Help center

1. Download and install LanFaro from Download (Windows, macOS or Linux). If Windows shows SmartScreen, click *More info → Run anyway* (it happens with new unsigned programs).
2. Link the app to your account. The first time you open it, click *Link*: an 8-letter code appears that you confirm on the web. It is free and you get 14 days of Pro when you sign up. Your password never goes through the app.
3. Press Scan. The app detects your network (for example 192.168.1.0/24) and fills the table: IP, name, vendor, category, system and ports if you tick *Ports*. Next time you open the app you see the last known list right away and it scans by itself.
4. Check the security score (top right). Click it to see what lowers it and what to do.
5. Click a device to open its card: details, advisories with recommendations, 7-day presence, ping, traceroute, Wake-on-LAN, name and notes.

States

• Online: answered in the last scan (amber *no answer* for a sleeping phone that is still connected).
• New: appeared for the first time after the initial scan. The first scan of a network is the *baseline*.
• Offline: was there before and no longer answers.
• "-" as the name: the device does not announce a name of its own; give it one in its sheet. Your own PC is tagged This computer and private MACs show a 🔒. If many devices are unidentified and Monitoring is off, the Identify devices button listens to the network for 90 seconds and scans again.

Security score

A 0–100 figure for the whole network. It subtracts points for risky ports (RDP, SMB, VNC, Telnet…), unencrypted services, unreviewed new devices and unknown vendors. Mark the devices you recognise as trusted and it goes up. Each network's profile is chosen in the *Network* block of the sidebar (Home, Office, Rental or Public Wi-Fi; *Settings → Network profile* is only the default): Office stops counting SMB/NetBIOS on PCs; Public Wi-Fi shows tips for networks you don't own.

New devices without a name

The app lists them in a notice: click each one to name it, or *Mark all as trusted*. With the table checkboxes you can trust, watch, mute or forget several at once.

"Random MAC (private)"

Phones change their MAC address for privacy and show no vendor. That is normal. With *Monitoring* on, passive listening (DHCP, mDNS) usually identifies them by name or model.

Known networks

If you use the laptop on several networks (home, office), the ▾ menu next to *Network* keeps each one with its devices: when you come back, the usual ones do not show as new.

Shortcuts: F5 scan · Esc stop · Ctrl+F search · Ctrl+1…9 and Ctrl+0 sections.

LanFaro never tries passwords, never attacks and never changes your router's settings: it only observes what the network publishes.

• Per-device advisories: exposed Telnet or remote desktop (high), unencrypted FTP, camera with RTSP, SMB, SNMP, a MySQL/MariaDB database open on port 3306 or PostgreSQL, Redis, MongoDB, Elasticsearch, Memcached or SQL Server open to the network (medium), the Docker API without TLS on 2375 (high), NetBIOS or a panel without HTTPS (low), each with what it means and what to do.
• Wi-Fi encryption and WPS: the sidebar shows your Wi-Fi encryption (red if it is open or WEP) and *Checks* shows whether the router announces WPS. The WPS PIN can be guessed in a few hours even with a strong password: if you do not use it, turn it off in the router panel.
• Action plan: what is worth fixing, most serious first, with progress on what is already solved.
• Automatic checks between scans: router MAC changed (possible spoofing), DNS changed, open or WEP Wi-Fi, new risky port, watched device offline, rogue DHCP server (heard by passive listening), twin Wi-Fi with weaker encryption a new device using another one's name and IP conflicts (two devices with the same address).
• Name resolution (LLMNR/NetBIOS): devices that ask the whole network for names, where anyone could answer "that's me" and capture their sign-in attempt (and those looking for the WPAD automatic proxy). LanFaro only listens to those questions.
• File sharing (SMB): on devices with port 445 open, LanFaro opens the SMB conversation without user or password and checks whether they accept SMBv1 (the protocol WannaCry used) and whether they require signing. Checked once a day.
• DNS hijacking: checks that ten well-known sites (Google, Microsoft, PayPal…) lead to servers with a valid certificate; if the router was tampered with, it alerts.
• What the Internet sees of your network: on request, looks up your public IP in Shodan's public InternetDB. LanFaro sends nothing to your IP.
• New device while nobody is home: if People shows nobody home, any new device alerts, even during quiet hours. In each device sheet you can also set allowed hours (light parental control).
• Network segmentation: warns if the router or switch management is visible from the user network (Office profile), if cameras and IoT gadgets share the network with PCs, if a device other than the router serves DNS, and if a UPnP forward points at a camera or at remote desktop (serious).
• Before and after: save a snapshot of the network before fixing things and get a PDF comparing both, with the map (Pro). Great to show a client what changed.
• Rental check: one click looks for cameras and speakers with microphones, unidentified gadgets, the Wi-Fi encryption and exposed services. On screen for everyone; the PDF is Pro or a single report.
• For technicians: approved baseline (every device, port or firmware change shows up as a deviation), availability of watched devices (SLA) and public IPv6 on the network; all of it goes into the compliance report.
• HTTPS certificates of panels (router, NAS, cameras): expired, self-signed, name mismatch or weak keys. Checked automatically after the first scan.
• Firmware with public advisories: matches what each device announces over UPnP (stack, model, version) against a CVE and end-of-life table, without any Internet lookup.
• Router review over UPnP: published port forwards and exposed services.
• Hidden cameras: flags devices that are or look like cameras (useful in rentals). It never accesses the video.
• Guided quarantine: steps to move a doubtful device to the guest network, verified afterwards.
• Compliance report (Business and MSP plans): PDF/HTML with controls, findings and inventory, under your brand.
• One-click technician visit (Business and MSP plans): in *Security*, one button identifies the devices (listens to the network for 60 s and scans ports), saves the "before" snapshot (if this network already has one, it is kept for comparison) and creates the compliance report with your logo. After fixing things, use "Before and after" to show the change.

• Presence: how many devices were connected in each slot (1, 7, 14 or 28 days) and a timeline per device. On the web, each network page shows the same chart.
• People: assign devices to each person (their phone, their laptop) and the app knows who is home; it tells you when they arrive or leave.

Network map

By default, a tree: Internet → router → access points → devices, with the reason for each link on hover ("why is it here"). Collapsible groups, a search that highlights the path, drag to pin a device under another and click for the card. The rings view (router in the middle) is still available from the selector. The map also goes into the before-and-after PDF.

Speed

Download, upload and latency against Cloudflare, with history and a chart. It also measures latency under load and gives a bufferbloat grade from A+ to F (with a bad grade, video calls and games stutter even on a fast line). If you enter your contracted plan in *Settings*, the cards show what % of your plan you get. You can schedule it (hourly, every 6 h or daily; Pro). On the web it is compared with other networks on the same provider.

Internet monitor

Checks the connection every 5 seconds and logs each outage with time, duration and where it broke: your router, the modem, the ISP network or just DNS. With Pro you get a report for your ISP (PDF) with the outages and speed tests, ready to file a claim. With *Upload my scans to the cloud* on, the outages of the last 30 days also show in your web dashboard, on each network's page.

What goes to the cloud

Only with the Cloud box ticked: network name, public IP and, per device, IP, MAC, name, vendor, category and ports. Export or delete everything: *Account* on the web.

Plans

• Free: all local scanning; cloud with 1 network, 3 days of history and up to 25 devices per network.
• Pro (US$5.99/month or 49/year): continuous monitoring and background mode, instant alerts, device watch, scheduled speed tests, 3 networks, 5 linked computers, 90 days, HTML and PDF reports.
• Business (US$29/month or 290/year): for the office or the technician with up to 10 clients: everything in Pro, 10 networks, 365 days, 15 linked computers, shared workspaces, white label, compliance report, a monthly report to each client, the clients dashboard and the one-click technician visit (no API).
• MSP (US$79/month or 790/year): for technicians with up to 25 clients: everything in Business with 25 networks included, 30 linked computers, API and MCP server.
• More than 25 clients? Write to us for a custom plan. Current prices are always on *Pricing*.
• In some countries (for example Colombia, Mexico or Argentina) the annual plan has a regional discount, shown on *Pricing* and applied automatically at checkout; monthly prices don't change.

When you sign up you get 14 days of Pro free, no card. When it ends you move to Free and nothing is charged. Cancel anytime from *Plan & billing*; you keep access until the end of the period.

Single report (one-off payment)

Only need one PDF or HTML report of your network (for your landlord, technician or insurer)? In *Plan & billing* you can buy a single report for US$4.99, no subscription. In the app, when exporting, choose *Use 1 report*: it is only spent once the file is saved.

Two-step verification

On the web, *Account → Two-step verification → Turn on*: scan the code with Google Authenticator, Microsoft Authenticator, 1Password or similar and enter the 6-digit code. From then on, signing in asks for the code after your password, and also before resetting a forgotten password. Recommended for technicians and admins.

Recovery codes: when you turn it on we give you 10 single-use codes. Save them (password manager or paper). If you lose your phone, on the code screen click *Lost your phone? Use a recovery code* and enter one: the second step is removed, your other sessions are signed out and you get a warning email. Sign in with your password and turn it back on. *New codes* replaces them whenever you want (the old ones stop working).

AI agents (MCP)

In the dashboard, *AI agents* brings together the LanFaro chat and the MCP server to connect your own assistant (Claude Desktop, Claude Code, Copilot in VS Code and other MCP clients). Create a key on that page (MSP plan), copy your program's configuration and put the key only in the config file. Everything is read-only.

Video guides

In the dashboard, *Video guides* has a short video for each part of LanFaro, in English and Spanish, for account holders only. From the app, *? Help → Watch this page's video* opens the one for the page you are on. They are being recorded: until then each module says "Coming soon".

• Clients dashboard (*Clients* menu in the dashboard): all your networks in one table, worst first: score, devices online, at risk and unreviewed, last scan, 24/7 agent status and monthly report.
• Monthly report to the client: on each network page you enter the client's name and email; on the 1st of every month they get their network's PDF under your white label with a month summary. Replies come to you and the client can unsubscribe from the email itself. You are responsible for having their permission to email them.
• White label: company, technician and contact under *Account → White label for reports*; the logo is set in the app (*Settings*).

• Continuous monitoring (Pro): tick *Monitoring* and pick the interval (15 s to 1 h). Besides scanning, it listens to the network and detects a new device as soon as it talks.
• App channels: desktop notification with sound, Telegram, Discord, Slack, Teams and webhook (Home Assistant, n8n, IFTTT…). *Test* button on each channel; the ones you have not set up are dimmed.
• Web channels (*Account → Alerts*): email, push notification on your phone or browser (install the dashboard as an app) and WhatsApp (from Pro, with a monthly message allowance, urgent things only: new device, silent agent or critical service open). The 24/7 agent alerts through these channels.
• What to alert and where: a table with each alert type (new device, watched offline and its return ("Resolved", in green), risky port, router/DNS/Wi-Fi change, firmware, quarantine, people, Internet) and each channel.
• Quiet hours: during that slot alerts are only logged, without notifications.
• Digest mode: external alerts (Telegram, Discord, Slack and Teams) grouped every 5, 15 or 60 minutes.
• Muted devices: from the card, for 1 h, 24 h or forever.
• Weekly summary by email (all plans) and a PDF report by email weekly or monthly (Pro, Business and MSP).

A device marked as trusted no longer triggers "new" alerts.

• Automatic updates: when a new version is out, the sidebar shows *Install and restart*; the download is signed and the app reopens by itself. *Settings → Help → Check now* to check manually. In *Settings → Help → Update channel* choose Stable (final versions only) or Beta (new features first).
• Background: when you close the window the app asks whether to quit or stay in the tray (with *Remember my choice*; change it in *Settings → General*).
• Start with the system: *Settings → General* starts LanFaro in the tray when the computer boots, with monitoring as you left it.
• Windows firewall: the first time it may ask whether LanFaro can use the network; allow it on *private networks* so passive listening works.

The agent is LanFaro without a screen: it watches the network as a system service, even with nobody logged in, and uploads to your dashboard. Requires Pro. Download it from Download. Files and services are still named redscan-* (RedScanAgent) for compatibility with existing installs: it is LanFaro.

On Windows, from PowerShell as administrator:

.\RedScan-Agent-windows.exe --link                                   # link (once)
.\RedScan-Agent-windows.exe --install-service --interval 300 --ports
.\RedScan-Agent-windows.exe --service-status

On Linux, the same with sudo ./RedScan-Agent-linux-x86_64 (systemd service). With Docker:

docker run --rm -it --net=host -v redscan-agent:/data ghcr.io/inge2026/redscan-agent --link      # vincular (una vez)
docker run -d --restart unless-stopped --net=host --cap-drop ALL --cap-add NET_RAW --cap-add NET_BIND_SERVICE -v redscan-agent:/data ghcr.io/inge2026/redscan-agent

--net=host is required to see the LAN. If the agent runs on the same PC as the app, the app detects it (*24/7 agent* chip) and does not upload the same thing twice. The agent appears under *Linked computers* and counts as one of your plan.

Install on several computers with a token

On the web, *Account → Install the agent on several computers* creates an enrollment token (rse_…, with a number of uses and days of validity). When installing: .\RedScan-Agent-windows.exe --enroll rse_… --install-service (Windows, as administrator) or sudo ./RedScan-Agent-linux-x86_64 --enroll rse_… --install-service (Linux). Each computer links itself, without typing a code on each one. Revoke the token when you are done.

Requests from the web

On each network page, the *24/7 agent* card shows whether it is reporting and lets you ask for read-only checks: scan now, test speed, traceroute, check certificates and check the router. It never opens tunnels or gives remote access.

Updates and proxy

Installed as a service, the agent updates itself (once a day) on the stable channel, with the signature verified; if the new version does not start, it goes back to the previous one. To try betas, --update-channel beta; to never update, --no-auto-update. If the network only reaches the Internet through a proxy: --proxy http://proxy.company:3128.

Names heard by the agent

On Windows the agent holds the DHCP port used by passive listening, so it shares the names and models it hears (DHCP, mDNS) with the app: the app uses them in the table and the listening indicator shows *DHCP 🛰* in green. If you installed the agent before version 3.0.0-beta.16, run --install-service again as administrator to create the shared folder.

Analysis

How the devices on the network break down: by type, vendor and operating system, and how well LanFaro recognizes them (complete, partial or unrecognized). Hover over each figure to see what it means and click a bar to filter *Devices* to those devices.

Tools

Diagnostics with ordinary queries, without changing anything on your network:

• Wi-Fi scanner: nearby access points with channel, band, signal, encryption and whether they announce WPS. On Windows 11 it needs *Settings → Privacy → Location* turned on to list networks.
• Ping and traceroute to any IP or name (for example google.com).
• DNS lookup: which IP a name has, or which name an IP has.
• DNS comparison: your network's DNS against Cloudflare, Google, Quad9 and OpenDNS; if one is clearly faster, it suggests it.

Did we get it right?

In each device sheet you can answer *Yes* or *No*. If *No*, give the type, system, vendor or model: your correction wins for that device from the next scan on. With a linked account, the device type and its technical traits (vendor prefix, ports, services, DHCP fingerprint) are sent to LanFaro anonymously, never the IP, the full MAC or the name you gave it. That way recognition improves for everyone.

Ask LanFaro (AI assistant)

In a device sheet and in *Security*, the *Ask LanFaro* button answers in plain language: what a device is, whether it is dangerous, how to close a port or what to fix first. It only sends anonymous technical data (device type, ports, services). It is included in paid plans (and a little during the trial) with a monthly allowance that renews every month on your billing date (during the trial, from when it starts); the assistant shows how much you have used. Answers are AI-generated and can be wrong: check them before changing any settings.

In *Sharing* you can invite other LanFaro users by email. They see your networks, devices, events and scans read-only, under *Shared with me*. You can revoke them anytime. Designed for technicians serving clients or small companies with several support people.

Windows says the app is unknown (SmartScreen)

Click *More info → Run anyway*. It happens with new programs without a signing certificate.

Almost every device shows as "Random MAC" or "Unknown"

Normal on networks with many phones. Turn on *Monitoring* (passive listening identifies them) and name them from the card or the web.

A device I know exists does not appear

Some devices do not answer ping (power saving, firewall). LanFaro also reads the ARP table and retries the ones that were there; scan again. If it is on another subnet, type its network in the *Network* field.

The firmware advisory mentions "libupnp" or "miniupnpd"

That is the UPnP stack the device announces, not its firmware. Updating the vendor firmware usually brings a newer stack; if there is no update, turn off UPnP or isolate the device.

The website is slow the first time

The free server sleeps after 15 minutes without use and takes about 30 seconds to wake up. Only the first access is slow.

Emails do not arrive

Check *Account → Alerts* on the web and your spam folder. Instant alerts require Pro; the weekly summary is free.

Linking says "device limit"

Your plan allows a number of linked computers (Free 1, Pro 5, Business 15, MSP 30). Unlink one under *Linked computers* or upgrade.

I want to delete everything

*Account → Delete account*: the account, networks, devices, history and subscription are deleted instantly. You can download everything as JSON first.

Only scan networks you own or have permission to scan. LanFaro does not intercept traffic, does not try passwords and attacks nothing: it uses ping, ARP, DNS/NetBIOS/mDNS/UPnP, TCP connections to well-known ports, the initial SMB negotiation (no credentials) and listens to announcements the network already broadcasts. Your scan runs on your computer and the cloud is optional: in the app, *Settings → What leaves this computer* shows every outgoing connection, whether it is active and when it was last used; usage statistics are off unless you turn them on. Your cloud data is yours: export and delete in one click from *Account*. More in Privacy and Terms.