Tech stack

KillerScan is a native Windows app. There is no Electron, no browser engine, no runtime to install, and no separate scanner program running behind the scenes. Everything listed below ships inside a single .exe that runs on its own:

Install & data

KillerScan is a single .exe. Put it anywhere and run it as is, or use the built-in installer. By default it installs just for you: the app is copied into your user folder, with a Start Menu shortcut and a normal Windows uninstall entry registered for your account alone, needing no admin rights, no .NET runtime, and nothing else installed. Tick Install for all users in that prompt and it goes to Program Files for every account on the PC instead, which is the one case where Windows asks for permission. When you run it from outside its installed location, a PORTABLE badge and an Install KillerScan... button appear in the status bar.

Keyboard & app size

KillerScan is small enough that it does not need a drawn keyboard map, so it keeps to ten shortcuts and they work wherever the focus happens to be, including inside the results table. Press F1 at any time to see the same list inside the app. Ctrl+F and Ctrl+A keep their usual meaning while you are typing in the subnet or filter box.

Those last three set an app-wide size rather than zooming the results table on its own. Everything between the title bar and the status bar grows or shrinks together, and the text is laid out again at the new size instead of being stretched, so it stays sharp. The size is remembered between runs. You can also do it with the mouse: hover over the KillerScan wordmark in the title bar and roll the wheel, which moves in finer steps of two percent. Either way the range is 70% to 250%.

The scan pipeline

A scan runs in two stages. First KillerScan finds every device that is switched on and connected. Then it takes a closer look at each of those devices at the same time. Doing it in that order means the slow, detailed work only happens for addresses that actually replied, which keeps the whole scan fast.

Phase 0: building the address list

You give KillerScan the addresses to check, and it accepts more than one at a time: a subnet in the usual shorthand like 192.168.8.0/24 (that "/24" simply means the block of 256 addresses on your local network), a single address like 192.168.8.10, a full range like 192.168.8.10-192.168.8.50, or the short form of that same range, 192.168.8.10-50. Separate as many of those as you like with commas; stray spaces around them are ignored rather than treated as a mistake. KillerScan turns the lot into one list of addresses worth testing, dropping duplicates where the entries overlap, and tells you rather than trying it if the total comes to more than 65,536 addresses. It also reads three things from your active network connection: your own address, your router's address (the gateway), and the DNS server you are set to use. Those are passed to the classifier so the router can be labeled correctly later on.

Phase 1: discovery (who is out there?)

Three things happen at roughly the same time:

• Reading the ARP cache. Windows keeps a small table that matches recently seen addresses to the hardware ID (the MAC address) of each device. ARP is the protocol that builds that table. KillerScan reads it first to get an instant list of devices Windows has talked to lately.
• Ping sweep. KillerScan pings every address on the list at once, where a ping is just the "are you there?" message that the ping command sends. It keeps around 200 going at a time and gives each one half a second to answer, so a typical home network finishes in a couple of seconds. Any address that stays quiet then gets a second chance: KillerScan quietly tries to open a connection on a few common ports (file sharing, remote desktop, web, SSH), and if any of them answers, the device still counts as present. That picks up machines set to ignore pings, and devices reached across a VPN, where the hardware-level ARP trick below cannot see them at all.
• A second ARP read. Many devices ignore pings but still respond at the lower hardware level, including a lot of phones, tablets, and smart-home gadgets. The pings quietly prompt Windows to record those devices in its table, so reading it again right after the sweep catches devices the ping alone would have missed. A direct hardware request fills in anything still missing.

At the same time, KillerScan sends out two broadcast questions that many devices answer automatically. The first is mDNS (also called Bonjour), which Apple devices, printers, and Chromecasts use to announce themselves on a network. The second is SSDP (part of UPnP), used by smart TVs, media players, and similar gear. KillerScan listens a short, fixed time for each (about a second and a half) and matches every reply back to the device that sent it. Because the listening windows are short, this finishes about when the ping sweep does and the scan stays quick.

Once the live devices are known, KillerScan looks up each one's MAC address, the hardware ID it uses to name the maker. There is a catch on routed networks: a MAC address only travels within your local network segment, so for a device reached through a router or a VPN, Windows hands back the address of the tunnel or gateway instead of the device's own. Left unchecked, every device on the far side of a VPN would share one address and all be mislabeled as the same maker (a Fortinet SSL VPN connection is a common example). KillerScan spots this by discarding any MAC that turns up for several different addresses at once, treating those devices as having no reliable hardware ID and identifying them from their ports and services instead.

Phase 2: taking a closer look at each device

Every device found in Phase 1 is now examined at the same time, with a sensible limit so a large network does not try to open thousands of connections at once. For each device, KillerScan:

• Checks a short list of network ports to see which are open. A port is like a numbered door into a device, and each common service (web, file sharing, remote desktop, and so on) sits behind a known door number. Each check is given a fifth of a second.
• Tries to find the device's name. It first asks DNS for the name attached to the address, and if that comes back empty it falls back to the name the device announced over mDNS, then to its older Windows (NetBIOS) name.
• Gathers identifying clues from anything that answers: the title and server type of any web page it serves, the greeting text an SSH login returns, the name on its security certificate, its Windows name, and its SNMP description (a standard "what am I" line that network gear and printers report). It also notes the TTL, a small number attached to replies that hints at the device's operating system.
• Looks up who made the device from its hardware ID, and attaches the mDNS and SSDP details gathered back in Phase 1.

Only once all of that is collected does KillerScan decide what the device actually is, weighing every one of those clues together.

Ports probed

Rather than testing all 65,000 possible ports, KillerScan checks only the handful that genuinely tell you something about what a device is:

Vendor resolution

Every network device has a MAC address, a hardware ID built in by its maker. The first half of that ID is assigned to a specific manufacturer, so it is the strongest clue to who built the device. A plain lookup is not always enough on its own, so KillerScan works through a fixed set of rules and uses the first one that matches:

1. Brand overrides

Some makers register their address ranges with the IEEE (the body that hands them out) as "Private", or leave them unnamed, so an ordinary lookup returns nothing useful. KillerScan keeps a small table, maintained by hand, that maps those ranges to the real brand. Several Govee ranges are handled this way, for example, so the device shows the right name even when the official record will not.

2. Randomized MACs

Modern phones regularly invent a fake Wi-Fi address to protect your privacy (Apple calls this "Private Wi-Fi Address"; Android does much the same). These made-up addresses carry a marker showing they were not handed out by a real manufacturer. Rather than guess a brand from an address that only matches by coincidence, KillerScan simply labels the device (Randomized), which is the honest answer: the real maker is hidden.

3. Most-specific match first

The IEEE hands out address ranges in three sizes, and a small manufacturer can be given a slice of a larger range, sharing its opening digits with the bigger company that owns the parent range. To avoid crediting the wrong one, KillerScan always checks the smallest, most specific range first:

A 9-digit match beats a 7-digit match, which beats a 6-digit match, so the smaller, more specific owner always wins over the larger company that holds the parent range.

The database itself

The full IEEE manufacturer list, roughly 57,000 entries across all three registries (MA-L, MA-M, and MA-S), ships inside the .exe, so manufacturer names appear instantly and without any internet connection.

You can update it to the latest data from inside the app. The About screen shows how many entries you have and when they were last refreshed, with a one-click update that downloads the newest list. The update is built so it can never leave you worse off: if a download is blocked or incomplete, a safety check refuses to replace your list with a smaller one, so an update can never wipe out or shrink what you already have.

Device classification

Working out what a device is uses a points system rather than a single rule. Every clue (its name, its maker, its open ports, the banners its services return, and the mDNS and SSDP details) adds points to the device types it fits, and the type with the highest score wins, as long as it clears a minimum. A few clues are so reliable that KillerScan acts on them straight away, before any scoring. The order is:

Gateway, DNS, and three honest labels

The device sitting at the gateway address is your router. Routers often pass along DNS traffic (port 53), which used to make them look like the DNS server even when they were not. KillerScan only calls the gateway Router/DNS when it really is the DNS server your computer is set to use. If DNS is handled by a separate machine, the gateway stays labeled Router and that machine is labeled DNS Server. That gives three honest labels instead of one wrong guess.

Weighted signals

The more specific a clue, the more points it is worth. Here is a rough guide:

Some clues deliberately ignore the maker. Port 62078 (used to sync iPhones) counts toward iPhone no matter what the address says, so an iPhone hiding behind a randomized address is still spotted. Networking gear that gives no sign of being a specific router or switch is labeled Switch/AP.

When nothing scores

A device that is idle or locked down may answer at the hardware level and nothing else. Rather than give up, KillerScan makes its best honest guess, working down this list:

That rule about PC makers exists for a real situation: a small business desktop in modern standby still answers at the hardware level but refuses every incoming connection. Without the rule, the catch-all would label your Dell a smart-home gadget.

Deep rescan: one host, in depth

The normal scan is tuned to sweep a whole network quickly, so it checks each device with a short list of common ports and only gives each one a brief moment to answer. When you want everything about one machine instead, select it in the results (hold Shift or Ctrl to pick several) and right-click to choose Rescan. That runs a much more thorough probe against just the hosts you picked, and drops the refreshed result straight back into its row.

On a deep rescan, KillerScan:

• Checks every well-known port from 1 to 1024, plus its curated list of higher service ports, rather than the short common-port list the sweep uses, so a service listening somewhere unusual is not missed.
• Gives each port more time to answer and tries once more if it stays quiet, so a slow or busy device that the fast sweep skipped over still shows up.
• Re-reads the device's hardware ID, name, and TTL from scratch rather than reusing what the first pass found.
• Runs the full set of fingerprint probes, and widens the web-page and security-certificate checks to every open port instead of only the standard web ports, so an admin panel or certificate sitting on an unusual port is still read and identified.
• Re-scores the device type from the refreshed clues and updates that device's row in place.

Because it favors thoroughness over speed, a deep rescan takes a few seconds per host, so it is meant for spot-checking specific devices rather than re-running the whole network.

Privacy & footprint

Everything happens on your own machine. There is no account, no background agent, no cloud lookup, and no usage tracking. The vendor database is built into the app, so even manufacturer names are looked up offline. Nothing about your network ever leaves your computer.

The one thing you may notice the first time you scan is a Windows Firewall prompt. That is the mDNS and SSDP discovery asking to listen for replies, which it has to do in order to hear Chromecasts, printers, and similar devices. Allow it on private networks and you will not be asked again. Deny it and those two discovery methods simply find nothing, while the rest of the scan carries on as normal.

Glossary

Plain-language definitions of the networking terms and abbreviations used on this page, in alphabetical order.