It sends a UDP inquiry packet to a multicast address and listens to the responses, interpreting and reporting those that identify as Hikvision.
This way it does not matter that the PC IP address is on a different IP segment than the responding devices, but they do need to be on the same wiring, ie not behind a routed interface.
Here is a sample response from an NVR. As you can see - it does give a fair bit of detail for nothing.
Code:
<?xml version="1.0" encoding="UTF-8" ?>.
<ProbeMatch>.<Uuid>377581D7-9F0B-4775-9DE0-89988682E405</Uuid>.
<Types>inquiry</Types>.
<DeviceType>41343</DeviceType>.
<DeviceDescription>DS-7816N-E2</DeviceDescription>.
<DeviceSN>DS-7816N-E21620150203AARR503146794WCVU</DeviceSN>.
<CommandPort>8000</CommandPort>.
<HttpPort>80</HttpPort>.
<MAC>c0-56-e3-3d-19-5b</MAC>.
<IPv4Address>192.168.1.211</IPv4Address>.
<IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>.
<IPv4Gateway>192.168.1.1</IPv4Gateway>.
<IPv6Address>fe80::c256:e3ff:fe3d:195b</IPv6Address>.
<IPv6Gateway>fe80::4ff:97ff:fe67:3aa4</IPv6Gateway>.
<IPv6MaskLen>64</IPv6MaskLen>.
<DHCP>false</DHCP>.<AnalogChannelNum>0</AnalogChannelNum>.
<DigitalChannelNum>16</DigitalChannelNum>.
<SoftwareVersion>V3.4.91build 161220</SoftwareVersion>.
<DSPVersion>V5.0, build 161208</DSPVersion>.
<BootTime>2017-01-07 16:15:58</BootTime>.
<OEMInfo>N/A</OEMInfo>.<Activated>true</Activated>.
<PasswordResetAbility>true</PasswordResetAbility>.
<SyncIPCPassword>true</SyncIPCPassword>.
<PasswordResetModeSecond>true</PasswordResetModeSecond>.
<DeviceLock>true</DeviceLock>.
<SupportGUID>true</SupportGUID>.
<SupportSecurityQuestion>true</SupportSecurityQuestion>.
</ProbeMatch>.