NetScanner
Support & FAQ
Everything worth knowing before you buy, and the things people hit afterwards — including the awkward ones about running a scanner on a managed network.
Before you buy
What do I need to run it?
64-bit Windows 10 or 11. It runs as a standard user — no administrator or root, no packet-capture driver such as Npcap or WinPcap, and no database server. A self-contained build needs no .NET runtime installed.
Am I allowed to scan my network?
That is yours to establish, and it is not a formality. Scan only networks you own or have been authorised to test. On a corporate network, get that authorisation in writing before you run anything — including a first test scan.
The app asks for a one-time acknowledgement on first run, warns before scanning outside RFC1918 private address space or a range over 65,536 addresses, and refuses anything above roughly a million addresses outright.
What does it actually put on the network?
ICMP echo requests; TCP connect attempts to a curated set of roughly 100 ports; SSDP, mDNS and NetBIOS name queries; DNS and SNMP requests; and, on hosts with a web server, one benign HTTP request and a TLS handshake to read the certificate. It captures no traffic and injects no raw packets.
Nothing it sends is an exploit or an authentication attempt. If your security team needs the detail before approving it, the deployment notes shipped with the product are written to be forwarded to them as-is.
Will it set off our intrusion detection?
Quite possibly, and that is expected — a port scan looks like reconnaissance because it is reconnaissance, just authorised. Tell whoever watches the alerts before you start. Polite pacing is gentler and less likely to trip detection.
Is it a subscription?
No. One payment, no account, no licence server, no seat count, nothing expires.
Can I get a refund?
Refunds are handled through Gumroad under their buyer refund policy.
After you buy
Where is my download?
Gumroad emails a receipt with a download link immediately after purchase, and the file stays in your Gumroad library. Check spam if it has not arrived.
My antivirus quarantined it.
This is the single most common thing people hit, and it is not a false alarm in the usual sense: a port scanner is behaviourally indistinguishable from reconnaissance malware, so heuristic detection reacts to what it does rather than to anything wrong with the file. Windows SmartScreen will also warn on first run, as it does for any executable without established download reputation.
Verify the download against the published hash, then add an exclusion for the executable. If your endpoint protection is centrally managed, this needs your IT team — which is the same conversation as the authorisation one above.
Closed ports are being reported as filtered.
A VPN or endpoint security filter in the path can make TCP refusals take seconds to arrive rather than milliseconds. Switch to Polite pacing, which allows a 3-second connect timeout.
A device I know exists is not showing up.
Check the range first, then the network path — discovery cannot cross a router that drops the probes, and a client-isolation setting on wireless will hide devices from each other by design. If it appears with only ARP in the Found by column, it is present but answering nothing else.
A host is greyed out.
That is a stale record — it was found on a previous scan and did not answer this time. Stale hosts are kept rather than deleted, and only become gone after several consecutive misses, so a device that was merely asleep does not vanish from your inventory.
How do updates work?
The app never updates itself and never checks for updates. New versions appear in your Gumroad library and Gumroad emails you.
Known limitations
Stated plainly, so you can decide before you pay rather than after.
- Windows only. It runs on Windows 10 and 11, 64-bit, and nothing else.
- Results are evidence, not proof. A host that did not answer may still be there. An open port is what was observed at that moment, from where you were standing.
- It is a connect scanner, not a packet sniffer. No raw sockets, no SYN scanning, no passive capture — which is exactly why it needs no driver and no administrator rights, but it also means it cannot see traffic it did not cause.
- Discovery stops at the broadcast domain for some signals. ARP, SSDP, mDNS and NetBIOS do not cross routers. Off-subnet ranges are found by ICMP and TCP only.
- Vendor lookup is only as good as the OUI table. Randomised MAC addresses — normal on modern phones — have no vendor, by design.
- Hard ceiling above roughly a million addresses. This is a refusal, not a warning, because exhausting memory mid-scan would discard the results already gathered.
- The executable is not code-signed. See the antivirus answer above.
Still stuck?
Support runs through Gumroad’s contact form on the product page. Using Gumroad means your message arrives attached to your purchase, so there is no licence key to dig out.
Tell me the range you scanned, the pacing mode, what you expected and what appeared instead. Please do not paste real host names, addresses or certificates from a network you do not want described in an email.