GitHub killertools.net

KillerScan

~/killerscan
$ killerscan --scan 192.168.1.0/24

found 47 hosts in 3.2s
probed 12 open ports across 6 services
identified 38 vendors via MAC OUI
classified printers, switches, APs, endpoints

Optional installer. No agent. No account. No telemetry.
Free. Open. GPLv3. Built by a field tech, for field techs.

$
Download for Windows (.exe)
Windows 10/11 x64 · .NET Framework 4.8
$ KillerScan v1.4.0 · updated 5/16/2026
SHA25661CCE53F8CEBEB06B26DF7D6AED8A6B386789122814DCD1BBB4CB1E561D8B924
Now open source under GPLv3. View on GitHub →

What it does

ARP + Ping Discovery

Dual-method host detection catches devices that don't respond to ICMP, including IoT devices and firewalled endpoints.

Port Probing

Parallel scan of common service ports (SSH, RDP, SMB, HTTP, printing, hypervisor, NAS) with 200ms timeout per port.

Vendor Identification

MAC OUI lookup against the IEEE database identifies device manufacturers -- printers, switches, APs, IoT, and more.

Device Classification

Automatic typing via hostname keywords, OUI vendor, and port fingerprinting. Right-click to manually override any device type.

Export

Export scan results as CSV or HTML report. Right-click any device to copy IP, MAC, hostname, or launch RDP/SSH/browser.

Self-Installer or Portable

Run it straight from the EXE for a portable no-install experience, or let it install itself to %LOCALAPPDATA% with a Start Menu shortcut. No runtime, no admin rights, no dependencies.