I would love to see UDT show a user that just connected 5/10 minutes ago, or at least his MAC and IP address showing up.
One way to do this is to use traps to know when an interface goes into connected/disconnected mode. Then scanning that switch with a hold timer after each scan so a flapping interface doesn't consume all the processes.
There should still be a 4 hour global scan, or maybe longer depending on your size.
I am using a 1000+ switch environment as an example....
I have many users that use UDT to find 'lost' systems or users on the network