1. NMAP (www.insecure.org)
   Will perform network scans, and do a pretty good job of identifying the hardware. As seen in The Matrix
   It's a bit slower on Windows than Unix, but is still a superb tool. Will save you a lot of effort by identifying printers, routers, switches and so-on which you may not be interested in from a anti-virus perspective.
   
2. Ethereal (www.ethereal.com)
   My favorite network packet sniffer. Use this interactively to spot "noisy" devices which are suspicious, or use the text mode "tethereal" in a script to gather active IP addresses. You will need a promiscuous port in a switched environment and it will only monitor traffic which passes through the local network so you will miss peer-to-peer traffic which is entirely in the WAN locale

$arrIPs = pping($arrIPs,30)

for each $ip in $arrIPs

	Shell 'PortQry.exe -n '+$IP+' -e 135 -nr -q'

	if not @error

		$nbt= wshpipe('%comspec% /c nbtstat -A '+$ip+' |find "<20>"',1)

		$name = trim(substr($nbt[0],5,15))

		if $name > ' '

			? $name

		else

			? "unable to resolve "+$ip

			endif 

	else

		? $ip+" is not running Windows or has firewall"

		endif 

	next 





Function PPing($Array,optional $Number)

	Dim $pos, $t, $name, $return, $iter, $run, $ubound

	$ubound=ubound($Array)

	if not $number		$number=$ubound		endif

	$t=''

	While not $pos > $ubound

		$run = ''

		$iter = 0

		Do 

			$run = $run +' '+ $Array[$pos]

			$iter = $iter + 1

			$pos = $pos + 1

			until  $iter > $Number or $pos > $ubound

		$return = WshPipe('%comspec% /c pping /report:ok /times:2'+$run+ ' |find " is ok"',1)

		if VarType($return) & 8192

			for each $Line in $return

				$name = trim(split($line)[0])

				if $name > ' '

					$t=$t+@crlf+$name

					endif

				next

			endif

		loop

	$PPing=split(substr($t,3),@crlf)

	EndFunction