Why ScanWRX does not need administrator, and what that costs

Nearly every Windows network scanner asks for administrator, and many also want a packet-capture driver installed. That is such a normal request that it is worth asking what it is actually for.

Why scanners usually want it

Raw sockets. Crafting packets by hand — a SYN scan that never completes the handshake, a custom ICMP payload — requires raw socket access, which Windows restricts to administrators.

Packet capture. Watching traffic that is not addressed to you requires a driver such as Npcap sitting below the network stack. That is a kernel component, and installing one requires administrator.

Both are genuinely powerful. Both carry real costs.

What that costs you

• You often cannot. On a client machine, or a locked-down corporate laptop, you may simply not have the rights — and the job does not wait for a change request.
• Antivirus objects. A capture driver plus raw sockets is a combination security software is trained to be suspicious of, sometimes correctly.
• A driver is a driver. A kernel component from a scanner vendor is attack surface that outlives the scan, and it is on the machine until somebody removes it.
• The trust question. A tool that needs full control of a machine in order to look at a network is a tool that can do anything at all to that machine. Whether it does is then a matter of trust rather than capability.

What ScanWRX does instead

Windows has APIs for exactly this, available to ordinary users, and they are perfectly good:

• IcmpSendEcho from the IP Helper API sends pings and reports latency and TTL, with no raw socket.
• GetIpNetTable2 and SendARP resolve hardware addresses without packet capture.
• GetAdaptersAddresses gives the real prefix length, gateway and DNS configuration.
• Ordinary UDP sockets carry mDNS, SSDP, WS-Discovery and NetBIOS. Ordinary TCP connects probe services.

That combination discovers, identifies and documents everything a technician needs, from a standard user account, with no installation beyond the application itself.

What you give up — honestly

The question is whether those matter for the job in front of you. For finding what is on a network, working out what each thing is, and documenting it — they do not. For traffic analysis or stealth port scanning, they are the entire point, and you should use the right tool.

A side effect worth having

Because ScanWRX never needs elevation, it can install per-user into your own profile, where it cannot modify anything the rest of the machine depends on. Combined with opening no inbound port, that makes it a fairly small thing to have on a laptop that visits other people’s networks — which is the whole point.

The security page sets out what it opens, with the measurements.