AJapps

Network Discovery Result Checker

Compare what a network scan really found with the approved IP and asset register: devices nobody registered, registered devices that did not answer, an IP address answered by a different MAC address, and open ports that are not on the approved list.

Scan result

Register

Approved services and scope

Result

Open or paste a scan result and a register, or load the samples.

Tool guide · know before you use

What this tool is, how it works and how far to trust it

A checker that compares a network scan (what is on the network) with the approved IP or asset register (what should be on it).

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Read nmap XML, grepable and normal output, a Windows or Linux ARP table, or a CSV / plain list of addresses.
  • Read the register as an IP register (one row per address), the SCL NetStudio asset register (several addresses per device) or an SCL NetStudio project.
  • Find unknown devices, registered addresses not found in the scanned range, addresses answered by a different MAC address, devices found at another address (their MAC is registered elsewhere), and one MAC answering for several addresses.
  • Check every open port against an approved-services list per device name or IP, and call out clear-text and high-risk services.

Why you need it

  • An unregistered laptop, a replaced relay with a new MAC, an IED at the wrong address or Telnet left enabled are found only by comparing reality with the register — and IEC 62443 requires the asset owner to know what is connected and to disable what is not needed.
  • A scan of a substation subnet gives hundreds of lines; comparing it with a register by eye is slow and misses things.

Understand this first

  • On the local subnet a scan uses ARP, which every device must answer, and sees each device's MAC address; from another subnet it can only use ping or TCP probes, which many devices ignore, and it sees no MAC addresses.
  • A MAC address identifies the network interface: a different MAC on a registered IP means a different device (or a replaced one); the same MAC on another IP means the device was given a different address.
  • An open port means a service is listening. Every service that is not needed is an attack surface (IEC 62443-3-3 SR 7.7, least functionality).
  • Scanning can disturb old devices: scan only with permission, in an agreed window, and start with host discovery before a port scan.

What you need before you start

  • A scan result of the subnet (for example nmap -sn 10.13.0.0/25 for discovery, nmap -sS -p 1-1024,2404,3389,5900,8080 -oX scan.xml for ports), an ARP table (arp -a) or a list of addresses.
  • The approved IP or asset register (CSV with a heading line) or the SCL NetStudio project.
  • The list of approved services per device type (edit the example).
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Open or paste the scan and the register, or load the samples.
  • Edit the approved-services list: one line per device name or IP pattern (* and ? as wildcards), then the ports, for example GW*: 2404/tcp, 22/tcp. Lines add up, and * applies to every device.
  • Check the scanned range (taken from the nmap command line when the file has it) so registered addresses outside the scan are not reported as missing.
  • Work through the findings and export the table as CSV for the change record.

What you get

  • A summary, the findings with severity, and a table of every address with its status (in register, unknown, not found, MAC mismatch), the MAC and vendor seen, the open ports and the ports not approved.

How to read the results

  • Unknown device: identify it; register it if it belongs, remove it if not.
  • MAC mismatch: if the device was replaced, update the register (and any MAC-based port security); if not, look for a duplicate IP address.
  • Device found at another address: correct the device or the register — SCADA, the gateway and firewall rules use the registered address.
  • Not found: the device may be off, disconnected or ignoring probes; confirm on site before concluding.
  • Port not approved: disable the service on the device, or approve it with a documented reason. Telnet, FTP, TFTP and HTTP send passwords in clear text.

Technical basis

  • Matching by IP address first, then by MAC address for devices not found at their registered address.
  • Scope: the targets on the nmap command line, the range you enter, or else the /24 networks of the hosts found.
  • Port approval: a port is approved when any rule whose pattern matches the device's register name or its IP lists the port (protocol optional).
  • IEC 62443-2-1 (asset inventory), IEC 62443-3-3 SR 7.7 (least functionality) and SR 7.8 (control system component inventory); ARP (RFC 826).

Limits: when not to rely on it

  • It analyses a scan you ran; it does not scan (a browser cannot).
  • A port scan shows what answered at that moment from where it ran; filtered ports and UDP services are not seen unless scanned for.
  • Vendor names come from the scan file (the scanner's OUI database).

Sample files for this tool

Download, open and compare with what the guide says you should see.

All sample files and what to expect →

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 61a41bc · 2026-11-14