Netpicker vs Oxidized

Netpicker validates network state, device configurations, compliance, security and behavior, and can automate remediation. It runs automated Python tests in pytest format against device configurations, show-command output and API data. The free version includes unlimited configuration backups, Git history, diffs, search and drift detection. Netpicker supports devices from more than 180 vendors and can be deployed as a Docker container or OVA virtual appliance, on-premises or in air-gapped environments. API-based connections link it to source-of-truth systems, Git, ITSM tools and other existing tools. Its REST API manages devices, backups and tests, runs show commands and tests, and restores backups; documentation is provided through Swagger/OpenAPI. Security validation covers CVEs, security configurations, compliance and pen-test findings without sending network data outside the customer's environment. Potential CVEs are matched by OS version, while verified CVEs also check whether vulnerable features are enabled and mitigations are present. AI can draft tests, remediation jobs and troubleshooting queries from plain English, subject to engineer review and approval. The free Foundation plan is available; Professional starts at $7,500 a year.

Oxidized is a network device configuration backup tool and a RANCID replacement. It supports more than 130 operating system types, with SSH and Telnet among its documented input methods. Node records can come from CSV, SQLite, MySQL, or HTTP. Backups can be written to files, Git, Git-Crypt, or HTTP; Git records a commit for each configuration change, while Git-Crypt encrypts configuration pushes using git-crypt. Oxidized adjusts its thread count to meet the configured retrieval interval. Its REST API can list nodes, retrieve configurations, show versions and diffs, reload nodes, and move a node to the front of the queue. Syslog examples can prompt a fetch after configuration changes. The web interface and API are supplied by the optional oxidized-web gem, disabled by default and configured for port 8888 by default. A setting can strip sensitive data before storage. Oxidized is free under Apache License 2.0 and is deployed on-premises; documented installation options include Linux distributions, FreeBSD, Docker, and Podman. The project says it has few maintainers and invites more involvement.