What you are measuring
A LAN scan enumerates which IPv4/IPv6 addresses respond on your broadcast domain or which MAC entries your station already knows. It is not the same as auditing authorized devices—enterprise networks use 802.1X, NAC, and inventory systems for that.
ICMP ping sweep
Many tools send ICMP Echo Request (ping) to each address in a /24 (e.g. 192.168.1.0/24). Firewalls often block ICMP even when the host is online, so absence of a reply is inconclusive. On Windows, arp -a after light traffic may show more neighbors than ping alone.
ARP and Ethernet
On IPv4 Ethernet, delivery uses ARP (RFC 826). Your gateway maintains ARP state for active stations; passive sniffing on a SPAN port can inventory MACs without sending probes—common in SOCs. Wi-Fi adds client isolation modes that deliberately block peer-to-peer ARP visibility.
Heavier tooling
nmap (-sn ping scan, TCP SYN discovery on selective ports) reduces false negatives when ICMP is filtered. Running broad unsolicited scans on networks you do not own may violate policy—get written permission for corporate ranges. For methodology overlap, see IP scanning tools and rogue device concepts.
Consumer workflow
- Connect the scanning host to the target LAN (same SSID/VLAN).
- Derive the subnet from your DHCP lease (address + mask).
- Use a scanner app or
nmap -sn net/mask; reconcile MAC OUI hints with vendor databases.
Validate your own public egress separately—how to find your IP address—because LAN scans never show the WAN address your ISP presents to the internet.