Skip to main content

Private IP Ranges

Overview​

The Sensor classifies each connection as private network traffic or internet traffic by checking its addresses against a list of private IP ranges. The default ranges cover the standard private, reserved, and cloud provider ranges.

If your network uses addresses outside the defaults, such as public IP space used internally, add them with the private-cidrs setting. The ranges you add are combined with the defaults, not a replacement for them.

Configuration​

Set private-cidrs to a comma-separated list of CIDRs with no spaces. The Sensor reads the ranges once at startup.

Add private-cidrs to /etc/upwind/agent.yaml:

private-cidrs: "11.0.0.0/8,30.20.0.0/16"

Restart the Sensor to apply the change:

sudo systemctl restart upwind-agent.service
note

An entry that isn't a valid CIDR is logged as an error and skipped. The rest of the list still applies.

Default Private IP Ranges​

The Sensor always treats the following ranges as private:

RangePurpose
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16RFC 1918 private networks
100.64.0.0/10Carrier-grade NAT, used for additional Amazon EKS VPC CIDRs
198.18.0.0/15Benchmarking, used by Amazon EKS
240.0.0.0/4Reserved, used in some VPCs
0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 255.255.255.255/32Local network, loopback, link-local, and limited broadcast
192.0.0.0/24, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24IETF protocol assignments and documentation ranges
224.0.0.0/24, 232.0.0.0/8, 233.252.0.0/24, 239.0.0.0/8Multicast
35.191.0.0/16, 130.211.0.0/22, 209.85.152.0/22, 209.85.204.0/22Google Cloud load balancer health checks
fc00::/7, fe80::/10, ::1/128, ::/128IPv6 unique local, link-local, loopback, and unspecified
100::/64, 2001::/32, 2001:2::/48, 2001:db8::/32, 2001:10::/28IPv6 discard, Teredo, benchmarking, documentation, and ORCHID
2600:2d00:1:b029::/64, 2600:2d00:1:1::/64, 2600:1901:8001::/48Google Cloud load balancer health checks (IPv6)