Shadow IT discovery

[cunha]

We can use breadth-first search to infer the subnet on each hop inside an intranet, and then scan all hosts on each identified subnet.

https://ieeexplore.ieee.org/abstract/document/6108072
https://orbi.uliege.be/handle/2268/194693