The rule that decided it,
quoted by name.

PathMRI reads the policy that actually governs your flow — from the device or the cloud control plane, over its own API or CLI — and works out which rule wins. Not "the firewall is probably fine": rule 147, on this interface, in this direction.

Download See every vendor

Thirteen policy sources, thirteen ways of deciding

Every platform resolves a packet differently, and the differences are exactly where a generic parser gets it wrong. PathMRI models each one the way it really behaves.

First match, last match, or priority

ASA is first-match with an implicit deny. pf is last match unless the rule is quick. Azure Firewall gives the action to the collection, not the rule, and denies when nothing matches — the opposite of an NSG.

Pre-NAT or post-NAT

PAN-OS matches pre-NAT addresses with the post-NAT zone. Check Point matches pre-NAT. FTD and Juniper match the real, post-NAT destination. Get this backwards and the verdict is confidently wrong.

The objects behind the rule

Address and service groups expanded, nested and cycle-guarded; aliases resolved; negate flags honoured; schedules evaluated in the device's own timezone. A group whose members the API does not return is never trusted as empty.

Where it will not guess

A confident wrong answer is worse than no answer, so several situations produce a named caveat instead of a verdict.

Situation	What PathMRI does
The vendor string is not recognised	Answers `unknown` and refuses to guess — quoting the string it did not recognise and listing the ones it does. Applying a rule refuses before it opens a connection, rather than typing one vendor's commands into another vendor's box
A rule matches on payload	An AWS Network Firewall Suricata rule that inspects content is named on the verdict rather than obeyed — header rules decide, payload rules are declared
IDS or IPS packages are installed	A pfSense box running Suricata, Snort or pfBlockerNG gets a caveat on an allow, because those drop packets pf has already passed — and no caveat when they are absent or switched off
An IPv6 flow	Only FortiGate evaluates one today. Every other source returns `unknown` with a caveat naming what was not read, decided before the vendor branch runs — because an evaluator handed a flow it cannot match would fall through to the policy default and answer confidently

The prediction is only half the answer. Whatever the policy says, PathMRI still sends a real packet and reconciles the two. A firewall that permits a flow it is silently dropping is exactly the case this product exists for.

Supported vendors What is read on each platform, and what is evaluated. NAT, declared and observed The translation that changes which packet the far end even sees. Path verification How the prediction is tested against a real packet.