# Batfish models a whole network from configuration text, so you can ask what breaks

> Batfish is a Java network configuration analyser that builds a model of forwarding behaviour from device configs alone, without touching the devices, and answers reachability and equivalence questions about them. The cost is memory: the recommended server is a quad-core box with 32 GB of RAM.

**batfish/batfish** — Batfish is a network configuration analysis tool that can find bugs and guarantee the correctness of (planned or current) network configurations. It enables network engineers to rapidly and safely evolve their network, without fear of outages or security breaches.

- Repository: https://github.com/batfish/batfish
- Website: http://www.batfish.org
- Stars: 1,527 · Forks: 290
- Language: Java
- License: Apache-2.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/batfish-batfish

## No device access, which is the whole premise

Most network validation tools work by talking to devices. Batfish's central claim is the opposite: the core analysis requires only the configuration of network devices and does not need direct access to them.

That constraint is what makes pre-deployment validation practical. The README calls this a critical gap in existing network automation workflows: by including Batfish in those workflows, engineers can close the gap and ensure that only correct changes are deployed.

The analysis is not limited to configuration text. It may be enhanced with additional information from the network, and the README names two sources: BGP routes received from external peers, and topology information represented by LLDP or CDP. Those are optional inputs, and the difference matters. Without external BGP routes, Batfish models routes as originating from its model rather than as learned from the internet, which changes some answers about default routes and egress behaviour.

The output of that modelling is a set of answers about network behaviour rather than a set of lint messages. It finds violations of network policies, and the policies come from three places: built-in checks, checks you define, and best-practice checks.

## Four categories of question, and change analysis is the distinctive one

The README groups the checks into four categories, and the last one is what separates Batfish from a configuration linter.

Configuration compliance covers undefined-but-referenced or defined-but-unreferenced structures such as ACLs and route maps, template matching for settings including MTU, AAA, NTP and logging, and requirements that devices be reachable only over SSHv2 with a non-null password. These are structural checks and they overlap with what config linters do, except that Batfish resolves references across devices.

Reliability covers end-to-end reachability not being impacted for any flow after any single-link or single-device failure, and certain services such as DNS being globally reachable. That is a failure analysis question, not a configuration question, and answering it by hand means enumerating failure modes.

Security covers whether sensitive services can be reached only from specific subnets or devices, and whether paths between endpoints are as expected, for example that a path traverses a firewall or has at least two-way ECMP.

Change analysis is the one worth pausing on. It checks that end-to-end reachability is identical across the current and a planned configuration, that planned ACL or firewall changes are provably correct and cause no collateral damage for other traffic, and that two configurations, potentially from different vendors, are functionally equivalent.

Those last two are claims about proof rather than review. An equivalence check between a Cisco and a Juniper configuration of the same intent is something no amount of careful reading establishes reliably at scale, and it is the strongest argument for the tool.

## Running it: one container, three ports, and a memory conversation

Getting started is one container. The README says to pull and run the `allinone` image, which includes Batfish along with example Jupyter notebooks:

    docker pull batfish/allinone

    docker run --name batfish -v batfish-data:/data -p 8888:8888 -p 9997:9997 -p 9996:9996 batfish/allinone

Three ports are mapped, 8888 for Jupyter, 9997 and 9996 for the service itself, and a named volume `batfish-data` is mounted at `/data` so snapshots persist across restarts.

Two Docker flags are called out and both point at the same issue. The README says the amount of memory available to Batfish is determined by the Docker configuration and suggests `--memory` to set it explicitly. On Linux systems running the OOM Killer it also suggests `--oom-kill-disable`, which runs together with `--memory` to stop Linux killing Batfish under memory pressure.

That combination is worth understanding rather than copying. Disabling the OOM killer means an over-committed container can push the whole host into swap instead of failing, so it protects your analysis session at the cost of taking down whatever else runs on the machine. Use it on a dedicated host.

The next step is the client. Analysis is driven through Pybatfish, a Python 3 SDK, installed with:

    python3 -m pip install --upgrade pybatfish

The README recommends installing it in a virtual environment though it is not strictly necessary, and points to the notebooks in the pybatfish repository as the way to learn the API, with full documentation on readthedocs.

For the first look, browse the notebooks at http://localhost:8888 and authenticate with the Jupyter token printed when the container started. "Getting Started with Batfish" is named as the notebook to start with.

## Hardware is the adoption barrier

The system requirements section is unusually explicit, and it is the part most likely to change your decision.

For the example notebooks, the README says a reasonably capable laptop is enough: dual core CPU, 8 GB of RAM, 256 GB of hard drive. For running Batfish against your own network, it recommends a server with a quad-core CPU with two threads per CPU, 32 GB of RAM and 256 GB of hard drive.

The gap between those two lists is the point. Notebooks are a tutorial. Real network snapshots are a large data structure, and 32 GB is a floor rather than a comfortable figure for a large network. Budget for a dedicated machine and note that the disk figure is not incidental either: snapshots are the unit of work, and every analysis runs against stored snapshots rather than live devices.

Platform support is narrow in a specific way. Batfish can run on any operating system that supports Docker, but the containers are actively tested on macOS and Ubuntu 16.04 LTS. An operating system that supports Docker but is not in that list is untested rather than unsupported.

The build system tells you something too. The repository is Bazel-based, with `.bazelversion`, `MODULE.bazel`, `WORKSPACE`, a `.bazel-steward.yaml` for automated dependency updates and a `.trivyignore` for vulnerability scanning exclusions. A `.pre-commit-config.yaml` and `.prettierrc.yaml` cover formatting, `tools/` holds build tooling, `skylark/` holds Bazel extensions, and `networks/` and `projects/` hold example inputs. For a Java analysis tool of this size, that is a large build surface, and it is only relevant to you if you plan to build from source rather than pull the container.

## Vendor coverage, and where it stops

The supported list is long and the qualifier matters: Batfish describes support for a large and growing set of physical and virtual devices.

Named as fully supported are A10 Networks, Arista, AWS resources including VPCs, Network ACLs, VPN Gateway, NAT Gateway, Internet Gateway and Security Groups, Azure resources including VirtualNetworks, public IPs, NAT Gateways and NSGs, Cisco across NX-OS, IOS, IOS-XE, IOS-XR and ASA, Check Point, Cumulus, F5 BIG-IP, Fortinet, Free-Range Routing, iptables on hosts, Juniper across MX, EX, QFX, SRX, T-series and PTX, Nokia SR OS and SR-SIM with MD-CLI, Palo Alto Networks and SONiC.

That list spans enterprise switches, firewalls, cloud networks and Linux hosts, which is what makes the cross-vendor equivalence check possible rather than theoretical.

Then there is the part that should govern your decision. The README introduces a separate category with limited support for certain platforms, and the list that follows it is not included in what is available here. That is not a small gap in the documentation; it is the most important line in the file for an adopter.

A parsing gap is dangerous in a tool that answers questions rather than reporting errors. If a construct is silently unsupported, Batfish may return a confident answer computed from a model that does not match reality, and the failure mode looks like a green result. Before trusting any answer, run a check whose result you already know, and compare it against what the device actually does.

## Release cadence, licence and where Batfish sits

The repository is not archived and the last push was on 2026-10-16.

Releases are date-stamped rather than semver: v2026.08.27 on 2026-08-27, v2025.07.07 and v2024.07.10. A roughly annual cadence with a date in the name tells you the versioning question up front. There is no compatibility promise expressed as major, minor and patch, so treat an upgrade as a re-validation rather than a routine bump.

Licensing is Apache-2.0 in the LICENSE file at the root, which permits commercial use and modification with the notice retained, and is a normal choice for infrastructure tooling.

Where Batfish sits against alternatives is worth being direct about. Against a config linter such as a vendor's own parser or an open source checker, Batfish is heavier and slower, because it builds a model of the whole network rather than reporting per-line problems. What it buys is the questions a linter cannot answer: reachability after a failure, collateral damage from an ACL change, equivalence between two vendors.

Against commercial network verification systems with similar goals, the differences are operational: an open source tool you run yourself, with no vendor contract behind the answers, and with the Pybatfish SDK as the only documented interface. The README points to batfish.org for technical detail on how the modelling works, a Slack community, and a YouTube channel plus notebooks as the learning path.

## Conclusion

Batfish fits a team whose changes are large, multi-vendor and hard to review by eye, particularly one that wants to answer reachability questions before committing a change rather than after an outage. Do not adopt it for single-device changes or on a laptop, since the recommended production server is a quad-core machine with 32 GB of RAM and 256 GB of disk. Verify first that your device vendors appear in the supported list, and treat the limited-support platforms as unsupported until you have tested them against your own configurations, because a parsing gap produces a wrong answer rather than an error.

## FAQ

### Does Batfish need access to my network devices?

No. The README states Batfish does not require direct access to network devices, and that the core analysis requires only their configuration. Analysis can optionally be enhanced with BGP routes from external peers and LLDP or CDP topology information.

### How do I run Batfish locally?

Pull the allinone container with `docker pull batfish/allinone` and run it mapping ports 8888, 9997 and 9996 with a volume at `/data`. Then install the client with `python3 -m pip install --upgrade pybatfish` and open http://localhost:8888 for the example notebooks.

### What hardware does Batfish need for a real network?

The README recommends a server with a quad-core CPU with two threads per CPU, 32 GB of RAM and 256 GB of hard drive. For the example notebooks alone, a dual core laptop with 8 GB of RAM is described as enough.

### Which vendors does Batfish support?

The README names A10 Networks, Arista, AWS, Azure, Cisco across NX-OS, IOS, IOS-XE, IOS-XR and ASA, Check Point, Cumulus, F5 BIG-IP, Fortinet, Free-Range Routing, iptables on hosts, Juniper, Nokia SR OS, Palo Alto Networks and SONiC. It also lists a separate category of platforms with limited support.

### What kinds of checks can Batfish perform?

Four categories: configuration compliance such as unreferenced ACLs and template mismatches, reliability such as reachability after a single-link or single-device failure, security such as sensitive services reachable only from expected sources, and change analysis such as reachability being identical across current and planned configurations.

### What license is Batfish released under?

Apache-2.0, in the LICENSE file at the repository root. The default branch is master and releases are date-stamped, for example v2026.08.27, rather than following semantic versioning.

## Sources

- [batfish/batfish on GitHub](https://github.com/batfish/batfish)
- [License: Apache-2.0](https://github.com/batfish/batfish/blob/master/LICENSE)
- [Project website](http://www.batfish.org)
- [README](https://github.com/batfish/batfish/blob/master/README.md)
- [Releases](https://github.com/batfish/batfish/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/batfish-batfish