You scan your network and the scanner reports every address as online: 254 of 254 on a /24, even though you know there are maybe twenty devices. Look closer and the "devices" share three odd traits:
- no MAC address,
- no reply to ping,
- exactly the same open ports on every one of them.
Nothing is wrong with your network. Something on your own PC is answering for every address, and the scanner believes it.
The case that showed us
In September a user wrote to us with exactly this: the Dashboard said 254 of 254 online on his home network. Every ghost had no MAC address, did not answer ping, and showed ports 25, 110 and 143 open. He had Norton installed and no VPN.
Ports 25, 110 and 143 are the mail ports: SMTP, POP3 and IMAP. That was the clue.
Why it happens
A scanner has three ways to decide that an address is "online":
1. Ping
Many devices ignore ping (Windows PCs often among them), so a scanner cannot rely on it.
2. ARP
On your own subnet, a device must answer ARP before anything can talk to it. Reliable, but only for the local subnet.
3. A TCP connection
The scanner tries a few common ports. If a connection is accepted, something is clearly there.
This is where it goes wrongNorton's email protection (the settings "Scan inbound emails (POP3, IMAP4)" and "Scan outbound emails (SMTP)") works as a transparent proxy on your PC. When any program on the PC connects to a mail port, Norton accepts the connection itself so it can scan the mail, before anything leaves the computer.
So the scanner tries port 110 on 192.168.1.37, Norton accepts it, and the scanner concludes that 192.168.1.37 is a live device. Then it does the same for .38, .39 and every other address. The packet never reached the network, which is why no MAC address ever shows up.
Norton is the case we confirmed. Other software that intercepts connections on the PC can produce the same pattern: other antivirus email scanners on the mail ports, web filters on 80 and 443, and some VPN or security clients that answer every connection.
Check it yourself in two minutes
Pick an address on your subnet that you know is empty, for example 192.168.1.250.
-
Open PowerShell and test a mail port on the empty address. If
TcpTestSucceededsays True for an address with nothing on it, something on your PC answered. Try-Port 25or-Port 143too.PS C:\> Test-NetConnection 192.168.1.250 -Port 110 ComputerName : 192.168.1.250 RemoteAddress : 192.168.1.250 RemotePort : 110 InterfaceAlias : Ethernet SourceAddress : 192.168.1.20 TcpTestSucceeded : True
-
Ask Windows whether any device answered ARP at that address. No output means no device is there. A real device on your subnet always shows up here after you try to reach it.
PS C:\> arp -a | findstr 192.168.1.250 PS C:\> # no output: nothing at that address
- Turn off your antivirus email scanning for a minute, run the two tests again, and scan again. If the ghosts disappear, you have found the cause. Turn the protection back on afterwards.
What Subnetlens does about it
Since version 1.2.1, Subnetlens checks for this on every scan:
A canary probe
Before discovery it tries the network address of your subnet, where no device can exist. Any port that answers there is being answered by software on your PC, so those ports are left out of the scan and the scan log names them.
The ARP rule
On your own subnet, a device that "answered" over TCP but never produced an ARP entry was never on the wire, so it is left out of the results.
It tells you
The status line says how many ports were skipped because software on the PC answered them, and how many addresses were left out because they were never on the network.
The user who reported it ran the new version and confirmed his scan was clean.
Subnetlens is a network scanner for Windows with a free version. If your current scanner shows you a wall of ghosts, try it on the same network.