Why are some assets on my network not being detected by runZero?

There are a number of reasons assets may not be discovered by the runZero Explorer. The most common are:

1. Network segmentation issues
2. Subnet sampling configuration on sparse networks

Network segmentation issues

A common issue is that the Explorer host is unable to communicate with the target assets due to network segmentation.

To see if this is the case, send a ping and traceroute from the machine hosting the Explorer to the target asset addresses. If there are network issues, one or both of these will fail.

Subnet sampling configurations

Subnet sampling is a runZero feature that enables efficient scanning of large networks. It works by breaking down the target IP range into smaller /24 subnets. For each subnet, the Explorer pings a small percentage of the addresses. The set of addresses pinged is based on analysis of which IP addresses are most likely to be in use on customer networks. If a device responds on one of the sampled IP addresses, the entire /24 subnet is scanned; otherwise, it is skipped.

The default setting for scans is to ping 3% of addresses. This can be insufficient if subnets are very sparsely populated and systems have unusual IP addresses. If you suspect that this is the case, you can increase the quantity of addresses sampled.