Beyond Line-by-Line Diffs
When a developer changes code, git diff shows which lines changed. That's useful, but for networks it's not enough. A one-line change to a route map can redirect traffic for thousands of flows. A one-line change to an ACL can open or close access for entire subnets. The text diff is small; the behavioral impact is enormous.
Differential Analysis compares the behavior of two network snapshots, not just their text. Before deploying a change, you run Batfish against two configurations:
- Snapshot A: The current production configuration (baseline).
- Snapshot B: The proposed new configuration (candidate).
Batfish computes the behavioral difference:
Snapshot A → Batfish → Behavior Model A ─┐
├─ Diff → Behavioral Delta
Snapshot B → Batfish → Behavior Model B ─┘
The output isn't "line 47 changed." It's:
- "These 50 flows that previously reached the database server will now be dropped."
- "Port 80 is now reachable from the management subnet — this was not reachable before."
- "Failover behavior for link X has changed: traffic will now route through the backup path 200ms slower."
This semantic diff gives engineers and reviewers the information they actually need to evaluate a change. It's the difference between a code reviewer seeing x = x + 1 and understanding that the counter now increments — versus just seeing that a character changed.
In a CI/CD pipeline, differential analysis runs automatically on every Pull Request. The pipeline posts the behavioral delta as a comment on the PR. Reviewers can approve or reject based on actual impact, not guesswork.