Discovery and device inventory
Use the Devices page to search your inventory, review newly found devices, and follow address changes.
What gets scanned?
Discovery checks only the configured RFC1918 private IPv4 ranges. Supported prefixes are /22 through /32, with up to eight ranges and 1,024 configured addresses per scanner. Overlapping targets are probed once, but configured range sizes still count toward the address budget.
The scanner uses ICMP echo and short TCP connection checks on ports 22, 80, 443, 445, and 3389. Devices that block all discovery checks may not appear. This is discovery, not a vulnerability scan.
Find and review devices
Search by name, MAC, owner, location, or exact IP. Use filters for new devices, trust labels, RMM management, IP changes, and confirmed address types. Lists are paginated so you can work with larger inventories.
Open a device to inspect details and its recent IP history. Technicians and administrators can mark it reviewed and maintain names, owners, locations, tags, and notes. Trusted and blocked are inventory review labels; they do not configure a firewall or block network access.
Device identity and IP changes
When a scanner observes the same MAC address at a new IP, Network can keep the device record and record the address change. Identity is scoped to the scanner. Different scanners may report the same physical device separately.
MAC visibility normally depends on local neighbor information and often stops at routers. Without an observed MAC, discovery may use IP identity, so an address change can produce a separate record. Shared or ambiguous MACs are labelled rather than silently merging unrelated devices.
Vendor, hostname, and operating system
Reverse DNS can provide names. A bundled IEEE registry can identify the registered vendor for a globally assigned MAC prefix. This identifies an address registration, not necessarily the exact device manufacturer or model. Private or locally administered MAC addresses do not claim a registered vendor.
OS and device-type hints depend on available observations, such as ports and optional SNMP responses. Unknown remains Unknown when evidence is insufficient. Missing vendor details do not necessarily mean the scan failed.
DHCP versus static
Network shows confirmed evidence only. The Windows scanner can report assignment evidence for its own adapters. It does not guess other devices' address types from how often an IP changes. DHCP server integration is not included.
Presence and last seen
Seen means observed during the last completed scan, not guaranteed online now. Scanner connectivity is a separate status. Failed or partial scans are not reliable evidence that a device is missing.
Link to Sherlock RMM
Unambiguous exact MAC matches can link devices in the same organization. Manual linking requires Network technician or administrator access and RMM access. Matching names or IP addresses alone do not automatically connect unrelated records.
Continue with maps, gateways and VLANs or monitoring and alerts.