Skip to content
MikroTik RouterOS Docs

IP Scan

IP Scan

Section titled “IP Scan”

The IP Scan tool discovers devices on your network, collecting IP addresses, MAC addresses, DNS names, SNMP information, and NET-BIOS names.

Overview

Section titled “Overview”

IP Scan allows scanning networks in two ways:

  1. Active scanning - Scan a specific IP address range
  2. Passive listening - Listen to an interface and collect information from passing traffic

Collected Information

Section titled “Collected Information”
FieldDescription
addressIP address of network device
mac-addressMAC address of network device
timeResponse time of network device
DNSDNS name of the device
SNMPSNMP system description
NET-BIOSWindows network name

:::warning CHR Free License Limitation /tool ip-scan is not functional on CHR free license. The command returns exit code -1 with no output. To use IP Scan, upgrade to a paid CHR license tier (P1, P10, or P-Unlimited). See CHR Licensing for details. :::

Active Scanning

Section titled “Active Scanning”

Scan a specific IP address range to discover all devices:

/tool ip-scan address-range=10.0.0.1-10.0.0.254

Output:

Columns: ADDRESS, MAC-ADDRESS, TIME, SNMP
  ADDRESS         MAC-ADDRESS        TIME  SNMP
  10.0.0.1        E4:8D:8C:1C:D3:18  2ms  CCR1036-8G-2S+
  10.0.0.2        6C:3B:6B:48:0E:8B  1ms  750Gr3
  10.0.0.3                             2ms
  10.0.0.10       B8:69:F4:B3:1B:D2  0ms  CRS328-24P-4S+

Scan Options

Section titled “Scan Options”
ParameterDescription
address-rangeIP range to scan (e.g., 10.0.0.1-10.0.0.254 or 10.0.0.0/24)
interfaceInterface to listen on for passive scanning
timeoutTime to wait for responses

CIDR Notation

Section titled “CIDR Notation”

You can also use CIDR notation to specify the range:

/tool ip-scan address-range=192.168.1.0/24

This scans all 256 addresses in the 192.168.1.0/24 subnet.

Passive Listening

Section titled “Passive Listening”

Instead of actively querying addresses, you can passively listen on an interface to collect information from traffic passing through:

/tool ip-scan interface=bridge1

This method:

  • Does not generate additional network traffic
  • Collects information from ARP, DHCP, and other broadcast traffic
  • Builds a device list over time as traffic is observed

Use Cases

Section titled “Use Cases”

Network Discovery

Section titled “Network Discovery”

Use IP Scan to discover all devices on a network segment:

/tool ip-scan address-range=10.155.126.1-10.155.126.255

Device Identification

Section titled “Device Identification”

Identify connected devices by their MAC vendor OUI:

MAC-ADDRESS        VENDOR
E4:8D:8C:1C:D3:18  MikroTik
6C:3B:6B:48:0E:8B  MikroTik
B8:69:F4:B3:1B:D2  MikroTik

SNMP Inventory

Section titled “SNMP Inventory”

IP Scan queries SNMP on discovered devices to identify:

  • RouterBOARD models
  • Switch models
  • Other SNMP-enabled equipment

Troubleshooting

Section titled “Troubleshooting”

Not Working on CHR Free License

Section titled “Not Working on CHR Free License”

/tool ip-scan returns exit code -1 with no output on CHR free license. This is a known limitation — despite the command being present in the menu, it does not execute on the free tier.

Workarounds:

  • Upgrade to a paid CHR license (P1 or higher)
  • Use /ip arp print to see passively discovered neighbors
  • Use /ping for targeted host reachability checks
  • Run an external network scanner (e.g., nmap) from a management host

No Devices Found

Section titled “No Devices Found”
  1. Verify the IP range is correct and accessible
  2. Check that devices are online and responding to ICMP
  3. For passive mode, ensure traffic is flowing on the interface
  4. Verify proper network connectivity

Partial Results

Section titled “Partial Results”

Some devices may not respond to all queries:

  • Firewalled devices may block ICMP
  • Devices without SNMP may show blank SNMP column
  • Some devices may not respond to ARP requests

Performance

Section titled “Performance”

Large address ranges take longer to scan. Consider:

  • Breaking large scans into smaller subnets
  • Using passive listening for non-urgent discovery
  • Running scans during maintenance windows on busy networks
Section titled “Related Commands”
  • /tool mac-server print - Show MAC server configuration
  • /ping - ICMP connectivity testing
  • /tool traceroute - Path tracing
  • /tool sniffer - Packet capture
Section titled “Related Resources”