[^<]+)\s*\s*'
+ $tableMatches = [regex]::Matches($body, $tablePattern, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+
+ foreach ($m in $tableMatches) {
+ $label = $m.Groups['label'].Value.Trim()
+ $value = $m.Groups['value'].Value.Trim()
+
+ if (-not $phoneData.MAC -and $label -match '(?i)mac') {
+ $phoneData.MAC = ($value -replace '-', ':').ToUpper()
+ }
+ if (-not $phoneData.Serial -and $label -match '(?i)(serial|machine)') {
+ $phoneData.Serial = $value
+ }
+ if (-not $phoneData.Model -and $label -match '(?i)(model|product)') {
+ $phoneData.Model = $value
+ }
+ if (-not $phoneData.FirmwareVersion -and $label -match '(?i)(firmware|software)') {
+ $phoneData.FirmwareVersion = $value
+ }
+ }
+ }
+
+ # If we got at least one meaningful field, consider it a success
+ if ($phoneData.MAC -or $phoneData.Serial -or $phoneData.Model -or $phoneData.FirmwareVersion) {
+ $phoneData.Success = $true
+ $phoneData.Error = ""
+ }
+ elseif (-not $phoneData.Error) {
+ $phoneData.Error = "Could not parse any fields from status page response"
+ }
+
+ return $phoneData
+}
+
+# ---------------------------------------------------------------------------
+# CSV Output
+# ---------------------------------------------------------------------------
+function Export-PhoneInventory {
+ <#
+ .SYNOPSIS
+ Appends phone inventory data to a CSV file. Creates the file with headers if it does not exist.
+ #>
+ param(
+ [Parameter(Mandatory)]
+ [array]$PhoneRecords,
+
+ [Parameter(Mandatory)]
+ [string]$FilePath,
+
+ [Parameter(Mandatory)]
+ [string]$Site
+ )
+
+ $csvRows = [System.Collections.Generic.List[PSCustomObject]]::new()
+
+ foreach ($phone in $PhoneRecords) {
+ $csvRows.Add([PSCustomObject]@{
+ MAC = $phone.MAC
+ Serial = $phone.Serial
+ Model = $phone.Model
+ FirmwareVersion = $phone.FirmwareVersion
+ IP = $phone.IP
+ SiteName = $Site
+ })
+ }
+
+ $fileExists = Test-Path -Path $FilePath -PathType Leaf
+ if ($fileExists) {
+ # Append without header
+ $csvRows | Export-Csv -Path $FilePath -NoTypeInformation -Append -Force
+ }
+ else {
+ $csvRows | Export-Csv -Path $FilePath -NoTypeInformation -Force
+ }
+}
+
+# ===========================================================================
+# MAIN EXECUTION
+# ===========================================================================
+
+$scriptStartTime = Get-Date
+
+Write-Host ""
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host " Yealink Phone Scanner" -ForegroundColor Cyan
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host " Subnet: $Subnet"
+Write-Host " Site: $SiteName"
+Write-Host " Output: $OutputFile"
+Write-Host " Timeout: ${Timeout}ms"
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host ""
+
+# --- Step 1: Calculate subnet addresses ---
+Write-Host "[INFO] Calculating IP addresses for $Subnet..." -ForegroundColor Yellow
+try {
+ $ipList = Get-SubnetAddresses -CidrSubnet $Subnet
+}
+catch {
+ Write-Host "[ERROR] Invalid subnet: $_" -ForegroundColor Red
+ exit 1
+}
+Write-Host "[OK] $($ipList.Count) host addresses in range." -ForegroundColor Green
+Write-Host ""
+
+# --- Step 2: Ping sweep to populate ARP table ---
+Write-Host "[INFO] Pinging $($ipList.Count) addresses to populate ARP table..." -ForegroundColor Yellow
+
+# Use ping in batches — send async pings using .NET Ping.SendPingAsync for speed
+$pingTasks = [System.Collections.Generic.List[object]]::new()
+$batchSize = 100
+for ($i = 0; $i -lt $ipList.Count; $i += $batchSize) {
+ $batch = $ipList[$i..[math]::Min($i + $batchSize - 1, $ipList.Count - 1)]
+ foreach ($ip in $batch) {
+ $pinger = New-Object System.Net.NetworkInformation.Ping
+ try {
+ $task = $pinger.SendPingAsync($ip, $Timeout)
+ $pingTasks.Add(@{ Task = $task; Pinger = $pinger })
+ }
+ catch {
+ $pinger.Dispose()
+ }
+ }
+ # Wait for this batch to finish
+ foreach ($pt in $pingTasks) {
+ try { [void]$pt.Task.Wait(($Timeout + 500)) } catch {}
+ $pt.Pinger.Dispose()
+ }
+ $pingTasks.Clear()
+ $done = [math]::Min($i + $batchSize, $ipList.Count)
+ $pct = [math]::Round(($done / $ipList.Count) * 100)
+ Write-Host "`r Ping progress: $done/$($ipList.Count) ($pct%)" -NoNewline
+}
+Write-Host ""
+Write-Host "[OK] Ping sweep complete." -ForegroundColor Green
+Write-Host ""
+
+# --- Step 3: Parse ARP table for Yealink MACs within our subnet ---
+Write-Host "[INFO] Scanning ARP table for Yealink MAC prefixes..." -ForegroundColor Yellow
+
+$yealinkDevices = [System.Collections.Generic.List[PSCustomObject]]::new()
+
+# Build a HashSet of IPs in our target subnet for fast lookup
+$subnetIPs = [System.Collections.Generic.HashSet[string]]::new()
+foreach ($ip in $ipList) { [void]$subnetIPs.Add($ip) }
+
+# Parse the full ARP table
+$arpLines = & arp -a 2>$null
+foreach ($line in $arpLines) {
+ $line = $line.Trim()
+ if ($line -match '^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+([\da-fA-F]{2}[-:][\da-fA-F]{2}[-:][\da-fA-F]{2}[-:][\da-fA-F]{2}[-:][\da-fA-F]{2}[-:][\da-fA-F]{2})') {
+ $ip = $Matches[1]
+ $mac = $Matches[2].ToUpper() -replace '-', ':'
+ if ($subnetIPs.Contains($ip) -and (Test-YealinkMac -Mac $mac)) {
+ $yealinkDevices.Add([PSCustomObject]@{
+ IP = $ip
+ MAC = $mac
+ })
+ Write-Host " Found: $ip -> $mac" -ForegroundColor Cyan
+ }
+ }
+}
+
+# Also try Get-NetNeighbor as a fallback (more reliable on Windows 10/11)
+try {
+ $neighbors = Get-NetNeighbor -State Reachable,Stale,Delay,Probe -ErrorAction SilentlyContinue
+ foreach ($n in $neighbors) {
+ $ip = $n.IPAddress
+ $mac = ($n.LinkLayerAddress -replace '-', ':').ToUpper()
+ if ($subnetIPs.Contains($ip) -and (Test-YealinkMac -Mac $mac)) {
+ # Avoid duplicates
+ $already = $yealinkDevices | Where-Object { $_.IP -eq $ip }
+ if (-not $already) {
+ $yealinkDevices.Add([PSCustomObject]@{
+ IP = $ip
+ MAC = $mac
+ })
+ Write-Host " Found: $ip -> $mac (via NetNeighbor)" -ForegroundColor Cyan
+ }
+ }
+ }
+}
+catch {
+ Write-Host " [INFO] Get-NetNeighbor not available, using ARP table only." -ForegroundColor DarkGray
+}
+
+Write-Host "[OK] Found $($yealinkDevices.Count) Yealink devices." -ForegroundColor Green
+Write-Host ""
+
+if ($yealinkDevices.Count -eq 0) {
+ Write-Host "[WARNING] No Yealink devices detected on this subnet. Exiting." -ForegroundColor DarkYellow
+ exit 0
+}
+
+# Display detected devices
+Write-Host " Detected Yealink devices:" -ForegroundColor Cyan
+foreach ($dev in $yealinkDevices) {
+ Write-Host " $($dev.IP) ($($dev.MAC))"
+}
+Write-Host ""
+
+# --- Step 4: Query each Yealink phone's web UI ---
+Write-Host "[INFO] Querying Yealink phone web UIs for inventory data..." -ForegroundColor Yellow
+Write-Host ""
+
+$successfulScrapes = [System.Collections.Generic.List[PSCustomObject]]::new()
+$failedScrapes = [System.Collections.Generic.List[PSCustomObject]]::new()
+
+$deviceIndex = 0
+foreach ($device in $yealinkDevices) {
+ $deviceIndex++
+ Write-Host " [$deviceIndex/$($yealinkDevices.Count)] Querying $($device.IP) ($($device.MAC))..." -NoNewline
+
+ $phoneData = Get-YealinkPhoneData -IPAddress $device.IP -User $Username -Pass $Password -TimeoutMs ($Timeout * 5)
+
+ # If we didn't get MAC from the web UI, use the ARP MAC
+ if (-not $phoneData.MAC) {
+ $phoneData.MAC = $device.MAC
+ }
+
+ if ($phoneData.Success) {
+ $successfulScrapes.Add($phoneData)
+ Write-Host " [OK] $($phoneData.Model) / $($phoneData.Serial)" -ForegroundColor Green
+ }
+ else {
+ $failedScrapes.Add([PSCustomObject]@{
+ IP = $device.IP
+ MAC = $device.MAC
+ Error = $phoneData.Error
+ })
+ Write-Host " [FAILED] $($phoneData.Error)" -ForegroundColor Red
+ }
+}
+
+Write-Host ""
+
+# --- Step 5: Output results ---
+if ($successfulScrapes.Count -gt 0) {
+ # Write to CSV
+ Write-Host "[INFO] Writing $($successfulScrapes.Count) records to $OutputFile..." -ForegroundColor Yellow
+ try {
+ Export-PhoneInventory -PhoneRecords $successfulScrapes -FilePath $OutputFile -Site $SiteName
+ Write-Host "[OK] CSV updated: $OutputFile" -ForegroundColor Green
+ }
+ catch {
+ Write-Host "[ERROR] Failed to write CSV: $_" -ForegroundColor Red
+ }
+
+ # Display results table
+ Write-Host ""
+ Write-Host "==========================================" -ForegroundColor Cyan
+ Write-Host " Scan Results" -ForegroundColor Cyan
+ Write-Host "==========================================" -ForegroundColor Cyan
+ Write-Host ""
+
+ $successfulScrapes | ForEach-Object {
+ [PSCustomObject]@{
+ IP = $_.IP
+ MAC = $_.MAC
+ Model = $_.Model
+ Serial = $_.Serial
+ FirmwareVersion = $_.FirmwareVersion
+ }
+ } | Format-Table -AutoSize | Out-String | Write-Host
+}
+
+# Report failures
+if ($failedScrapes.Count -gt 0) {
+ Write-Host " Failed devices:" -ForegroundColor Red
+ foreach ($fail in $failedScrapes) {
+ Write-Host " $($fail.IP) ($($fail.MAC)): $($fail.Error)" -ForegroundColor Red
+ }
+ Write-Host ""
+}
+
+# --- Summary ---
+$elapsed = (Get-Date) - $scriptStartTime
+
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host " Summary" -ForegroundColor Cyan
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host " Site: $SiteName"
+Write-Host " Subnet: $Subnet"
+Write-Host " IPs scanned: $($ipList.Count)"
+Write-Host " Yealink detected: $($yealinkDevices.Count)"
+Write-Host " Successfully scraped: $($successfulScrapes.Count)" -ForegroundColor Green
+Write-Host " Failed: $($failedScrapes.Count)" -ForegroundColor $(if ($failedScrapes.Count -gt 0) { "Red" } else { "Green" })
+Write-Host " Elapsed time: $([math]::Round($elapsed.TotalSeconds, 1))s"
+Write-Host "==========================================" -ForegroundColor Cyan
+Write-Host ""
diff --git a/tools/test-yealink.ps1 b/tools/test-yealink.ps1
new file mode 100644
index 0000000..c8a567f
--- /dev/null
+++ b/tools/test-yealink.ps1
@@ -0,0 +1,183 @@
+# Test SSDP/UPnP discovery for Yealink phones
+param(
+ [string]$IP = "172.16.1.29",
+ [int]$DiscoveryTimeout = 5
+)
+
+# --- Test 1: SSDP M-SEARCH broadcast ---
+Write-Host "=== Test 1: SSDP M-SEARCH (broadcast) ===" -ForegroundColor Yellow
+Write-Host " Sending M-SEARCH to 239.255.255.250:1900..." -ForegroundColor DarkGray
+
+$ssdpMessage = @"
+M-SEARCH * HTTP/1.1
+HOST: 239.255.255.250:1900
+MAN: "ssdp:discover"
+MX: 3
+ST: ssdp:all
+
+"@
+
+$ssdpBytes = [System.Text.Encoding]::ASCII.GetBytes($ssdpMessage.Replace("`n", "`r`n"))
+$udpClient = New-Object System.Net.Sockets.UdpClient
+$udpClient.Client.ReceiveTimeout = ($DiscoveryTimeout * 1000)
+$udpClient.Client.SetSocketOption([System.Net.Sockets.SocketOptionLevel]::Socket,
+ [System.Net.Sockets.SocketOptionName]::ReuseAddress, $true)
+
+$multicastEp = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Parse("239.255.255.250"), 1900)
+$udpClient.Send($ssdpBytes, $ssdpBytes.Length, $multicastEp) | Out-Null
+
+$responses = @()
+$sw = [System.Diagnostics.Stopwatch]::StartNew()
+while ($sw.Elapsed.TotalSeconds -lt $DiscoveryTimeout) {
+ try {
+ $remoteEp = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Any, 0)
+ $data = $udpClient.Receive([ref]$remoteEp)
+ $response = [System.Text.Encoding]::ASCII.GetString($data)
+ $sourceIp = $remoteEp.Address.ToString()
+
+ if ($response -match 'yealink|Yealink|YEALINK|SIP-T') {
+ Write-Host " [YEALINK] Response from $sourceIp" -ForegroundColor Green
+ Write-Host $response -ForegroundColor Cyan
+ $responses += @{ IP = $sourceIp; Response = $response }
+ }
+ elseif ($sourceIp -eq $IP) {
+ Write-Host " Response from TARGET $sourceIp" -ForegroundColor Green
+ Write-Host $response -ForegroundColor Cyan
+ $responses += @{ IP = $sourceIp; Response = $response }
+ }
+ }
+ catch [System.Net.Sockets.SocketException] {
+ break # Timeout
+ }
+}
+$udpClient.Close()
+Write-Host " Received $($responses.Count) Yealink/target responses" -ForegroundColor DarkGray
+
+# --- Test 2: Direct SSDP to the phone's IP ---
+Write-Host ""
+Write-Host "=== Test 2: Direct SSDP M-SEARCH to $IP ===" -ForegroundColor Yellow
+
+$udpClient2 = New-Object System.Net.Sockets.UdpClient
+$udpClient2.Client.ReceiveTimeout = 3000
+
+$directEp = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Parse($IP), 1900)
+$udpClient2.Send($ssdpBytes, $ssdpBytes.Length, $directEp) | Out-Null
+
+try {
+ $remoteEp2 = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Any, 0)
+ $data2 = $udpClient2.Receive([ref]$remoteEp2)
+ $response2 = [System.Text.Encoding]::ASCII.GetString($data2)
+ Write-Host " Response from $($remoteEp2.Address):" -ForegroundColor Green
+ Write-Host $response2 -ForegroundColor Cyan
+}
+catch {
+ Write-Host " No response (timeout)" -ForegroundColor DarkYellow
+}
+$udpClient2.Close()
+
+# --- Test 3: Try fetching UPnP device description if we got a LOCATION header ---
+Write-Host ""
+Write-Host "=== Test 3: UPnP device description URLs ===" -ForegroundColor Yellow
+
+# Try common UPnP description URLs
+$descUrls = @(
+ "http://${IP}:1900/description.xml",
+ "http://${IP}/description.xml",
+ "http://${IP}:49152/description.xml",
+ "http://${IP}:5060/description.xml",
+ "http://${IP}/DeviceDescription.xml",
+ "http://${IP}/upnp/description.xml"
+)
+
+# Also extract LOCATION from any SSDP responses
+foreach ($r in $responses) {
+ if ($r.Response -match 'LOCATION:\s*(http[^\s\r\n]+)') {
+ $loc = $Matches[1].Trim()
+ if ($descUrls -notcontains $loc) { $descUrls = @($loc) + $descUrls }
+ }
+}
+
+[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
+[System.Net.ServicePointManager]::Expect100Continue = $false
+
+# Enable unsafe header parsing
+$netAssembly = [System.Reflection.Assembly]::GetAssembly([System.Net.Configuration.SettingsSection])
+if ($netAssembly) {
+ $settingsType = $netAssembly.GetType("System.Net.Configuration.SettingsSectionInternal")
+ if ($settingsType) {
+ $bf = [System.Reflection.BindingFlags]::Static -bor [System.Reflection.BindingFlags]::GetProperty -bor [System.Reflection.BindingFlags]::NonPublic
+ $instance = $settingsType.InvokeMember("Section", $bf, $null, $null, @())
+ if ($instance) {
+ $field = $settingsType.GetField("useUnsafeHeaderParsing", [System.Reflection.BindingFlags]::NonPublic -bor [System.Reflection.BindingFlags]::Instance)
+ if ($field) { $field.SetValue($instance, $true) }
+ }
+ }
+}
+
+foreach ($url in $descUrls) {
+ Write-Host " Trying: $url" -ForegroundColor DarkGray -NoNewline
+ try {
+ $req = [System.Net.HttpWebRequest]::Create($url)
+ $req.Timeout = 3000
+ $req.UserAgent = "UPnP/1.0"
+ $resp = $req.GetResponse()
+ $reader = New-Object System.IO.StreamReader($resp.GetResponseStream())
+ $body = $reader.ReadToEnd()
+ $reader.Close()
+ $resp.Close()
+ Write-Host " -> OK ($($body.Length) chars)" -ForegroundColor Green
+ Write-Host $body -ForegroundColor Cyan
+
+ # Save if it looks like XML device description
+ if ($body -match 'serialNumber|modelName|manufacturer') {
+ Write-Host ""
+ Write-Host " [FOUND] Device description with useful fields!" -ForegroundColor Green
+ $body | Out-File "C:\temp\yealink_upnp.xml" -Encoding UTF8
+ }
+ }
+ catch {
+ Write-Host " -> FAIL" -ForegroundColor Red
+ }
+}
+
+# --- Test 4: Try SNMP if available ---
+Write-Host ""
+Write-Host "=== Test 4: SNMP probe (community: public) ===" -ForegroundColor Yellow
+Write-Host " Trying SNMPv2c GET on common OIDs..." -ForegroundColor DarkGray
+
+# Build a simple SNMPv2c GET request for sysDescr (1.3.6.1.2.1.1.1.0)
+# This is a minimal hand-crafted SNMP packet
+$snmpGet = [byte[]]@(
+ 0x30, 0x29, # SEQUENCE, length 41
+ 0x02, 0x01, 0x01, # INTEGER: version = 1 (SNMPv2c)
+ 0x04, 0x06, # OCTET STRING: community
+ 0x70, 0x75, 0x62, 0x6C, 0x69, 0x63, # "public"
+ 0xA0, 0x1C, # GET-REQUEST, length 28
+ 0x02, 0x04, 0x01, 0x02, 0x03, 0x04, # request-id
+ 0x02, 0x01, 0x00, # error-status: 0
+ 0x02, 0x01, 0x00, # error-index: 0
+ 0x30, 0x0E, # varbind list
+ 0x30, 0x0C, # varbind
+ 0x06, 0x08, # OID
+ 0x2B, 0x06, 0x01, 0x02, 0x01, 0x01, 0x01, 0x00, # 1.3.6.1.2.1.1.1.0 (sysDescr)
+ 0x05, 0x00 # NULL
+)
+
+try {
+ $snmpClient = New-Object System.Net.Sockets.UdpClient
+ $snmpClient.Client.ReceiveTimeout = 3000
+ $snmpEp = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Parse($IP), 161)
+ $snmpClient.Send($snmpGet, $snmpGet.Length, $snmpEp) | Out-Null
+
+ $snmpRemote = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Any, 0)
+ $snmpData = $snmpClient.Receive([ref]$snmpRemote)
+ $snmpResponse = [System.Text.Encoding]::ASCII.GetString($snmpData)
+ Write-Host " SNMP response received ($($snmpData.Length) bytes)" -ForegroundColor Green
+ # Try to extract readable text from the response
+ $readable = ($snmpData | ForEach-Object { if ($_ -ge 32 -and $_ -le 126) { [char]$_ } else { "." } }) -join ""
+ Write-Host " Readable: $readable" -ForegroundColor Cyan
+ $snmpClient.Close()
+}
+catch {
+ Write-Host " No SNMP response (timeout or blocked)" -ForegroundColor DarkYellow
+}
diff --git a/tools/yealink-serial-scanner.html b/tools/yealink-serial-scanner.html
new file mode 100644
index 0000000..03da6da
--- /dev/null
+++ b/tools/yealink-serial-scanner.html
@@ -0,0 +1,338 @@
+
+
+
+Yealink Serial Scanner
+
+
+
+Yealink Phone Serial Scanner
+This tool logs into Yealink phone web UIs to extract serial numbers (Machine IDs) for YMCS/RPS registration.
+
Enter phone IPs (one per line or comma-separated), credentials, and click Scan.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+