Network Inventory and Documentation: Device Discovery, Port Mapping, and Infrastructure Records with DL NetTools

Every network begins its life documented. Someone installs a router, connects a switch, assigns IP addresses, and writes it down — in a spreadsheet, a diagram, a notebook, or at minimum their own memory. Then time passes. Devices are added and removed. IP assignments drift from the original plan. A contractor installs a wireless access point and does not tell anyone. A developer plugs in a Raspberry Pi for testing and forgets about it. A smart TV, a security camera, and a networked printer join the network silently via DHCP. Within a year, the documentation — if it still exists — bears only a passing resemblance to the actual network.

The consequences of undocumented infrastructure compound silently. Security audits cannot assess what they cannot see. Troubleshooting network issues takes longer when you do not know what is on the network or how it is connected. Capacity planning fails when the baseline is unknown. IP conflicts emerge because nobody knows which addresses are in use. And when the person who built the network leaves the organization, their institutional knowledge leaves with them.

DL NetTools provides the discovery and documentation tools to rebuild your network inventory from scratch using nothing more than an Android phone connected to the network. Its Device Scanner, Port Scanner, Network Map, MAC Lookup, SNMP Browser, and Report Builder work together to answer the three fundamental questions of network documentation: what is on this network, what services is each device running, and how is it all connected. This guide walks through the complete inventory workflow.

The first phase of network inventory is discovery: identifying every device with an IP address on the network. Open DL NetTools' Device Scanner and initiate a scan of your local subnet. The scanner sends ARP requests and ICMP pings across the subnet range, identifying every device that responds. For each discovered device, the scanner captures the IP address, MAC address, hostname (if available via DNS or NetBIOS), and response time.

The initial scan results are raw data that needs interpretation. Many devices respond with cryptic or absent hostnames — an IP address of 192.168.1.47 with no hostname could be anything from a laptop to a smart light bulb. This is where the MAC Lookup tool becomes essential. Every network interface has a MAC address whose first three octets (the OUI — Organizationally Unique Identifier) identify the manufacturer. DL NetTools' MAC Lookup cross-references each discovered device's MAC address against the IEEE OUI database. Suddenly, that mystery device at 192.168.1.47 is identified as a Sonos speaker, or a Ring doorbell, or a Dell laptop. The manufacturer identification transforms anonymous IP addresses into recognizable devices.

For devices that remain unidentified after MAC lookup — perhaps because they use randomized MAC addresses (common on modern phones and laptops) or because the manufacturer's OUI is not in the database — the Port Scanner provides the next layer of identification. Scan the mystery device's open ports. A device running port 80 (HTTP) and port 443 (HTTPS) is likely a web-accessible device — a router interface, a NAS management page, or an IoT device with a web console. A device running port 22 (SSH) is likely a Linux server or network appliance. A device running port 3389 (RDP) is a Windows machine with remote desktop enabled. The combination of manufacturer identity and open ports identifies virtually every device on a typical network.

Run the Device Scanner during business hours and again after hours if you are inventorying a workplace network. Some devices — employee phones, laptops that go home at night, devices on timers — are only present during certain periods. A comprehensive inventory requires multiple scans at different times to capture the full population of devices that use the network.

Knowing that a device exists on the network is the first step. Knowing what it does — what services it runs, what protocols it speaks, what ports it exposes — is the second step, and often the more security-relevant one. A network-attached storage device running a file-sharing service on the local network is expected and benign. The same device with port 21 (FTP) and port 23 (Telnet) open to the internet is a security incident waiting to happen.

DL NetTools' Port Scanner systematically probes each discovered device for open TCP and UDP ports. For the most informative results, scan the common service ports first (the well-known ports 1-1024) and then selectively scan higher port ranges for devices that warrant deeper investigation. Each open port tells a story: port 53 indicates a DNS server, port 161 indicates SNMP management capability, port 8080 often indicates a web application or proxy, port 5353 indicates mDNS/Bonjour service discovery.

The mDNS Browser in DL NetTools provides an alternative discovery method that complements port scanning. Many modern devices — especially Apple products, smart home devices, and network printers — advertise their services via multicast DNS. The mDNS Browser passively listens for these advertisements and displays the service name, type, and host for each discovered service. This often reveals services that port scanning misses because they run on non-standard ports, and it provides human-readable service descriptions that port numbers alone do not.

For managed network equipment — enterprise switches, access points, and routers — the SNMP Browser provides the deepest level of detail. SNMP (Simple Network Management Protocol) exposes device configuration, interface statistics, routing tables, and operational status through a standardized query interface. If SNMP is enabled on your network equipment (and you have the community strings or credentials), DL NetTools' SNMP Browser can retrieve interface descriptions, port speeds, VLAN assignments, and traffic statistics that no other scanning method can access. This data is invaluable for documenting how the network is actually configured versus how it was intended to be configured.

Individual device records are useful but insufficient for understanding how a network actually works. The topology — how devices connect to each other, which switches serve which segments, where the routing boundaries are, and how traffic flows from source to destination — requires a visual representation that individual device entries cannot provide.

DL NetTools' Network Map aggregates the discovery and scanning data into a visual topology representation. Devices are displayed as nodes, connections between devices are displayed as links, and the map provides an intuitive overview of network structure that a spreadsheet of IP addresses never can. The map reveals architectural features that are invisible in tabular data: network segments, bottleneck points, devices with multiple connections serving as bridges, and orphaned segments connected through a single link.

The Network Map is also a powerful troubleshooting tool. When a connectivity problem occurs, the map immediately shows the path between the affected device and the gateway, highlighting every intermediate device that could be the source of the problem. Without a topology map, troubleshooting requires tracing physical cables or guessing at the path. With the map, the candidate failure points are visible at a glance.

For networks with VLANs or multiple subnets, the VLAN Analyzer and Subnet Calculator provide additional structural information. The VLAN Analyzer identifies which ports on managed switches are assigned to which VLANs, revealing the logical segmentation of the network. The Subnet Calculator helps verify that addressing schemes are correct and efficient. Together with the Network Map, these tools produce a complete picture of both the physical and logical network topology — the foundation for any meaningful network documentation.

Discovery without documentation is reconnaissance without memory. The insights gained from scanning, mapping, and analyzing the network are valuable only if they are recorded in a format that persists beyond the scanning session. DL NetTools' Report Builder, Network Documenter, and Asset Inventory tools transform raw scan data into structured, exportable documentation.

The Asset Inventory compiles every discovered device into a structured record: IP address, MAC address, manufacturer, hostname, open ports, discovered services, and the timestamp of the last scan. This inventory becomes the authoritative record of what exists on the network. When a new scan discovers a device that is not in the inventory, it is immediately identifiable as a new addition. When a device that was in the inventory stops appearing in scans, it has been removed or is offline. The inventory transforms network documentation from a static snapshot into a living record that reveals changes over time.

The Report Builder generates formatted reports suitable for different audiences. A technical report includes full port scan results, SNMP data, and raw MAC addresses — the detail that a network engineer needs for troubleshooting and security assessment. An executive summary includes device counts, network segmentation overview, and high-level security findings — the information that management needs for compliance and budget decisions. A compliance report maps discovered devices and services against security baselines, identifying deviations that require attention.

Export these reports and inventory records regularly. A network inventory is a snapshot in time — it is accurate on the day it was created and becomes progressively less accurate as devices are added, removed, and reconfigured. Establish a monthly or quarterly inventory refresh using DL NetTools: re-scan the network, compare against the previous inventory, document changes, and export updated records. This cadence turns network documentation from a one-time project into an ongoing practice that keeps the documentation aligned with reality.