Network Bridge Report

View as Markdown

Platform

Most users should start with the Network Map. It surfaces the same multi-homed bridge assets — and goes further with subnet clustering, choke-point ranking, hop-filter tracing, and exports to Gephi, Cytoscape, and Visio.

The network bridge report finds assets that bridge two or more network segments. These multi-homed assets are the pivots an attacker uses to move between zones — between guest Wi-Fi and corporate LAN, between IT and OT, or between an internal segment and the public internet.

Accessing the report

  • Reports — Open it directly at /reports/analysis/bridges from the Reports menu, or https://console.runzero.com/reports/analysis/bridges.
  • Network Map — The same assets appear on the Network Map under the Pivots stat in the Network Intel card (multi_homed:t). Each multi-homed asset shows up once in every subnet it has an address in, with edges drawn between the copies so you can see exactly which segments it bridges.

How bridges are detected

runZero detects network bridges by collecting extra IP addresses returned in responses to common discovery probes — NetBIOS, SNMP, MDNS, UPnP, and others — and by correlating MAC addresses across subnets. A bridge is reported whenever the same asset is observed with addresses in two or more distinct subnets.

Network Map filtered with multi_homed:t, showing a high-risk EOL Windows asset (10.10.0.1 / FACTORY-FFU-02) bridging the 10.10.0.0/24 segment to the 10.66.0.0/24 OT segment with a callout reading “Multi-homed: can become pivot point”

The detection is opportunistic. Hardened endpoints (host firewalls, disabled discovery services) may not reveal their other interfaces, so the report can miss bridges. Treat what it shows as a floor, not a ceiling.

Reading the report

  • External networks are drawn in red, internal networks in green.
  • Edges connect a subnet to every multi-homed asset that has an address in it.
  • Single-homed assets are omitted to keep the graph readable.

The visualization is intentionally segmentation-focused; it is not a full topology view. For a full Layer-2 / Layer-3 picture, use the Network Map. For switch-port–level connectivity, use the Switch Topology report.

Querying multi-homed assets directly

Every bridge in this report is a multi-homed asset. You can query them straight from the inventory:

multi_homed:t
multi_homed:t AND has_public:t        # bridges with at least one public IP
multi_homed:t AND category:OT         # OT pivots — top-of-register OT risk

Combine with subnet_class:OT, category:IT, risk:high, or eol:t to surface the bridges that matter most for segmentation hardening.

See also

Updated