PortDock

PortDock Net Scan Guide

Find devices on industrial networks — industrial ports, long-term ping

About this program

PortDock Net Scan finds the IP addresses of devices (PLCs, HMIs, drives, instruments, gateways) on factory and machine networks.

On the same subnet it asks by ARP, so it finds devices even if they block ping, and shows the vendor from the MAC address. For each device it checks whether industrial ports such as Modbus TCP, FEnet, SLMP, S7, EtherNet/IP and OPC UA are open.

It also has a long-running «Ping monitor» that records drops, and Wake-on-LAN to wake PCs.

No admin rights or drivers are needed. Only the listed ports are checked — it never does a generic all-ports scan.

Getting started

  • 1. Under «Network adapter», pick the adapter the devices are connected to. Its IP, gateway and MAC are shown below.
  • 2. «Range to scan» is filled with that adapter's subnet (usually 192.168.x.0/24). Edit it if needed.
  • 3. Press «Scan» (F4). Devices appear in the table as they are found; «Services» fills in when the port and name checks finish.
  • 4. Click a device to open its web page, copy its IP or «host:port», wake it or add it to the ping monitor from the panel below.
  • On first start these steps appear as a card in the empty results area. «Don't show again» replaces it with a short one-line guide.
  • Discovery settings such as ARP, ping, waits and the port list usually fit as they are, so they are collapsed under «Discovery & ports (advanced)» on the left. Normally you only need the adapter and «Scan».

Layout

  • Left: adapter, range, «Scan»/«Stop», status and progress bar. Below them «Discovery & ports (advanced)» is collapsed, with the current settings summarized next to its title, e.g. «ARP+ping · 22 ports · Modbus ID · names». Non-default settings add «(changed)» and the section starts expanded next time. Click the title to show ARP, ping, ping wait, parallel, name lookup, industrial port check, ports to check, port wait and Modbus ID reading (the state is remembered). It expands by itself when both ping and ARP are off or the port list is invalid.
  • Tabs: «Devices» (results) and «Ping monitor». The monitor keeps running while you look at the other tab (● or «n ↓» on the tab).
  • «Devices» toolbar: filter box, «Industrial ports only», «New n» / «Gone n», «Save CSV», «Clear».
  • Below the table: details and actions for the selected device.
  • 📌 in the header: always on top — keeps this window above others (same as «Always on top» in Settings).
  • The window title shows the current state (e.g. «COM3 115200 8N1 · Connected ● REC — PortDock Serial»), so you can tell windows apart on the taskbar.
  • At 900 px wide or less (e.g. half-screen snap) the left connection panel folds away and a summary line with «⚙ Connection» and the connect button appears. «⚙ Connection» opens the panel; ✕ or clicking outside closes it.

Adapter and range

  • The adapter list shows adapters with an IPv4 address as «name — IP/prefix». An adapter with several IPs (e.g. a temporary extra IP) is listed once per IP. After plugging in an adapter or changing an IP, press ↻.
  • Picking an adapter sets the range to its subnet. Subnets wider than /24 (e.g. /16) use only the /24 that contains the adapter's address.
  • Range formats: «192.168.0.0/24» (subnet), «192.168.0.1-254» (last number), «192.168.0.1-192.168.1.20» (first–last), «192.168.0.10» (single). Separate several with commas.
  • Up to 4096 addresses per scan. Above that the box turns red and «Scan» is disabled.
  • If the range is outside the adapter's subnet, ARP cannot be used (behind a router): ping only, and MAC/vendor are unknown.

Discovery — ARP and ping

  • These settings are under «Discovery & ports (advanced)» on the left; click its title to expand it.
  • ARP asks «what is the MAC of this IP?» for every address on the same subnet. A device answers whenever it is connected, even if its firewall blocks ping — the most reliable way to find industrial devices. «no ping» in the «Reply» column means it was found by ARP only.
  • Ping (ICMP) also finds devices behind a router and measures the reply time (ms). On the same subnet, addresses that fail ARP are not pinged (they cannot be reached anyway).
  • «Ping wait (ms)»: how long to wait for each ping. Increase it for Wi-Fi or slow devices.
  • «Parallel»: how many addresses are probed at once (default 64). A /24 usually finishes in 10–20 s.
  • «Look up names»: device names via whatever Windows knows (DNS, NetBIOS, …). Devices without names add a few seconds at the end.
  • A reply time of «<1» means faster than 1 ms.

Industrial port check

  • For each device it only opens a TCP connection to each port in «Ports to check» (no data is sent) and shows open ones as «Services» chips. Industrial ports are highlighted.
  • Default list: 502 Modbus TCP · 2004 FEnet (LS XGT Ethernet) · 5000–5010 SLMP (MC protocol) · 102 S7 · 44818 EtherNet/IP · 4840 OPC UA · 80/443 web · 23 Telnet · 21 FTP · 1883 MQTT · 5025 SCPI.
  • Pick «Ports to check» with name chips: Modbus 502 · S7 102 · EtherNet/IP 44818 · MC/SLMP 5000–5010 · FEnet 2004 · OPC UA 4840 · MQTT 1883 · SCPI 5025 · HTTP 80 · HTTPS 443 · Telnet 23 · FTP 21; click to toggle. For ports without a chip, open «Enter manually…» and write commas and ranges such as «502, 8080, 9000-9003» (it opens by itself when such ports exist). Up to 32. «Default list» restores it.
  • «Port wait (ms)»: how long to wait for each connection. A filtered port counts as closed after this time.
  • An open port does not prove the protocol (5000, for example, is used for many things). Hover over a chip for a description.
  • Some devices log even a brief connect/disconnect. On running machines, keep the range narrow.

Modbus device ID

  • With «Read Modbus device ID (502)» on, devices with 502 open get a «Read Device Identification» request (FC 2B/0E, basic level) — Slave ID 1 first, then 255.
  • If they answer, vendor, product code and revision appear in «Services» and in the panel below. It is a read-only request; no register is changed.
  • Many devices do not support it (exception 01). «Read Modbus device ID» in the panel asks again at any time.

Results table

  • Click a header (IP, MAC, Vendor, Name, Reply, Services) to sort by it; click again to reverse. IPs sort numerically (192.168.0.2 before 192.168.0.10).
  • Filter box: shows rows where IP, MAC, vendor, name, service name or port number contains the text. Ctrl+F focuses it, Esc clears it.
  • «Industrial ports only» hides devices with only web/Telnet/FTP open (office PCs, printers, …).
  • Marks: «this PC», «gateway», «new» (not found by the previous complete scan of the same range), «gone» (found last time but not now, dimmed).
  • «new»/«gone» compare only complete scans of the same range (stopped scans are not kept). Up to 10 ranges are remembered.
  • «—» in MAC: the device is behind a router, so its MAC is unknown. «random MAC»: a phone or VM using a randomized MAC; the vendor cannot be known.
  • «Save CSV» (Ctrl+S) saves the rows as shown (filter and sort applied) as a CSV you can open in Excel.
  • Double-click a row to open the web page of a device with port 80 open.
  • Right-click a row (or the Menu key / Shift+F10): open web page, copy IP, copy «IP:502», copy MAC, read Modbus device ID, add to ping monitor, Wake-on-LAN — the same as the buttons below. Items that cannot apply (502 closed, MAC unknown) are greyed out.
  • Clicking the Modbus chip in the table's «Services» copies «IP:502» right away (paste into the address box of Modbus Master or TCP).

Device actions

  • «Open web page» opens http://IP/ in the default browser (https if only 443 is open) — for device configuration pages.
  • «Copy IP», «Copy MAC».
  • Click a service chip («Modbus 502 ⧉», …) to copy «IP:port» — paste it into the address box of PortDock TCP or Modbus.
  • «Wake (WoL)» sends a magic packet for that MAC to the selected adapter's subnet broadcast and 255.255.255.255 (ports 9 and 7). WoL must be enabled in the target's BIOS/NIC, and the MAC is known only for devices found by ARP on the same subnet.
  • «Add to ping monitor» adds the IP to the «Ping monitor» list.

Ping monitor

  • Enter an IP (or name), press «Add», set «Interval (s)» and «Wait (ms)», then «Start monitor». Hosts are pinged in parallel (up to 64).
  • Table: state (up/down), last reply time, sent / lost (%), min/avg/max, drop count, last drop time (while down, how long it has been down).
  • «Changes» lists drops and recoveries (with the outage length), newest first.
  • «Flash the taskbar on drop» makes this program's taskbar button flash when a host drops.
  • «CSV log»: while monitoring, pick a file to append «time,host,ip,result,rtt_ms,event» every round. The event column holds down/up only on change lines, easy to filter in Excel. With «Start file log automatically» and «Auto-log folder» in Settings (⚙), every monitor start logs automatically.
  • The list and interval are locked while monitoring; stop to change them. «Reset stats» zeroes the numbers only.

Devices on another subnet are not found

Factory devices often ship with fixed IPs such as 192.168.1.x or 192.168.10.x. If your PC is on another subnet, neither ping nor ARP reaches them and they do not appear.

  • Check the default IP in the manual or on the label. If unknown, connect the device directly to the PC with one cable (no switch) and try common default subnets one by one (192.168.0.x, 192.168.1.x, 192.168.10.x, …).
  • Adding a temporary extra IP on that subnet reaches it without dropping your current network: Settings → Network & internet → Ethernet → IP assignment «Edit» → Manual → IPv4 with a free address on the device's subnet (e.g. device 192.168.1.10 → PC 192.168.1.200, mask 255.255.255.0). Or Control Panel → Network Connections → adapter Properties → IPv4 → Advanced → «Add IP address». This needs admin rights.
  • Then press ↻ next to the adapter here; the new IP appears as its own entry. Pick it and scan.
  • Remove the extra IP afterwards (it conflicts if another device later uses it). Never give the PC the same IP as the device.
  • A DHCP device plugged straight into the PC (no router) uses 169.254.x.x (link-local). Pick the 169.254 entry and enter the device's range instead (169.254.0.0/16 is too large to scan as a whole).

Firewall and antivirus

  • Devices that block ping are still found by ARP on the same subnet. Devices behind a router that block ping cannot be found.
  • Windows PCs do not answer ping by default, so «no ping» is normal for them.
  • Only the listed ports are checked, but corporate security systems may still flag it as a port scan — tell your IT team before using it on an office network.
  • Wake-on-LAN sends a UDP broadcast. No Windows Firewall prompt appears; if it is blocked, it is usually by router/switch settings.

Settings (⚙)

  • Language, theme, font size.
  • «Log timestamp»: time format in the ping monitor («elapsed» shows as clock time here).
  • «Start file log automatically» and «Auto-log folder»: each monitor start writes «portdock-netscan-ping-date-time.csv».
  • «Ask before closing while connected or logging»: asks if you close the window while scanning or monitoring.
  • «Export settings» / «Import settings» move adapter, range, port list, monitor list and display settings as a JSON file.
  • «Always on top»: keeps this window above other windows (same as 📌 in the header).
  • «Expand all (expert view)»: shows the groups that are normally collapsed (advanced connection, receive settings, fault injection, statistics, scan options, triggers, auto-reply …) open. Folding one while it is on lasts only for this run. Turning it off returns each group to its remembered state.

Shortcuts and tips

  • F4: scan / stop.
  • Ctrl+S: save results as CSV. Ctrl+L: clear results. Ctrl+F: focus the filter box (Esc clears it).
  • Enter in the range box: scan.
  • F1 or the ? button: this help. Close it with Esc.
  • Number boxes: ↑/↓ by 1, Shift+↑/↓ by 10, PageUp/PageDown by 100.
  • Hover over a field to see a tooltip.

Troubleshooting

  • Nothing found: check the adapter choice, cable and switch lights, and that the range is the devices' subnet. For another subnet see «Devices on another subnet are not found».
  • Scanning over Wi-Fi may hide other wireless devices (client isolation on the access point). Use a wired adapter.
  • Ports missing: increase «Port wait (ms)». Devices that limit connections (e.g. one Modbus client) may look closed while another program is connected.
  • Empty names: most industrial devices have no DNS name (normal).
  • «IcmpCreateFile» error: ICMP is blocked by company policy on this PC. Turn ping off and use ARP only.
  • The program does not open: Microsoft Edge WebView2 is required (included in Windows 11).
  • Vendor names come from the IEEE public registry (MA-L, retrieved 2026-10-18). MACs registered later may show no vendor.