SoftPerfect Network Scanner Online Manual

Product Page / Download

Getting started

This is the main window you see when you run the SoftPerfect Network Scanner.

Under the menu there is a toolbar with buttons used to access the main features.
The program controls are as follows:

Application options

Press Ctrl+O or the button to access the network scanner options

On the General tab:

• Max. threads - the maximum number of scanning threads.
• Max. thread run-time - gracefully stop a thread and move on to a next IP address if it has not finished within the specified time. If the thread cannot be stopped, it will be forcibly terminated when 2 x the specified time elapses. A zero run-time sets no limit on thread execution time.
• Method - the ping method. Can be chosen from ICMP (ping), ARP (arping), or both.
• Ping Timeout - the period to wait for a reply from the remote computer.
• Attempts - the maximum number of ping requests.
• Always analyse host - forces the scanner to analyse a non-responding host.
• Ping broadcast addresses - when enabled the scanner tries to ping IP addresses ending with .255.
• Explore shared folders in background - If this option is set, whenever you choose to explore a folder the network scanner launches a separate process of Windows Explorer to avoid temporary unresponsiveness.
• Case insensitive sorting - ignores case type when results are sorted.
• Display dead hosts - add non-responding hosts into the results.
• Show last scan time - shows the time when the host was last scanned.
• Random scan order - scans IP addresses and ports in a random order, not sequentially.
• Minimise to the notification area - the application will be minimised to the system tray.

On the Additional tab:

• Resolve Host Names - when enabled, the IP addresses are converted to the host names.
• Resolve MAC addresses - when enabled, you will see hardware (MAC) addresses. There are three discovery methods available: ARP query, NetBios query and Router SNMP MIB query. The ARP query method sends an ARP packet to the target device to resolve its MAC address directly. Similarly, the NetBios query method sends a NetBios packet to the target device. If the target device responds to the request, the network scanner will obtain the MAC address of that device. The Router SNMP MIB query method works differently. Before starting scanning the application will send a few SNMP requests to the default gateway configured in your network card's properties in order to find out what MAC address corresponds to what IP address. If the gateway is SNMP capable and responds to the request, the application will cache this information and use it for MAC address resolution. Generally, the ARP query method is sufficient to resolve all MAC addresses in a local subnet. However, if you also require to discover those behind the router, enable the NetBios query and Router SNMP MIB query methods and place them first and second in the list. Double-click a method to access its additional configuration parameters.
• Resolve IPv6 addresses - enables the network scanner to obtain the IPv6 address of a remote host. This feature requires Windows Vista or above and discovers addresses of hosts with a dual IPv4/IPv6 stack.
• Lookup network card vendor - as per the IEEE standard, the first three octets of a MAC address represent the NIC's vendor. In order to use this feature you will need to download this file from the IEEE and save it to the network scanner folder.
• Retrieve monitor information - displays monitor vendor, model and serial number if available. This feature requires the remote registry service as the information is read from the registry.
• Grab HTTP server banner - displays web-server software name and version if a web-server is running on a remote host.

On the Ports tab:

• Check for open TCP ports - attempts connection to the specified TCP ports and reports those open (you can specify several ports separated by a comma or dash, e.g. 21, 80, 110-115).
• Check for open UDP ports - discovers some UDP-based services such as DNS, TFTP, NTP, NBNS.

On the Workstation tab:

• Lookup LAN group - displays the workgroup/domain name which a Windows workstation belongs to.
• Lookup Windows version - displays the Windows version on a workstation.
• Enumerate user accounts - lists all user accounts registered on a remote computer.
• Lookup logged-on users - displays a list of users currently logged-on to a Windows workstation.
• Lookup remote Time and Date - Retrieves and shows the time of the day on a remote system.
• Retrieve list of disk drives - Lists all disk drives available on a remote computer.
• Retrieve computer uptime - Shows how long a remote computer was up and running.
• Retrieve assigned comment - displays a comment assigned to a Windows workstation.
• Lookup server type/roles - displays all roles (e.g. PDC, SQL server, Master Browser) assigned to a server.

See the rightmost columns on the main screen once you have enabled one or more options.

• Scan for shared resources - enables scanning of shared resources. Below are all the possible types of shared resources.
• Check for write access - determines if the shared folder is writable or not (read only).
• Enable security & user permission scan - with this option enabled, the network scanner will discover what reading and writing privileges are assigned to shared folders. You may have to be an administrator to retrieve this information.
• Determine disk space - determines shared folders' total and free space.
• All - all resources.
• Folders - shared folders or drives.
• Printers - shared printers.
• Comm. device - communication devices.
• Administrative shares - special share reserved for remote administration of the server, e.g. ADMIN$, C$, D$, E$, etc.
• IPC - interprocess communication (IPC).

The Applications tab extends support for third-party applications. For example, if you use remote administration or specific network client software, you can setup the network scanner to connect to a remote host using the additional software directly from the network scanner.

Should you require to pass extra arguments upon launching an application, you can use user-prompted parameters specified in braces. It is also possible to specify a default value after a colon. If the parameter name contains the "file" or "path" string, there will be a button allowing you to choose a file or a directory respectively. As an example, the following line lets you quickly execute commands on the remote system with PsExec.

psexec.exe \\%0 -u {User name:Admin} -p {Password} {Command}

Launching this command will bring up a window where you can specify the arguments to pass to PsExec as shown below. Then the network scanner will launch PsExec with your input.

Since the network scanner interprets braces as user-prompted parameters, you may have problems with passing a value containing braces, for example a GUID. In this case double the braces, e.g. myapp.exe {{12345678-ABCD-EFGH-1234-567890ABCDEF}}, so that this value will not be treated as a user-prompted parameter.

If you have got many applications to launch and some require common parameters such as a user name and password, you can define these as global variables. Click Advanced at the Applications tab to open the variables editor. A value can be either plain text or an environment variable, whose contents you can pass to applications.

Finally, the Browsing tab enables the network scanner to check whether a host is still on-line when you attempt to explore its folders, or establish a connection to that host. This greatly speeds up some operations, as an attempt to connect an off-line computer might temporarily hang the network scanner until the connection fails You can enable one or more methods to check the availability and set a timeout. Additionally you can choose a live display mode, whether the network scanner must only find previously undiscovered nodes in background, or it must keep rescanning those already discovered, or it must do both. Don't forget to turn the live display on in the main menu View - Enable Live Display.

IP range and automatic detection of network configuration

The SoftPerfect Network Scanner is able to detect your IP range automatically. Select the Options - IP Address - Detect Local IP Range menu item. In the following dialog, select an interface and the program will calculate the IP range of the network. If you are connected to the Internet and are behind a router or proxy server, use the Detect External IP Address command to determine your external IP address (requires Internet connection).

In this example SoftPerfect Network Scanner has determined the range of IP addresses on the network. You are good to go!

You can add more IP address ranges to scan with the button.

The interpretation of your IP address range depends on the state of the button. If the button is up, the range is interpreted as a regular one. In this case the program will sequentially scan all IP addresses within the range. If it is down, the range is interpreted as a noncontiguous one. In this case the program will only scan IP addresses whose octets fall in the range. For example, if you specify a range of 10.1.254.1 to 10.9.254.5, the following octets will be scanned:

Octet 1: 10 - 10
Octet 2: 1 - 9
Octet 3: 254 - 254
Octet 4: 1 - 5

Therefore, the program will scan

10.1.254.1, 10.1.254.2, 10.1.254.3, 10.1.254.4, 10.1.254.5
10.2.254.1, 10.2.254.2, 10.2.254.3, 10.2.254.4, 10.2.254.5
10.3.254.1, 10.3.254.2, 10.3.254.3, 10.3.254.4, 10.3.254.5
...
10.9.254.1, 10.9.254.2, 10.9.254.3, 10.9.254.4, 10.9.254.5

This can be useful if you have got a large network and you want to scan specific devices in each subnet.

Scanning

To begin scanning click the Start Scanning button

Scan results

When scanning has finished, you will be able to browse the results, save to a file, map a network drive, explore folders, etc.

Live display

If you enable the Live Display option (choose View - Live Display from the main menu), the network scanner will constantly update scan results to reveal the latest changes in the network. If a new host joins or leaves the network, it will be reflected in the main window. There is also a live display log keeping track of computers joining and leaving the network. When the live display is active, choose View - Show Live Display Log from the main menu to access it.

You can specify what happens when a computer joins or leaves the network. If the Notify me... option is ticked, a balloon will popup in the notification area. In addition you can choose one or more actions in the settings: play a sound, launch another application or save the event to a file. It is also possible to pass the contents of any column to the application by specifying it in the square brackets as shown below. There is also a pseudo column [event] that you can refer to. It contains the event type, i.e. join or leave.

Rogue DHCP server detection

There is a built-in tool searching for active DHCP servers in a LAN segment. It does not require a scan as such. Instead it broadcasts a DHCP discovery message and collects replies from all available DHCP servers. These may be either normal DHCP servers, or rogue servers that are not under administrative control of the network staff. The latter may disrupt connectivity or may be used for network attacks.

In order to see all active DHCP servers, choose Actions - DHCP Server Discovery from the main menu. In a few moments, you will see a list of all the servers along with offered DNS and gateway addresses.

UPnP device detection

Furthermore, the application can discover Universal Plug and Play (UPnP) devices in your network such as media servers, routers and printers. Similarly to the DHCP discovery, it broadcasts a UPnP discovery message and collects replies from compatible devices. In order to see your UPnP devices, choose Actions - UPnP Device Discovery from the main menu. Click a Device User Interface URL to access the device.

Wake-on-LAN and remote shutdown

To send a 'magic' wake up packet to a remote computer (its MAC address must be known), choose Actions - Wake-On-LAN from the main menu. To shutdown or reboot a remote PC, choose Actions - Remote Shutdown. You can also suspend or hibernate a remote computer by choosing Actions - Remote Suspend/Hibernate.

In order to shutdown or suspend a remote computer, several criteria must be met:

• Administrative shares are enabled.
• Administrator has got a non-empty password.
• Simple file sharing is turned off.
• Administrative shares IPC$ and ADMIN$ are accessible.

Otherwise you may encounter either the error Access is denied or Network path not found.

WMI Query builder and scanning

The network scanner is capable of running WMI (Windows Management Instrumentation) queries against hosts being scanned. In order to create a WMI query, choose Options - WMI from the main menu. Queries are written in a special language called WQL, similar to SQL.

The New button allows you to easily construct simple WQL queries. It merely connects to your computer's WMI subsystem and lets you pick a WMI class and parameter to be used in the query. When you have one or more WMI queries enabled, there will be additional columns shown in the scan results.

Remote file, registry and services

Firstly, the application can connect to the remote registry of remote PCs running Windows, provided the remote registry service is started. Secondly, it can also connect to the their file system via administrative shares (C$, D$, E$, etc) and retrieve information about a specific file. Thirdly, it can connect to the remote service manager and query the status of one or more service. These features are useful mainly for network administrators maintaining large networks and can be accessed by choosing Options - Remote Registry, Options - Remote File or Options - Remote Services from the main menu.

There are several predefined entries in the list and you can easily add new items to retrieve data about hardware and software specific to your environment. The columns are as follows: Item Name is a name of the entry. Root represents one of the root registry hives. Registry key contains the path to a value of interest. Parameter Name is the value name to be retrieved. Finally, Local Value merely shows the value in the local registry on your computer. On this screenshot three items are chosen to be retrieved from remote computers.

Likewise, provided the administrative shares are enabled and accessible, you can pull out information about a specific file or folder on remote computers. For example, you want to find out the version of Internet Explorer, or when a log file changed, or how large a particular file is. To do so, enter the full name of a file and choose what property you would like to retrieve.

On the following screenshot, the application is configured to access the Internet Explorer executable and display its version. Drive letters get substituted to the relevant administrative shared folders. For example, if you scan a range of 10.0.0.1 to 10.0.0.10 with these settings, the application will attempt to display the version information embedded in the files \\10.0.0.1\C$\Program Files\Internet Explorer\iexplore.exe, \\10.0.0.2\C$\Program Files\Internet Explorer\iexplore.exe, etc.

It also possible to use wildcards, for example C:\Program Files\Internet Explorer\*.exe will process all executable files in C:\Program Files\Internet Explorer.

Furthermore, you can have variable parts in path names, which is especially useful in a multilingual environment. If you have a few possible locations for your file, list them in the brackets and separated by a vertical bar, as in the following example: C:\[Program Files|Program Files (x86)|Programme]\Internet Explorer\iexplore.exe. In this case, the network scanner will try three different paths C:\Program Files\Internet Explorer\iexplore.exe, C:\Program Files (x86)\Internet Explorer\iexplore.exe, C:\Programme\Internet Explorer\iexplore.exe and proceed with the first valid one.

Lastly, you can retrieve information about the status and configuration of a service on remote computers. For example, if you want to make sure that the messenger service is up and running, turn the pre-defined item on as shown below. The network scanner will then connect to each computer's service manager and query the information requested.

There will be additional columns showing the information retrieved.

Remote SNMP query

Network scanner can look for machines that have an SNMP service running. You can specify a community (e.g. public or private) and a MIB OID number. The application automatically determines the type of data received and displays it in a readable form.

Remote groups query

If you need to find out what users participate in a particular group, or what groups a user belongs to, you can use this feature. The network scanner connects to each computer and retrieves local or global group membership.

Remote XML

There is an advanced feature to obtain device configuration and status. It allows you to send a HTTP request and parse a XML response. It works virtually for any device that has got a built-in web-server that produces XML output. For example, there is a couple of default entries to retrieve HP Integrated Lights-Out properties.

Tips and tricks

• When clicking a bookmark in the network scanner's main menu, the current IP addresses will be replaced with those assigned to the selected bookmark. Hold the Ctrl key to append them instead. The same applies to choosing one or more IP addresses in the automatic IP address detection dialog.
• It is possible to group bookmarks or custom applications that you define within the network scanner. Specify a vertical bar to create groups of items. For example, try naming your bookmarks as Network A | Subnet 1, Network A | Subnet 2 or naming your applications as FTP clients | FileZilla, FTP clients | Total Commander.
• If it appears that all IP addresses are detected as active, set the Ping Method to ICMP only. This is happening because when you are scanning a different subnet, the default gateway may respond to every ARP request with its own MAC address rather than the target device's address, thus misleading the network scanner.
• You can change any column's background colour and text colour for easy identification. In order to do so, right click a column's header and choose Change Column View.
• If you want to send Wake-On-LAN packets to a subnet specific broadcast address, change the default broadcast address to 0.0.0.255. In this case, when you are adding a computer to wake up from the main view, the actual computer's IP addresses will be merged with the default address. For example, when adding 192.168.1.10 and the default broadcast address being 0.0.0.255, a new WOL entry will have 192.168.1.255.

Command line switches

You can use the following switches as netscan.exe /switch1 /switch2 ... switchN.

/auto:filename.[txt|htm|xml|csv] runs scan with global settings and exports the results to a file, i.e. /auto:"c:\desktop\result.txt". Specify a corresponding extension to produce a file of that type. For example:

netscan.exe /hide /auto:"c:\desktop\result.txt"
netscan.exe /hide /auto:"c:\desktop\result.htm"
netscan.exe /hide /auto:"c:\desktop\result.csv"

In order to run a scan automatically without exporting to a file, specify /auto: with a colon, but without a file name. It is also possible to have the current date and time in the file name. Use any combination of the following tokens each enclosed between two percent signs: y, yy, yyyy, m, mm, mmm, mmmm, d, dd, ddd, dddd, h, hh, n, nn, s, ss. For example date_%yyyy%%mm%%dd%_time_%hh%%nn%.csv.

/live:filename.[txt|htm|xml|csv] is similar to the above switch. Unlike the /auto switch, the /live switch leaves the network scanner on and enables the live display. The specified file is updated after every complete round of the live scan, so the file always reflects latest changes.

/config:filename.xml loads the specified XML configuration file in the application.

/hide does not show the main window (silent mode).

/load:filename.xml loads the specified XML result set in the application. It is possible to rescan it with the /auto switch.

/cols:col1;col2;col3 applies to the /auto command and exports only the specified columns to a file. Otherwise all visible columns are exported. Example: /cols:"Host Name;MAC Address".

/range:From-To Sets an IP address range for scanning, for example: /range:192.168.0.1-192.168.10.254. In order to pass a noncontiguous IP address range, specify the circumflex sign, for example /range:^10.64.1.1-10.64.5.10.

/append applies to the /auto command for text and CSV files. Appends the results to a file rather than overwrites it.

/wol:MAC sends a Wake-On-LAN magic packet to the specified MAC address and immediately exits. Example: /wol:AABBCCDDEEFF.

/wolfile:filename.txt allows you to specify a text file with MAC addresses to wake-up, e.g. /wolfile:c:\myfile.txt where the file is a plain text file containing one MAC address per line.

/wakeall sends a WOL packet to all computers configured in the WOL manager and immediately quits.

The two switches below are mutually exclusive and have no effect if the application is launched from a USB stick or other removable device.

/ini forces the scanner to load and save its settings to an INI file instead of the registry by default (see a note below). This switch is obsolete.

/xml forces the scanner to load and save its settings to a XML file instead of the registry by default. However, when the network scanner is launched from a removable drive, such as a USB stick, it does not use the registry. Instead, it stores settings in a XML file, so you need not specify this switch to make it portable. Also, If you used the /ini or /xml switch once, you need not specify it every time. After first use the application will create a configuration file on the disk and will use that file rather than the registry in the future.

/maxcols:N allows to display more columns for certain multi-column queries. The default value is 10, however you may want to increase it to see more than 10 columns of the same type at once.

/file:filename.txt loads the specified text file and feeds in IP addresses to be scanned. Another way to do this is to choose File - Import IP/Host Name List from the main menu. There must be one address or range per line in one of the following notations. Any mismatching lines in the file will be discarded.

Line	Example	Intrerpretatioin
x.x.x.x	10.0.0.1	Plain IP address
x.x.x.x-y.y.y.y	10.0.0.1-10.0.0.255	IP address range
x.x.x.x/y	10.0.0.1/24	IP address/mask
x.x.x.x/y.y.y.y	10.0.0.1/255.255.255.0	IP address/dotted mask
hostname	google.com	Host name (will be resolved to an IP address)

Product Page / Download