Skip to content

Packaging snapshots for analysis

Harsh Verma edited this page Mar 15, 2019 · 18 revisions

Batfish service expects the configurations to be packaged in the following folder structure. The names in bold are keywords, i.e., your snapshots must use those names; other folders and files may be differently named. Your snapshot may not have all of these components (e.g., if you are not analyzing hosts/iptables configurations, you don't need the corresponding folders).


snapshot [top-level folder]

  • configs [folder with configurations for network devices]
    • router1.cfg
    • router2.cfg
    • ....
  • hosts [folder with host configurations (e.g., pointers to their iptables files)]
    • host1.json [see below for the expected format]
    • host2.json
    • ....
  • iptables [folder with iptables configuration files; host json files should point to these files]
    • host1.iptables
    • host2.iptables
    • ....
  • batfish [folder for miscellaneous configurations (not network device configurations) used by Batfish]
    • isp_config.json [configuration file used to model Internet Service Providers (ISPs), see below for expected format]

See the example snapshot in the repository as an example. For convenience, this folder contains some extra files that are not used by Batfish.

When you supply the snapshot as a zipped file, the top-level folder (called "snapshot" above) should be part of the zip archive.

Format for F5 Big-Ip configuration files

F5 Big-Ip configuration spans multiple individual files. Follow the instructions here to properly package them for analysis

Format for host json files

The host json files contain basic information about the hosts attached to the network, including their names, a pointer to their iptables configuration file, and their interfaces. An example file is:

  "hostname" : "host1",  
  "iptablesFile" : "iptables/host1.iptables",  
  "hostInterfaces" : {  
      "eth0" : {  
          "name": "eth0",  
          "prefix" : ""  

"iptables/host1.iptables" is the path relative to the snapshot where this hosts iptables configuration can be found. iptables configuration files should be in the format that is generated by iptables-save.

Format for the topology file (EXPERIMENTAL)

Normally Batfish infers layer-3 interface adjacencies based on IP address configuration on interfaces.

For instance, if there are two interfaces in the network with IP assignments and respectively, Batfish will infer that these interfaces are adjacent.

However, you may override this behavior by supplying a layer-1 topology file. In this case, layer-3 adjacencies are computed by combining the supplied layer-1 adjacencies with layer-2 and layer-3 configuration to get a more accurate model. This is especially useful if IP addresses are reused across the network on interfaces that are not actually adjacent in practice.

Batfish can take the topology file in JSON format:

The expected JSON file has a list of edge records, where each edge record has node and interface names of the two ends. See this file for an example. Your file name should be layer1_topology.json for it to be considered by Batfish.

Format for ISP configuration json files

Batfish can model routers representing ISPs (and Internet) for a given network. The modeling is based on a json configuration file (isp_config.json), which tells Batfish about the interfaces on border routers which peer with the ISPs. An example file is:

	"borderInterfaces": [
			"borderInterface": {
				"hostname": "as2border1",
				"interface": "GigabitEthernet3/0"
			"borderInterface": {
				"hostname": "as2border2",
				"interface": "GigabitEthernet3/0"
	"filter": {
			"onlyRemoteAsns": [],
			"onlyRemoteIps": []

Here borderInterfaces contains the list of interfaces on border routers which are meant to peer with the ISPs. onlyRemoteAsns (list of ASNs) and onlyRemoteIps (list of IPs) provide a way to apply additional filter by restricting to ISPs having specific ASNs or IPs.

Batfish will not try to model any ISP routers in the absence of this configuration file.

An example network with ISP modeling configuration is here.

You can’t perform that action at this time.