RFC 1918 Report

Coverage reports show which IP spaces you have scanned, which contain assets, and which are still unknown, so you can uncover potential blind spots on your network. With this information, you can find missing subnets, rogue devices, and misconfigurations.

To open the coverage reports, go to Reports on the main menu and scroll down to RFC 1918 coverage.

RFC1918 coverage report

The RFC1918 coverage report tracks the subnets in use on your internal network, which of them you have scanned, and which you have not.

TCP/IP version 4 reserves three ranges of IP addresses for private use. Specified in RFC1918, they are:

Most companies use these ranges for their internal IPv4 networks and connect them to the Internet through Network Address Translation (NAT).

To help you visualize and assess your RFC1918 coverage, the RFC1918 report includes:

• Coverage maps
• Subgrids
• Statistics

RFC1918 coverage maps

A common network security and administration goal is to scan all of the available private IP addresses to detect which subnetworks are in use on your internal network. With so many addresses, this can take a long time, and you need a way to track which addresses you have scanned and which you have not.

The Coverage report solves this with a graphical map of the RFC1918 private address spaces that shows which pieces you have scanned and what percentage of each you have scanned.

runZero sometimes detects that a device has additional IP addresses outside the range being scanned. That can mean the device is present on an unscanned part of the private IP address space, and the coverage reports mark it by drawing a red border around the matching grid cell.

Hover over a cell to see a tooltip with the CIDR address range the cell represents, how many unscanned hosts are believed to be in that range, and what percentage of the entire range you have scanned.

RFC1918 sub-grids

On the 192.168.0.0/16 map, each grid cell is a /24 (256 addresses). Clicking a cell takes you to the subnet analysis report for that range, which lists the assets found.

On a map of a large address range, such as 10.0.0.0/8, each cell is an entire /16 of 65,536 addresses. To narrow the search for assets and unscanned hosts, click any /16 cell to open a grid map of just that range. From a /16 grid, the link at top right takes you back to the full range map.

On the /16 sub-grids, each cell is a /24, so clicking one takes you to the subnet analysis for that cell’s address range, as on the 192.168.0.0/16 map.

Statistics

At the top of the coverage report page, statistics show how much of the RFC1918 address space you have scanned. Another box breaks the coverage down by the three blocks of reserved addresses.

Clicking the magnifying glass icon in the summary box creates a sample scan task covering the unscanned address ranges. The refresh buttons create scan tasks to rescan all of the corresponding range. To understand and optimize your coverage after a full discovery scan, see Identifying gaps in scanning.