It is basically how MAC address resolution works in networking. As you know, there are 4 related settings in the Network Scanner:
- ARP query (address resolution protocol). This method always works in a local subnet, but does not work with a non-local subnet. The reason is that routers do not pass ARP messages from one subnet to another.
- NetBIOS query. This method sends a special NetBIOS packet to a target computer, which works for both local and non-local subnet. The downside here is that only the computers that have the NetBIOS protocol will respond with their MAC address.
- Router SNMP MIB. This method queries router ARP tables. As the router sits between two subnets, it knows clients MAC addresses on both sides. So it works for both local and non-local subnets. The router may need to be specially configured to provide this information via SNMP.
- WMI query. If you are running the application under a domain admin account, it may be possible to connect to every computer's WMI system (Windows only) and retrieve the MAC address.
All in all, I am afraid there is no universal way to resolve MAC addresses from a different subnet. Depending on your environment, methods 3 and 4 may work bearing in mind the requirements outlined above.