Wire inventory
Reads MAC tables from switches and ARP tables from firewalls over SNMPv3, read-only, and places every device on its site, switch, port and VLAN.
See · Honest coverage
Never “nothing found” when it was not looking.
For every switch and firewall, every day: monitored, partly monitored or not monitored. A gap is shown as a gap, in the product and in every evidence pack.
The problem
A clean report means nothing if the switch was not being read. A tool that shows “0 unapproved devices” for a day it could not reach the switch has told you something false.
Unless the evidence says when the tool was blind, an examiner cannot tell the difference.
What you see
What this shows
A coverage timeline for today from 4 AM to 12 PM, one row per source and one cell per 15 minutes. SW-HQ-01 was monitored all morning. SW-B3 was monitored except one partly monitored cell at 7:30 AM. SW-B5 stopped answering at 6:05 AM and was not monitored until 9:14 AM, shown as hatched cells. FW-01 was monitored except one partly monitored cell at 10:15 AM. SW-B7 was added at 10:30 AM; the cells before that are marked before monitoring and are not counted. Overall, 89% monitored in this window. Asked about unapproved devices on SW-B5 between 7 and 8 AM, the appliance does not say "0 unapproved devices". It says: not monitored from 6:05 to 9:14 AM, 140 devices unverified, ask again for a monitored window.
The Coverage page shows how much of the last seven days was monitored, a timeline with one row per source and one square per day, and every gap with its reason.
The screenshot was taken just after the test appliance was stopped for about five minutes. Every source shows today as partly monitored, and each gap is listed. You cannot sign the weekly review until you acknowledge it.
Shown in the new interface, which is in development.
Coverage shows what the appliance saw and what it did not. A real screen from a test appliance that started 20 minutes earlier. Coverage reads 16.6% because the days before it count as not monitored, not as clean, and the week cannot be signed until someone acknowledges the gap.
How it works
- A poll counts only if it read a switch’s whole MAC table, or returned rows from a firewall or router. A firewall that returns no ARP table does not count.
- Each source gets one label per day: covered; degraded, for an authentication failure, a partial poll or a gap; not monitored; or before install.
- A source not read for more than two poll intervals raises a High blind-spot alert, which resolves by itself when polling recovers.
- Removing a switch never erases its gaps. Its rows stay for every day up to its removal.
- A network scan never counts as coverage.
What it proves
coverage.csv in every pack labels each switch-day, and the verifier recounts it. The published specification says it plainly: a not-monitored day means nothing was seen, never that the network was clean.
What it records
Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.
- poll_runA source’s first poll, and any poll whose result, coverage or warnings change, with a hash of what it read.
- poll_rollupHourly, per source, with a hash of its polls. Every purge of old poll rows is logged.
- alert_raisedA blind_spot alert when a source goes unread for two intervals.
- review_signedThe week’s coverage, and whether the reviewer acknowledged the gap.
Limits
What it does not do yet, stated plainly. The technical page lists every known gap.
- Coverage measures whether each source was read. Whether every device sits behind a polled switch is a different question, answered by the blind-segment finder.
- Checks such as “the gateway’s MAC address is on the uplink” are not built, so they do not affect a day’s label.
- The 14, 30 and 90-day ranges and recommended fixes arrive with the new interface.
Technical detail
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.