Scanning a subnet and its ports

Finding hosts

IP Scanner lists the subnets this machine is already on, so usually you pick one and press Scan. Hosts come back with IP, MAC, the vendor that MAC belongs to, a hostname where one resolves, and a round-trip time.

Right-click a host to open SSH, SFTP, RDP, a ping, a traceroute or a port scan against it without retyping the address. That is the point of having them in one app.

Discovery is ARP and ICMP based, so a host configured to answer neither will not appear. Absence of a host in the list is not proof it is not there.

Scanning ports

Targets can be written several ways, and mixed:

• One host — 10.0.0.1 or switch.local
• A subnet — 192.168.1.0/24
• A range — 192.168.1.10-50
• A comma-separated or newline-separated list of any of those

Multi-host targets are swept for live hosts first and only those are scanned, because a /24 is 254 addresses and usually a dozen machines. Ports are written the same way: 22,80,443 or 1-1024 or both.

Options worth knowing

• Timeout — raise it on a slow or distant network, lower it on a LAN.
• Parallelism — how many probes are in flight. High values are faster and more conspicuous.
• Retries — worth one or two over Wi-Fi, where a single lost probe is not evidence of a closed port.
• Banner grabbing — reads the first thing a service says, which is often enough to identify it.

Reading the results

Results group by host. open means a TCP connection completed. open|filtered appears for UDP and means the port did not answer — which for UDP is genuinely ambiguous, since silence is also what an open port that ignores unknown input looks like.

The service name is the IANA name for that port number. It is a reasonable guess, not an interrogation. There is no version detection and no OS fingerprinting — for that, use Nmap.

Export to CSV, JSON or text from the results header. See exports and logs.