Skip to content
SPECIFICTION
Get listed

Batfish

batfish.org

WindowsmacOSLinuxAPISelf-hosted
Visit batfish.org
Spec score 7.9 #4 of 37 in Network Security Policy Management Software

What it is

Batfish is an open-source tool for analyzing network device configurations and validating network behavior. It works from configuration files, so core analysis does not require direct access to network devices. Teams can inspect deployed configurations and check planned changes before deployment. Checks cover undefined references, MTU and AAA settings, template compliance, sensitive-service reachability and expected traffic paths. Batfish can test whether end-to-end reachability survives any single-link or single-device failure, compare current and planned reachability, assess ACL or firewall changes and evaluate functional equivalence across vendors. Pybatfish provides a Python 3 SDK, and example Jupyter notebooks are available. An all-in-one Docker container bundles Batfish and notebooks. It runs on operating systems supporting Docker. Documented support includes Arista, AWS, Azure, Cisco, Juniper, Palo Alto Networks and SONiC, while Aruba, Dell Force10 and Foundry have limited support.

Spec sheet

Purpose
Batfish analyzes network device configurations to find policy violations and validate network behavior.Read 5 Oct 2026 · github.com
Deployment
The project provides an all-in-one Docker container that includes Batfish and example Jupyter notebooks.Read 5 Oct 2026 · github.com
Integrations
The maker documents Ansible modules for extracting and validating configuration facts and asserting network behavior in playbooks.Read 5 Oct 2026 · batfish.org
Support
The maker directs users with questions or feature requests to its Slack community or GitHub repository.Read 5 Oct 2026 · batfish.org
License
Batfish is released under the Apache Software License, Version 2.0.Read 5 Oct 2026 · github.com
Change analysis
Batfish can compare current and planned reachability, assess ACL or firewall changes, and test functional equivalence between configurations from different vendors.Read 5 Oct 2026 · github.com
Change comparisons
Batfish can compare reachability across current and planned configurations and assess functional equivalence between configurations from different vendors.Read 5 Oct 2026 · github.com
Change validation
Batfish can validate planned configuration changes before deployment and deployed configurations as well.Read 5 Oct 2026 · github.com
Community support
The project directs users with questions or feature requests to its Slack community or GitHub.Read 5 Oct 2026 · batfish.org
Configuration checks
Checks include undefined references, settings such as MTU and AAA, and whether devices meet specified configuration templates.Read 5 Oct 2026 · github.com
Device access
Core analysis requires network device configurations and does not require direct access to network devices.Read 5 Oct 2026 · github.com
Failure analysis
Batfish can check whether end-to-end reachability is preserved after any single-link or single-device failure.Read 5 Oct 2026 · github.com
Operating systems
Batfish can run on any operating system that supports Docker; its containers are actively tested on Mac OS X and Ubuntu 16.04 LTS.Read 5 Oct 2026 · github.com
Pre-deployment checks
Batfish can validate configuration changes before deployment to help ensure only correct changes are deployed.Read 5 Oct 2026 · github.com
Python client
Pybatfish is a Python SDK for interacting with the Batfish service.Read 5 Oct 2026 · github.com
Reliability analysis
Batfish can check reachability after single-link or single-device failures and whether services such as DNS are globally reachable.Read 5 Oct 2026 · github.com
Security analysis
Checks can verify that sensitive services are reachable only from specified subnets or devices and that traffic follows expected paths.Read 5 Oct 2026 · github.com
Security checks
Supported checks include verifying that sensitive services are reachable only from specified subnets or devices.Read 5 Oct 2026 · github.com
Support limitation
Batfish has limited support for Aruba, Dell Force10, and Foundry platforms.Read 5 Oct 2026 · batfish.readthedocs.io
Supported configurations
Documented support includes Arista, AWS, Azure, Cisco, Juniper, Palo Alto Networks, and other network platforms; Aruba, Dell Force10, and Foundry have limited support.Read 5 Oct 2026 · github.com
Supported devices
Supported configurations include vendors and platforms such as Arista, AWS constructs, Cisco, Juniper, Palo Alto Networks, and SONiC.Read 5 Oct 2026 · batfish.readthedocs.io
Supported environments
Batfish can run on operating systems that support Docker; its containers are actively tested on Mac OS X and Ubuntu 16.04 LTS.Read 5 Oct 2026 · github.com

Strong points and limits

Strong points

  • Open-source and free
  • Validates changes before deployment
  • Analyzes single-failure reachability
  • Python SDK and Jupyter examples
  • Supports major network platforms

Limits

  • Requires Docker-capable operating system
  • Limited support for Aruba, Dell Force10 and Foundry
  • Configuration files are required

Who it suits

Batfish suits network engineers who want configuration-based policy, security, reliability and change analysis. It fits teams comfortable with Docker, Python or self-hosted operation.

Verdict

Batfish offers detailed pre-deployment and operational network analysis without direct device access. Platform coverage is broad, but some vendors have limited support and deployment depends on Docker.

Where Specifiction places it

Alternatives to BatfishAll alternatives →