Blind-segment finder

The problem

A bank proves its inventory is complete by pointing at the switches it polls. That only holds if those switches see every device.

A coverage number cannot tell you that a wiring closet or a VLAN is missing.

How it works, illustrated

$ appliance segments -data-dir /var/lib/appliance -csv# lists each part of the network no source sees, most important first,# each with a one-line fix, and the share of known devices placed on a port# exit 0: nothing found, exit 9: findings (for Nagios, PRTG, Zabbix or cron)

Command-line usage from the appliance’s reference.

Today the finder runs in the engine, the data routes and the command line. Its screens, a Completeness tab on Coverage and a headline on the Overview, are designed and arrive with the new interface.

A finding reads like this: Add “HP-2530” (10.2.0.5) as a source under Settings > Sources & credentials.

How it works

Uses only tables already read: MAC tables, ARP tables, LLDP and CDP neighbors, port names and link aggregation. No new reads and no probes.
Every device a gateway knows is placed on a managed port, recently placed, behind an uplink, or unseen. Completeness is the share placed, overall, per site and per gateway interface.
Only a complete, error-free read counts. While a gateway has not been read, the result is marked partial and never shown as complete.
Eleven kinds of finding, each with a code, a severity, the evidence, sample devices and the fix: a gateway that is not a source, a neighbor switch nobody polls, a subnet no switch places, Wi-Fi clients no switch sees, and others.
On a synthetic network of 40 switches and 38,400 devices, a full run took about 135 ms (benchmark on an Apple M4 Pro).

What it proves

It turns “all sources monitored” into an honest placement-completeness figure, with its method, logged at least once a day. An examiner sees what the appliance could not see and what would fix it.

What it records

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

self_testKind placement_completeness: written when findings, sources or completeness change, and otherwise daily. Counts, the method and hashes; no MAC or IP addresses.

Limits

What it does not do yet, stated plainly. The technical page lists every known gap.

The screens are not built yet.
A finding cannot yet be accepted as a signed decision.
DHCP scope gaps and routed subnets need inputs it does not read yet.
It stores the tables it compares. On a very large network that is worth planning for on a Raspberry Pi’s SD card.

Technical detail

Docs · Feature referenceBlind-segment finder: how it is builtWhat it does, how it works, what it records, security notes, limits and known gaps, the command line, data routes and the review summary.

Early access: now taking pilot customers.

See it on your own network.

A live demo with the engineers who built it. We bring a simulated network; you bring your questions.

Request a demo Documentation