NetGuard
NetGuard / Network scanner app for iPhone
How it works
Network Scanner App for iPhone: How NetGuard Finds Your Devices
A scan is not magic and it is not guesswork. It is three separate questions asked of your network at the same time, then folded into one list. Here is each of them.
The three signals
What a scan actually asks your network
-
01
A sweep of the subnet
NetGuard works out which addresses belong to your network from your own address and netmask, then probes every one of them in parallel. Whatever answers is alive. This finds devices even when they announce nothing about themselves.
-
02
Bonjour service browsing
Many devices broadcast what they offer: printing, AirPlay, casting, file sharing, HomeKit. NetGuard browses 18 service types and records which addresses answered for which service.
-
03
Reverse DNS
For each address that answered the sweep, NetGuard asks the network what name belongs to it. That is where readable names like a laptop or a media box usually come from.
The three run together rather than one after another, which is why a scan finishes in seconds rather than minutes. The results are merged per address, so a device that answers the sweep and advertises AirPlay and has a reverse DNS name shows up once, not three times.
Reference
The 18 service types NetGuard listens for
Each one is a standard Bonjour service type. If a device on your network advertises any of them, NetGuard will see it and show it in the device profile.
| Group | Service types | Meaning |
|---|---|---|
| Printing | _ipp, _printer, _pdl-datastream | The device accepts print jobs |
| Media | _airplay, _raop, _googlecast | Screen mirroring, AirPlay audio, Google Cast |
| Home automation | _homekit, _hap | A HomeKit accessory or bridge |
| File sharing | _smb, _afpovertcp | Windows or Apple file sharing |
| Remote access | _ssh, _sftp-ssh | The device accepts remote logins |
| Apple pairing | _companion-link, _rdlink | An Apple device, but not which kind |
| Identity | _workstation, _device-info | The device describes itself as a computer |
| Web | _http, _https | A web interface, often a router or a camera |
Detail work
Three small decisions that change the result
-
The router is always in the list
Some gateways ignore probes on principle. NetGuard adds the gateway explicitly if it did not answer, and labels it as router rather than leaving a gap where the most important device on your network should be.
-
AirPlay audio names are cleaned up
AirPlay audio announces itself as a long hexadecimal prefix, then an at sign, then the real speaker name. NetGuard strips the prefix, which also stops the same speaker appearing as two devices under two different names.
-
IPv6 answers are not merged blindly
A device can answer over both IPv4 and IPv6. Merging the two naively creates a phantom duplicate, so NetGuard keeps to the IPv4 address that the sweep already found.
Between scans
How new, returned and missing are decided
Every scan is compared with the previous one and with everything ever recorded on that network. Each device lands in exactly one of four buckets, which is what the change summary at the top of the list is counting.
| State | Means |
|---|---|
| New | Never seen on this network before this scan |
| Returned | Known from earlier, absent last scan, back now |
| Missing | Present last scan, no answer this time |
| Still present | Answered last scan and this one |
Missing is not an error. Phones leave the house and TVs go to sleep. It matters when the device that went missing is one that should never move.
Platform limits
What no iPhone scanner can do
iOS does not expose MAC addresses to apps. On a desktop operating system a scanner reads the hardware address from the local address table and looks up the manufacturer in a public registry. iOS does not permit that, so device identity on iPhone has to come from names and services instead.
The practical consequences are worth knowing before you download anything: a quiet device may show only an address, two identical accessories can be hard to tell apart, and no iPhone app can promise you a manufacturer for every entry. NetGuard states which devices it could not identify instead of inventing a label, and its security score treats unidentified devices as a finding you should resolve.
A permission note that follows from the same rules: reading your WiFi name requires location permission on iOS, because the network name can reveal where you are. NetGuard asks for it only for that purpose, and the app collects no data either way.
Download
Run a scan on your own network
Free and ad supported, iPhone with iOS 17.0 or later. The scan, the device list, the speed test and the ping and DNS tools are all in the free version.
Keep going