Device types, from a home-network field report: six switches listed as routers, two UPS units and a TV listed as switches, a managed switch listed as IoT. Each case was reproduced against the classifier and corrected for the general case, then checked against a frozen corpus of real devices and a live scan before shipping. Plus a one-click way to set the type yourself when Subnetlens is not sure.
Fixed
- Web-only switches are switches. A device from a network-gear brand that shows only its web page and offers no DNS, DHCP or VPN service used to land on an exact tie between router and switch, and the tie fell to router. It falls to switch now; a device that really routes keeps its label.
- A ping alone no longer earns a type. A network stack that starts at TTL 255 is network gear, but also the stack inside most smart devices, so "answered a ping and nothing else" used to make UPS units, TVs and smart-home controllers read as Switch or Router. TTL now counts only when a network vendor or a management port backs it; otherwise the device is Unknown, with the TTL kept as the one reason shown.
- APC and Schneider Electric devices are recognised as UPS and control equipment, LG Innotek modules as appliances, and Dell PowerConnect greetings as switches.
Added
- "Set type" on Unknown and low-confidence devices. The card, the table row and the details panel show a one-click hint that opens the type picker. Your choice is kept across scans and restarts, and the hint disappears once a type is set by hand.
- Video tutorial. An 11-minute walkthrough of every page is on YouTube, linked from the site and from the app's Help & Tour page.
Hardening of the 1.2.1 guard, from an independent review run the same evening. 1.2.1 was right on the case it was built for, a single local subnet; 1.2.2 makes sure it never guesses anywhere else.
Fixed
- Never outside your own subnet. The "answered TCP but never on the network" rule now judges each host against your PC's own interface subnets. On a /16 scan or a range across VLANs, hosts reached through the router can never be removed, and the PC itself is never a candidate. Two or more such hosts are needed before anything is removed at all.
- The check address is always your own subnet's network address, never the typed range's: a /24 typed inside a bigger subnet has a valid host at its ".0". Explicit ranges get the same check as the CIDR form.
- One refused port cannot blind the scanner. When the check address refuses a single port (an outbound block on the path), only that port loses its liveness credit; hosts that block ping but refuse every other port are still found.
- The check announces itself in the scan log and is a little faster.
The honest-online fix: security software that answers connections on behalf of every address can no longer make a whole range show as online. A field report (254 of 254 devices online, each with no MAC address and exactly the mail ports open) traced to Norton Email Protection; the scanner now asks an address that cannot exist before it trusts a TCP answer.
Fixed
- Software that answers for every address no longer creates devices. Before TCP discovery the scanner probes the range's own network address, where nothing can live. Any port that answers "open" there is answered by software on your PC or its path (an antivirus mail shield such as Norton Email Protection on ports 25, 110 and 143, a web filter or captive portal, a VPN or security client). That port is skipped for the rest of the scan on every host, and the scan log says which kind of software is doing it. Skipped ports read as "not scanned this time", never as closed.
- On your own subnet, a TCP answer with no MAC address is not a device. A host reached over TCP must have appeared in ARP by the end of the sweep; one that never did was never on the wire, so it is left out and counted in the scan log. Applied only where your PC has an ARP-capable interface on the range, so a VPN tunnel never trips it.
- A firewall or VPN that resets unused addresses no longer turns every address into a device: when the probe address is refused rather than answered, a refusal alone stops counting as proof of life for that scan. Ports are still checked, so a real host's closed ports stay closed.
- The scan summary says how many ports were skipped and how many addresses were left out.
Changed
- No guessing on numbers alone: a routed segment of identical servers with ping blocked looks the same as a proxy from outside, so without a probe hit the guard never removes devices on statistics. Pinned by a test.
- If your device list was affected: install this update, open Settings, Data, run Soft reset, then scan once.
The Port Watch release: watch the ports that matter on every scan, one honest vocabulary for port states everywhere, the common port set visible in Settings, and a scanner that keeps names and types steady when a lookup fails.
Added
- Port Watch page (Pro): tell the scanner which extra ports to check on every device (up to 32) or on one device (up to 16 more), and see each of them after every scan as open, closed, no answer or not scanned yet, with when it was last checked and when it last changed. A port outside a scan is never called closed. Every open or close also lands in Radar, the port history and your webhooks.
- The common port set is visible: Settings lists exactly which ports every scan checks (33 decide whether an address is alive, 45 TCP plus 7 UDP on every live host), and the scan summary says how many were checked per device, plus your watched extras.
- One vocabulary for port states across Port Watch, Explorer Ports and the Devices port history, which gains the "open, not scanned this time" state.
- Device type changed is a new Radar event, carried by webhooks too. It fires once per real change, never on a flap.
- Scan quality now reports how the name step went: attempted, resolved and timed-out lookups, and whether the gateway was probed gently.
Fixed
- Names stay: a name lookup that times out no longer erases a known device name. The last name is kept and marked as coming from an earlier scan, on the map and in Devices.
- Types stay: a device type no longer flips between scans on thin evidence. A known type is kept until a better-founded verdict, or the same new verdict twice in a row. Sentinel sweeps now keep everything a full scan learned, so this works for Sentinel users too.
- Not scanned is not closed: a port the scan did not ask about is carried untouched, with no closure, no event and no port-history entry.
- Late refusals count: some host firewalls delay the "closed" answer by about two seconds. The scanner now waits three seconds per port on live hosts, so those ports read closed instead of "no answer".
- Gentle gateway: the router is probed in the last batch with at most 8 connections at a time. Some home routers treated the old burst as an attack and blocked the scanning PC for two minutes, exactly while names were being looked up.
- Bounded name lookups: up to 6 seconds each within a 30 second budget for the whole step, and the scan log says when most lookups failed instead of shipping a nameless map in silence.
- A different MAC seen only at layer 2 for a silent host no longer takes over the old record; a new device inherits nothing from the old one.
- Scheduled scans no longer stamp "checked now" on ports they never touched.
Changed
- The per-port wait on hosts already known to be alive is 3 seconds (was 1). A full scan of a busy subnet takes a few seconds longer.
- Devices with a randomized (private) MAC address are classified by their name, since such a MAC can never resolve a manufacturer.
The reliability release: the app always appears when you launch it, every feature ships enabled, and failures finally speak up instead of staying silent.
Fixed
- The app always appears on launch: on some computers (especially right after installing, or after a restart) the first double-click started Subnetlens hidden in the tray and only a second click revealed it. The window now always shows itself within half a second of launch.
- Silent update button: the in-app update banner could fail to download or install without saying anything. It now shows what went wrong and offers a working Retry.
- Monitoring honesty: if a background listener fails to start, you now get a clear warning instead of a green light over a half-working monitor.
- Profile subnet protection: a rare timing bug could silently replace a saved profile's subnet (a VPN or remote site network) with your local network. Saved profiles are now safe.
- Small screens: the window now fits 1366x768 laptops and high Windows display scaling instead of hanging below the taskbar.
- Admin launchers: opening an admin command prompt or PowerShell now works for Windows usernames containing spaces, and stored credentials pass through correctly.
- Starting a scan, saving a setting, or deleting a webhook now reports failures clearly instead of doing nothing.
- A brand-new user who closed the app during the welcome tour no longer comes back to a frozen menu.
Changed
- Every feature ships enabled: Risk Overview, IPAM, Sentinel, scan history, baselines, trend graphs, the map timeline, HTML reports and SNMP topology no longer ship switched off in Settings. Existing installs are updated once; your later choices stick.
- Instant launch feedback: a small starting screen appears the moment you launch, so slower computers never show a blank dark box.
- If the app window ever fails to load (for example an antivirus holding new files), you get a plain explanation and a pointer to the antivirus help page instead of a black screen.
- The top-left corner now shows the real Subnetlens lens logo.
- The window fits itself to your screen's working area on first launch.
The monitoring honesty release: a calmer, truthful activity feed, nothing scans without your say so, and every file in the installer is now signed.
Added
- Ask before monitoring resumes: if Monitoring was on when the app closed, Subnetlens now asks before turning it back on instead of starting by itself. Nothing scans your network without your say so.
- Quiet device probe: devices your computer's address cache had forgotten are pinged before anything is called offline. This ends false "went offline" waves on busy networks.
- Honest "cannot measure" state: if your own computer loses its network connection, monitoring says so instead of wrongly marking every device offline.
- Trial email: starting the 7 day Pro trial now asks for your email address, so your trial can be recovered and you can hear about updates.
- Launch pricing in the app: all three Pro plans show their launch discount, locked in forever once you buy (until March 1, 2027).
Changed
- Broadcast rollup: repeated broadcasts from one device now update a single feed row with a counter instead of flooding the feed. A device quiet for 30+ minutes that speaks again gets its own honest "Active again" entry.
- Fewer notification popups: routine online/offline changes fold into one summary. Security alerts always come through on their own.
- Feed cleanup keeps real history: when the activity feed reaches its limit, routine noise is removed before meaningful events like port changes and offline reports.
Fixed
- Switching network profiles no longer silently stops the background sweep while the Monitor light stays green.
- Broadcasts from outside your selected network are no longer mistaken for new devices on it.
- Other scanners' network search queries are no longer misread as devices broadcasting.
- Every file in the installer is now digitally signed by HELIOSOFT LTD (a few internal components were not before), which helps antivirus products trust the app.
Same-day fast follow-up from field testing 1.0.0 on a second network: device removal lands, plus a set of clarity and layout fixes.
Added
- Forget devices: right-click any device (Devices, cards, Network Map, Radar) or use the device panel and bulk toolbar to remove it from the list. Devices are never blocked: if a future scan finds one again, it reappears.
- Automatic cleanup of long-offline devices (off by default): pick the age and frequency in Settings. Favorites, renamed and noted devices are always kept, and a "Last cleanup" line shows exactly what was removed.
Fixed
- Port events now read "opened: 902" with port chips; the old "+902" style could be misread as a count of ports.
- Hostname-change events showed "(none) to (none)" instead of the real old and new names.
- The network interface picker listed virtual adapters (VirtualBox, VMware, Hyper-V) before your real one.
- Device cards could get crushed and overflow beside the open details panel on narrow windows.
- Clearer wording in offline evidence and recovery stats.
Subnetlens leaves beta. Five weeks of engine, honesty and polish work since beta.8: scanning that reports evidence instead of guesses, one unified pipeline behind every number, a 51-finding release audit fully cleared, and a professional icon set across the whole app.
Added
- "Last seen" on every device: the Devices table and details panel now show a dated last-observation stamp, so a status always comes with its evidence.
- Windows taskbar scan progress, export toasts with an "Open folder" button, and date-stamped export filenames.
- Text size setting (Default / Large) and a 12px minimum text size everywhere in the app.
- Calm mass-change question: when many devices appear or vanish at once, the app asks "is this expected?" instead of sounding an alarm.
- Antivirus transparency page: subnetlens.com/antivirus explains detections, our signing identity, and how we resolve false positives with vendors.
Improved
- Honest presence everywhere: "Offline" now means proven gone, "Not seen" means not observed, and a quiet device is never declared gone on one missed reply. Ports only report closed on real evidence.
- One scanning pipeline: manual, scheduled and background scans share one state, one merge and one diff, so every page shows the same numbers.
- Phones with randomized (private) addresses are recognized and labeled calmly instead of raising the loudest "unknown device" alert.
- Notification toggles now govern every notification path; security alerts and mass-change questions are always delivered while notifications are on.
- A professional icon set replaces emoji across the entire app and this website.
- A 90-item interface polish pass: accurate keyboard-shortcut help, consistent copy and dialogs, better keyboard and screen-reader support.
Fixed
- License lifecycle: Pro no longer lapses during long tray sessions, and docking or undocking a laptop can no longer invalidate the license store.
- Data durability: a corrupt settings or data file can no longer stop the app from starting (it is quarantined and rebuilt, never deleted); "Export all data" now exports everything it names.
- Credential hygiene: temporary launcher files are swept at startup and removed on exit.
- Dozens more from the pre-release audit: 51 findings reviewed, all resolved.
Our biggest update yet — scans that pay off with a clear summary, alerts when new risk appears, a free way to test-drive Pro, and a polish pass across the whole interface.
Added
- 7-day free Pro trial — try everything in Pro for 7 days. Start it from inside the app: no card, one trial per machine.
- Scan reveal — every scan now ends with a summary card: total devices found, new arrivals, devices gone offline, and any newly risky ports.
- New-exposure alerts — if a high-risk port (Telnet, FTP, SMB, RDP or VNC) opens on a device that didn't have it before, you get a clear warning on the Dashboard and Risk pages.
- White-label reports (Pro) — export HTML and PDF reports with your own company name and logo, ready to hand to a client.
- Custom development for teams & MSPs — we now build tailored features and custom, white-label versions of Subnetlens to fit your organisation. Higher tiers include free small custom requests; larger work is scoped and quoted up front. Learn more.
Improved
- Command palette (Ctrl+K) now reaches every page, all 26 tools and common actions, and remembers your recent picks.
- Interface polish across the app — smoother dialogs, hovers and page transitions, info cards when hovering the Network Map, a "while you were away" summary, and a new Interface-animations setting that follows your Windows motion preference (or your own choice).
Changed
- Scan history is now free for everyone — it was previously a Pro feature.
- Multiple saved network profiles are now a Pro feature. Free keeps one full network profile of any size. If you already use several profiles on the free tier, you keep them — and scanning is never blocked.
Fixed
- Switching between network profiles could mix up per-network data such as favourites and zones — fixed.
- Scheduled scans no longer interrupt live monitoring, and a failed scan now shows a clear error instead of failing silently.
- The animated border on the Pro upgrade cards could draw large gradient shapes over the Settings and Pro pages on PCs with Windows animations enabled — fixed in the current beta.8 installer. If you downloaded beta.8 in its first hours and see this, simply re-download.
The first code-signed release.
- First signed installer — the installer and app are now code-signed by HELIOSOFT LTD, so Windows can verify your download is authentic and untampered.
- Every "Get Pro" surface inside the app now opens the live checkout through subnetlens.com — no more dead ends for upgrading.
- Downloads served from
dl.subnetlens.com/latest; existing installs move to the signed build automatically via the built-in updater.
Real licensing, a new name, and a direct line to us.
- Live licensing — Pro keys now activate against our licensing service and are then verified offline with cryptographically signed entitlements, including a 7-day offline grace period.
- Removed the bundled
BETA-2026 unlock key — beta access moved to individual, revocable keys.
- Always-on in-app feedback button that reaches support@subnetlens.com directly.
- The app is now Subnetlens (formerly "Network Mapper") — new name, new icon, same tool. Your data and settings carry over untouched.
Device recognition, leveled up.
- Hostname-pattern device identification — a hand-curated database of 1,451 patterns across 13 device categories (phones, routers, printers, cameras, NAS, smart-home, enterprise gear and more) ships inside the installer. No cloud lookups, ever.
- Hostname resolution now runs three methods in parallel (DNS, reverse DNS, NetBIOS) and picks the most reliable answer instead of the first one to respond.
- When a definitive pattern match agrees with the device's hardware vendor, classification locks at high confidence; contradictions are downgraded and explained in "Why this type?".
- beta.5 added the Samsung
CS-s- hostname family after live testing, so Galaxy phones are labelled automatically.
A workshop for every single device.
- Explorer — a single-device workshop inside Control Panel (Pro): browse a device's shared Files, review its Ports, probe its Web endpoints, check its Risk profile, and keep Notes — all in one place.
- Inline TLS and HTTP-header deep-scan probes on any web endpoint a device exposes.
- "NEW since baseline" badge on ports that appeared after the device's first inventory.
- Fixed a credential-vault auto-lock freeze where the UI got stuck at "1s left" with a stale unlocked state.
Devices you can actually recognise.
- Device-identification accuracy pass — friendly device labels with real model names (like "CANON G5000 series") instead of bare IP addresses.
- Device broadcast data (SSDP descriptions, mDNS records) is now fetched and parsed for far richer identification.
- New Help & Tour page with a guided first run for new users.
- Smarter classifier: an honest "unknown" instead of a wrong guess, recognition profiles for NAS boxes, hypervisors, PBXes and more, and contradiction checks that explain themselves.
- A large polish sweep across the Toolkit, Radar magnifier and scheduled scans.
The first public beta.
- First public beta release (under the app's original name, "Network Mapper").
- Live Mode — continuous mDNS + SSDP listeners that catch devices the moment they broadcast, even between scans.
- Per-device port and service history — every scan records which ports opened or closed, with "new since baseline" tracking.
- Prometheus
/metrics exporter for plugging into an existing Grafana / Prometheus stack.
- Settings → Data: export everything, soft reset — plus a large accessibility pass across the app.