A monthly census your future self will thank you for

§ 1The routine

1. Fix a date and a tool

   First Sunday of the month, Angry IP Scanner, same fetcher set every time. Consistency matters more than the particular tool — see its manual for a setup you can repeat half-asleep.

2. Sweep and export

   Same range, same columns, CSV export named 2026-09.csv. The naming scheme is the whole system; keep it boring.

3. Diff against last month

   Open both files side by side, or run a plain text diff on the sorted host columns. New rows and vanished rows are the only output that matters.

4. Investigate the deltas

   A new MAC is usually the espresso machine joining WiFi. A vanished backup server is not usually anything good. Deltas are questions, not verdicts — but unasked questions are how intrusions go unnoticed for quarters.

§ 2Why it works

Attacks on small networks are rarely sophisticated; they are opportunistic and long-lived. A monthly delta asks "what changed?", which is precisely the question an uninvited guest answers badly. You are not building an SOC — you are refusing to be the site that notices a stray device nine months late.

For Windows offices, add a quarterly pass with Network Scanner over the shares, and for managed switches a Toolset port map after hardware changes. Three files a quarter is a documented network.