: Boolean
Default: Disabled
Ping hosts
Send a ping (ICMP echo request) to every IP address. Disable it if ICMP is blocked or rate limited in the network (e.g. by an IDS): without ping, an unreachable host is finished after the port scan / NetBIOS timeout instead of after all ping attempts, so the scan is faster. Hosts that only answer the ping are not found then. The Time column and the ping details are hidden for a scan without ping.
Type: Boolean
Default: Enabled
A host is only found if it answers a probe: at least one of Ping hosts, Scan ports, Scan for NetBIOS or Read the SNMP system information must be enabled, otherwise the scan doesn't start. Find hosts in the local subnet alone is not enough, it uses the neighbor entries created by the packets of these probes.
Attempts
Maximum number of ICMP requests sent to each IP address. Another request is only sent if the previous one has timed out (e.g. a lost packet), other replies like "destination host unreachable" are final.
Type: Integer [Min 1, Max 10]
Default: 2
Timeout (ms)
Timeout in milliseconds for each ICMP request, after which the packet is considered lost.
Type: Integer [Min 100, Max 15000]
Default: 2000
Buffer
Size of the buffer for each ICMP request in bytes.
Type: Integer [Min 1, Max 65500]
Default: 32
Guess the operating system from the TTL
Shows the operating system guessed from the TTL of the ping reply in the OS column (icon and text, ... while the ping is running; the Windows version replaces it if it was read with Read Windows host information): every operating system starts with a typical TTL and every router on the way reduces it by one. The guess is the smallest typical TTL that is not lower than the received TTL, the tooltip shows the number of hops (e.g. TTL 126 → Windows, 2 hops). No additional packets are sent.
| Initial TTL | OS (guess) | Icon | Examples |
|---|---|---|---|
64 | Linux / Unix | Terminal | Linux, macOS, Android, iOS, many IoT devices |
128 | Windows | Windows logo | Windows |
255 | Network device | Switch | Routers, switches, printers, Solaris |
Type: Boolean
Default: Enabled
It's a hint, not a detection: the TTL can be changed on the host (e.g. some devices use 64 or 128), NAT and VPN can change it. Only available for hosts that answered the ping and only for IPv4 (the ping reply of IPv6 has no TTL). The export contains it as OSGuess (LinuxUnix, Windows, NetworkDevice).
Resolve hostname
Resolve the hostname (PTR) for each IP address.
Type: Boolean
Default: Enabled
Scan ports
Scan each IP address for open TCP ports. The web pages are only read with the port scan; its settings are disabled while the port scan is disabled.
Type: Boolean
Default: Enabled
Ports
List of TCP ports to scan for each IP address. The button next to the input restores the default ports.
Type: String
Default: 21; 22; 23; 53; 80; 135; 139; 389; 443; 445; 554; 631; 636; 3389; 5900; 5985; 7000; 8009; 8080; 8443; 9100; 62078
Multiple ports and port ranges can be combined with a semicolon (e.g. 22; 80; 443). Only common and known ports should be scanned to check if a host is reachable. Use the Port Scanner for a detailed port scan.
Timeout (ms)
Timeout in milliseconds after which a port is considered timed out (no answer). A port is closed if the host refused the connection.
Type: Integer [Min 100, Max 15000]
Default: 2000
A closed port is reported as soon as the host refuses the connection. Each attempt sends the connection request once (see Attempts).
Attempts
Number of connection requests sent to each port. Another request is only sent if there was no answer (timed out), an open or closed port is final.
Type: Integer [Min 1, Max 10]
Default: 1
In a local network (LAN), 1 is enough. On an unreliable network (e.g. Wi-Fi, VPN) or for hosts on the internet, a lost connection request can make an open port appear as timed out and a host appear as unreachable - increase it to 2 in this case. This only takes longer for ports without answer (attempts × timeout); with the default settings, unreachable hosts are not slower up to 2 attempts, because the ping takes as long (2 × 2000 ms).
Read Windows host information
This setting is in beta (Beta label in the settings and the Options menu): it is tested publicly and may change. Turn it off to stop all SMB requests and logons of the scans (also of Rescan). Please report problems on GitHub.
Read the Windows host information of every reachable host over SMB (TCP port 445). With Scan ports enabled and port 445 in its ports, only hosts with port 445 open are asked, otherwise every found host (a host without SMB is finished after the SMB request).
Two steps, the second only if the host answered the first:
| Step | Credentials | Values |
|---|---|---|
| SMB / NTLM negotiation | None (no logon, no failed logon on the host) | Operating system and build (e.g. Windows 11 25H2, 10.0.26200), computer name, domain, time offset to the local clock, SMB version and signing |
| NetApi (RPC over SMB) | User running NETworkManager, or the Windows credentials of the profile / group the tab was opened with or of the tab (Options > Set Windows credentials...) | Role (workstation, server, domain controller), description, workgroup; with admin rights on the host also the logged-on users and, if the Remote Registry service runs, the patch level, display version and edition (e.g. Pro, 10.0.26200.6584) |
The NetApi requests connect to the DNS hostname of the host if it is the full DNS name the host sends itself in the NTLM negotiation (Kerberos), otherwise to the IP address (NTLM, e.g. a computer in a workgroup). With Windows credentials, hosts that are not part of the lockout protection (workgroup computers, local accounts) are always asked by their IP address. Errors (e.g. Access is denied., wrong password) are shown in the row details instead of the values. The values are in the search and the export (WindowsOS, WindowsEdition, WindowsVersion, WindowsRole, WindowsComputerName, WindowsDomain, WindowsTimeOffset in seconds, WindowsUsers, WindowsDescription, WindowsError as Win32 error code, -1 if not tried because the credentials were rejected on another host (or by this host in an earlier scan of the tab), -2 if not tried because they were still being checked on another host after the timeout, SMBDialect, SMBSigningRequired, SMBServerGuid).
Type: Boolean
Default: Disabled
Windows 10 / 11 and Windows Server 2016 and later all report the version 10.0, the build tells them apart. Some builds are shared by a client and a server version (e.g. 26100: Windows 11 24H2 / Server 2025), the role decides if it could be read. Hosts that only allow Kerberos (NTLM disabled) don't send the NTLM values; Samba and NAS devices answer with their own values (no Windows version).
With the Windows credentials of a profile / group / tab, a wrong password must not lock the account (every host in a domain makes a domain controller count a failed logon). The credentials are checked on one host at a time until a Windows host in the domain of the credentials accepts them; after a failed logon in their domain (or without domain), or the Max. logon failures on hosts of other domains, they are rejected: the other hosts don't use them (Not tried: ... in the row details), a message is shown and the next scans of the tab (and other tabs with the same account and password) don't use them - set them again with Options > Set Windows credentials.... Computers in a workgroup and local accounts (.\admin) are not part of this check. The checks are written to the log file (without the password).
See Windows account lockout protection for how it works in detail (which results accept or reject the credentials, how failed logons are counted, what is logged and what is not covered).
Every host that answers on port 445 receives a logon with the credentials of the scan (the user running NETworkManager or the Windows credentials of the profile / group / tab) - also a device you don't control. If it is asked by its IP address, the logon uses NTLM: a malicious host could relay it to another server or try to crack the password offline. Only scan networks you trust with privileged accounts, prefer an account with only the rights you need (logged-on users need admin rights on the host) and require SMB signing on your servers. Hosts asked by their DNS name use Kerberos (see above).
The NetApi requests need the firewall rules File and Printer Sharing (SMB-In) on the host, the logged-on users admin rights (e.g. a domain admin or the local administrator), the patch level also the Remote Registry service (disabled by default on Windows clients).
Timeout (ms)
Timeout in milliseconds of the SMB request and of the NetApi requests of a host (each). NetApi requests that take longer are shown as timed out (if only the remote registry takes longer, the other values are shown without the patch level); they keep running in the background until Windows ends them (for all tabs and repeated scans limited by Max. concurrent Windows host information threads).
Type: Integer [Min 500, Max 30000]
Default: 5000
Max. logon failures
Logon failures with the Windows credentials on hosts outside the domain of the credentials (e.g. in a trusted domain) before they are rejected and not used for the other hosts, see Windows account lockout protection. A logon failure on a host in the domain of the credentials, or with credentials without domain, rejects them right away. The failures are counted per account for all tabs until NETworkManager is closed.
Type: Integer [Min 1, Max 5]
Default: 2
A domain controller may count one failed logon twice (Kerberos, then NTLM). Keep this value below half of the account lockout threshold of your domain.
Scan for NetBIOS
Scan each IP address for NetBIOS information.
Type: Boolean
Default: Enabled
Only IPv4 addresses are scanned for NetBIOS, NetBIOS doesn't exist over IPv6.
Timeout (ms)
Timeout in milliseconds after which a NetBIOS request is considered lost.
Type: Integer [Min 100, Max 15000]
Default: 2000
Find hosts in the local subnet
Find hosts in the local subnet and Resolve MAC address and vendor both read the neighbor table of Windows (ARP for IPv4, NDP for IPv6), but for different purposes. They can be enabled independently (section ARP / NDP in the settings).
| Find hosts in the local subnet | Resolve MAC address and vendor | |
|---|---|---|
| Purpose | Decides if a host is up | Shows information about a host that was found |
| Hosts | Hosts in a local subnet that didn't answer the ping, a port or NetBIOS | Every found host |
| Uses | The state of the entry (Reachable = up, Stale is checked again) | The MAC address of the entry (NetBIOS answer as fallback) and the vendor of it |
| Result | Host shown as up, Detected by ARP / NDP | MAC address and Vendor columns |
Example: a Windows client with the firewall on is only found with Find hosts in the local subnet; its MAC address is only shown if Resolve MAC address and vendor is enabled as well.
Find hosts in a local subnet that don't answer the ping, a port or NetBIOS by their entry in the neighbor table (ARP for IPv4, NDP for IPv6). To send a packet to a host in a local subnet, Windows has to resolve its MAC address first - and a host answers this request even if its firewall drops everything else (e.g. a Windows client in a public network, a phone, an IoT device). After the probes of a host are finished, its entry is read from the neighbor table: a host whose entry was confirmed (Reachable) is shown as up (Detected by ARP / NDP). No additional packets are sent, except for an entry from earlier traffic: an entry that was not confirmed again yet (Stale), or that was already Reachable before the probes were sent (Windows doesn't resolve it again for them), is resolved again (ARP request / neighbor solicitation) to check if the host is still there.
Type: Boolean
Default: Enabled
Only hosts in a subnet of a local network interface can be found this way, hosts behind a router are never in the neighbor table. An answer with the MAC address of the default gateway (proxy ARP, e.g. a router that answers for every address of the subnet) is ignored. A host that leaves the network while its probes are running may still be shown as up.
Resolve MAC address and vendor
Show the MAC address and vendor of every found host in the MAC address and Vendor columns. It doesn't find hosts - a host that doesn't answer the ping, a port or NetBIOS is only found with Find hosts in the local subnet.
Type: Boolean
Default: Enabled
The MAC address is resolved via ARP (IPv4) or NDP (IPv6) from the neighbor cache. If no entry is found there, NetBIOS is used as a fallback. Because ARP and NDP are link-layer protocols, the device must be in the same subnet as the local machine.
Resolve mDNS hostname
Resolve the mDNS hostname (e.g. macbook.local) of every reachable host: a reverse lookup (PTR) is sent to UDP port 5353 of the host. Answered by Apple devices, Linux (Avahi), Android, printers and many IoT devices that have no DNS (PTR) record. The name is shown in the row details (Hostnames) and used as Hostname if there is no DNS hostname (order: DNS, mDNS, NetBIOS). Like a NetBIOS name, it is not passed to other tools (the IP address is used instead).
Type: Boolean
Default: Disabled
Most devices only answer requests from the local subnet. Unreachable hosts are not queried.
Timeout (ms)
Timeout in milliseconds after which an mDNS request is considered lost.
Type: Integer [Min 100, Max 15000]
Default: 2000
Read web pages
Read the web page (GET /) of every reachable host with an open port of the Ports below: status code, title, the Server and X-Powered-By headers, the realm of a login prompt (WWW-Authenticate header of a 401 response, e.g. RT-AC68U - routers, cameras and printers often name their model there) the target of a redirect to another host (e.g. https://unifi.local:8443/) and, for https, the TLS certificate: subject, issuer (Self-signed for a self-signed certificate) and the end of the validity ((expired) if it is expired). The title is shown in the Web column (the URL in the tooltip), all values in the Web section of the row details. The ports are tried in the order of the list, the first one that answers is used: https on 443 and 8443, http on 80 and 8080, https and then http on any other port. On ports other than 443 / 8443, the https attempt waits at most 1 second (also with a higher timeout), so a plain http device that doesn't answer the TLS handshake doesn't cost the whole timeout before http is tried. Redirects on the same host (e.g. http to https, / to /login.html) are followed, the values (also the certificate) are those of the last response. If the page has no title, the column shows the realm, the Server header (e.g. nginx) or the redirect target. The values are in the search and the export (WebStatusCode, WebServer, WebPoweredBy, WebRealm, WebRedirectURL, WebCertificateSubject, WebCertificateIssuer, WebCertificateNotAfter, WebCertificateSelfSigned). Web Console in the context menu opens the port (and scheme) that answered.
Type: Boolean
Default: Disabled
Only ports that are open in the port scan are requested - the ports must also be in its Ports list. Without the port scan, no web page is read and the setting is disabled. No cookies or credentials are sent, no proxy is used and certificate errors are accepted (the certificate is only read). Every request uses a new connection (Connection: close), so the certificate is also read on a rescan. The request appears in the log of the web server. At most 64 KB of the page are read.
Ports
Ports whose web page title is read, in the order they are tried (only ports that are open). Ports and port ranges are separated by a semicolon. The button next to the field restores the default.
Type: String
Default: 443; 80; 8443; 8080
Example: 443; 80; 8443; 8080; 5000-5001; 9443
Timeout (ms)
Timeout in milliseconds of a web request (per port, scheme and redirect).
Type: Integer [Min 100, Max 15000]
Default: 2000
Read the SNMP system information
Read the name, description and location (sysName, sysDescr, sysLocation) of every IP address with an SNMP GET request to UDP port 161, sent together with the ping, the port scan and the NetBIOS request. A host that answers is shown as up (Detected by SNMP), also if it doesn't answer any other probe (e.g. a switch or printer that blocks ICMP). The values are shown in the row details (SNMP), the name also in the SNMP name column, e.g. to identify switches, printers and access points.
Type: Boolean
Default: Disabled
A host with another community usually doesn't answer at all (no value after the timeout); an answer with an error (e.g. noSuchName of SNMP v1) still counts as up. The request is sent to every IP address of the range, also unused ones. Many intrusion detection systems report requests with common communities like public.
SNMP v3 needs credentials, so it is only available with the SNMP version and credentials of a profile or group (not in the settings, the settings file is not encrypted). A discovery request is sent first: every SNMP v3 agent answers it, also without valid credentials, so the host is found anyway. Then the GET request with the user; wrong credentials are answered with an error, shown in the row details (SNMP) and exported as SNMPError (e.g. UnknownUserName, AuthenticationFailed). Each of the two requests waits up to the timeout.
Version
SNMP version of the request.
Type: NETworkManager.Models.Network.SNMPVersion
Default: V2C
Possible values:
V1V2C
Community
Community of the request.
Type: String
Default: public
The community is saved as plain text in the settings file (not encrypted). Use a read-only community (e.g. public), not one with write access.
Timeout (ms)
Timeout in milliseconds after which an SNMP request is considered lost.
Type: Integer [Min 100, Max 15000]
Default: 2000
Show notification popup on changes
Show a notification popup in the bottom-right corner of the primary screen when a repeated scan found changes since the previous scan (see Changes since the last scan; only new hosts like a host that is up, a gone host or a changed MAC address like a host that is down). One notification per scan: up to three changes, one per line with the IP address (and hostname) and the change in its color (e.g. 10.0.0.5 (server) · New, green for new, red for gone, orange for a changed MAC address), otherwise one line per counter (e.g. 5 New, 2 Gone). Not for a scan that was started manually. The header shows the tool, the title the scanned input; the status icon is green for only new hosts, red for only gone hosts, half green / half red for both, orange for a changed MAC address. A click opens the tab of the scan.
Type: Boolean
Default: Enabled
Play sound on changes
Play a system sound when a repeated scan found changes. Independent of the popup.
Type: Boolean
Default: Disabled
Display duration (seconds)
Time in seconds the notification popup is shown before it closes automatically.
Type: Integer [Min 3, Max 60]
Default: 10
Custom commands
Custom commands that can be executed with a right click on the selected result.
Type: List<NETworkManager.Utilities.CustomCommandInfo>
Default:
| Name | File path | Arguments |
|---|---|---|
| Edge | cmd.exe | /c start microsoft-edge:http://{{IPAddress}}/ |
| Edge (https) | cmd.exe | /c start microsoft-edge:https://{{IPAddress}}/ |
| Windows Explorer (c$) | explorer.exe | \\{{IPAddress}}\c$ |
| Windows Explorer (shares) | explorer.exe | \\{{IPAddress}} |
| Computer Management | mmc.exe | compmgmt.msc /computer:\\{{IPAddress}} |
| Event Viewer | eventvwr.exe | \\{{IPAddress}} |
| System Information | msinfo32.exe | /computer {{IPAddress}} |
Computer Management, Event Viewer and System Information need administrative rights on the remote computer.
In the arguments you can use the following placeholders:
| Placeholder | Description |
|---|---|
{{IPAddress}} | IP address |
{{Hostname}} | Hostname (DNS hostname, otherwise the NetBIOS name) |
The hostname comes from the network (DNS PTR record or NetBIOS name). For security reasons, {{Hostname}} is replaced with an empty value if the hostname contains characters that are not allowed in a hostname (e.g. & or a space), so it can't be used to run other commands.
Right-click on a selected custom command to edit or delete it.
You can also use the Hotkeys F2 (edit) or Del (delete) on a selected custom command.
Max. concurrent host threads
Maximum number of hosts (IP addresses) that are scanned at the same time. A thread is not an operating system thread, but one host that is pinged, scanned for ports and NetBIOS concurrently.
Type: Integer [Min 1, Max 256]
Default: 128
Every host opens up to Max. concurrent port threads TCP connections at the same time (with the default settings up to 128 × 11 = 1408). Too many simultaneous requests may be detected as a port scan and blocked or rate-limited by a firewall (local, on the network or on the scanned devices) and can overload small routers. If hosts are missing in the result or the network becomes slow during the scan, reduce the number of threads. This will increase the scan time.
Max. concurrent port threads
Maximum number of ports that are scanned at the same time for each host (IP address). If this is less than the number of ports, the remaining ports are scanned after the first ones are finished, which increases the time per host by the timeout.
Type: Integer [Min 1, Max 32]
Default: 16
Too many simultaneous requests may be detected as a port scan and blocked or rate-limited by a firewall (local, on the network or on the scanned devices). If hosts are missing in the result, reduce the number of threads. This will increase the scan time.
Max. concurrent Windows host information threads
Maximum number of hosts whose NetApi requests of Read Windows host information run at the same time, for all tabs and repeated scans. The requests are blocking: each one uses its own operating system thread, also after the timeout until Windows ends it (e.g. a host that doesn't answer RPC). A host that doesn't get a free slot within the timeout is shown as timed out. A changed value applies to the next requests, also while requests of a running scan are still waiting.
Type: Integer [Min 1, Max 64]
Default: 16