The buttons on the right of the toolbar are permanent views rather than windows that come and go. Each one keeps its own state while you work in the others, so moving from a scan to a topology picture and back does not throw anything away.

Right-click the view buttons to change their icon size or move their captions. When the window is too narrow for all of them, the view buttons overflow into a menu instead of the input bar being squeezed.

Scan history and scan profiles are not views. They share a sidebar that slides out from the icon rail on the left, resizes by dragging its edge, and cross-fades between the two sections.

F7 turns the results inside out. Instead of one row per device listing its ports, you get one row per open port: the service, the port number, and the device it belongs to, with its name, address and type.

It answers the question the device table makes you work for, which is "what is running SSH on this network", or "who is serving HTTP that should not be". Thirty-three well-known ports are named, and anything else is listed by its number rather than guessed at.

Sort by any column, and your sort survives a rescan. The list follows the toolbar filter, so it shows the same devices the table would.

Ctrl+A selects everything while the view is active, and Export offers the service list as its own CSV.

Keep Alive answers the question you ask on every intermittent fault: is this thing actually dropping, and when? It watches up to sixteen addresses at once.

Open it with F9 and the target box is already filled in with your gateway, your DNS server, and whatever device you had selected, so the common case needs no typing. Select several devices in the results table first and choose Keep Alive, and all of them are watched together.

Targets are separated by commas, semicolons, or new lines, and duplicates are dropped.

Every target is pinged in parallel on a fixed two second cadence, and the loop subtracts the time the pings themselves took so the interval stays honest rather than drifting. Each ping is given 1.2 seconds to answer before it counts as a miss.

Each target gets its own card showing a status dot and the latest round-trip time, the state in words, a latency graph, and a line with packet loss, the number of pings sent, and the time of the last change of state. The graph keeps the last forty samples, which at a two second cadence is a little over a minute of history.

A missed reply is drawn at the top of the graph rather than left as a gap, so an outage reads as a spike you can see at a glance. The vertical scale never drops below 20 ms, which stops a healthy local link from looking like a field of spikes.

Average latency counts only the pings that came back, and loss is the plain percentage of pings that did not.

Below that, each card carries its own event log, capped at thirty lines. It records only transitions, not every ping, so the log is a short list of when the device went down and when it came back, in green and red, rather than a wall of identical successes.

Right-click a card to copy its address, run its checks again, reset its counters without disturbing the other targets, or drop it from the run, which also rewrites the target box to match. Stopping a run leaves the results on screen; starting again clears them.

The toolbar Copy button walks every card in order and copies the whole run, counters, checks, and event log included, as tab separated text that pastes cleanly into a ticket.

Every card also carries its own set of checks, and they run for the whole set as soon as a run starts, four cards at a time. You can rerun them for one card from its right-click menu.

The same checks are what F3 runs against a single selected device. They are:

The groups run at the same time rather than one after another, so a slow DNS server does not hold up the port checks. A timestamp is added when they all finish.

F8 draws the scan as a picture. It is worth being straight about what that picture is: KillerScan does not interrogate your switches, so it is not a cable map.

Nothing here depends on CDP, LLDP, or a managed switch admitting anything. It takes what the scan already knows, works out which device is your gateway, which is you, and which is your DNS server, and draws every other device as a spoke off the local network in the middle.

Where the DNS server is the gateway, it is drawn once rather than twice.

Every device is a box you can pick up and move. Click to select, Ctrl+click to add to the selection, and drag any selected box to move the whole selection together.

Boxes are held inside the canvas, and the dashed connector to the middle is redrawn as you drag rather than after you let go, so it stays attached. Selection is shared with the results table, so a box you select in the picture is the row that is selected when you switch back.

Right-click a box for the same device menu the table gives you. Typing in the toolbar filter filters the picture too, so you can draw only the printers, or only one vendor.

Positions you set are remembered by address for as long as the app is open, so changing the filter or refreshing the view does not shuffle your layout back. Starting a new scan or switching arrangement clears them, because both make the old positions meaningless.

Cycle them with Ctrl+G or pick one directly with Ctrl+1 through Ctrl+4. Your choice is remembered between runs. The button is icon-only and stays where it is once used.

The number of columns follows the width of the window, so the picture reflows instead of scrolling sideways, and each new group starts on its own row with a small gap in front of it.

Export while topology is showing and you get the arranged picture as a PNG. It is rendered from the canvas itself rather than from what happens to be on screen, so devices scrolled out of view are in the file, at full size, with the arrangement and the positions you set.

The background is the current theme's content surface, so the image matches the app you exported it from instead of arriving on a white sheet.

The Terminal view is a real terminal, not a box that shows the output of a command after it finishes. It is built on the Windows pseudoconsole, the same mechanism Windows Terminal uses, so full-screen programs, colors, and interactive prompts behave the way they do anywhere else.

The escape sequences are parsed by hand and the text is drawn directly rather than through a text box, which is what keeps a busy screen smooth.

It keeps five thousand lines of scrollback, resizes the running program properly when you resize the pane rather than just reflowing what is already there, and reads output as UTF-8. Select with the mouse, and copy and paste with Ctrl+Shift+C and Ctrl+Shift+V, Ctrl+V, Shift+Insert, or the middle button.

Ctrl+plus, Ctrl+minus and Ctrl+0 change the font size, as does Ctrl and the wheel. If ProFont IIx Nerd Font is installed it is used, otherwise it falls back through Cascadia, Consolas, Lucida Console, and Courier New.

For a shell it prefers PowerShell 7, looking for pwsh.exe on your PATH first and then in the usual Program Files locations, and falls back to Windows PowerShell 5.1 when 7 is not installed. Device actions open here too: ping runs a continuous ping with replies in green and timeouts, unreachable and failure lines in red, and Escape stops it, which the status line tells you at the time.

SSH runs the Windows SSH client with the username you gave for that device, passed as an argument rather than through a shell, so nothing you typed is ever interpreted as a command. Closing a terminal ends its process, and a program that exits on its own reports its exit code rather than leaving a dead pane.

The terminal uses KillerShell's prompt, and it is a file you own rather than something baked into the app. On first use it is unpacked to %LOCALAPPDATA%\KillerScan\prompt\.

Two files land there: KillerPrompt.default.ps1, which is rewritten whenever the app changes so it always matches the version you are running, and KillerPrompt.ps1, which is written only if it is not already there. That second one is yours.

Edit it however you like and an upgrade will never touch it; compare it against the refreshed default file when you want to pick up a change. Both are written with a byte order mark, because Windows PowerShell 5.1 reads a file without one in the system codepage and mangles the box drawing characters. Set KS_PROMPT=0 in the environment to skip the whole thing.

The KillerScripts PowerShell module travels inside the executable, which is the point: it is there on a locked-down machine where you cannot install anything. It is unpacked per version to %LOCALAPPDATA%\KillerScan\Modules\ the first time you open a terminal, written to a temporary name and moved into place with a marker file written last so a half-finished unpack is never used.

The module path is appended rather than prepended, so a copy you installed properly from the gallery still wins.

Right-click for the things a terminal is expected to offer: copy, paste, select all, copy the whole session including scrollback, clear, and the speed test. Copy is offered only when there is a selection.

Clear empties the screen and the scrollback without sending anything to the program on the other end, because a full-screen program would redraw over it and a shell mid-command should not receive stray input. The terminal keeps only the Ctrl+Shift chords for itself, so Ctrl+A, Ctrl+C and the rest reach the program you are talking to, which is what lets readline and screen work normally.

The terminal carries a small KillerScan module of its own, unpacked from inside the exe like the rest. It gives you four short commands, and the point of them is not that they are shorter than the command line: they hand back objects rather than text.

A scan you run this way can be filtered, sorted, counted and piped like anything else in PowerShell, without a single line of parsing.

Each command is the app doing the work: the module shells out to the same command line an installed copy puts on PATH, and reads its JSON. It knows where to find a portable copy too, so the commands work from a folder you just dropped the exe into.

The names are deliberately short because they live in this terminal rather than in your own PowerShell profile, where scan would be a rude thing to claim.

F4, or the rail icon, runs a speed test in the Terminal. If the official Ookla CLI is already on your PATH it is used as is.

If it is not, KillerScan says what it would download and where from, and waits for an answer: the CLI is a separate binary under its own license, so it is never fetched quietly. Decline and the built-in test runs instead, which installs nothing and needs no extra binary.

With the Ookla CLI, the output is read as structured events rather than scraped from its console, so the server, ISP, latency, jitter, download, upload, packet loss and result link are printed in KillerScan's own colors, and the CLI's occasional startup noise is simply not shown. The built-in fallback measures latency to a public resolver, then download and upload against Cloudflare's speed endpoints, and labels itself as indicative rather than an official speedtest.net result, because that is what it is.

Every completed scan is recorded, and Ctrl+H opens the list, newest first. Pick an entry and KillerScan compares it against the previous scan of the same target, so comparing a subnet against an unrelated one is not something you can do by accident.

The comparison is shown as one flat table of added, missing, and changed devices, in that order, with a one-line summary of the three counts. The first scan of a target says so plainly rather than reporting every device as new.

Two readings of the same entry sit behind a selector on the right. Changes is the comparison. All devices is the snapshot itself, every device as it was recorded, which is the one you want when nothing moved and the comparison is therefore empty. The choice is remembered.

Devices are matched between scans by hardware ID where one is known, and only by address where it is not. That is what makes the comparison worth reading: a device that picked up a new address from DHCP is reported as changed rather than as one device disappearing and another appearing.

A device counts as changed when its address, name, maker, type, or set of open ports is different from last time. A newly opened port on a device that was there yesterday is the interesting case, and it shows up here.

History is kept in %LocalAppData%\KillerScan\history.json as plain readable JSON, with the last fifty scans retained. Each entry holds the time, the target, and the devices with their names, hardware IDs, makers, types, and open ports.

The first full scan that finds anything, on a machine that has never trusted a device, becomes your baseline: everything found is marked trusted and the status bar tells you how many. There is no setup step to forget.

From then on, every scan counts the devices that are not trusted, and the status bar reports how many unknown devices turned up. Toggle trust for any device from its right-click menu.

Trust is stored against the same hardware ID used by history, in %LocalAppData%\KillerScan\devices.json, alongside the names you have given devices by hand, so renaming a device does not affect whether it is trusted and reconnecting it on a different address does not make it a stranger.

Ctrl+Shift+P opens saved profiles. A profile is deliberately small: a name, the targets, and whether to follow the scan with Deep Scan.

Save the current target under a name, and saving again with the same name replaces it. Load puts the target in place without scanning, for when you want to change something first.

Run starts it immediately. If the profile is set to deep scan, the exhaustive pass follows automatically as soon as the normal scan finishes, so a site you visit regularly is one keystroke rather than a sequence. Profiles live in %LocalAppData%\KillerScan\profiles.json.

Export offers only what the view in front of you can actually produce, so the menu changes as you move between views. In Devices and Services it writes the device list as CSV or as the HTML report, with the service list as its own CSV while Services is showing.

In Topology it drops those entirely, because there is no table on screen to write, and offers the picture instead: a transparent PNG to drop onto someone else's document, a JPG flattened onto the theme's own surface and grain for the places that refuse transparency, and an HTML page carrying real SVG, which stays sharp at any size and can be edited afterwards. In Keep Alive it writes the run as CSV or as a page, or the cards themselves as a picture.

In the Terminal it writes the session to a text file, scrollback included. Files are named with the date and time, so exporting the same network twice in an afternoon does not overwrite the morning's evidence.

The picture exports render the whole canvas rather than the part of it on screen, so a device you scrolled past is still in the file, in the position you left it. The SVG is written from the canvas itself, one element per connector and per device box, reading its colors from the theme you are using, so it arrives as shapes and text you can restyle rather than as pixels.

The HTML report is one self-contained file. It carries the whole device table with every column sortable by clicking its heading, addresses sorted as numbers rather than as text, device types colored the way they are in the app, and a theme and accent picker with the same thirteen themes, remembered in the browser for the next time that report is opened. It needs nothing from the network to render.

The right of the status bar carries your own address, the adapter it belongs to and the negotiated link speed, with a wired or wireless glyph in front of them. Click that cell to fold the adapter and speed away and back; the choice is remembered.

It also folds itself: when the bar runs short the speed goes first and the adapter follows, each disappearing whole rather than being trimmed to an ellipsis, and the address always stays. Anything Windows does not report is left out rather than shown empty.

In the corner is a small light for the state of the scan: amber before the first scan and after one that was stopped short, because a half-finished scan and no scan tell you the same thing about the list on screen; red while a scan runs; blue during a Deep Scan; green when a scan completes. It keeps reporting while you are in Keep Alive or the Terminal, which is exactly when a status light earns its place.

The same scanner that powers the window can run headless from Command Prompt, PowerShell, scripts, scheduled tasks, and RMM tools. Install KillerScan, open a new terminal, and call it by name.

Windows commands are case-insensitive, so killerscan and KillerScan are the same command. Running it without any flags opens the normal app.

SSH usernames and authentication. When you launch SSH from a device's right-click menu, KillerScan asks for the username the first time and remembers only that username against the device's MAC address. It never asks for, sees, or stores passwords or private keys.

The normal Windows SSH client handles the connection and all authentication.

Targets use exactly the same syntax as the subnet box: CIDR blocks such as 192.168.8.0/24, a single host, a full address range, or a range with only the final octet on the right. Supply several targets separated by commas or as separate arguments.

Overlaps are removed and the combined safety ceiling is 65,536 addresses.

KillerScan sends the result table to standard output and progress or errors to standard error, so redirecting the table does not mix in status messages. Ctrl+C cancels a running scan.

Because KillerScan is also a graphical Windows app, Command Prompt may return its prompt before the headless process finishes; scripts that need the result must explicitly wait: