Source Breadth
The Source Breadth factor measures how wide the source address range is. Broader source ranges mean more hosts are permitted to initiate the flow, increasing the attack surface.
Default max contribution: 25 points.
Scoring table
| CIDR Prefix | Base Points | With Public IP Bonus (+3) | Example |
|---|---|---|---|
| /0 (any) | 25 (max) | - | 0.0.0.0/0, any, or any x.x.x.x/0 |
| /1 - /8 | 20 | 23 | 10.0.0.0/8 |
| /9 - /16 | 15 | 18 | 172.16.0.0/16 |
| /17 - /24 | 8 | 11 | 192.168.1.0/24 |
| /25 - /31 | 3 | 6 | 10.0.0.0/28 |
| /32 (host) | 0 | 3 | 10.0.0.1 |
Public IP bonus
A +3 point bonus is added when the source range is public. A range is public unless the whole range lies inside non-public space:
- RFC 1918 private space (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16) - Carrier-grade NAT (
100.64.0.0/10, RFC 6598), treated like private space - Loopback (
127.0.0.0/8) - Link-local (
169.254.0.0/16) - Multicast (
224.0.0.0/4) - Reserved (
0.0.0.0/8,240.0.0.0/4, including255.255.255.255)
The documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) and the benchmark range 198.18.0.0/15 count as public, because docs and tests use them as stand-ins for internet addresses.
Examples:
10.0.0.0/7covers 10.0.0.0 - 11.255.255.255, and 11.0.0.0/8 is public, so the range is public: 20 + 3 = 23 points.100.64.1.10is CGNAT space: no bonus, 0 points.10.0.0.0/0(any address with /0) is treated as any: 25 points.
The bonus reflects the higher risk of allowing traffic from internet-routable sources compared to internal addresses.
Clamping
After adding the public IP bonus, the total is clamped to 25. For example, a /1 prefix (20 base) with a public IP bonus (+3) produces 23 points, not 25 - but a /0 prefix already hits the cap at 25, so no bonus is applied.
With a custom srcMax in the CLI, the clamped points are then scaled to the custom cap (see Overview). For example, srcMax: 50 turns a public /32 source into 6 points, shown as public IP (+6).