Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I scan a network to find out which devices are on it? (I'd be happy with a list of MAC addresses and IPs.)

For example, lets say I'm at work and want to be sure that there are no unknown devices connected to the network (especially if access is not filtered by password or MAC). DHCP logs could help, but what if I want to find devices with static IPs?

Alternatively, let us say I'm at a friends house and he wants me to setup port forwarding, but doesn't know the IP of his router. Sure, a few good guesses will usually get it, but it'd be nicer to scan.

share|improve this question

11 Answers 11

up vote 25 down vote accepted

For the first scenario, look at nmap. You can scan entire subnets in one command. For example: nmap -sP

For the second, the router IP should show up as the gateway IP for your machine. In windows, that appears in the connection status dialog.

share|improve this answer
nmap also includes a nice GUI tool called Zenmap for Linux, Windows, Mac OS X, BSD, etc. – Clinton Blackmore Jun 5 '09 at 16:47

You can ping to the broadcast address and see arp table. Here is a example of doing it on Linux:

ping -b
arp -n

NB: The OS of the device have to echo back to ICMP echo request. Some OS don't reply to ICMP with broadcast IP adress. In which case you can ping to every possible ip address in the network. Recently windows boxes don't reply to ICMP echo with unicast IP address by default, so this won't help.

share|improve this answer

I use The Dude. I found it here yesterday when looking for network tools. Run it on your machine and it makes a map of all equipment on your network. The best part is that its totally free!

share|improve this answer
URL for the dude is here: ""; – slm Sep 7 '12 at 4:30
Working link is here – c24w May 17 at 8:48

Angry IP Scanner is an awesome tool for this.

I cannot post a link due to forum restrictions but Google will bring it right up.

It will also allow you to export a .csv for use in IP inventory etc.

share|improve this answer
Angry IP Scanner is a GPLed GUI app for Windows/Linux/Mac, available at – Clinton Blackmore Jun 5 '09 at 16:55

In response to the second question:

On Windows

  1. Windows Key + R
  2. Type in cmd
  3. At the prompt type in "ipconfig"

The output should have a line that lists the Default Gateway. There might be more than one adapter listed, but typically only one with an ip address and default gateway listed.

share|improve this answer

Spiceworks will provide you with detailed information about your network. Might be overkill if you're just wanting to find IP addresses and Macs, but if you need to monitor your network on an ongoing basis, it's a great tool. Otherwise use nmap.

share|improve this answer
Wikipedia says "Spiceworks provides a free systems management, inventory, and helpdesk software application, Spiceworks IT Desktop, designed for network administrators working in small- to medium-sized businesses." It is much more than a network scanner. While it scans all platforms, it runs on a Windows box. – Clinton Blackmore Jun 5 '09 at 16:58

Android app Fing just does that amazingly, I wish there would be a UNIX style command that could yield a similar result.

share|improve this answer
Welcome to ServerFault! Link to the application would also help! – Pothi Sep 18 '13 at 2:44
I guess people should be able to search for 'Fing' on Google Play with their device... a link can always be useful though, I edited my answer – coolnodje Sep 18 '13 at 7:02
Thanks for the link! – Pothi Sep 18 '13 at 7:15

nmap, but failing that you can ping the network broadcast address and check what comes back. Coupled with checking the ARP table, this can be a fairly effective method of discovering what's on a given subnet.

For the specific example of "does not know the router IP", checking the host routing tables should reveal the default gateway and that is (often, but not always) a suitable management IP for the router.

share|improve this answer
Many, if not most, systems nowdays won't respond to a broadcast ping. So this is unreliable at best. – Scott Pack May 30 '09 at 14:22

Another good tool is look@lan. It will allow you to scan the network and will give you several different results.

share|improve this answer
look@lan has now become overlook fing (, with a freeware Windows/Linux/Mac CLI tool called fing. It looks like it'll happily give you the data in different formats for continued processing. – Clinton Blackmore Jun 5 '09 at 16:53

If your network and all it's devices conform to the RFC's than you should get a reply back form all network devices when you ping the broadcast address of your network. Understandably this doesn't work very often and you have to revert to scanning each of the available IP on the full spectrum of the ports.

share|improve this answer

You can also use Advance IP Scanner or as mentioned above Angry IP scanner is awesome and open source.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.