An XDA piece this week described the four small network utilities the author keeps on a USB stick that never leaves the backpack. The pitch is simple: when a router is unreachable, when DNS is answering wrong, or when a printer that worked yesterday has vanished, you want tools that boot on someone else’s Windows machine in ten seconds without an installer, admin approval, or a sync from OneDrive that hasn’t happened yet. The seven best apps for a portable USB network toolkit below fit inside 200 MB total on a $6 flash drive.
What to look for in a portable network tool
- True portability. The executable runs from the USB stick without writing to
Program Files, without an installer, and without registry keys that persist. Many “portable” builds still write to%APPDATA%; verify with Process Monitor once before you trust it. - No admin required, or a clean admin fallback. Packet capture and low-level ICMP often need admin; scans and lookups should not. A good toolkit works at both privilege levels.
- Signed binary or reproducible source. Someone’s Windows machine may block unsigned executables under SmartScreen. Prefer a signed build; keep the SHA-256 in a text file on the stick.
- Clear license. Every app below is free for the sort of home and small-shop use most readers will actually do; two are open source and two are freemium with a functional free tier.
- Handles both v4 and v6. IPv6 is finally common enough on home networks that a scanner that can’t see it is missing half the traffic.
Quick comparison
| Tool | Best for | License | Portable executable | Admin required |
|---|---|---|---|---|
| Nmap (Zenmap) | Deep scans, service and OS detection | Open source | Yes | For SYN scans |
| Angry IP Scanner | Fast subnet sweep | Open source | Yes | No |
| Advanced IP Scanner | Windows share and RDP discovery | Freeware | Yes | No |
| WinMTR | Traceroute + ping in one view | Open source | Yes | No |
| PuTTY | SSH, serial, telnet to routers | Open source | Yes | No |
| Wireshark Portable | Packet capture and analysis | Open source | Yes | Yes (Npcap) |
| Fing Desktop | Friendly LAN inventory and speed test | Freemium | Installer, USB copy works | No |
1. Nmap (Zenmap), Best for the “what is that device” moment
Nmap is the tool you want when you already know something is on the network and want to know what. Zenmap is the GUI wrapper. Both the CLI and Zenmap run from a portable copy on the stick, though SYN scans need admin. The “quick scan” profile finds live hosts and open ports in under thirty seconds on a /24. The “intense scan, no ping” profile catches devices that ignore ICMP but still answer TCP, which is most consumer smart-home gear from the last three years.
Where it falls short: Nmap’s output is verbose. On a strange machine, run a shorter scan first, or pipe through --top-ports 100. The full 65k-port sweep is rarely what you actually need.
Pricing: Free and open source.
Bottom line: Every USB network kit starts here. Nothing else replaces it.
2. Angry IP Scanner, Best for a fast, no-admin subnet sweep
Angry IP Scanner is what you reach for when you don’t need Nmap’s depth. It sweeps a /24 in a few seconds, resolves reverse-DNS, and shows MAC vendor prefixes so you can spot the phone, the printer, and the thing you don’t recognise. The single-executable portable build fits on the stick and runs without admin, which is the whole point.
Where it falls short: Fingerprinting is thin. If you need to know a device’s actual OS and service versions, escalate to Nmap.
Pricing: Free and open source.
Bottom line: Boot this first. Escalate to Nmap only if a device looks interesting.
3. Advanced IP Scanner, Best for Windows shares and RDP shortcuts
Advanced IP Scanner from Famatech is the Windows-flavoured cousin of Angry IP Scanner. It surfaces SMB shares, offers a right-click to RDP, and reads NetBIOS names, which is exactly what a small office network wants. It runs from the USB stick as a single portable executable, no installer. Compared to Angry IP Scanner it’s a little slower on the sweep but hands you more useful right-click actions on Windows-heavy networks.
Where it falls short: Freeware, not open source. Read Famatech’s license before deploying commercially.
Pricing: Free.
Bottom line: Keep this on the stick alongside Angry IP Scanner. They complement each other on Windows LANs.
4. WinMTR, Best for finding where a slow connection breaks
WinMTR is a Windows port of the classic mtr traceroute-plus-ping tool. It shows every hop between you and a target with rolling loss and latency statistics, which is exactly how you prove that “the internet is slow” is actually “hop 4 at the ISP is dropping 12 percent.” The Sourceforge build is a single executable, portable, and no-admin.
Where it falls short: WinMTR has not seen active development in a while; the newer BestTrace and PingPlotter are more polished. But WinMTR runs from the USB stick without complaint, which is what matters here.
Pricing: Free and open source.
Bottom line: Anytime a network is “slow but connected”, run this to five hops past the customer’s router.
5. PuTTY, Best for talking to routers, switches, and console ports
PuTTY is the SSH client every network admin has used at least once. On a portable stick it lets you log in to OpenWrt routers, managed switches, and any serial console with a USB-to-serial cable. The portable build persists sessions inside its own folder, so a stick that has visited five sites remembers all of them.
Where it falls short: The UI has aged. If you want tabs and a modern skin, keep PuTTY on the stick as a fallback and add MobaXTerm Portable or Termius as a primary. But PuTTY works on anyone’s Windows box.
Pricing: Free and open source.
Bottom line: Belongs on every stick, forever.
6. Wireshark Portable, Best for the “why won’t this work” packet dive
Wireshark Portable, packaged by PortableApps, is a full Wireshark install that runs from the USB stick. It does need Npcap installed on the host to capture live traffic, which means admin, but a pre-installed Npcap on a home PC is common. Wireshark’s display filters (http.host contains netflix, dns.qry.name, ip.addr==192.168.1.55) turn a live capture into an answer in seconds.
Where it falls short: Wireshark on a shared machine is heavy: it can pull hundreds of MB of RAM on a chatty network. Use a capture filter (host 192.168.1.55) rather than a display filter for long runs.
Pricing: Free and open source.
Bottom line: The court of last resort. If nothing else has explained the problem, Wireshark will.
7. Fing Desktop, Best for a friendly LAN inventory in one click
Fing Desktop brings the phone app’s device fingerprinting and speed testing to Windows. It is not a true portable app, but the installer is small and lives happily on a USB stick for repeated installs on strange machines. Its device database is stronger than any of the scanners above, so “brand new device, unknown vendor” is often actually named by Fing when Nmap only shows a MAC prefix.
Where it falls short: The account-required tier is annoying, and Fing pushes its Fingbox hardware. The free tier does everything covered here.
Pricing: Free tier for LAN discovery and speed test. Premium tier unlocks alerts.
Bottom line: A friendly first pass when a stranger’s network is a black box.
How to pick your first stack
Not everyone needs all seven. If the stick is fresh and you want a minimum viable toolkit:
- On any Windows box, no admin: Angry IP Scanner + WinMTR + PuTTY. Diagnoses 80 percent of home-network problems.
- You expect admin at some sites: add Nmap (Zenmap) + Wireshark Portable. Now you can go deep when the fast tools miss.
- Small business networks: add Advanced IP Scanner + Fing Desktop. Better on Windows-flavoured LANs.
Keep a plain text README.txt on the stick with each tool’s SHA-256 and license. Sanity for future you.
FAQ
Do these run without installing anything on the host machine?
All except Fing Desktop are true portable executables. Fing needs an installer, but does not persist configuration in the host registry once uninstalled. Wireshark’s Npcap driver does install; that’s the trade-off for live packet capture.
Can we use these on a work laptop with SmartScreen or EDR?
SmartScreen will warn on the first launch of any unsigned or rarely-executed binary. EDR products often quarantine Nmap and Wireshark. Talk to IT before running these on managed hardware. On personal hardware, all seven are safe and widely deployed.
Does the stick’s write speed matter?
Only for Wireshark’s packet captures. A $6 flash drive works for the other six. If you plan to capture more than a few seconds of live traffic, use a USB 3 stick or capture to the host’s SSD.
What about Linux and macOS versions?
Nmap, WinMTR (as mtr), PuTTY, Wireshark, and Angry IP Scanner all exist on Linux and macOS, though the “portable executable from a stick” pattern is Windows-native. For cross-platform sticks, consider a Ventoy setup with a small Linux ISO that has these tools pre-installed.
Which one catches an unknown device on my LAN fastest?
Fing Desktop or Angry IP Scanner. Both surface the device inside ten seconds; Fing usually names the brand as well.
