How can we help?

How to Scan IP Ranges to Avoid Large Network Scans

Follow

Auvik’s scanning is optimized for private network infrastructure and will only scan RFC 1918 private IP ranges by default.

When Configuring Discovery

Prioritize Active Subnets: Add only subnets actively used for network infrastructure and user endpoints.

Avoid /8 or /16 subnets unless absolutely necessary: Large subnets can degrade collector performance and result in excessive scanning.

Use /24 or smaller subnets where feasible: This reduces scan overhead.

Best Practices for Setting Up Scanning

  • Enable scanning only on subnets where you expect live devices.
  • Avoid scanning full ranges (e.g., entire /16 or /12 blocks) unless necessary.
  • Break up large networks into smaller blocks—like /24, /27, /28, or /29—when possible.
    This helps improve scan speed and reduce unnecessary traffic

Avoid Oversized Subnets

  • Scanning a /16 may take 50+ minutes to complete a single pass.
  • Larger ranges, such as /12, can take many hours or days and are typically discouraged unless required.

Leverage Rule Precedence

Auvik uses a child subnet > parent subnet rule logic.
For example: If a /24 is set to “Don’t Scan,” but a /29 inside it is set to “Scan,” the /29 will still be scanned.

Excluded by Default Without Special Configuration

Auvik does not scan the following IP address ranges by default:

  • 127.0.0.0/8 — Loopback addresses
  • 169.254.0.0/16 — Link-local addresses
  • 224.0.0.0/4 and 240.0.0.0/4 — Multicast and reserved ranges
  • 255.255.255.255 — Broadcast address

These ranges are excluded because they do not represent routable networks or usable devices in a traditional sense.

Auvik will not scan the following without explicit setup:

  • Public IP ranges (e.g., internet-facing or non-RFC1918 addresses)
  • External or cloud environments without agent-based deployment or configured routing
  • VLANs, VPNs, or firewalled subnets that are not routed to or reachable by the Auvik collector

How Auvik Schedules and Prioritizes Scans

  • A scan is attempted every 3 minutes.
  • Each cycle scans up to 15 /24 subnets.
  • All networks are broken down internally into /24 blocks, regardless of the size you define.

Scan Prioritization Logic:

  • Subnets with previously discovered devices are scanned more frequently.
  • Subnets where no devices were found are deprioritized to reduce load.
    This means newly added devices in unused subnets may take longer to be discovered.

Maintain Scanning Hygiene

  • Review and update scan rules regularly to reflect your current network architecture.
  • Remove outdated or unused ranges to prevent wasted scan cycles.
  • Avoid scanning external-facing public IPs unless intentionally required and securely configured.
  • Remove offline or decommissioned devices from the network.
  • Regularly review scan settings to align with network topology changes.
  • Avoid leaving rogue DHCP scopes or unused VLANs that can confuse discovery logic.
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request