Network Scan

The Network Scan feature performs comprehensive device discovery on your local network using an advanced 11-phase scanning process. Results appear in the table at the bottom of the main window, showing all discovered devices with detailed information.

Starting a Scan

There are three ways to initiate a network scan:

Toolbar Button - Click the green play button (▶) in the toolbar
Menu Bar - Select Tools → Scan
Keyboard Shortcut - Press ⌘S

Before Scanning

Verify these settings in the toolbar:

Interface - Select the network interface to scan
IP Range Start - Starting IP address (auto-populated)
IP Range End - Ending IP address (auto-populated)
Host Count - Number of IPs that will be scanned

Example: Scanning 192.168.1.1 to 192.168.1.254 will scan 254 hosts

During Scan

While scanning:

Scan button shows a spinner/progress indicator
Status updates appear in the footer
Results appear in real-time as devices are discovered
Current scan phase is displayed
Scan button is disabled (cannot start multiple simultaneous scans)

The Scanning Process

PingStalker uses a sophisticated multi-phase approach to discover and identify devices:

ARP Table Scan

Purpose: Quick initial discovery from existing ARP cache

Discovers: Devices your Mac has recently communicated with

Speed: Very fast (< 1 second)

DNS Lookups for Discovered Hosts

Purpose: Resolve hostnames for devices found in Phase 1

Method: Reverse DNS lookups (PTR records)

Adds: Human-readable hostnames

Example: 192.168.1.1 → router.local

Ping Scan

Purpose: Discover devices not in ARP cache

Method: ICMP echo requests to all IPs in range

Discovers: Active hosts responding to ping

Note: Some devices have firewalls that block ping

Port Scanning

Purpose: Identify services running on discovered devices

Method: TCP connection attempts to common ports

Ports Scanned: - 22 - SSH (Secure Shell) - 80 - HTTP (Web Server) - 443 - HTTPS (Secure Web Server) - 445 - SMB (Windows File Sharing) - 554 - RTSP (Streaming Media) - 3389 - RDP (Remote Desktop Protocol)

Parallel Scanning: Up to as many simultaneous connections your Mac can handle for speed

Targeted Lookups

Purpose: Gather additional device information

Methods: - NetBIOS lookups for Windows devices - SNMP queries for network equipment

Adds: Device names, Windows computer names, SNMP system descriptions

mDNS Device Identification

Purpose: Identify Apple devices with specific model information

Discovers: iPhone, iPad, Mac, Apple TV, HomePod models

Example: "iPhone 15 Pro", "MacBook Air (M2)", "iPad Pro 12.9-inch"

Advantage: More specific than just "Apple, Inc." from OUI lookup

Scan Results Table

Results display in a comprehensive table with columns:

IP Address

The IPv4 address of the discovered device.

Color: Often highlighted or linked for emphasis

Sorting: Click column header to sort by IP address

MAC Address

The hardware address of the device.

Format: 00:11:22:33:44:55

Privacy: Can be obfuscated in Settings → Privacy

Note: Devices not on local subnet (beyond router) won't have MAC addresses

Vendor

The manufacturer identified from the OUI (first 6 characters of MAC).

Database: 6MB+ vendor database with thousands of manufacturers

Examples: - Apple, Inc. - Cisco Systems - Netgear - Raspberry Pi Foundation - Intel Corporate - Samsung Electronics

Vendor Logos: Displayed when available (loaded asynchronously from Clearbit API)

Hostname

The DNS name or NetBIOS name of the device.

Examples: - router.local - DESKTOP-ABC123 - Johns-MacBook-Pro.local - nas.home.arpa

When Empty: Device has no resolvable hostname (no DNS PTR record)

Device Model

Specific model information for Apple devices.

Examples: - iPhone 15 Pro - MacBook Air (M2, 2024) - iPad Pro 12.9-inch (6th generation) - Apple TV 4K (3rd generation) - HomePod mini

When Empty: Not an Apple device, or model couldn't be determined

Open Ports

List of open/accessible ports discovered during port scanning.

Display: Comma-separated list: 22, 80, 443

Service Identification: Common ports show service names in tooltips

Interactive: Click to connect (see Connecting to Services below)

Actions

Right-click menu and action buttons for each device.

Available Actions: - Add to Ping Monitor - Copy IP Address - Copy MAC Address - Copy Row Data - Connect to Service (if open ports exist)

Working with Results

Connecting to Services

When a device has open ports, you can click to connect:

Port 22 (SSH): - Opens Terminal with ssh command - Format: ssh user@192.168.1.50

Port 80 (HTTP): - Opens web browser to http://192.168.1.50

Port 443 (HTTPS): - Opens web browser to https://192.168.1.50

Port 445 (SMB): - Opens Finder to smb://192.168.1.50 - For Windows file sharing

Port 554 (RTSP): - Attempts to open stream URL - For IP cameras and streaming devices

Port 3389 (RDP): - Opens Microsoft Remote Desktop (if installed) - For Windows remote desktop

Method: 1. Click the port number in the Open Ports column 2. Or right-click the device → Connect to → [Service]

Adding to Ping Monitor

To continuously monitor a discovered device:

Right-click the device in results table
Select Add to Ping Monitor
Device immediately appears in Ping Monitor pane

Benefit: Track the device's availability continuously without rescanning

See: Ping Monitor for details on continuous monitoring

Copying Information

Right-click any device to copy:

Copy IP Address - Copy just the IP (e.g., 192.168.1.50)
Copy MAC Address - Copy just the MAC (e.g., 00:11:22:33:44:55)
Copy Row Data - Copy all columns (tab-separated, for pasting into spreadsheets)

Use Cases: - Documentation - Sharing with colleagues - Pasting into network diagrams - Importing into other tools

Sorting Results

Click any column header to sort:

First click: Sort ascending
Second click: Sort descending
Third click: Return to original order

Common Sorting: - IP Address: Organize by network order - Vendor: Group devices by manufacturer - Hostname: Alphabetical device listing - Open Ports: Find devices with specific services

Filtering Results

Use the search box (if available) or visually scan sorted results.

Tips: - Sort by Vendor to find all Apple devices - Sort by Open Ports to find all web servers - Search hostnames for specific devices

Exporting Results

PingStalker can export all scan results and interface information to CSV format.

Export Process

Click Export to CSV button (typically in footer or results area)
Choose save location
Name your file (auto-suggests timestamped filename)
Click Save

CSV Contents

The exported CSV includes:

Interface Information Section: - Interface name and type - IP address, MAC address, subnet - Gateway, DNS servers - Internet details (public IPv4/IPv6, ASN, ISP, country) - DHCP information

Scan Results Section: - All columns from results table - IP Address - MAC Address - Vendor - Hostname - Device Model - Open Ports (comma-separated)

File Format: Standard CSV, opens in Excel, Numbers, Google Sheets, etc.

Filename Example: PingStalker_Scan_2025-10-31_14-30-15.csv

Use Cases for Export

Documentation: Record network inventory
Comparison: Compare scans over time to detect changes
Reporting: Share network audit results
Analysis: Import into database or analytics tools
Compliance: Maintain records of network devices

Performance Considerations

Incomplete Information

Missing Hostnames: - Devices may not have DNS PTR records - Not a problem—IP addresses still identify devices

Missing MAC Addresses: - Devices beyond local router won't show MAC addresses - Only local subnet devices provide MAC addresses

No Open Ports: - Devices may have firewalls blocking ports - PingStalker currently only scans common ports (22, 80, 443, 445, 554, 3389)

Unknown Vendor: - MAC address OUI not in database (rare) - Randomized MAC addresses show as "Unknown" or "Randomized"

Scan Hangs or Takes Very Long

Security Auditing

Use scans to:

Identify unknown/rogue devices
Find devices with unexpected open ports
Detect MAC address changes (spoofing)
Monitor for new devices (intrusion detection)

Network Mapping

Combine scan results with:

Routing Table to understand traffic paths
Interface Details to document configuration
Wireless Details for Wi-Fi infrastructure

The Network Scan feature provides comprehensive device discovery and inventory capabilities. Use it regularly to maintain visibility into your network, and export results for documentation and compliance purposes.