The Address Scan tool allows you to scan a range of IP Addresses to check for active addresses, services, or assigned domain names.
Select the type of scan desired from popup menu (Look Around, Last Seen, Domain Name) and then enter or select the network number (x.x.x.x/n), address range (x.x.x.x-y.y.y.y or x.x.x.x-y), starting address, or domain name in the Target field. As a convenience for scanning the attached LAN, the network number for each currently active and configured interface is listed in the Target popup. If no ending address is specified, a default range of 32 addresses is used. Press Scan to begin scanning.
You can scan for active hosts using ping, or for a specific TCP or UDP listener by selecting the corresponding protocol and service. You can specify any port number (TCP or UDP service) directly in the target field by appending it to the IP address with a colon (x.x.x.x:p/n).
Use the Look Around scan to see a list of active IP Addresses on your LAN.
When using ping to scan for devices on your LAN, IPNetMonitorX will try to show the corresponding Bonjour (Rendezvous) host name (if any) and Ethernet hardware address and device manufacturer. The first three octets of an Ethernet address form the OUI (Organization Unique Identifier, 00-03-93 for example). You can often lookup the corresponding manufacturer at http://standards.ieee.org/regauth/oui/index.shtml to help identify an unknown device.
Since ping responses may be lost if the network is busy, you can specify a retry count to try the same ping again if a previous echo request times out. The number of devices detected from a retry is indicated. You can also repeat the scan continuously to watch as devices come and go from your network.
The "Latency" shows the maximum time between when packets arrive and when they are read and processed (for each pass). A latency of several seconds may indicate your system is temporarily busy with other processing, so responses are more likely to time out or be dropped.
Use the Last Seen scan to repeat the scan once every minute and report the last time each host was seen. This is useful for detecting which IP addresses are actually in use on your network or when a server becomes unavailable since you can leave the scan running for as long as desired.
The Domain Name Scan does a DNS lookup on each IP address that responds in the scan range to display the corresponding Domain Name if any. This might be used to check which hosts are currently available. To retrieve a large range of domain names, consider requesting a Zone Transfer using the NSLookup tool.
When scanning for TCP listeners, the tool attempts to open a connection to the specified service port. The connection attempt can succeed (the port is open), be refused (the port is closed), or time out (indicated as lost or no response). When scanning for UDP listeners, the tool first tries to ping the corresponding target. If ping responds, it then sends a UDP probe to the corresponding port. The probe can be rejected indicating the port is closed, silently accepted, or ignored. When scanning for UDP, there is no way for the tool alone to distingish between probes that are accepted versus silently ignored. If the target responds to ping and the probe is not rejected, the port is listed as open indicating there could be a listener on that port. Based on the network context and other responses, you will often be able to determine whether the port is actually open, or blocked by a firewall in "stealth" mode. The summary statistics below the table show what was sent and the number and type of responses received (open, closed, lost).
The ability to see the active hosts on your LAN by name (Look Around Scan) is a popular feature that has lead to many questions. When you open an Address Scan Window, the tool browses for any advertised services on your LAN using Bonjour. If you later invoke a Look Around Scan, the tool compares the host addresses it finds with the address and name of any advertised services to extract the corresponding host name. Many older devices do not support Bonjour or do not advertise their host names. iOS devices like the iPad only advertise a Bonjour service if you run a corresponding application like "Air Sharing" on the device. Once a device name has been found, the Address Scan tool will remember it for future reference using the corresponding Ethernet MAC address.
You can edit the values displayed for the Name and Comment columns directly in the Address Scan table when Look Around Scan is selected. Editing is similar to editing file filenames in Finder, click, pause, and click again. In this case, the Address Scan tool itself remembers the user entered values for the corresponding Ethernet hardware MAC address. To restore the found name or comment, edit the corresponding field to be empty.
You may also configure a "Hosts" file on your system (/etc/hosts) so you can access systems by name using common Internet tools. Normally this file is used to define name-to-address mappings for IP hosts on your LAN. If no matching service name is found during a Look Around Scan, the tool will read the Hosts file to look for any locally defined names. By customizing the Hosts file, you can have the Address Scan tool correctly identify any device on your LAN that uses a fixed IP address.
If you are having trouble identifying a device and have an AirPort base station, you can use the AirPort Utility to examine the DHCP Device Table. This will show the "DHCP Client ID" which may provide another clue for identifying a device. Navigate to "AirPort Utility -> Manual Setup -> Advanced -> Loging & Statistics -> Logs & Statistics-> DHCP Clients". On my network for example, there is a DHCP client named "Wii" and "iPod Touch".
When you invoke one window from another, the corresponding data is automatically transferred.
A popup menu keeps a list of Recent Targets or history. The contents of the target field are added to the list when a test to that target is invoked. If the recent targets menu becomes full (10 entries), the least recently used item will be removed. To add or remove an item, or clear the entire list, use the corresponding selections from the History menu.
You can double-click on any destination in the table to start a Port Scan to that address. You don't have to wait for the scan to finish.
You can select the results of an Address Scan and copy them to the clipboard as plain text (for pasting into email messages). If you include the first row of the table in your selection, the table headings will also be copied.
The Look Around Scan and Domain Name Scan normally list only those hosts that respond. To include all IP addresses in the scan range in the table output, use the List All Addresses check box.
IPNetMonitorX recognizes the 'GURL' AppleEvent to handle URLs of the form:
scan://192.168.0.1;limit=32;scanType=lastSeen;listAll=1 scan://192.168.0.1-192.168.0.64;scanType=lookAround
You can select File->Save to save a double-clickable ".ipnm" document with the corresponding URL. You can preview the URL that will be saved by pausing over the "Save" button in the panel that appears. URLs are saved as plain text. You can include multiple URLs in the same file, one per line, to open the corresponding tools.
You can open and use multiple Address Scan windows at the same time.