Packet Echo for Windows

Packet Echo: free Windows network scanner with LLDP/CDP switch-port discoveryThe toolkit for the whole visit.

Discover the devices, find the switch port, inspect the switch, work out why it is slow, read the capture, and leave your client a report they can use. One Windows application, with Packet Lens built in.

Download free Pro: $79 one-time

Windows 10 & 11Signed installer
Free editionScanning, LLDP/CDP, Diagnose
Pro, per personUp to five of your machines
Offline licenceIncludes future updates

Packet Echo network scanner: 254 addresses scanned, 40 responding, 63 open ports, with hosts listed by address, hostname, type and open ports. MAC and vendor columns are redacted. — Actual application · documentation-range example data

Discover

What’s connected, and where it plugs in.

Scan one address, a range or a whole subnet in Quick, Standard or Deep mode. Responding hosts come back with hostname, MAC vendor, latency and open ports, and the next scan tells you what changed since this one.

Then let Discovery listen for LLDP and CDP: Packet Echo names the neighbouring switch and the exact port this machine is on. It works without Npcap, through Windows’ built-in Pktmon (run as administrator); Npcap is an optional enhancement.

Scan only what you are authorised to inspect. A scan is a point-in-time observation; save the context with your report.
Services, Wi-Fi, Interface and External views fill in the rest of the picture.

Then compare

Scan the same network again and Pro reports what is new and what went missing since last time. Every result can leave as a report, a data file or a ticket note.

Packet Echo scan totals and export actions: Site Packet, HTML Report, PDF Report, Copy Ticket Note, Export CSV, Export JSON and Branding. — Actual application · current build, cropped to unredacted areas

Inspect · Pro

Look inside the switch. Change nothing.

One read-only SNMP v1 or v2c connection gives you the system group, interfaces, the bridge MAC table and spanning tree. Query many switches at once from a pasted list, ranges or CIDR, and each one that answers joins the topology map.

A raw counter cannot tell you whether a port is failing now or failed two years ago. Observe takes a baseline and reports the change, which is the number worth acting on.

Nothing in the switch workspace ever writes to a device. What you see depends on what the device exposes to the community you use.

Packet Echo read-only SNMP switch workspace showing port health for eight ports: state, speed, VLAN, errors, discards, utilisation and a health verdict for each. — Actual application · device names redacted

Diagnose

“Why is it slow?” in about fifteen seconds.

An ordered check of local link, internet path, DNS and throughput, then a plain-English verdict on the most likely reason. The first thing you learn is which hop to stop blaming.

Packet Echo Diagnose workspace: an ordered check of local link, internet path, DNS and throughput, ending in the verdict "Network looks healthy". — Actual application · current build, cropped to unredacted areas

Investigate · Pro

Packet Lens is built in.

The Capture Analysis workspace runs the Packet Lens engine on a local .pcap or .pcapng, streamed from disk, so larger captures work than a browser tab can hold. Guided and Expert views, findings, devices, conversations, a timeline and transactions, with the supporting packets one click away.

A Pro licence also includes Packet Lens Web, the browser edition shown here, for when you are away from your own machine.

Add a finding to your session notes, or copy it into a ticket.
A capture only sees traffic at its capture point. Packet Lens says so when it matters.

Packet Lens in the browser analysing a synthetic capture: four findings ranked by importance, each confirmed and explained, above totals for packets, duration, devices and conversations. — Actual browser application · entirely synthetic capture

Document · Pro

A map that admits what it doesn’t know.

Topology Studio draws what discovery and SNMP found, and labels every link by the evidence behind it. Names, notes, locations and layout you add are stored separately from the scan, so a rescan never overwrites them. Add the unmanaged switch the scan could not see by hand.

Confirmed: both ends agree (LLDP)
Observed: one side reported it
Inferred: from MAC learning
Assumed: no evidence for this path

Packet Echo Topology Studio documentation panel: locations, adding a device by hand, restoring hidden devices, what discovery could not determine, and the confirmed, observed, inferred and assumed link legend. — Actual application · current build, cropped to unredacted areas

Everything in the box

Every workspace, one window.

Grouped the way a visit actually runs. Anything marked PRO needs a licence; the rest works in the free edition.

01Find what is there

Network ScannerAddress, range or subnet. Hostname, MAC vendor, latency, open ports.
Discovery: LLDP & CDPThe neighbouring switch, and the port this machine is on.
Deep ScanA longer, more thorough pass for when the quick scan is not enough.
ServicesWhatever advertises itself over SSDP/UPnP and mDNS: printers, NAS, media boxes.
Wi-FiSignal, band, channel and neighbouring networks, read through the native Windows API.
InterfaceThe local adapter in detail: addresses, gateway, DNS, DHCP lease.
ExternalPublic IP, the ASN and ISP behind it, and a TLS certificate and expiry check.

02Understand how it fits together

SNMP switch workspacePROOne read-only connection, several views: interfaces, MAC-to-port, spanning tree.
Port health and ObservePROWatch errors and discards move while the fault is still happening.
Topology StudioPROThe map, with observed links kept distinct from inferred ones. Arrange, annotate, export.
Scan comparisonPROWhat appeared, what vanished, and what changed since last time.

03Prove what is wrong

DiagnoseOne button, an ordered check: local link, internet path, DNS, throughput.
FindingsSearch a device and see where it is, what is wrong near it, and what to do next.
ConnectivityPing and traceroute without leaving the window.
MonitorContinuous ping against one target: loss, jitter, min/avg/max over time.
Capture AnalysisPROThe Packet Lens engine on a local .pcap or .pcapng, streamed from disk.
Rogue DHCP detectionCatch the second DHCP server nobody admits to plugging in.

04Hand it over

NotesNotes as you go, assembled into a session summary at the end.
Branded reportsPROHTML and PDF carrying your name rather than ours.
Structured exportsCSV and JSON scan data, for whatever you keep records in.
Editable diagramsPROSVG and draw.io topology the next technician can actually edit.
Ticket noteA short written summary, formatted to paste straight into a ticket.
Site PacketPROReports, data, notes and diagrams collected into a single ZIP.

Also in the Toolkit: Subnet calculator · Multi-resolver DNS lookup · MAC vendor (OUI) lookup · Wake-on-LAN · Site profiles · Session event log · TXT and JSON export.

Hand over · Pro

Your findings, with your name on them.

Branded HTML and PDF reports, CSV and JSON scan data, editable SVG and draw.io topology, and a ticket note. The Site Packet collects it all into one ZIP the next technician can pick up.

PDF
HTML
CSV
JSON
SVG
draw.io
Ticket note
Site Packet ZIP

Download a sample topology export

An anonymised Packet Echo topology export: internet, a gateway and example devices, with the link-confidence legend. — Actual exported diagram · device labels replaced with examples

Free edition

Scanning, LLDP and CDP discovery, Diagnose, connectivity tools, Wi-Fi and the Toolkit. No account, no time limit.

Download for Windows

Packet Echo Pro · $79 per person, once

SNMP, Topology Studio, Capture Analysis, branded reports and the Site Packet, plus Packet Lens Web. Perpetual, offline-validated, up to five machines, with every future update included.

See Pro pricing

Discover · Investigate · Document

Start with what’s connected.

Download Packet Echo free for Windows, open Packet Blueprint in your browser without an account, and upgrade when the work calls for it.

Get Packet Echo Open Blueprint free