Tool guide · Commercial

SolarWinds Engineer's Toolset: from a ping sweep to a switch port map

Reviewed 15 September 2026 · Windows · commercial licence, trial available

Engineer's Toolset is not one scanner — it is roughly sixty separate desktop utilities sharing an installer and a launchpad. Five of them do the work covered here: Ping Sweep, MAC Address Discovery, Switch Port Mapper, MIB Scanner and TraceRoute. Together they take you from "which addresses are alive" to "that laptop is on port 2/14 of the third-floor switch".

The five tools that matter for discovery and mapping

1. 1. Ping Sweep — the inventory layer

   The starting point for every job. Enter a range in the Enter ranges to scan field — the syntax is 10.199.1.20-10.199.1.101 — or load a saved list with From file…. The Scan for selector filters the output to All, responding hosts only, or non-responding only.

   Three columns come back: IP Address, Response Time in milliseconds, and DNS. Addresses with no reply read Request timed out in red, which makes free-address hunting trivial — set Scan for to non-responding and you have your list of assignable IPs.

   The DNS column is doing quiet work here. Names like LAB-WSUS-01 or LAB-EXC2003-DC identify server roles before you have touched the host, and an alive address with no DNS name on a managed subnet is exactly the anomaly worth chasing.

   

2. 2. MAC Address Discovery — identity for each address

   An IP address is a lease; a MAC address is the device. MAC Address Discovery takes a local subnet and returns IP Address, MAC Address, DNS and Network Card Manufacturer for every host it can reach.

   Set the Local Subnet selector, press Discover MAC Addresses, and the table fills. The status line reports the total, for example MAC Address Discovery Complete. 24 addresses.

   The manufacturer column is the interesting one. An OUI resolving to VMWARE, INC. tells you the host is a virtual machine; a consumer phone or IoT vendor appearing on a server VLAN is an incident. This output is also the input for the next step — Switch Port Mapper needs MAC addresses to correlate against the switch's bridge table.

   Run it from inside the VLAN.

   MAC discovery is ARP-based, so it only sees the broadcast domain you are attached to. Scanning a remote subnet returns the router's MAC for every host, which is correct and useless. Use Export to keep each subnet's results.

   

3. 3. Switch Port Mapper — the reason to buy the Toolset

   Subtitled What's connected where?, and that is exactly the job. Give it a switch's management IP and an SNMP credential; it walks the interface table, the bridge (forwarding) table and the ARP cache, and correlates them into one row per physical port.

   The output table carries:

   Switch Port Mapper columns

   Column	What it tells you
   Interface Index / Name / Description	The SNMP ifIndex and the port as the switch names it — 2/14, 10/100 utp ethernet (cat 3/5).
   Interface Alias	The description someone configured on the port. Empty here is a documentation gap worth closing.
   Admin Status / Operational Status	Configured state versus actual link state. Admin up + operational down is an unused or faulty port.
   Port Speed	Negotiated speed. A 10 Mbps figure on a gigabit switch means a duplex or cabling fault.
   Type of Interface	Physical ethernet, VLAN interface (propVirtual), or management port.
   TrunkPort	Whether the port is a trunk — which is how you tell an uplink from an access port.

   The header line confirms which device was polled and where the ARP data came from — Port Map for 10.199.4.13, ARP Info from device 0.199.4.13 — because on a layer-2 switch the ARP table usually has to be read from the router instead.

   Export the result and you have a cabling document that was not typed by hand. Re-run it after every patching session and diff it: that is change control for the physical layer.

   

   The classic workflow.

   Ping Sweep gives you the IP. MAC Address Discovery turns the IP into a MAC. Switch Port Mapper turns the MAC into a port. Three tools, five minutes, and you know which wall socket to unplug — without walking the floor.

4. 4. MIB Scanner and MIB Browser — SNMP at range and at depth

   MIB Scanner does one OID across many devices. Enter an IP range and an OID (1.3.6.1.2 for a general system walk), choose whether to match all OID instances or only specific ones, and press Discover. Each row returns the IP, the OID, the SNMP credential used and the value.

   Pointed at sysDescr, this is the fastest inventory of firmware and OS versions you will get: the value column fills with strings like Hardware: Intel64 Family 6 Model 45 … Software: Windows Version 6.1 (Build 7601) and Linux lamp 3.2.0-4-amd64 #1 SMP Debian. Two tabs separate All devices from Devices matching the requested OIDs, and Export results writes the lot out.

   

   MIB Browser is the opposite: one device, every OID. It presents the loaded MIB tree — vendor branches and all — and lets you Get or Walk any node, set a drag format, bookmark an OID you use often, or export the table to Net-SNMP format. When a monitoring system needs to poll something unusual, this is where you find the OID that returns it.

   

5. 5. TraceRoute — the path, with context

   Subtitled Find ICMP path. Enter a hostname or IP and press Trace. What separates it from the tracert built into Windows is the extra columns: alongside hop number, IP and DNS you get Response Time, Up Time, Last Boot, Location and Description.

   Where the hop is one of your own SNMP-reachable devices, those columns fill in — 217 days 19 hours 12 minutes, Cisco 2821, ISP — so a trace doubles as a check that the router in the path has not rebooted recently. Beyond your edge the extra columns empty out and you are back to plain hop latency, with Request timed out rows where a hop declines to answer ICMP.

   Timed-out hops are usually normal.

   Many carrier routers rate-limit or drop ICMP TTL-exceeded messages. A gap in the middle of a trace that still reaches the destination is not a fault.

   

Other utilities worth knowing

The launchpad holds around sixty tools. Beyond the five above, these come up most often in day-to-day work:

FAQ