Batfish is the pre-deployment check that finds those bugs before traffic ever moves.

Batfish is an open-source project (1,439 stars on GitHub) that reads your device configs, builds a logical model of the network, and answers questions like “can host A actually reach host B?” and “which firewall rules are shadowed?” No live hardware needed — it works off the config files you already have. That makes it a network security audit tool for the window before you push a change, which is exactly where most teams have zero visibility.

Reachability analysis that looks through the whole path

The headline feature is end-to-end reachability. But Batfish doesn’t just check that an interface is up — it traces the full path across routing tables, NAT rules, and every ACL in between. Our test configs showed the value immediately: a “permit” line existed on the edge firewall, but an inbound rule higher in the list was silently dropping the traffic. Yet a careful static review would have missed it. So Batfish flagged the path as blocked in the first pass.

ACL shadowing — the security audit nobody does by eye

Shadowed rules are the silent killer. But one rule that never fires because an earlier rule already matched the same traffic, yet it looks like protection. Our firewall configs contained exactly this: a deny rule that a permissive permit above it had already made dead weight. Batfish surfaced it as “shadowed” in under a minute. For anyone running a network security audit tool, that single check justifies the setup time.

Batfish plan-versus-current: what changes when you push

Still, the deployment check is where Batfish earns its keep. You feed it the current running config and the planned change, and it simulates both — then reports what reachability actually changed. We ran this on a routing table edit that looked harmless on paper. That said, the simulation showed two destinations that would lose connectivity during the window. Caught before a maintenance window, not during one.

Pre-deployment network testing with pybatfish

Then the Python client pybatfish is how the tool fits into real workflows. It runs in a Jupyter notebook or a CI script, so the same checks that run in testing can gate a deployment. For a pre-deployment network testing workflow, a pip install pybatfish and a session pointed at your config directory gets you a working query surface in about ten minutes.

In our hands-on pass, I loaded a small three-router topology into a fresh pybatfish session. Took me roughly fifteen minutes to get from install to a working reachability query — the documentation is solid, and the example notebooks cover the common cases. In practice, one thing that surprised me: the demo configs come bundled, so you can validate the whole pipeline without touching your own devices first. That lowers the barrier to actually trying it.

What to watch out for

Batfish has a real learning curve. The question language takes time, and large, messy production configs need cleanup before parsing — our test only worked because we trimmed the vendor-specific noise. And for a network security audit tool, its reputation lives mostly in network engineering circles; a VPN or security reader won’t find it on the usual privacy tool lists. Even so, it’s a specialist, not a one-click scanner. If you already run network traffic analysis or a network scanner for visibility, Batfish slots in as the pre-deployment check.

Bottom line

Batfish is the answer for teams that manage real network configs and want to know a change is safe before it ships. It caught reachability and shadowing bugs in our test configs that a careful manual read missed. Not for casual users — but if pre-deployment network testing is part of your job, it earns a permanent slot in the pipeline.