Net Scanner · LAN IP Scanner

Features

Everything you need to keep track of your local network.

📈

Live used / available map

Every IP is probed and colour-coded. Green means in use, grey is free, yellow marks your own machine.

📱

Host details

Click any host to see MAC address, vendor (OUI lookup), reverse-DNS hostname, response time and OS.

🖥️

OS fingerprinting

Windows, Apple, Linux/Unix, printers and routers are guessed from ICMP TTL plus open TCP ports.

🔒

ARP scanning

Run with sudo to get instant ARP results with MAC + vendor. Falls back to TCP/ICMP without privileges.

🔍

Filter, sort & page

Grid or list view, used/available filters, sortable columns and pagination with configurable page size.

🔄

Multiple subnets

Scan several subnets at once and switch between them with per-subnet tabs in the UI.

Install & run

Requires a Rust toolchain — install it with rustup.

Build

git clone [email protected]:andikurnia/net-scanner-rust.git
cd net-scanner-rust
cargo build --release

Run (no root needed)

./target/release/net-scanner

Uses ICMP + TCP probes. Open the web UI at http://127.0.0.1:8080.

Run with full ARP results

sudo ./target/release/net-scanner

With root / CAP_NET_RAW the scanner uses ARP, giving you MAC addresses and vendors for every used host, and enables the TTL-based OS probe.

Using the web UI

A quick tour of the dashboard.

Overview

• The status cards show total IPs, used and available addresses, and the last scan time.
• The grid renders one tile per IP — green used, grey available, yellow this machine.
• Switch between Grid and List views. In list view every column is sortable.
• Use the Used / Available filter chips to narrow the results, then hit All to reset.
• Navigate results with the pager and pick a page size (25–500 per page).
• Click any used host to open its detail panel (MAC, vendor, OS, hostname, RTT).
• The footer lets you choose how often the page syncs with the backend (Off, 1s – 60s).

Trigger a scan

Scans run automatically every 10 seconds. Need a fresh scan right now? Press Scan now in the top bar — or call the API:

curl -X POST http://127.0.0.1:8080/api/scan

Config quick reference

Everything lives in config.toml and can be overridden with CLI flags (e.g. --subnet 10.0.0.0/24, --interval 15).

Configuration

All options can be given via CLI flags or config.toml.

Option	CLI	Default
Web bind address	--bind 0.0.0.0:8080	127.0.0.1:8080
Scan interval	--interval 60	10 seconds
Scan method	--method auto\|arp\|tcp	auto
Probe timeout	--timeout-ms 500	100 ms
Concurrency	--concurrency 512	256
Subnets	--subnet 10.0.0.0/24	auto-detect main LAN
OS detection	--detect-os false	true
Probe ports	ports = [...]	22, 53, 80, 445, ...

How it decides "used"

ARP — any reply means the address is in use (needs root).
TCP + ICMP — any open port, or a ping reply, marks the host used.

Your own machine is always counted as used.

How the OS is guessed

TTL of the ICMP reply — Unix ≈ 64, Windows ≈ 128, routers ≈ 255.
Open ports — 445/3389 → Windows, 62078/7000 → Apple, 22/631 → Unix, 9100 → printer.

HTTP API

The backend exposes a tiny JSON API, handy for scripting and monitoring.

Method	Path	Description
GET	/	Web UI
GET	/api/state	Current scan results (JSON)
POST	/api/scan	Trigger a scan immediately
GET	/api/health	Liveness check

curl http://127.0.0.1:8080/api/state | jq '.subnets[].hosts[] | select(.used) | {ip, os, vendor, hostname}'

Troubleshooting

"failed to open datalink channel"

Run with sudo, or just run without privileges to use the TCP probe mode.

No subnet found

Pass --subnet <CIDR> explicitly or add subnets = ["192.168.1.0/24"] to config.toml.

Some hosts are missing

Firewalls or AP isolation can block ARP/ping between clients. Those hosts are only detected if they expose a common TCP port.

OS shows as “–”

The host answered no probes we could fingerprint (e.g. it blocks ICMP and all probed ports). Run with sudo for the TTL probe.

Scan your LAN, see who's online