Angry IP Scanner is a network inventory utility that probes a chosen range of IP addresses and records which hosts respond. It can add hostnames, round-trip time, local MAC addresses, selected TCP ports, and other fetcher results, then export the table. Angry IP Scanner observes responses at the moment of the scan. It does not create a permanent device registry, prove ownership of an address, or test every possible port unless the user selects them.
Define the range
A scan begins with a start and end address, a network, or another feeder that generates targets. A small local subnet can finish quickly. A broad range multiplies probes, timeouts, DNS lookups, and port attempts, and can trigger security monitoring.
Scan only networks that the user owns or has permission to inspect. The same packets used for inventory can look like reconnaissance to another administrator. A range typed incorrectly can leave the intended subnet and send traffic to unrelated systems.
Ping is a test
Angry IP Scanner can use several pinger methods. ICMP resembles the ordinary ping command, while TCP or UDP methods infer that a host is alive from another response. Firewalls often block one method while allowing an application service.
A silent ICMP result therefore means that the probe received no qualifying reply, not that the device has no power. Raw-socket ICMP can also require elevated privileges on some systems. Change the pinger or test a known service before treating every silent address as unused.
Fetchers add work
Fetchers decide what Angry IP Scanner collects after host detection. Hostname lookup asks DNS, MAC discovery uses local-network information, and the Ports fetcher attempts the selected TCP ports. Adding more fetchers increases the work per address.
A MAC address generally makes sense only on the same local network segment. Routers hide the hardware address of remote devices. Reverse DNS can return no name or an old name, so the result should not replace an asset record without confirmation.
Ports are selected
The Ports fetcher scans only the numbers entered by the user. An empty or narrow list can report no open ports while another service listens elsewhere. A closed response differs from a filtered timeout, where a firewall may have discarded the probe.
An open port shows that something accepted a connection. It does not prove the service identity or security state. Version detection can make a guess from the response, but proxies and custom banners can mislead it. Verify an important finding with the service owner.
Timeouts shape results
A short timeout speeds a scan across unused addresses but can miss a slow or distant device. A long timeout finds more delayed replies but makes dead ranges take much longer. Thread count adds another tradeoff between completion speed and network load.
Wireless devices can sleep between probes, and rate limits can ignore repeated requests. Run a second scan of uncertain addresses rather than increasing concurrency across the entire network. Compare the time of each scan because DHCP can assign the same address to another device later.
Exports are snapshots
Angry IP Scanner can save results as text, CSV, XML, or an IP-port list. The columns follow selected fetchers, so two CSV exports can have different structures. A script that expects a fixed column order can misread a later export after fetchers change.
An export records one observation, not an automatically updated inventory. Store the scan time and target range with the file. Before comparing two snapshots, use the same pinger, ports, timeouts, and fetchers so that a settings change does not look like a network change.
