← All Docs

Network Scanning & Reconciliation

IPAM records rot the moment reality drifts. Scan reconcile compares what's actually live on your network against what's documented — using tools you already have, with nothing to install and no agent to trust.

How It Works

1. Run a scan on a machine connected to your network (three methods below), or export a client list from your router or DHCP server
2. Open the subnet in IPCraft and click Scan in the address list header
3. Paste everything your tool printed — the format is detected automatically
4. Review the preview: which records were confirmed live, which live hosts are undocumented, and which records weren't seen
5. Click Apply

Applying a scan does three things:

• Confirms matched records — each documented address seen in the scan gets a "last seen" timestamp
• Backfills blanks — if the scan saw a hostname or MAC and the record has none, the blank is filled in. A scan never overwrites what you documented: a differing MAC is flagged as a possible conflict, not changed
• Creates records for undocumented hosts (optional) — live hosts with no record are created as assigned, with whatever hostname and MAC the scan provided

Method 1: Built-in Commands (Nothing to Install)

Every OS ships with ping and arp. A ping sweep populates your machine's ARP table; arp -a then dumps every neighbor with its MAC address. Run the one-liner for your OS, replacing 10.0.0 with your subnet's first three octets, then paste the whole output.

macOS

for i in {1..254}; do ping -c1 -t1 10.0.0.$i >/dev/null 2>&1 & done; wait; arp -a

Linux

for i in {1..254}; do ping -c1 -W1 10.0.0.$i >/dev/null 2>&1 & done; wait; ip neigh

Windows (PowerShell)

1..254 | % { ping -n 1 -w 200 "10.0.0.$_" | Out-Null }; arp -a

These commands only send pings and read your machine's own neighbor table — nothing on the network is changed. They're short enough to read in full before running, which is the point: you never have to trust a downloaded binary.

Method 2: nmap (Best Results)

If you have nmap installed, a ping-scan gives the richest output — hostnames, MAC addresses, and vendor names, and it handles any subnet size:

nmap -sn 10.0.0.0/24

Paste the normal output directly, or save XML and paste that instead (both are recognized):

nmap -sn -oX scan.xml 10.0.0.0/24

• Run with sudo on macOS/Linux to include MAC addresses (ARP scan needs raw sockets)
• Works across routed subnets too — you'll get liveness without MACs for remote networks

Method 3: DHCP Server & Router Exports

Often the most accurate inventory already exists in your DHCP server — no scanning required. IPCraft understands the native lease formats directly:

dnsmasq (Pi-hole, OpenWrt, many routers)

cat /var/lib/misc/dnsmasq.leases

Paste the file contents as-is. Expired leases are skipped automatically.

ISC dhcpd

cat /var/lib/dhcp/dhcpd.leases

The lease file is an append-log — an IP can appear several times. IPCraft folds duplicates and keeps only each lease's current state, importing only binding state active entries.

Kea

Paste the memfile lease CSV (e.g. /var/lib/kea/kea-leases4.csv). Declined and expired-reclaimed leases are skipped.

Windows DHCP Server

Get-DhcpServerv4Lease -ScopeId 10.0.0.0

Paste the table output directly. Rows in Active or ActiveReservation state are imported; expired and declined leases are skipped. Classic netsh dhcp server scope ... show clients output works too.

Router client lists (UniFi, pfSense, and friends)

Export or copy your router's client list as CSV — any file with a recognizable IP column (plus optional MAC and hostname columns) is parsed, whatever the exact header names. Copy-pasting a status page table of IP  MAC  hostname rows also works.

Supported Formats

Paste	From	Provides
arp -a	Windows, macOS, Linux	IP + MAC (+ hostname on macOS/Linux)
ip neigh	Linux	IP + MAC, IPv4 and IPv6
ndp -an	macOS	IPv6 neighbors: IP + MAC
nmap normal or XML (-oX)	any OS	IP + hostname + MAC
ping replies	any OS	IP liveness
dnsmasq / ISC dhcpd / Kea leases	DHCP servers	IP + MAC + hostname
Get-DhcpServerv4Lease, netsh	Windows DHCP	IP + MAC + hostname
CSV with an IP column	router exports, spreadsheets	whatever the columns hold
bare list of IPs	anywhere	IP liveness

Formats can be mixed in one paste — a ping loop followed by arp -a merges by IP, and junk lines are simply ignored.

Limitations Worth Knowing

• ARP is local. arp -a only sees the subnet your machine is plugged into. For remote subnets, use nmap, a DHCP export, or run the one-liner from a machine on that segment
• Pings can be filtered. A host behind a strict firewall on a remote subnet may not answer — "not seen" means exactly that, no more
• One subnet at a time. The paste is reconciled against the subnet you opened. Entries outside it are counted and ignored, so you can paste the same DHCP export into each subnet in turn
• More specific subnets win. If a parent subnet has children, hosts that belong to a child are excluded from the parent's reconcile — scan the child subnet to update them. In the other direction, a host the parent already has a record for (made before the child existed) is not recorded again in the child
• Container subnets can't be scanned — they hold no address records by design
• 1,000 hosts per apply. One apply writes at most 1,000 hosts: the records it marks seen plus the records it creates. This is the same bulk limit every bulk action has. Entries outside the subnet, in child subnets, or skipped don't count. The preview warns before you apply; paste a larger scan in parts, or untick creating new records if only the matches fit
• IPv6 subnets can't be ping-swept (2⁶⁴ addresses) — paste your machine's neighbor table instead: ndp -an on macOS, ip -6 neigh on Linux, or use a DHCP export

Where the Data Shows Up

• Each record's last seen timestamp appears when you open the address
• Every apply writes one activity log entry with the counts, every address it created, every record it marked seen, and each hostname or MAC address it filled in
• An apply that creates records sends one address.created webhook event for the batch: data.created is the count, data.ips lists every address it created, and resource_id is the subnet’s ID
• Backfilled hostnames/MACs appear immediately in the address list

Ready to try it? Open a subnet in your dashboard and click Scan.