Network scanner for Linux, from the terminal or a GUI

On Linux you can scan your LAN two ways. From the terminal, nmap and arp-scan hand you a full host list, open ports and MAC vendors in seconds. A GUI makes sense once you'd rather read and sort results than re-type flags. Either route needs root or a setcap grant for the deeper probes.

Scanning your LAN from the terminal

Start with a fast sweep of who is alive. arp-scan is the bluntest tool for a local subnet because it works at layer 2 and returns the MAC vendor for free:

sudo arp-scan --localnet

That gives you IP, MAC and a vendor guess from the OUI (the first half of the MAC, which identifies the manufacturer). For a subnet nmap doesn't need root to do, a ping sweep:

nmap -sn 192.168.1.0/24

To see open ports and services on a host, go deeper. This is where the useful detail lives, because a printer speaking IPP on 631 or a NAS offering SMB on 445 tells you what a device actually is:

sudo nmap -sS -sV --top-ports 100 192.168.1.0/24

For hostnames, nmap already resolves DNS. mDNS names (the .local ones Apple and Chromecast devices announce) need avahi-browse -a, and NetBIOS names come from nmblookup. Piecing those three together by hand is the tedious part.

When a GUI helps

The terminal is fine for a one-off. It gets old when you want to watch a network over time, sort devices by vendor, or hand the result to someone who doesn't live in a shell. A GUI is worth it when you need presence monitoring (which device dropped off, which one is new), a topology view, or a security summary you don't have to assemble from four commands. Zenmap covers the nmap-visualisation case; it stops there.

What permissions does a Linux scanner need?

Raw packet capture and SYN scans need elevated rights on Linux. Running everything with sudo works but is heavy-handed. The cleaner approach is a file capability, which grants one binary the specific privilege without making it root:

sudo setcap cap_net_raw,cap_net_admin=eip /path/to/binary

cap_net_raw lets a process open raw sockets for ARP and SYN scanning; cap_net_admin covers interface-level operations. Without one of these, a scanner falls back to a plain TCP connect scan, which is slower, noisier and misses the MAC layer. Any Linux network scanner runs into this, so it's worth understanding rather than reflexively reaching for sudo.

Running DeviceShelf natively on Linux

DeviceShelf is a local-first scanner that does the terminal work in one pass and keeps the result. It resolves MAC vendor, hostname (DNS, mDNS and NetBIOS together), an OS and device-type guess, open ports and services, then rolls a prioritized security report on top: exposed Telnet or RDP, default-credential checks, risk scores. It also keeps watching, so a new device on the LAN triggers an alert instead of waiting for your next manual scan.

It ships as an AppImage, a .deb and an .rpm, so it runs on Debian, Ubuntu, Fedora and most of what's downstream. The Linux install page has the packages and the one setcap line to enable full capture. There's also a headless server edition (Docker or a systemd service) if you want a homelab box scanning around the clock. No account, no telemetry, and the license check works offline.

If you're weighing it against nmap, Fing or Angry IP Scanner, the comparison page lays out what each one does and doesn't do.

You can try the full version on your own network first: there's a free 7-day trial, no account needed. One-time €59 after that, no subscription.