Passive sampling

runZero Explorers can identify assets, services, and vulnerabilities by passively monitoring network traffic. Passive sampling can be an alternative data source where active scanning is prohibited, and it can help you find unknown IP ranges. A passive sampling task is limited to a single CPU core and temporarily skips packets when it reaches that limit. If an active scan runs on an Explorer with a passive sampling task, the passive task is interrupted and restarts once the active scan completes.

Configuring passive sampling

Configure passive sampling from the Explorer details screen: choose Deploy from the left navigator and click an Explorer. The network interfaces available for passive sampling appear on the left. Once enabled, the sampling task processes any traffic received on these interfaces, including plain layer-2 frames from SPAN and TAP ports, traffic encapsulated with 802.1q (VLAN or QinQ), and layer-3 traffic encapsulated with GRE or VXLAN. A full SPAN capture gives the best results, but any traffic, including broadcast, adds useful enrichment.

The passive sampling task automatically enables promiscuous mode on the selected interfaces. Some virtual infrastructure, such as VMware ESXi, may require promiscuous mode on the virtual switch before it forwards traffic to the interface.

The Discovery scope sets which IP ranges qualify for asset, service, and vulnerability creation. runZero ignores traffic with no source or destination inside an allowed range. You can also list Excluded hosts for IP ranges you want to skip.

The Site option sets where assets are created and updated. If the same IPs exist in other sites, you can end up with duplicate asset records.

You can set Asset tags for systems identified through passive traffic sampling. Tags can help you review the new assets and learn more about them with active scans.