Every discovery method finds a different population and proves a different thing. Knowing which is which is the difference between reading a scan and guessing at one.
ARP and the neighbour table
Address Resolution Protocol maps an IP address to a hardware address on the local segment. Your computer keeps a cache of recent answers — the neighbour table — and reading it is instant and free.
Proves: this hardware address held this IP address recently, on this segment.
Does not prove: that it is there now. A stale entry looks identical to a live one, which is why a device found only in the cache should not be reported as online.
ICMP echo
The ping. Sends an echo request, waits for a reply, measures the round trip.
Proves: something at that address is up and reachable, and gives you latency and a TTL.
Does not prove: anything about what it is. Plenty of devices and most host firewalls drop ICMP by default, so silence proves nothing either.
TCP connect
Completing a normal three-way handshake against a port. Distinguishes three states, not two: open (handshake completed), closed (actively refused), filtered (no answer at all).
That distinction matters. “Refused” tells you a host is there and not listening on that port; “no answer” tells you a firewall is between you and it. Collapsing them into “not open” throws away real information.
mDNS
Multicast DNS, also called Bonjour or zero-configuration networking. Devices announce services on a multicast address, and often include a _device-info._tcp record naming their own model.
Proves: often the strongest evidence available — the device stating what it is.
Watch for: a computer sharing a printer advertises the printer’s model. Read naively that turns a MacBook into a Brother printer. The model is only about the device itself when the device also behaves like one.
SSDP and UPnP
Simple Service Discovery Protocol, the discovery half of UPnP. A multicast search draws replies pointing at an XML description with manufacturer, model and serial.
Finds: media players, smart TVs, some routers and cameras.
Note: reading a UPnP descriptor is a read. It is entirely different from using UPnP to ask a router to forward a port, which ScanWRX never does.
WS-Discovery
Web Services Dynamic Discovery. How Windows machines announce themselves and, importantly, how ONVIF cameras do. Frequently the only method that finds a camera that ignores everything else.
NetBIOS
A name service from the 1980s that refuses to die, because it is still the fastest way to get a name off a Windows machine or a NAS. A NetBIOS query returns the computer name and often the workgroup or domain.
OUI
Organisationally Unique Identifier: the first three octets of a hardware address, registered with the IEEE.
Proves: which organisation registered the block the network interface came from.
Does not prove: what the device is. Many products use somebody else’s network module. And if the address is locally administered — randomised — it was not assigned by a manufacturer at all, so looking it up produces a name that means nothing.
TTL
Time To Live: a counter set by the sending system and decremented by each router. Common initial values are 64 (Linux, macOS, most embedded), 128 (Windows) and 255 (much network equipment).
Proves: roughly which operating system family sent it, and how many routers it crossed.
Weak on its own, good in combination. TTL 255 plus SNMP open plus a network-equipment prefix is a strong case for infrastructure.
Putting it together
No single signal identifies a device. The useful question is not “what is it” but “how much do these signals, together, support a conclusion, and what would change my mind?”
That is why ScanWRX shows confidence and evidence rather than a bare answer, and why a self-report is the only thing that reaches “confirmed”. Everything else is inference, and inference can be wrong.