NetScanner is a fast, lightweight network scanner for Windows. Give it a range and it discovers what is there, then progressively works out what each host is and what it is running — streaming findings into the grid as they arrive rather than making you wait for a full sweep. It runs from a single portable file as a standard user: no installer, no administrator rights, no packet-capture driver, no database server. How a scan works Six stages deliberately overlap, which is what makes results appear progressively. One host can be having its TLS certificates read while another has not yet been pinged. Seed — reads the OS ARP cache and listens for SSDP/UPnP announcements, so rows appear before the first probe packet is sent. Liveness — ICMP echo and TCP knocks on 445/135/139/22/80/443/3389, run concurrently. Identity — reverse DNS, NetBIOS node status, MAC from ARP, vendor from the embedded IEEE OUI table. Ports — TCP connect scan of around 100 curated ports. Services — banner grab, TLS certificate inspection, and a benign HTTP request. UDP — real protocol probes for DNS, SNMP and mDNS. Why ping alone misses half your network A host counts as present if any of ICMP, a TCP handshake, a TCP refusal, an ARP entry, or an SSDP/mDNS/NetBIOS announcement fires. Default Windows Firewall drops inbound echo requests, so a ping-only sweep silently misses most Windows machines on a LAN. The grid's "Found by" column records which signals fired, because "answered ARP only" and "answered ICMP" are very different findings. UDP without the usual noise Generic UDP scans report a wall of open|filtered because silence is ambiguous. These probes speak the actual protocol, so a well-formed reply is unambiguous proof and silence is simply not reported. Printers, switches and UPSs are usually TCP-quiet and nameless in DNS, yet return their exact model over SNMP in one round trip. Remembers what it found Results accumulate in one JSON file per range. Reopening the app renders the last known hosts immediately, greyed as stale, before any packet is sent. Device identity is MAC-first, IP-second, so a laptop that renews its DHCP lease onto a new address updates in place instead of duplicating. Randomised MACs are excluded from that rule, since phones rotate them per network. A host that stops answering becomes stale, not deleted, and only becomes gone after several consecutive misses. Three pacing modes Balanced suits everyday sweeps. Polite is gentler on constrained hardware and less likely to trip intrusion detection. Aggressive is fastest, but can overwhelm cheap switches and produce false negatives. Concurrency is always explicitly bounded — an unbounded sweep exhausts the Windows ephemeral port range mid-scan and produces false negatives that look like real results. Built to treat the network as hostile Every banner, page title, TLS subject, SNMP string, mDNS name and PTR record is chosen by whoever controls that device, and the scanner is the thing carrying it back to you. The code is written on that basis. Every device-controlled string is sanitised — control characters, bidirectional overrides that can make a name render as something entirely different, and other format characters are stripped, and length is capped. CSV export defuses formula injection. Quoting alone is not enough: spreadsheets treat a field starting with =, +, - or @ as a formula even inside quotes, so a device that names itself with one would otherwise execute when a colleague opened the report. Every wire-format parser is fuzzed with random bytes and with mutations of valid packets, and must never throw, never hang and never return unsanitised text. Remote input cannot drive unbounded work. Receive buffers are fixed and the HTTP body is capped, so a hostile device cannot choose how much memory the scan costs. Logs contain no device-supplied text — only addresses, ports, counts and exception types. Export Results export to CSV, with formula injection defused as described above. Only scan networks you own or are authorised to test The app asks for a one-time acknowledgement on first run, warns before scanning outside RFC1918 private space or a range over 65,536 addresses, and refuses anything above roughly a million addresses. Expect endpoint security software to take an interest — a port scanner is behaviourally indistinguishable from reconnaissance malware. Authorisation is yours to establish, the operational risks of active scanning are yours to accept, and results are evidence of what was observed rather than proof of what is present. About the screenshots Both screenshots show the built-in demo mode: a synthetic network, labelled as such in the window. No real hosts, and no packets were sent. What you need Windows, 64-bit No .NET runtime — a self-contained build is available No administrator rights, no packet-capture driver, no database server No telemetry, no account, no licence server The executable is not code-signed, so Windows SmartScreen will warn on first run: click More info, then Run anyway. Endpoint protection may also take an interest, for the reasons above. Proprietary licence, one-time purchase. No subscription, no seat count.