Drift detection

What changed,
and what did it break?

A path that worked on Tuesday is not evidence about Thursday. PathMRI takes a snapshot of the things that decide a flow — listening ports, host firewalls, routes, device configuration — and tells you what moved since, with the connectivity that moved with it.

Download Read the manual

Snapshot the things that decide a flow

Component	What is captured
Host	Listening ports, the host firewall — status, rules, inbound and outbound, Windows GPO — and the routing table
Network device configuration	Each connected firewall's policy, as PathMRI reads it
Connectivity	The result of the rules you declared, so a change in policy shows up as a change in reachability
Path and routing	The devices a flow crosses, and where each host sends its traffic

Change with a severity, not a diff

A firewall leaving the path

Security-relevant on its own. Traffic that used to be inspected no longer is, and nothing in a policy audit would have told you.

A firewall entering the path

One policy change away from an outage. It is reported before the outage rather than during the incident call.

Noise that is not change

A device answering on a new interface address is the same device. A lossy traceroute is not a new path. Metric-only and label-only route changes are ignored, so what remains is worth reading.

Drift is the second half of verification. The first run tells you the path is clear. Drift tells you it still is — or names the change that made it stop being true.

Routing & asymmetry Path drift and routing drift in detail, and the return leg. Rogue ports and baselines The same idea applied to listeners: what is open that was not before. The fix, and the report Configuration drift is a section of the printable report.