In this lesson, we will cover:
- The different questions that Batfish provides for packet forward analysis.
- Validating and tracing traffic to one of our hosts from multiple points in the topology against multiple ports and protocols.
- Looking at how Batfish builds the topology.
- L3 edges.
- L1 edges and Layer 1 topologies.
- Understanding L2 analysis behaviour.
Introduction to Forwarding Analysis
Batfish provides the ability to perform forwarding analysis by verifying and tracing the path of flows across your network topology. Traditionally we have used ping or traceroute to achieve this, which involved sending actual packets across the network. Batfish on the other hand allows you to perform these verifications by sending virtual packets across the modelled network topology it has built. Because of this, we get much more flexibility and power over the traditional methods, such as being able to validate the success of all ports and protocols across the network within a single test, or being able to send these virtual packets from any or multiple points in the network.
Packet Forwarding Questions
Batfish provides the following questions to perform packet forward analysis.
- Traceroute - Performs a virtual traceroute in the network from a starting node. A destination IP and ingress (source) node must be specified. Unlike a real traceroute, this traceroute is directional.
- Bi-directional Traceroute - Same as
Traceroutebut also provides the path traces for the reverse flows.
- Reachability - Similar to the
Traceroutequestion, however it searches across all flows that match the input conditions. For example, it allows you to test reachability from multiple points in the network.
- Bi-directional Reachability - Same as the
Reachabilitybut also provides the path traces for the reverse flows.
- Loop detection - Searches across all possible flows in the network and returns example flows that will experience forwarding loops.
- Multipath Consistency for host-subnets - Returns any flows where multiple paths are present, and when the path outcome is different to the others. The tested flows are between host subnets. For example, one trace within the flow shows SUCCESS and the other DENIED.
- Multipath Consistency for router loopbacks - The same as Multipath Consistency for host-subnets, but is performed between router loopbacks.
Import the snapshot for this section using the supplied helper script and snapshot. Like so,
$ ./scripts/bf_snapshot_importer.py -p snapshots/003-pforwarding_analysis_l3edge