Coverage reports

Coverage reports help you understand potential blind spots on your network by identifying which IP spaces have been scanned, which ones contain assets, and which ones still are unknown. With this information, you can find things like missing subnets, rogue devices, and misconfigurations.

To access the coverage reports, go to Reports on the main menu and scroll down to RFC 1918 coverage.

RFC1918 coverage report

The RFC1918 coverage report helps you better track and identify the subnets that are in use on your internal network, the ones that have been scanned, and the ones that haven’t been scanned.

TCP/IP version 4 reserves three ranges of IP addresses for private use. Specified in RFC1918, they are:

Most companies use these address ranges for their internal IPv4 networks, connecting them to the Internet via Network Address Translation (NAT).

To help you visualize and assess your RFC1918 coverage, the RFC1918 report includes:

• Coverage maps
• Subgrids
• Statistics

RFC1918 coverage maps

A common network security and administration goal is to scan all of the available private IP addresses, to detect which subnetworks are in use on your internal network. Because of the large number of addresses, this can take a long time, leaving the problem of tracking which addresses have been scanned and which have not.

To solve this problem, runZero’s Coverage report shows a graphical map of the RFC1918 private address spaces, showing which pieces have been scanned and to what percentage of completion.

runZero will sometimes detect that a device has additional IP addresses which are not part of the range being scanned. This can indicate that the device is present on an unscanned part of the private IP address space. The coverage reports show this by drawing a red border around the appropriate grid cell.

You can hover the mouse cursor over a cell to see a tooltip showing the CIDR address range the cell represents, how many unscanned hosts are believed to be in that range, and what percentage of the entire range has been scanned.

RFC1918 sub-grids

For the 192.168.0.0/16 map, each cell on the grid represents a /24 (256 addresses). Clicking a cell will take you to the subnet analysis report for that range and list the assets found.

For a map that shows a large address range, such as 10.0.0.0/8, each cell represents an entire /16 range of 65,536 addresses. To help narrow down the search for assets and unscanned hosts, you can click on any cell that represents a /16 range to go a grid map that showing just that range. From a /16 grid, you can use the link at top right to go back to the full range map.

On the /16 sub-grids, each cell is a /24, so clicking one takes you to the subnet analysis for that specific cell’s address range, like on the 192.168.0.0/16 map.

Statistics

At the top of the coverage report page, you can see statistics showing how much of the RFC1918 address space you have scanned. Another box breaks the coverage down by the three blocks of reserved addresses.

Clicking the magnifying glass icon in the summary box will create a sample scan task, covering the unscanned address ranges. The refresh buttons create scan tasks to rescan all of the appropriate range.