XDA recently walked through a problem most people never think about: your router’s admin page is probably reachable from the public internet. Remote management gets flipped on for a support call, a firmware update quietly re-enables it, or the box shipped that way from your ISP. The result is a login prompt sitting on your WAN address that anyone with a scanner can find. The best apps for checking whether your router’s admin page is exposed give a non-expert a way to look at their own public IP the way an attacker would, and to catch the same problem on IoT devices, NAS boxes, and old smart hubs that end up with ports open.
We picked seven desktop apps that run on Windows, macOS, or Linux, cover both an outside-in view and an inside-the-LAN sweep, and stay usable if you have never opened a terminal.
What to look for in a router exposure audit app
- Outside-in scanning. The check that matters is what your router looks like from a random address on the internet, not what it looks like from your couch. Pick apps that can scan your public IP directly, or that lean on a third-party scanner cloud so the request comes from outside your network.
- Common admin ports covered. Web admin sits on 80 and 443, alternative admin on 8080, 8443, 8888. SSH is 22, Telnet 23, UPnP 1900, and remote desktop 3389. A useful audit tool tests all of these and reports service names, not just port numbers.
- Beginner-safe defaults. A tool aimed at IT pros can be dangerous if a first-time user aims a full scan at the wrong subnet. Look for a saved profile like “quick scan” or “home audit” that limits noise.
- A readable report. The output should say “port 8443 open, appears to be your router login page” in plain language, not a raw table of TCP flags.
- Local execution. Nothing that requires uploading a full network diagram to a vendor cloud you have never heard of. Local scanning keeps the LAN map on your machine.
- A follow-up path. Once a tool finds an exposed port, you need a way to prove what is behind it. Packet-level inspection or a script scan that grabs the login banner is what separates a real audit from a guess.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price |
|---|---|---|---|---|
| Nmap | Deep scans of your public IP and LAN | Windows, macOS, Linux | Fully free | Free |
| Fing Desktop | One-click home network and internet exposure check | Windows, macOS | Free basic | Paid Premium subscription |
| Shodan Monitor | Seeing your public IP the way attackers already do | Web + CLI on all desktops | Free tier | One-time membership fee |
| Angry IP Scanner | Fast cross-platform port sweep with a friendly GUI | Windows, macOS, Linux | Fully free | Free |
| Advanced IP Scanner | Point-and-click LAN audit on Windows | Windows | Fully free | Free |
| SoftPerfect Network Scanner | Detailed LAN inventory with UPnP and shared resources | Windows, macOS, Linux | Free for personal use | Paid commercial licence |
| Wireshark | Confirming what a suspicious open port actually speaks | Windows, macOS, Linux | Fully free | Free |
1. Nmap — best for deep scans of your public IP and LAN
Nmap is the reference port scanner and the tool an incident-response engineer opens first. Point it at your public IP (nmap -sV your.wan.ip.address) and it reports every open port with a service guess, so a stray router login page or a forgotten IP-camera stream shows up in a single command. The Zenmap GUI ships alongside the CLI and gives a topology view and saved scan profiles for people who prefer not to memorise flags.
Where it falls short: The output assumes some networking familiarity. Aggressive scans can trip your ISP’s abuse detection if repeated against random targets, so keep it aimed at your own address.
Pricing:
- Free: Fully open source
- Paid: None
Platforms: Windows, macOS, Linux
Download: nmap.org · Zenmap GUI
Bottom line: The single most useful tool on this list and the one to install first.
2. Fing Desktop — best for a one-click home network and internet exposure check
Fing Desktop is the friendliest option in the category. Install it, click Scan, and it lists every device on your LAN with a vendor guess and an icon. The Internet Balance and network vulnerability checks probe from Fing’s own cloud so they see your public IP the same way an outside scanner would, and they flag open admin ports without needing you to enter a command. Consumer-grade audits do not get more approachable than this.
Where it falls short: The deepest external checks sit behind the paid Premium tier. Linux users need the mobile app or a browser session; the desktop client covers Windows and macOS only.
Pricing:
- Free: Basic device discovery and one-off checks
- Paid: Fing Premium subscription for continuous monitoring and full vulnerability reports
Platforms: Windows, macOS
Download: fing.com
Bottom line: The right pick if you want a scan you can hand to a non-technical family member.
3. Shodan Monitor — best for seeing your public IP the way attackers already do
Shodan is a search engine for internet-exposed devices, and Shodan Monitor is the free-tier tool that lets you claim your own address and get an alert whenever a new port opens on it. Because Shodan crawls the whole IPv4 space continuously, the report shows what a random attacker already sees today rather than a fresh scan from your own network. The CLI (shodan host your.wan.ip.address) prints the same data in a terminal for scripting.
Where it falls short: Requires a Shodan account and a paid membership to monitor more than a small number of IPs or to see historical banner data. It is a lookup, not a live scan, so a service you closed an hour ago may still show as open until Shodan rescans.
Pricing:
- Free: Basic Shodan Monitor for a small number of IPs
- Paid: One-time membership fee for higher limits and history
Platforms: Web dashboard plus CLI on Windows, macOS, Linux
Download: monitor.shodan.io · Shodan CLI
Bottom line: The outside-in check that catches what a local scan cannot.
4. Angry IP Scanner — best for a fast cross-platform port sweep with a friendly GUI
Angry IP Scanner is the small Java app most engineers keep in a tool folder. Point it at your LAN range or a single public IP, tick the ports you care about (22, 23, 80, 443, 8080, 8443, 1900), hit Start, and export the result to CSV or XML. Runs the same way on Windows, macOS, and Linux, which matters if your household mixes operating systems.
Where it falls short: Reports are functional rather than pretty. No continuous monitoring; each run is a snapshot. Requires a Java runtime on some platforms.
Pricing:
- Free: Fully open source
- Paid: None
Platforms: Windows, macOS, Linux
Download: angryip.org
Bottom line: The cross-platform default when you want a scan done in the next five minutes.
5. Advanced IP Scanner — best for a point-and-click LAN audit on Windows
Advanced IP Scanner is the Windows-first tool many home users and small-office admins default to. A single click walks the local subnet, returns device names, MAC addresses, vendors, shared folders, and open web ports, and lets you right-click a router to open its admin page in a browser. Useful for confirming that the login prompt you found on port 8080 is in fact your router and not a compromised IoT device.
Where it falls short: Windows only. Focused on LAN inventory rather than public-IP exposure; pair it with Nmap or Shodan for the outside-in view.
Pricing:
- Free: Every feature
- Paid: None
Platforms: Windows
Download: advanced-ip-scanner.com
Bottom line: The gentlest introduction to network scanning on Windows.
6. SoftPerfect Network Scanner — best for a detailed LAN inventory with UPnP and shared resources
SoftPerfect Network Scanner (often shortened to NetScan) is the paid-but-generous cousin of Angry IP Scanner. It walks a subnet, resolves hostnames, MAC vendors, and shared resources, checks TCP and UDP ports, and reads SNMP and UPnP data from any device that answers. That UPnP detail matters for router exposure work: if a game or torrent client has silently punched a port through your router with UPnP, this tool finds it.
Where it falls short: Free for personal use, but continuous or commercial use expects a paid licence. Some of the deeper features are Windows only in practice.
Pricing:
- Free: For personal use
- Paid: Commercial licence for business use
Platforms: Windows, macOS, Linux
Download: softperfect.com
Bottom line: The tool to reach for when you want more detail than Angry IP Scanner returns.
7. Wireshark — best for confirming what a suspicious open port actually speaks
Wireshark is the packet analyser you open after another tool tells you port 8443 is answering and you want to know what is actually behind it. Capture on your WAN interface, filter with tcp.port == 8443, and the request and response bytes make it obvious whether you found your router’s admin page, a leftover camera stream, or a device you had forgotten was still online. It is the same tool network engineers use for hard investigations, and the download page ships installers for every major desktop.
Where it falls short: The learning curve is real. If you do not know what a TCP handshake looks like, the capture reads as noise. Overkill if all you want is a yes-or-no answer on whether a port is open.
Pricing:
- Free: Fully open source
- Paid: None
Platforms: Windows, macOS, Linux
Download: wireshark.org
Bottom line: The follow-up tool that turns a port scan finding into a certain answer.
How to pick the right one
If you have never scanned a network before, start with Fing Desktop. Its Internet Balance check answers the “is my router admin page exposed” question with one click, and its LAN view catches the smart plug you forgot about. Add Shodan Monitor as a free alert so you find out when a new port opens without having to remember to run a scan.
If you are comfortable with a terminal or a scan profile screen, install Nmap and Zenmap as your primary tool and use Advanced IP Scanner or Angry IP Scanner as the daily LAN sweep. Nmap against your public IP gives the authoritative outside-in view; the LAN scanner tells you which device on your network is actually behind an open port.
If your goal is a repeatable audit for a home lab or a small office, add SoftPerfect Network Scanner for its UPnP and shared-resource visibility, and keep Wireshark on the same machine for the moments when a scan finding needs a proper explanation. Skip anything that ships the map of your LAN to a cloud you do not control.
FAQ
Is it legal to scan my own router or public IP? Yes. Running a port scan against equipment you own and an internet connection billed to you is not a legal problem in any major jurisdiction we know of. Scanning someone else’s public IP without permission is a different story and can violate computer misuse laws, so keep the scan aimed at your own address.
How do I find my public IP to scan?
Any of the tools above accept a hostname or IP as the target. To find yours, open a browser on the same connection and search for “what is my IP”, or run curl ifconfig.me in a terminal. That address is what the tools should target for the outside-in check.
What if the scan shows my router admin page is reachable from the internet? Log into the router’s admin page from inside the LAN, find the Remote Management, WAN Access, or similar setting, and turn it off. Then rescan from Shodan or Nmap to confirm the port is closed. If the router does not offer that setting, contact your ISP or replace the unit; a device that cannot hide its admin page belongs in a landfill.
Do these tools work for IoT devices, not just the router? Yes. Point the same scanner at the IP of a smart camera, NAS, printer, or hub and it reports the same list of open ports. IP cameras with an exposed web interface on port 80 or 8080 are one of the most common findings on home networks.
Do I need to run these scans over a VPN? No, and a VPN will actually get in the way of an outside-in check because it changes the source address of your scan. Run the outside-in tests (Shodan, or Nmap targeting your public IP) from a normal connection so you see the same address an attacker would.
How often should I rerun an audit? Once at install time, again after any firmware update, and any time you add a device that speaks to the internet. Shodan Monitor covers the day-to-day case by alerting on new open ports, so you do not have to remember to rescan yourself every week.