Find everything on the network, fast, without administrator rights
ScanWRX sweeps a subnet with seven discovery methods running at once and shows results as they arrive. On a real 80-device network over Wi-Fi it finishes in about eight seconds, from an ordinary user account.
Discovery is the part every scanner claims and few explain. Here is exactly what ScanWRX does, in the order it does it.
Seven methods, run together
Each method finds a different population of devices, and running them concurrently is why a full sweep takes seconds rather than minutes.
- The neighbour table. Windows already knows about devices this computer has talked to. Reading that costs nothing and finds things instantly.
- ICMP echo. The classic ping, through the Windows IP Helper API rather than a raw socket. That is the choice that avoids needing administrator.
- TCP connect. A short list of ports that indicate a service worth knowing about. Devices that ignore ping frequently answer this.
- mDNS. Apple devices, printers, Chromecasts and most modern IoT announce themselves here, often including their own model name.
- SSDP. UPnP devices — media players, smart TVs, some routers and cameras — reply with a description URL.
- WS-Discovery. How Windows machines and ONVIF cameras announce themselves. Frequently the only thing that finds a camera.
- NetBIOS. Old, and still the fastest way to get a name off a Windows machine or a NAS.
Why it does not ask for administrator
Most Windows scanners want elevation, and many want a packet capture driver installed as well. Both are real costs: the driver is a support burden, it upsets antivirus, and on a client machine you frequently do not have the rights to install one anyway.
ScanWRX uses the Windows networking APIs that exist for this purpose — IcmpSendEcho for pings, GetIpNetTable2 and SendARP for hardware addresses, GetAdaptersAddresses for the local topology. The result is a scanner you can run on a machine you were handed ten minutes ago.
Results while it is still running
The table fills in as answers arrive, sorted numerically by address rather than alphabetically, so 192.168.1.9 comes before 192.168.1.100. You can start reading before the scan finishes and sort or filter without waiting.
Three depths
Quick is a presence sweep — who is here. Standard adds service probing and identification, and is what you want almost always. Deep widens the port list and waits longer for slow devices, which is worth it on a site with cameras or industrial gear.
What this does not do
- Discovery is limited to networks the computer can reach directly or route to. It cannot see behind a firewall that drops your probes.
- A device configured not to answer anything will not be found by any scanner, including this one. If it never sends a packet and never replies, nothing can observe it.
- Subnets larger than a /22 are refused by default. Sweeping a /16 is four hours of traffic and almost never what someone meant to type.
See it on your own network
The free tier covers discovery, identification and the diagnostic tools. No account, no expiry.