What changed since last time — counted correctly
Compare today against a previous visit. A device that got a new DHCP lease is reported as one change: it moved. Scanners that key on the IP address report a removal and an addition, and you spend the afternoon chasing a device that never left.
The interesting question on a return visit is not what is here. It is what is different.
Identity is the whole problem
Get identity wrong and change detection produces noise instead of signal. If a device is identified by its IP address, then every DHCP renewal that lands on a different address reads as two events: something vanished, something new appeared. On a site with a short lease time, a comparison between two visits is then mostly false alarms, and you learn to ignore it — which is the worst outcome for a safety net.
In ScanWRX a device is its hardware address. The address it happens to hold is an observation about it, not part of what it is. So a device that moved from .31 to .44 produces exactly one line: it moved, and here is where from and to.
What it reports
- New — a hardware address not seen in the baseline.
- Gone — in the baseline, did not answer this time. Phrased that way deliberately: absence of a reply is not proof of removal.
- Moved — same device, different address.
- Changed — same device, same address, but something about it is different: a new open port, a changed hostname, a firmware string that moved on.
- Returned — absent last time, back now.
Why this is the feature people pay for
“Nothing changed since last month” is a sentence worth money to a client, and it is only worth anything if the tool that produced it would have noticed if something had. Equally, “this appeared on the network eleven days ago” is the beginning of a real answer to a real question.
What this does not do
- A device with a randomised MAC that rotates between visits cannot be tracked across them. Modern phones do this by default, and no tool can follow them without the device cooperating.
- Comparison needs a saved baseline, which is a Pro feature. The free tier scans and exports but does not keep history.
- A device that was asleep during one scan is reported as absent, because that is what was observed. It is described as 'did not answer this time', not as 'removed'.
See it on your own network
The free tier covers discovery, identification and the diagnostic tools. No account, no expiry.