Nearly every Windows network scanner asks for administrator, and many also want a packet-capture driver installed. That is such a normal request that it is worth asking what it is actually for.
Why scanners usually want it
Raw sockets. Crafting packets by hand — a SYN scan that never completes the handshake, a custom ICMP payload — requires raw socket access, which Windows restricts to administrators.
Packet capture. Watching traffic that is not addressed to you requires a driver such as Npcap sitting below the network stack. That is a kernel component, and installing one requires administrator.
Both are genuinely powerful. Both carry real costs.
What that costs you
- You often cannot. On a client machine, or a locked-down corporate laptop, you may simply not have the rights — and the job does not wait for a change request.
- Antivirus objects. A capture driver plus raw sockets is a combination security software is trained to be suspicious of, sometimes correctly.
- A driver is a driver. A kernel component from a scanner vendor is attack surface that outlives the scan, and it is on the machine until somebody removes it.
- The trust question. A tool that needs full control of a machine in order to look at a network is a tool that can do anything at all to that machine. Whether it does is then a matter of trust rather than capability.
What LANWRX does instead
Windows has APIs for exactly this, available to ordinary users, and they are perfectly good:
IcmpSendEchofrom the IP Helper API sends pings and reports latency and TTL, with no raw socket.GetIpNetTable2andSendARPresolve hardware addresses without packet capture.GetAdaptersAddressesgives the real prefix length, gateway and DNS configuration.- Ordinary UDP sockets carry mDNS, SSDP, WS-Discovery and NetBIOS. Ordinary TCP connects probe services.
That combination discovers, identifies and documents everything a technician needs, from a standard user account, with no installation beyond the application itself.
What you give up — honestly
The real trade
Without raw sockets LANWRX cannot do passive packet capture, cannot run a half-open SYN scan, and cannot craft arbitrary probe packets. If you need those, you need Wireshark or Nmap with a capture driver, and you need administrator. There is no clever way around it and we are not going to pretend otherwise.
The question is whether those matter for the job in front of you. For finding what is on a network, working out what each thing is, and documenting it — they do not. For traffic analysis or stealth port scanning, they are the entire point, and you should use the right tool.
A side effect worth having
Because LANWRX never needs elevation, it can install per-user into your own profile, where it cannot modify anything the rest of the machine depends on. Combined with opening no inbound port, that makes it a fairly small thing to have on a laptop that visits other people’s networks — which is the whole point.
The security page sets out what it opens, with the measurements.