{
    "name": "Firewall Rule Coverage Calculator",
    "url": "https://calculators.geekmidst.com/calculators/firewall-rule-coverage-calculator",
    "markdown": "https://calculators.geekmidst.com/calculators/firewall-rule-coverage-calculator.md",
    "category": "IT, networking & security",
    "description": "Measure firewall rule-base hygiene: the share of rules that matched traffic in a review period, unused rules to review and shadowed rules to remove.",
    "summary": "Rule coverage here means the share of rules in a policy that matched at least one connection during a review period, read from the firewall’s hit counters. Rules that never match are clean-up candidates.",
    "also_called": [
        "Firewall rule usage calculator",
        "Rule-base hygiene calculator"
    ],
    "applies_to": "Worldwide",
    "last_updated": "2026-10-29",
    "computation": "Results are computed in the visitor’s browser on the HTML page. This API describes the calculator; it does not compute results.",
    "inputs": [
        {
            "name": "total_rules",
            "label": "Rules in the policy",
            "type": "number",
            "default": "480"
        },
        {
            "name": "rules_hit",
            "label": "Rules with at least one hit in the period",
            "type": "number",
            "default": "312"
        },
        {
            "name": "shadowed",
            "label": "Fully shadowed rules (optional)",
            "type": "number",
            "default": "25",
            "optional": true
        }
    ],
    "outputs": [
        {
            "key": "coverage",
            "label": "Rules used",
            "format": "percent"
        },
        {
            "key": "unused",
            "label": "Unused rules",
            "format": "integer"
        },
        {
            "key": "unused_percent",
            "label": "Unused share",
            "format": "percent"
        },
        {
            "key": "review",
            "label": "Unused rules to review with owners",
            "format": "integer"
        }
    ],
    "formula": {
        "text": "Coverage % = Rules with hits ÷ Total rules × 100;  Unused = Total − Rules with hits;  To review = Unused − Shadowed",
        "variables": {
            "Rules with hits": "rules whose hit counter rose in the review period",
            "Shadowed": "rules that can never match because an earlier rule catches all their traffic"
        }
    },
    "worked_example": {
        "inputs": {
            "total_rules": "480",
            "rules_hit": "312",
            "shadowed": "25"
        },
        "steps": [
            "Coverage = 312 ÷ 480 × 100 = 65%.",
            "Unused = 480 − 312 = 168 rules (35%).",
            "25 are shadowed and can be removed; 168 − 25 = 143 need an owner to confirm."
        ],
        "result": "65% of the 480 rules carried traffic; 25 shadowed rules can go and 143 unused rules need review."
    },
    "interpretation": "Unused is not the same as unneeded: disaster-recovery, year-end and failover rules can be silent for months. Review with the rule owner, disable before deleting, and track coverage over time.",
    "assumptions": [
        "Hit counters were not reset during the period and cover every firewall enforcing the policy."
    ],
    "limitations": [
        "A rule with hits may still be too broad; coverage says nothing about least privilege.",
        "This is a simple ratio, not a risk score."
    ],
    "rules": null,
    "faqs": [
        {
            "question": "Why must shadowed rules be among the unused ones?",
            "answer": "A fully shadowed rule is never reached, so its hit counter stays at zero."
        },
        {
            "question": "How long should the review period be?",
            "answer": "Long enough to cover your slowest business cycle; many teams use 90 days or more."
        }
    ],
    "sources": [],
    "related": [
        {
            "name": "IPv4 Range to CIDR Calculator",
            "url": "https://calculators.geekmidst.com/calculators/ipv4-cidr-range-calculator"
        },
        {
            "name": "Percentage Calculator",
            "url": "https://calculators.geekmidst.com/calculators/percentage-calculator"
        },
        {
            "name": "Packet Loss Calculator",
            "url": "https://calculators.geekmidst.com/calculators/packet-loss-calculator"
        }
    ],
    "disclaimer": null,
    "publisher": "GM¹X CalcVerse"
}