SubnetLens

Why it's ranked here

A small Go scanner with more care underneath than its size suggests: it sizes its socket use against the operating system's open-file limit and queues work instead of crashing, CI runs vet, the tests and the race detector on every pull request, and the scan engine accepts plug-in discovery, scanning and classification stages. MIT licensed, one binary, and the basic TCP path needs no root. The limits are just as concrete: IPv4 only, TCP ports only, no structured export yet, and the operating system guess is keyword matching. It is a good way to take stock of a home or lab network, not a security audit tool.

What's good

It holds back 64 file handles for the process, treats the rest as a shared socket budget, and prints a warning with the estimated peak demand when your concurrency settings would exceed it, so a big scan slows down rather than failing with too many open files. Ping gets two tries before it falls back to TCP. The active ARP sweep paces its requests two milliseconds apart. Plain mode prints each host as soon as its name, hardware address and vendor are known, then flushes the stragglers at the end. The IEEE vendor list ships in the repository, and randomized hardware addresses, a phone privacy feature, are labelled as such.

Tradeoffs

IPv6 targets are rejected with an error. Operating system detection is a first-match keyword list over SSH, web server and TLS banners: an SSH server that only says OpenSSH reads as generic Linux/Unix, and a host with none of those services reads as Unknown. Output is a terminal screen or fixed-width text; JSON and CSV export are still unchecked on the roadmap. UDP scanning and a watch mode that alerts on changes are reserved for a planned proprietary Pro edition. Ping and ARP need sudo or Administrator, ARP on Windows needs the Npcap driver, and passive service listening is marked untested on Windows.

How to use it well

For anyone who wants a readable picture of their own home or lab network. Run it with sudo so ping and ARP discovery are on; without root, a host only counts if it accepts a connection on a probe port, unless you add the all-alive flag, which also counts hosts that refuse. Use plain mode with banners for text you can grep, lower the timeout on a fast wired network, and raise discovery concurrency for larger ranges. It does not cover continuous monitoring, alerting or machine-readable reports; scan only networks you are allowed to.

Observed

License

MIT

Language

Go, module declares go 1.25.0

Interfaces

CLI built on Cobra, with a Bubble Tea terminal UI and a plain-text mode

Install

Build from source with go build or go install; release binaries versioned via GoReleaser ldflags

Platform support

Linux, macOS and Windows; Windows ARP requires Npcap; mDNS not tested on Windows

Privileges

TCP scan runs unprivileged; ICMP and ARP need root or Administrator

Address family

IPv4 only; IPv6 targets are rejected

Port scanning

TCP connect only; UDP listed for a planned proprietary Pro edition

Output formats

Terminal UI or plain text; JSON/CSV export not implemented

CI

go vet, go test, go test -race and go build on pushes and pull requests to main

Vendor data

IEEE OUI CSV bundled in the repository for offline vendor lookup