A network digital twin is software that builds a complete copy of a company's network from the settings of every network device. Engineers search the copy to see what the real network will do with any piece of traffic. The copy is a digital twin: it is kept up to date from the real network, and engineers ask their questions of the copy instead of the network itself.
Why is a copy needed? A bank or a large company runs thousands of network devices: switches and routers in its offices, data centre switches, load balancers, firewalls and the virtual networks in its cloud accounts. Each device sends each packet of data onward according to its own settings and its own tables. No engineer can hold all of these in mind. When an app cannot reach a server, the usual way to find out why is to log in to one device after another along the path and read each one's settings.
The software does that reading for the whole network, several times a day. It collects each device's configuration, which is the settings that people write, and its state, which is the tables the device has built for itself, such as the routes it has learnt. It changes nothing on the devices. From this data, it calculates every path that traffic can take through the network. Each collection is kept as a snapshot, so engineers can compare the network today with the network last week.
Take, for example, a private bank in Mumbai with 2,600 network devices. One morning, employees at 40 branches in Gujarat cannot open the bank's loan system. An engineer searches the twin for the path from a branch computer's address to the loan server, on port 443, the port used by secure web traffic. The answer shows the full path through 9 devices. It stops at one firewall in the data centre, where a rule added the night before blocks the address range of the Gujarat branches. Comparing last night's snapshot with this morning's shows that exact change. The team corrects the rule within 20 minutes, without logging in to the other 8 devices.
The product has one part. Network change verification tests a planned change on the copy before anyone makes it on the real network. The twin also checks standing rules, called intents, every time it collects a snapshot. An example is "the servers that hold card data must never be reachable from the branch Wi-Fi". A failed intent shows the team a problem before an auditor or an attacker finds it.
How is it different from its neighbours? Network AIOps reads alarms and live measurements to explain a problem that is already happening. The twin calculates from settings, so it can answer a question before any traffic is sent. Attack path analysis builds a similar model of the network to answer one security question: what could an attacker from the internet reach, and through which known flaws?