batfish - Batfish is a network configuration analysis tool t

项目说明

Got questions, feedback, or feature requests? Join our community on Slack!

![codecov]()

What is Batfish?

Batfish is a network tool that provides correctness guarantees for security, reliability, and compliance by analyzing the configuration of network devices. It builds complete models of network behavior from device configurations and finds of network policies (built-in, user-defined, and best-practices).

A primary use case for Batfish is to configuration changes *before* deployment (though it can be used to deployed configurations as well). Pre-deployment is a critical gap in existing network automation workflows. By including Batfish in automation workflows, network engineers can close this gap and ensure that only correct changes are deployed.

Batfish does NOT require direct access to network devices. The core analysis requires only the configuration of network devices. This analysis may be enhanced using additional information from the network such as:
* BGP routes received from external peers
* Topology information represented by LLDP/CDP

See www.batfish.org for technical information on how it works.

What kinds of correctness checks does Batfish support?

<img src=batfish_video.png width=370>
<img src=batfish_notebook.png width=470>

The Batfish YouTube channel (subscribe!) and Python notebooks illustrate many checks. Batfish checks span a range of network behaviors.
#### Configuration Compliance
* Flag undefined-but-referenced or defined-but-unreferenced structures (e.g., ACLs, route maps)
* Configuration settings for MTUs, AAA, NTP, logging, etc. match templates
* Devices can only be accessed using SSHv2 and password is not null
#### Reliability
* End-to-end reachability is not impacted for any flow after any single-link or single-device failure
* Certain services (e.g., DNS) are globally reachable
#### Security
* Sensiti can be reached only from specific subnets or devices
* Paths between endpoints are as expected (e.g., traverse a firewall, have at least 2 way ECMP, etc...)
#### Change Analysis
* End-to-end reachability is identical across the current and a planned configuration
* Planned ACL or firewall changes are provably correct and causes no collateral damage for other traffic
* Two configurations, potentially from different , are functionally equi

How do I get started?

#### 1. Run the Batfish service
Getting started with Batfish is easy. Just pull and run the latest allinone Docker container that includes Batfish as well as example Jupyter notebooks.

docker pull batfish/allinone

docker run --name batfish -:/data -p 8888:8888 -p 9997:9997 -p 9996:9996 batfish/allinone

The second command starts the Batfish service and maps the necessary TCP ports.

##### Ad Docker configuration:
The amount of memory a to Batfish is determined by the Docker configuration. You may wish to supply the --memory command-line argument to explicitly set this value.

On Linux systems that run the OOM Killer, you may also wish to supply the --oom-kill-disable argument, which runs in conjunction with the --memory argument to prevent Linux from killing Batfish when there is memory pressure on the system.

#### 2. Browse example notebooks (optional)

If you are new to Batfish, consider walking through our notebooks which highlight different capabilities and use cases of Batfish. Point your browser to and in the Password or token: prompt, enter the token that Jupyter showed when you ran the container (e.g. token=abcdef123456...).

Jupyter will show you the list of a notebooks. "Getting Started with Batfish" is a good one to start with. This README explains what each notebook does.

#### 3. Install Pybatfish

To analyze your network configurations, you also need Pybatfish, a Python 3 SDK to interact with the Batfish service. Though not strictly necessary, we recommend that you install Pybatfish in a en.

To install Pybatfish run the following commands (in a en if applicable):

python3 -m pip install --upgrade pybatfish

#### 4. Develop your analysis

After installing Pybatfish, use your Python en of choice (e.g., PyCharm, interacti shell, Jupyter, ..) to interact with Batfish. The notebooks provide examples of such scripts.

See complete documentation of Pybatfish on readthedocs.

System Requirements for running Batfish

Batfish can be run on any operating system that supports Docker. The containers are actively tested on Mac OS X and Ubuntu 16.04 LTS.

To get started with the example Jupyter notebooks, all you need is a reasonably capable laptop:

* Dual core CPU
* 8 GB RAM
* 256 GB hard-drive

When you transition to running Batfish on your own network, we recommend a server that at least has:

* Quad-core CPU with 2 threads per CPU
* 32 GB RAM
* 256 GB hard-drive

Supported Network Device and Operating System List

Batfish supports configurations for a large and growing set of (physical and ) devices, including:

* A10 Networks
* Arista
* AWS (VPCs, Network ACLs, VPN GW, NAT GW, Internet GW, Security Groups, etc…)
* Azure (, Standard workflows, Public IPs / Nat Gateways, NSGs etc.)
* Cisco (All Cisco NX-OS, IOS, IOS-XE, IOS-XR and ASA devices)
* Check Point
* Cumulus
* F5 BIG-IP
* Fortinet
* Free-Range Routing (FRR)
* iptables (on hosts)
* Juniper (All JunOS platforms: MX, EX, QFX, SRX, T-series, PTX)
* Nokia (SR OS / SR-SIM, MD-CLI)
* Palo Alto Networks
* SONiC

Batfish has limited support for the following platforms:

* Aruba
* Dell Force10
* Foundry

If you'd like support for additional or currently-unsupported configuration features, let us know via Slack or GitHub. We'll try to add support. Or, you can &mdash; we welcome pull requests! :)

License and Dependencies

Batfish is released under The Apache Software License, 2.0. All
third-party dependencies are compatible with this licensing.

项目信息

开发语言：Java

Star 数：1493

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Batfish is a network configuration analysis tool that can find bugs and guarantee the correctness of (planned or current) network configurations. It enables network engineers to rapidly and safely evolve their network, without fear of outages or security breaches.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。