← All Docs

Network Scanning & Reconciliation

IPAM records rot the moment reality drifts. Scan reconcile compares what's actually live on your network against what's documented — using tools you already have, with nothing to install and no agent to trust.

How It Works

Run a scan on a machine connected to your network (three methods below), or export a client list from your router or DHCP server
Open the subnet in IPCraft and click Scan in the address list header
Paste everything your tool printed — the format is detected automatically
Review the preview: which records were confirmed live, which live hosts are undocumented, and which records weren't seen
Click Apply

Applying a scan does three things:

Confirms matched records — each documented address seen in the scan gets a "last seen" timestamp
Backfills blanks — if the scan saw a hostname or MAC and the record has none, the blank is filled in. A scan never overwrites what you documented: a differing MAC is flagged as a possible conflict, not changed
Creates records for undocumented hosts (optional) — live hosts with no record are created as assigned, with whatever hostname and MAC the scan provided

Nothing is ever deleted. Records absent from the scan are reported as "not seen" and left untouched — a host can simply be powered off. Reconciliation adds evidence; it doesn't pass judgment.

Method 1: Built-in Commands (Nothing to Install)

Every OS ships with ping and arp. A ping sweep populates your machine's ARP table; arp -a then dumps every neighbor with its MAC address. Run the one-liner for your OS, replacing 10.0.0 with your subnet's first three octets, then paste the whole output.

macOS

for i in {1..254}; do ping -c1 -t1 10.0.0.$i >/dev/null 2>&1 & done; wait; arp -a

Linux

for i in {1..254}; do ping -c1 -W1 10.0.0.$i >/dev/null 2>&1 & done; wait; ip neigh

Windows (PowerShell)

1..254 | % { ping -n 1 -w 200 "10.0.0.$_" | Out-Null }; arp -a

These commands only send pings and read your machine's own neighbor table — nothing on the network is changed. They're short enough to read in full before running, which is the point: you never have to trust a downloaded binary.

Why this works so well: your OS must resolve a neighbor's MAC via ARP before it can even send the ping — so hosts with firewalls that silently drop pings still show up in the ARP table. On your local subnet, this humble one-liner catches nearly everything nmap would.

Method 2: nmap (Best Results)

If you have nmap installed, a ping-scan gives the richest output — hostnames, MAC addresses, and vendor names, and it handles any subnet size:

nmap -sn 10.0.0.0/24

Paste the normal output directly, or save XML and paste that instead (both are recognized):

nmap -sn -oX scan.xml 10.0.0.0/24

Run with sudo on macOS/Linux to include MAC addresses (ARP scan needs raw sockets)
Works across routed subnets too — you'll get liveness without MACs for remote networks

Method 3: DHCP Server & Router Exports

Often the most accurate inventory already exists in your DHCP server — no scanning required. IPCraft understands the native lease formats directly:

dnsmasq (Pi-hole, OpenWrt, many routers)

cat /var/lib/misc/dnsmasq.leases

Paste the file contents as-is. Expired leases are skipped automatically.

ISC dhcpd

cat /var/lib/dhcp/dhcpd.leases

The lease file is an append-log — an IP can appear several times. IPCraft folds duplicates and keeps only each lease's current state, importing only binding state active entries.

Kea

Paste the memfile lease CSV (e.g. /var/lib/kea/kea-leases4.csv). Declined and expired-reclaimed leases are skipped.

Windows DHCP Server

Get-DhcpServerv4Lease -ScopeId 10.0.0.0

Paste the table output directly. Rows in Active or ActiveReservation state are imported; expired and declined leases are skipped. Classic netsh dhcp server scope ... show clients output works too.

Router client lists (UniFi, pfSense, and friends)

Export or copy your router's client list as CSV — any file with a recognizable IP column (plus optional MAC and hostname columns) is parsed, whatever the exact header names. Copy-pasting a status page table of IP MAC hostname rows also works.

Supported Formats

Paste	From	Provides
`arp -a`	Windows, macOS, Linux	IP + MAC (+ hostname on macOS/Linux)
`ip neigh`	Linux	IP + MAC, IPv4 and IPv6
`ndp -an`	macOS	IPv6 neighbors: IP + MAC
nmap normal or XML (`-oX`)	any OS	IP + hostname + MAC
ping replies	any OS	IP liveness
dnsmasq / ISC dhcpd / Kea leases	DHCP servers	IP + MAC + hostname
`Get-DhcpServerv4Lease`, `netsh`	Windows DHCP	IP + MAC + hostname
CSV with an IP column	router exports, spreadsheets	whatever the columns hold
bare list of IPs	anywhere	IP liveness

Formats can be mixed in one paste — a ping loop followed by arp -a merges by IP, and junk lines are simply ignored.

Limitations Worth Knowing

ARP is local. arp -a only sees the subnet your machine is plugged into. For remote subnets, use nmap, a DHCP export, or run the one-liner from a machine on that segment
Pings can be filtered. A host behind a strict firewall on a remote subnet may not answer — "not seen" means exactly that, no more
One subnet at a time. The paste is reconciled against the subnet you opened. Entries outside it are counted and ignored, so you can paste the same DHCP export into each subnet in turn
More specific subnets win. If a parent subnet has children, hosts that belong to a child are excluded from the parent's reconcile — scan the child subnet to update them
Container subnets can't be scanned — they hold no address records by design
IPv6 subnets can't be ping-swept (2⁶⁴ addresses) — paste your machine's neighbor table instead: ndp -an on macOS, ip -6 neigh on Linux, or use a DHCP export

Tip: Re-applying the same paste is safe — it's idempotent. Nothing is duplicated; matched records just get a fresh "last seen" timestamp.

Where the Data Shows Up

Each record's last seen timestamp appears when you open the address
Every apply writes one activity log entry summarizing what changed
Backfilled hostnames/MACs appear immediately in the address list

Ready to try it? Open a subnet in your dashboard and click Scan.