Security network segmentation reachability calculator

Calculate transitive reachable ordered zone pairs, excluding self and reachable pairs absent from supplied expected set with your own figures.

Your numbers

Use the units shown. Results update as you change valid inputs.

Use transitive reachable ordered zone pairs, excluding self and reachable pairs absent from supplied expected set to compare changes to your inputs. The method and limits below explain the scope.

Examples

Examples

Try the starting example

Known network zone IDs joined by |
Public|App|DB|Admin
Directed connections: source, destination; or none
Public,App App,DB Admin,DB
Explicitly expected reachable pairs: source, destination; or none
Public,App App,DB Admin,DB
Transitive reachable ordered zone pairs, excluding self
Public->App, Public->DB, App->DB, Admin->DB
Reachable pairs absent from supplied expected set
Public->DB
Expected pairs with no directed path
None
Reachable pairs requiring more than one supplied edge
Public->DB
Reachable share of distinct ordered zone pairs (%)
33.333333

Try another scenario

Known network zone IDs joined by |
Public|App|DB|Admin
Directed connections: source, destination; or none
Public,App App,DB Admin,DB
Explicitly expected reachable pairs: source, destination; or none
Public,App App,DB Admin,DB Public,DB
Transitive reachable ordered zone pairs, excluding self
Public->App, Public->DB, App->DB, Admin->DB
Reachable pairs absent from supplied expected set
None
Expected pairs with no directed path
None
Reachable pairs requiring more than one supplied edge
Public->DB
Reachable share of distinct ordered zone pairs (%)
33.333333
Calculation method

Calculation method

Transitive reachable ordered zone pairs, excluding self

Breadth-first reachability from every zone; self pairs are excluded even in cycles.

Reachable pairs absent from supplied expected set

Compare every reachable pair to the literal expected pair list; do not assume expected permissions are transitive.

Expected pairs with no directed path

Expected pairs absent from graph reachability.

Reachable pairs requiring more than one supplied edge

Reachable pair with shortest directed path length≥2 edges.

Reachable share of distinct ordered zone pairs (%)

Reachable pair count/(n×(n−1))×100; undefined for one zone.

Symbols and units
a
Known network zone IDs joined by |
b
Directed connections: source, destination; or none
c
Explicitly expected reachable pairs: source, destination; or none

Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.

Assumptions & limits

Assumptions & limits

  • A supplied directed-connectivity reachability model, not a network scan or proof of access. It assumes edges compose into paths and ignores routing policy, firewall conditions, identities and packet state. No connections are attempted.
Are these inputs private?

These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.

Further reading

NIST SP 800-53: background for inventory, access, audit and contingency controls; worksheet algorithms and rules are explicitly supplied, not NIST compliance tests ↗

Background reading; this does not imply endorsement or independent review of SumFizz.

Share this page
Share this calculator

Leave unchecked to share the page without your entered values.