This has really got me stumped.
Advanced IP Scanner has the ability to show "dead" entries—devices that were at some point visible on the network, but which are no longer reachable. Specifically, I can see the devices' last-known host names, NetBIOS names, IP addresses, MAC addresses, and even manufacturers.
This wouldn't be so weird if it weren't for the fact that I still see these even if I disable my network card, clear my DNS cache, and reboot while still disconnected from any network. I don't see this information anywhere else... not in ipconfig /displaydns, not in arp -a, not anywhere else.
The fact that this information persists across reboots and network disconnections implies it has to be stored somewhere on my computer itself. For the life of me, I cannot figure out where these entries are stored. I've searched the registry, the files in my \Windows folder, the application's files, etc. but the entries are nowhere to be found. Furthermore, I've even tried using Process Monitor, API Monitor, etc. to monitor the API calls, but I still cannot figure out where this information is coming from.
Where on my system are these dead entries stored?
Please note that I am NOT asking how to hide the information or anything else. I'm specifically trying to figure out where they are stored on my system.
106 Answers
Our investigation with OP finally narrowed to the particular file that is responsible for keeping mysterious dead entries.
The file that keep results of previous scans located in the file advanced_ip_scanner_MAC.bin that in turn stored in %AppData%\local\temp\Advanced Port Scanner 2. (It keeps text as Unicode characters, so not trivial to find if one searching for ASCII strings.)
Advanced IP scanner uses this file to show disconnected devices that were found with previous scans as dead entries. It could be useful if one need to wake up over WOL some devices, but it could be annoying if you travel between job sites and see such dead entries from others network, so if you don't need to keep results of previous scans, simply delete or rename this advanced_ip_scanner_MAC.bin file
I don't remember what version this appeared, but on the Settings|Options menu, select Misc. There is a button at the bottom of the page to 'Clear scan history'.
Not exactly the most obvious location for that feature, but it is easier than finding the file and erasing that.
1Using Advanced IP Scanner it is possible to clear all of the previous stored information. Navigate to
Settings -> Options -> Misc -> Delete Stored Data.
Worked for me and showed just what was currently on my LAN.
Check your hosts file (I'm assuming windows here).
The location is C:\Windows\System32\Drivers\etc\hosts.
2Not for Advanced IP Scanner but usually you run these commands to reset DNS cache in Windows (order is important):
ipconfig /release *
ipconfig /flushdns
ipconfig /renew *
ipconfig /registerdnsIt's a bit late for an answer, but today I found these files (Windows 10) here:
%HOME PATH%
advanced_ip_scanner_Aliases.bin
advanced_ip_scanner_Comments.bin
advanced_ip_scanner_MAC.binand even with the latest version 2.5.3850, in Settings/Options/Miscellaneous, the [Delete Stored Data] button does not do its job.
So, to have a fresh list, I simply delete these files.
Et voila ! (better late than never)
