Layer 0 — know your address space before you scan

Scanning the wrong range is the most common wasted afternoon in this work. Start from facts, not assumptions:

Run ipconfig /all (Windows) or ip addr (Linux/macOS) on a machine in each VLAN and write down the address, mask and default gateway.
Read the DHCP server's scope list. Every scope is a subnet you must scan.
Read the router's or firewall's interface list — including VLAN sub-interfaces. Static server segments rarely appear in DHCP.
Note which segments you are physically able to reach. ARP-based discovery cannot cross a router, so some layers can only be collected from inside the VLAN.

The output of this step is a list of CIDR ranges. Everything below is repeated once per range.

Layer 1 — the IP inventory

Sweep each range and record IP address, response time and hostname. Any of the three tools does this; on a mixed-OS estate Angry IP Scanner is the quickest, and Ping Sweep in Engineer's Toolset produces the same three columns with a filter for non-responding addresses.

Two settings decide whether this layer is accurate:

Timeout. Default timeouts are tuned for wired LANs. On Wi-Fi, over a VPN, or against sleeping devices, raise it to 1000–2000 ms or you will record live hosts as dead.
Liveness test. ICMP alone under-reports because host firewalls block it. Add a small TCP port list (22,80,443,445,3389) so a host that refuses ping still proves itself alive.

Layer 2 — attach a MAC address to every host

An IP address is a DHCP lease and changes. A MAC address identifies the network card and is what every switch in the building actually forwards on. Without this layer you cannot build a topology map at all.

Collect MAC and NIC-vendor for every host — the MAC Address fetcher in Angry IP Scanner, the MAC Address Discovery tool in Engineer's Toolset, or the host list in Network Scanner. Because this is ARP-based, it must be run from inside each broadcast domain: scanning a remote subnet returns the router's MAC for every host.

Read the vendor column.

OUI prefixes resolve to a manufacturer, which is free classification. Virtualisation vendors mean a VM; consumer phone and IoT vendors on a server VLAN mean someone plugged in something they should not have.

Layer 3 — roles and services

An inventory of addresses is not yet a map. Label each host with what it does:

Open ports give the first cut — 445 a Windows host or NAS, 3389 an RDP target, 80/443 a printer, camera or appliance, 22 a Linux box.
HTTP banners identify appliances outright. A Canon HTTP Server string is a printer, no further work needed.
SMB share names are the most descriptive signal on a Windows network. Network Scanner's resource tree, with its System default share and Printer Drivers comments, makes file servers and print servers self-identifying.
SNMP sysDescr returns the exact OS and firmware build where SNMP is available — MIB Scanner collects it across a whole range in one pass.

Layer 4 — physical topology

This is the layer people actually mean by "network map", and it is the one free tools cannot produce. It requires reading the switches themselves over SNMP:

The bridge / forwarding table says which MAC addresses the switch has seen on which port.
The ARP table — usually on the router, not the switch — maps those MACs back to IP addresses.
The interface table supplies port names, aliases, speed, admin and operational status, and the trunk flag.

Correlating the three gives one row per port: which device, which VLAN, what speed, up or down, access or trunk. Switch Port Mapper does the correlation for you; doing it by hand means show mac address-table, show arp and a spreadsheet.

Prerequisite.

SNMP must be enabled on each switch with a read-only community or v3 user, restricted by ACL to your management station. Leaving public enabled network-wide to make mapping easier is trading a real security control for an afternoon's convenience.

Uplinks are what turn a stack of port tables into a diagram: a trunk port carrying many MAC addresses is a link to another switch, not an end device. Follow the trunks and the hierarchy draws itself.

Layer 5 — keeping the map alive

A map is accurate for about a week. Make it repeatable instead of perfect:

Export every scan to CSV with a dated filename.
Schedule the IP sweep weekly — Angry IP Scanner's command line plus the OS task scheduler is enough, and free.
Diff consecutive exports. A new MAC address is the cheapest rogue-device detection available; a disappeared MAC is a decommissioned host nobody told you about.
Re-run Switch Port Mapper after every patching session and diff the port table. That is change control for the physical layer.
Keep the exports in version control or a dated share, so "when did this appear?" has an answer.

Pitfalls that ruin a map

Why maps come out wrong
Pitfall	Effect	Avoid it by
Scanning only the subnet you happen to be on	Whole VLANs missing from the map	Enumerating every DHCP scope and router interface first
Relying on ICMP alone	Firewalled Windows hosts recorded as dead	Adding a TCP port list to the liveness test
Collecting MACs from outside the VLAN	Every host shows the router's MAC	Running layer-2 collection inside each broadcast domain
Wi-Fi client isolation left on	Wireless clients invisible to any scan	Scanning from wired, or reading the controller's client list
Treating IP as identity	The map breaks at the next DHCP renewal	Keying the inventory on MAC address
Thread count too high for the hardware	Consumer routers drop sessions mid-scan; results look random	Lowering threads to 20–30 on small gear
Drawing it once in a diagram tool	Fiction within a month	Scheduling the scans and diffing exports

Authorisation.

Everything above assumes the network is yours or you administer it under a written agreement. Sweeping addresses, enumerating shares and polling SNMP on infrastructure you do not control is not a grey area — get permission in writing first.

How to map a local network, layer by layer

On this page