To scan a network on Windows, start with what ships in the box: arp -a lists the IP and MAC of every device your PC has recently talked to, and Get-NetNeighbor in PowerShell does the same with more detail. Both are instant and free. Neither tells you what those devices are. For names, vendors, open ports, and a security view you need a real scanner.
On a Mac the command-line half still works (arp -a is there too), but there has been no bundled graphical scanner since Network Utility was removed. We looked at nine that do run on macOS separately.
What Windows already gives you
Open a terminal and run arp -a. You get a table of IP addresses paired with MAC addresses for hosts in your ARP cache. It's the fastest possible answer to "what's on my network right now", but it only shows devices your machine has recently exchanged traffic with, so it misses quiet ones.
PowerShell goes a step further:
Get-NetNeighbor -AddressFamily IPv4 | Where-Object State -ne "Unreachable"
To force devices to appear, ping the whole subnet first so the ARP cache fills:
1..254 | ForEach-Object { Test-Connection -Count 1 -TimeoutSeconds 1 "192.168.1.$_" -ErrorAction SilentlyContinue }
The third free option is your router. Log into its admin page (usually 192.168.1.1) and open the DHCP client or connected-devices list. It sees everything that asked for a lease, including devices your PC never contacted. The catch is that router lists are often stale and label everything by hostname or a bare MAC, so a smart plug and a security camera look identical.
Turning a MAC address into a real device name
A raw scan gives you numbers. Identification is the work of turning a4:cf:12:... into "TP-Link smart plug". The first three bytes of a MAC are the OUI, an IEEE-assigned vendor code, so you can look up the manufacturer against the public OUI registry. Names come from a mix of reverse DNS, mDNS/Bonjour, and NetBIOS queries. Rolling that yourself is fiddly; it's exactly what dedicated scanners automate.
Free GUI scanners and where they stop
Advanced IP Scanner, Angry IP Scanner, and SoftPerfect are the usual free picks on Windows, and for a quick sweep they're fine. Where they tend to stop is depth. Most give you IP, MAC, hostname, and a vendor guess, then leave you there. They don't score which open ports are risky, they don't flag a device still answering on Telnet or exposing RDP, and they don't keep watching after the scan finishes. If you've outgrown that, the Advanced IP Scanner alternative rundown lays out what a deeper tool adds.
Live per-device bandwidth needs Npcap
One thing worth knowing before you expect too much: measuring how much bandwidth each device is using in real time requires packet capture, and on Windows that means the Npcap driver installed. No capture driver, no live per-device throughput. Any scanner promising bandwidth without it is estimating, not measuring. DeviceShelf prompts to install Npcap on first run for exactly this reason, and works without it for everything except live traffic graphs.
Where DeviceShelf fits on Windows
DeviceShelf runs as a native Windows app and does the identification, port enumeration, and security scoring in one pass. It discovers every device, resolves vendor and hostname, guesses OS and device type, lists open ports and services, and produces a prioritized report that flags exposed services, default-credential risks, and CVE hints. It keeps monitoring after the first scan, so a new device joining triggers an alert instead of going unnoticed. If you want a feature-by-feature look against the free tools, the comparison page covers it honestly.
It's local-first: no account, no telemetry, the license check works offline. There's a free 7-day trial with no account needed if you want to run it against your own network before deciding. A license is a one-time €59, not a subscription.
The short version
Start with arp -a and your router page to see what's there. Move to a GUI scanner when you want names and ports without typing. Reach for a monitoring tool when identification depth, a security view, and new-device alerts matter more than a one-off list. And remember that live bandwidth on Windows always needs Npcap underneath.
