Internal network scanner for Windows
Know what’s on your network. While it’s still scanning.
Give it a range and it discovers what is there, then works out what each host is and what it is running — streaming findings into the grid as they arrive, rather than making you wait for a full sweep.
Built-in demo mode: a synthetic network, no real hosts.
How a scan works
Six stages that deliberately overlap.
That overlap is what makes results appear progressively. One host can be having its TLS certificates read while another has not yet been pinged. Identity work and port scanning run as two independent pipelines, so naming every host is never stuck behind port-scanning a few of them.
Reads the OS ARP cache and listens for SSDP/UPnP announcements. Rows appear before the first probe packet is sent.
ICMP echo and TCP knocks on 445/135/139/22/80/443/3389, run concurrently — first success wins.
Reverse DNS, NetBIOS node status, MAC from ARP, vendor from the embedded IEEE OUI table.
TCP connect scan of around 100 curated ports.
Banner grab, TLS certificate inspection, and a benign HTTP request.
Real protocol probes for DNS, SNMP and mDNS.
Bars are illustrative of the overlap, not timings from a real scan.
Discovery
Why ping alone misses half your network.
Default Windows Firewall drops inbound echo requests, so a ping-only sweep silently misses most Windows machines on a LAN. NetScanner counts a host as present if any of these fire:
- ICMP
- TCP handshake
- TCP refusal
- ARP entry
- SSDP
- mDNS
- NetBIOS
A TCP refusal counts: an RST proves the host received the packet and replied, which no absent address can do. The grid’s Found by column records which signals fired, because “answered ARP only” and “answered ICMP” are very different findings.
What it works out
Names, vendors, ports and services — per host.
Select a host and the detail panel shows everything each stage learned about it.
UDP without the usual noise
Generic UDP scans report a wall of open|filtered. These probes speak the actual protocol, so a reply is proof and silence is simply not reported. Printers, switches and UPSs often return their exact model over SNMP in one round trip.
Remembers what it found
Reopen the app and the last known hosts render immediately, greyed as stale, before any packet is sent. Identity is MAC-first, so a laptop that renews its DHCP lease updates in place instead of duplicating.
Three pacing modes
Polite
Gentler on constrained hardware and less likely to trip intrusion detection.
Balanced
Sweeps a /24 in well under a minute. The everyday choice.
Aggressive
Fastest, but can overwhelm cheap switches and produce false negatives.
Concurrency is always explicitly bounded — an unbounded sweep exhausts the Windows ephemeral port range mid-scan and produces false negatives that look like real results.
Built to treat the network as hostile
Every device gets to choose what it tells you.
Every banner, page title, TLS subject, SNMP string, mDNS name and PTR record is chosen by whoever controls that device — and the scanner is the thing carrying it back to you. The code is written on that basis.
-
Every device-controlled string is sanitised.Control characters, bidirectional overrides that can make a name render as something else entirely, and other format characters are stripped, and length is capped.
-
CSV export defuses formula injection.Quoting alone is not enough — spreadsheets treat a field starting with =, +, - or @ as a formula even inside quotes.
-
Every wire-format parser is fuzzed.With random bytes and mutations of valid packets. It must never throw, never hang and never return unsanitised text.
-
Remote input cannot drive unbounded work.Receive buffers are fixed and the HTTP body is capped, so a hostile device cannot choose how much memory the scan costs.
-
Logs contain no device-supplied text.Only addresses, ports, counts and exception types.
One-time purchase
Stop guessing what’s on the LAN.
£2.99+
Pay what you want, from £2.99. No subscription, no seat count, no licence server.
-
One portable
NetScanner.exe, about 61 MB - Runs as a standard user — no admin rights, no driver, no database server
- No telemetry, no account
- CSV export with formula injection defused
- Windows 10 and 11, 64-bit
Before you buy
Questions
Do I need administrator rights?
No. It runs as a standard user, with no installer, no packet-capture driver and no database server. Copy the one file anywhere and run it.
Windows says “Windows protected your PC”.
That is SmartScreen. The executable is not code-signed, so Windows warns on first run. Click More info, then Run anyway.
Will my antivirus flag it?
It may. A port scanner is behaviourally indistinguishable from reconnaissance malware, so endpoint security software is likely to take an interest. Only run a copy you downloaded from this page.
Can I scan any network?
Only scan networks you own or are authorised to test. The app asks for a one-time acknowledgement on first run, warns before scanning outside private address space or a range over 65,536 addresses, and refuses anything above roughly a million.
Where are my results kept?
On your machine, in one JSON file per range, so the last known hosts appear the moment you reopen it. Nothing is sent anywhere: no telemetry, no account, no licence server. Results also export to CSV.
Is it a subscription?
No. It is a one-time purchase: no subscription, no seat count, no licence server.
Results are evidence, not proof
Authorisation is yours to establish, and the operational risks of active scanning are yours to accept. What NetScanner reports is what it observed, not a guarantee of what is present. Read the disclaimer and the support page.
More from RPSoft