Discover Every Device on Your LAN with ARP

**Get-NetIPAddress** shows the prefix length next to the address, and the prefix length is what defines the sweep range. A /24 has 254 hosts, a /16 has 65 534 and should be split.

Get-NetIPConfiguration | Select-Object InterfaceAlias,IPv4Address,IPv4DefaultGateway
Get-NetIPAddress -AddressFamily IPv4 | Where-Object PrefixOrigin -ne 'WellKnown' | Select-Object IPAddress,PrefixLength,InterfaceAlias

**Test-Connection -Count 1** fills the neighbour cache without waiting for a full timeout each time. The job runs 50 targets at once, which turns minutes into seconds.

$subnet = '192.168.1.'
1..254 | ForEach-Object -Parallel { if (Test-Connection -TargetName ($using:subnet + $_) -Count 1 -Quiet -TimeoutSeconds 1) { $using:subnet + $_ } } -ThrottleLimit 50 | Sort-Object

**Get-NetNeighbor** is the modern arp -a. The Reachable and Stale states both mean the entry is real; only Unreachable and Incomplete are noise.

Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.IPAddress -like '192.168.1.*' -and $_.State -in 'Reachable','Stale','Permanent' } | Sort-Object IPAddress | Select-Object IPAddress,LinkLayerAddress,State

Reverse DNS names printers, NAS boxes and managed switches that register themselves. The query is cheap, and a failure means the device has no name record.

Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.IPAddress -like '192.168.1.*' -and $_.State -ne 'Unreachable' } | ForEach-Object { $n = try { (Resolve-DnsName -Name $_.IPAddress -Type PTR -DnsOnly -ErrorAction Stop).NameHost } catch { 'no-name' }; [pscustomobject]@{ IP = $_.IPAddress; Name = $n; MAC = $_.LinkLayerAddress } } | Sort-Object IP | Format-Table -AutoSize

The first three bytes of a MAC identify the manufacturer. A short prefix table covers the common consumer brands, and the rest is lookup work in any public OUI database.

$oui = @{ 'B827EB'='Raspberry Pi'; '001132'='Synology'; '3C5AB4'='Google'; 'F4F5D8'='Amazon'; 'D8BBC1'='Huawei'; '001A11'='Google' }
Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.IPAddress -like '192.168.1.*' -and $_.LinkLayerAddress -ne 'FF-FF-FF-FF-FF-FF' } | ForEach-Object { $p = ($_.LinkLayerAddress -replace '-','').Substring(0,6).ToUpper(); [pscustomobject]@{ IP = $_.IPAddress; MAC = $_.LinkLayerAddress; Vendor = if ($oui[$p]) { $oui[$p] } else { 'unknown' } } } | Sort-Object IP | Format-Table -AutoSize

Open ports tell you what a box is without logging into it. **Test-NetConnection** on the usual management ports answers in a second, and a hostname from NetBIOS or LLMNR often follows.

Test-NetConnection -ComputerName 192.168.1.42 -Port 80,443,22,445,9100 -InformationLevel Quiet
Get-NetNeighbor -IPAddress 192.168.1.42 | Select-Object IPAddress,LinkLayerAddress,State
tracert -h 3 192.168.1.42