A portable network scanner that discovers reachable IPv4 devices, identifies vendors, and helps you investigate what is running on the network.
76c72b686e5d4e2f5225b6d808a6aca9
Install or run portable. Free, open source, GPLv3.
No agent, account, subscription, or ads.
The app sends no usage analytics. Network connections explained.
What it is for
Walking into a site you have never seen. Scan the subnet and you have the router, the switches, the hypervisors, the NAS, the printers and the cameras before anyone hands you documentation.
Chasing an intermittent drop. Put the gateway and the device in Keep Alive, watch which one actually loses packets, and paste the result straight into the ticket.
Asked what changed. Scan history compares this run against the last one of the same target and names what appeared, what went missing and what opened a port.
Run it from a USB stick without installing the app. Scan results stay local unless you export or share them. Bug reports and requests go on the GitHub issues page.
Read the story behind it on the About page.
Built from scratch
KillerScan is written in C# and WPF for .NET Framework 4.8. Its dependencies are bundled in one .exe; Windows must provide .NET Framework 4.8, and the embedded terminal needs Windows 10 version 1809 or later.
The bundled MAC vendor database covers MA-L, MA-M and MA-S prefixes and resolves vendors offline.
Discovery combines ARP, parallel ICMP probes and a TCP fallback for hosts that ignore ping. mDNS and SSDP add local discovery information.
The Technical page explains the scanner and device classification.
Fully featured
- ARP cache plus a parallel ping sweep, then a second ARP read to catch ICMP-blockers
- TCP fingerprinting across 30+ service ports
- mDNS (Bonjour) and SSDP (UPnP) discovery
- IEEE OUI vendor ID - MA-L, MA-M and MA-S
- Weighted classifier: routers, NAS, printers, cameras, IoT, phones and more
- Topology, Keep Alive and an embedded terminal beside the device list
- Scan history with trusted-device baselines and unknown-device alerts
- Export follows the view: CSV, HTML, or the topology as PNG, JPG or HTML with SVG
- KillerSpeed, device diagnostics and traceroute without leaving the app
- Headless command line for scripts, scheduled tasks and RMM
- Thirteen themes with live accent colors and remembered appearance settings
What it does
Discover hosts
KillerScan reads the ARP cache, runs parallel ICMP probes with a TCP fallback, and reads ARP again to find devices that block ping but answer ARP. Firewalls, sleeping devices and network isolation can prevent discovery.
Device classification
A weighted scorer combines hostname, vendor, open ports, banners, mDNS and SSDP into a best-guess type:
Router, switch/AP, NAS, printer, camera, hypervisor, phone, IoT and more.
Port fingerprinting
A throttled TCP connect scan across 30+ service ports (SSH, RDP, SMB, HTTP, printing, RTSP, MQTT, hypervisor, NAS, and more), with banner, HTTP, TLS, NetBIOS and SNMP probes for stronger identification.
mDNS & SSDP
A network-wide multicast pass runs alongside the sweep.
Bonjour service types and UPnP SERVER strings reveal Chromecasts, printers, Sonos, AirPlay, HomeKit, Roku, Plex and Synology boxes.
Vendor identification
Longest-prefix MAC OUI lookup across the full IEEE registries - MA-L, MA-M and MA-S - with brand overrides for blocks IEEE hides as "Private", and a clear label for randomized privacy MACs.
Gateway & DNS aware
The gateway is labeled Router, DNS Server, or Router/DNS - and only Router/DNS when the gateway really is your configured DNS, so a dedicated DNS server is never mislabeled.
Network topology
F8 draws devices as movable boxes, grouped by role, type, address or vendor. The map is inferred from scan results, not switch cabling. Export the full arrangement as transparent PNG, themed JPG, or HTML containing scalable SVG.
Keep Alive
Watch up to sixteen devices at once, each as a card with a latency graph, packet loss, and its own event log of exactly when it dropped and came back. Every card carries its own checks: route, forward and reverse DNS, ping, ports and traceroute. Copy the lot straight into a ticket.
Terminal built in
A real terminal inside the app, running PowerShell 7 where it exists, with KillerShell's prompt and a KillerScan module that turns a scan into objects you can filter and pipe. Device actions open here: ping in color, SSH with the account you gave for that device.
History & trusted devices
Completed GUI scans that find devices are saved and compared with the previous scan of the same target. The first nonempty scan creates a trusted baseline when no trusted devices exist; later scans flag unfamiliar devices.
Services view
F7 shows one row per open port rather than per device. Find which devices offer a service, sort or filter the list, and export it as CSV.
Profiles & deep scan
Save targets as named profiles, then load or run them from the profiles sidebar. Optionally follow with Deep Scan, which checks ports 1-1024 plus additional service ports and collects more fingerprints. KillerSpeed is available on the rail.
Quick actions
Right-click any device to copy its IP, MAC or hostname, or jump straight to it.
Open its web UI, or launch RDP or SSH directly, and set a manual device type that sticks.
Command line ready
Scan several networks, deep-probe one host, inspect the active network, or resolve a MAC vendor offline. Filter and sort the results, select ports and device types, set limits and timeouts, show progress, and emit table, CSV, JSON or themed HTML output with dependable automation exit codes. See every command.
Export
Use Export for device CSV or interactive HTML, service CSV, topology PNG/JPG or HTML with SVG, Keep Alive CSV/HTML/PNG, and terminal text including scrollback.
Vendor database
The bundled Wireshark MAC vendor database covers MA-L, MA-M and MA-S registrations for offline lookup. Use Refresh vendor database in About to download a newer list; an older local copy cannot replace a larger bundle.
Private by design
Vendor identification and device classification run locally, with no usage analytics or automatic scan-result uploads. Updates and other network features make external connections. Speed tests transfer generated data through speed.killerscan.net. See what connects and what is sent.
Install or run portable
Run the .exe directly or use its Install button. Per-user installation is the default; Install for all users requires administrator permission. .NET Framework 4.8 is required. Standalone install and uninstall dialogs use KillerScan's black/orange colors.
Themes & settings
Thirteen themes, all switchable live, with six accent colors each for Dark, Light, Black and 98SE - 33 looks in all - plus per-theme device-type coloring. KillerScan remembers your theme, accent, language and app size between runs.