AD-SUB-08: Distinct first octets count should be retrievable
| ID | AD-SUB-08 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Analyzing subnet distribution by first octet provides:
- Addressing scheme visibility: Understanding IP allocation patterns
- Network segmentation insight: How the network is logically divided
- Capacity planning: Identifying available address space
- Documentation: Supporting network topology documentation
Common patterns include using 10.x for corporate, 172.x for datacenters, etc.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Document the IP addressing scheme and first octet allocation
- Plan address space to avoid conflicts during acquisitions
- Reserve address space for future growth
- Review addressing scheme during network architecture changes
How the Test Works
Section titled “How the Test Works”This test extracts the first octet from all IPv4 subnets and counts the distinct values.
Related Tests
Section titled “Related Tests”Test-MtAdSubnetFirstTwoOctetsCount- Analyzes /16 networksTest-MtAdSubnetFirstThreeOctetsCount- Analyzes /24 networksTest-MtAdSubnetTotalCount- Counts total subnets
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.