This is a trivial method but you don't need any additional scanners just cmd on your Windows machine. Assuming that you deal with 24 subnet: You need to ping the broadcast address: ping x.x.x.255 And then display the arp cache: arp -a