As modern enterprise networks grow in scale and complexity, configuration errors remain a primary cause of unexpected outages and security vulnerabilities. Traditionally, network engineers validated design changes by setting up resource-intensive physical hardware labs or running emulation environments like GNS3. Once changes were applied to production, verification relied on manual, reactive debugging tools like `ping` and `traceroute`, or long-term monitoring via Network Management Systems.
In recent years, the industry has shifted toward proactive, formal network analysis. Rather than passing live packets through physical or emulated environments, formal analysis inspects raw device configuration files directly — finding hidden logic errors and verifying security policies before any changes reach live hardware.
The Foundation: Batfish
At the forefront of this shift is Batfish, an open-source network configuration analysis tool originally created by researchers at Microsoft Research, UCLA, and USC. Later commercialized by Intentionet and now managed as an open-source project under AWS (Apache 2.0 license), Batfish guarantees the correctness of both planned and running network configurations.
Batfish operates through a four-stage pipeline:
- Configuration Ingestion: Ingests raw configuration files from a wide range of network vendors.
- Model Normalization: Parses vendor-specific syntaxes into a unified, vendor-independent data model.
- Data Plane Computation: Simulates control plane logic to build the Routing Information Base (RIB) and Forwarding Information Base (FIB) for every node.
- Query Engine: Answers deep queries regarding packet flows, ACL rule reachability, tunnel status, and failure impacts.
Engineers can interact with Batfish programmatically using pybatfish, its Python SDK. While pybatfish is extremely capable for automated CI/CD pipelines, writing custom Python scripts for one-off sanity checks or ad-hoc troubleshooting creates a barrier to entry for network administrators unaccustomed to writing code.
Introducing Bat-Q: A Zero-Code Interface for Batfish
I wrote Bat-Q in 2023, a Streamlit web application that acts as a complementary, graphical front-end for Batfish. It enables network engineers, sysadmins, and students to run formal configuration checks, perform differential audits, and test outage scenarios directly through a web browser without writing a single line of Python.
Architecturally, it’s a thin wrapper: Bat-Q (the Streamlit UI) talks to a Batfish server (running as a Docker container) through the pybatfish API, and renders the results back as tables and diagrams.
Core Workflows and Application Pages
Bat-Q organizes Batfish’s analysis engine into five core application pages:
- Home: Connects to the local or remote Batfish Docker container, initializes workspace environments, and processes uploaded network configuration snapshots.
- Questions: Lets users pick from Batfish’s extensive set of built-in questions and configure specific query parameters via simple input fields.
- Analysis: Renders query results into clean, interactive tabular data and visual diagrams for convenient review.
- Failure Tests: Allows users to simulate node or link interface failures and observe how the network reacts.
- Differential Analysis: Enables side-by-side comparisons between two configuration snapshots (e.g., current production vs. planned candidate config) to detect behavioral changes before pushing updates.
Key Real-World Use Cases
- Multi-Option Design Evaluation: Network designers can evaluate competing topology designs, such as analyzing five distinct ISP connection strategies, without spending hours configuring hardware or emulator nodes.
- Pre-Deployment Differential Audits: By running a differential check between active configurations and modified candidate configurations, engineers can ensure an ACL edit doesn’t unintentionally block critical traffic.
- Resilience & Chaos Engineering: In the Failure Tests view, engineers can simulate critical core router failures to verify that redundant links take over forwarding paths as expected.
What’s New in Bat-Q Version 0.2
The latest release (v0.2), just published, brings substantial usability, visual, and architectural improvements, centered largely on catching up with recent changes to Streamlit and pybatfish:
- Improved navigation
- Interactive topology visualization
- Enhanced snapshot management
- DataFrame & schema optimization
- Report and spreadsheet generation
Try It Yourself
Bat-Q is free and open source under the Apache 2.0 license. If you’d like to try it, you’ll need a Batfish server (a single Docker container) and Python 3.11+ to run the Streamlit app. Full setup steps are in the GitHub Repo There’s also a YouTube tutorial playlist (work in progress) demonstrating its features.
Conclusion
Static network analysis represents a fundamental shift in how engineers design, deploy, and maintain infrastructure. By placing an intuitive Streamlit interface on top of Batfish’s powerful reasoning engine, Bat-Q gives network teams a way to evaluate designs, catch outage-causing errors, and validate behavior before a change ever touches production without needing to write Python code.
If you try it out, I’d welcome issues, feedback, or pull requests on GitHub. More on this and related projects at adhocnode.com.