How does runZero detect which devices are routers?

runZero checks to see if devices in the local IP space appear to act like a router. It does this by sending a packet with a TTL of 1 and looking for a "TTL exceeded" response (which routers will reply with). This data is stored in the asset attributes in the ipv4.forwarding and ipv6.forwarding, which you can search for in your asset inventory page.