Necessary cookies and storage support sign-in and learning. Optional Vercel analytics and campaign measurement stay off unless you accept. Rejecting won't affect courses or checkout.
Global Privacy Control is on. Optional analytics stays off.
FREE TOOL
Paste a configuration from before a change and one from after it, such as two "show running-config" captures from the same router. The tool compares them section by section and lists what was added, removed or changed in each section. Lines that change without anyone editing the configuration, such as the byte count and the last-change time, are listed separately as expected noise. The comparison runs in this page, and the page does not send what you paste to a server. No account is required.
This tool runs in your browser and needs JavaScript turned on. The boxes stay locked until the page script loads, so the page cannot send anything you enter. If they stay locked, the script did not load. Turn on JavaScript or reload the page to use the tool.
The tool is ready. It runs in this page, and the page does not send what you enter to a server.
One row for each change, under the section it belongs to. A section that is only in A or only in B is one row, with its lines. "Where" gives line numbers in each paste, and for an added line, the line in A it follows.
| Section | Change | Before (A) | After (B) | Where |
|---|
Lines set aside because they can change without a configuration change. Each one is compared, and "Compared" says whether it differs.
| Kind | In A | In B | Compared | Why it is set aside |
|---|
Lines the tool could not place in a section or read as configuration. They are compared in order as their own group, and any difference appears in the changes table under "Unparsed lines".
| Paste | Line | Text | Why it was not read |
|---|
Each step reports the counts from this comparison. The tables above list every change, every line set aside as expected noise and every line the tool could not read.
A configuration is a list of sections. An interface block, an access list and a routing process each start with one line in the first column, and the lines indented under it belong to it. A plain text diff does not know that, so a description change shows up as two unrelated lines, and when a section moves, the diff can report every line in it as removed and added. This tool reads each paste into sections first, matches each section in A with the section in B that has the same first line, and then compares the lines inside it.
Inside a section the lines are compared in order, not as a set. The entries of an access list are checked from the top, and the first entry that matches decides, so an entry inserted between two others changes what the list does even though no existing line changed. The tool shows an added line with the line in A it follows. A line that moved is shown as removed where it was and added where it is now, and a removed line and an added line for the same command in the same place are shown as one changed line.
To practice, read the two example configurations below and write down what changed before you paste them. There are two changes: the description on Ethernet0/1, and a new access-list entry, 25, between entries 20 and 30 of WEB-FILTER.
interface Ethernet0/1
description to core-rtr01 e0/1
ip address 172.16.12.5 255.255.255.252
!
ip access-list extended WEB-FILTER
20 permit tcp any host 203.0.113.10 eq 443
30 permit tcp any 203.0.113.0 0.0.0.255 range 8000 8080interface Ethernet0/1
description to core-rtr01 e0/1 (ECMP path B)
ip address 172.16.12.5 255.255.255.252
!
ip access-list extended WEB-FILTER
20 permit tcp any host 203.0.113.10 eq 443
25 permit tcp any host 203.0.113.20 eq 8443
30 permit tcp any 203.0.113.0 0.0.0.255 range 8000 8080Some lines differ between two captures even when nobody changed the configuration. IOS prints the size of the configuration ("Current configuration : 3756 bytes") and the time of the last change above it. The size changes with any edit, and the last-change time moves whenever the configuration is touched. Capture tools can touch it when they connect: the tool that captured this page's example configurations sets "no logging console" and "exec-timeout 0 0" on the console and vty lines every time it opens a session, which also moves the last-change time. These lines are listed in their own table with the reason, and the table says whether each one differs. They are not hidden, because a change you made to one of them on purpose should still be visible.
Only those exact lines are set aside. When the other paste has a different value for the same command in the same place, such as "exec-timeout 5 0" under line vty 0 4, or "logging console" instead of "no logging console", the difference is a real change. It is listed in the changes table as a changed line, and the noise table says so.
A paste can hold lines that are not configuration: a device message such as "% Invalid input detected", the error marker under it, a pager prompt, or an indented line with no section line above it. The tool does not guess where these belong. It lists each one with the reason, and compares them in order as their own group, so a difference there is shown but is not presented as a configuration change.
A paste that stops partway through the configuration makes every section after the cut look removed. The tool treats a paste as cut off when it has the header that show running-config prints but no "end" line, when the other paste ends with "end" and this one does not, or when its last line stops partway through a word or an address. The result then starts with a warning, the last line is listed with the unparsed lines because it may be only part of a line, and each removal (or each addition, when A is the cut paste) is marked unreliable. Paste the whole configuration and compare again before you act on the result. A paste that stops exactly at the end of a line, with no show running-config header and no "end" line in either paste, shows none of these signs, so the tool cannot tell from the text that it is cut off, and you should compare complete show running-config output from both devices.
Both boxes hold device configuration, and a configuration can carry addresses, names and secrets. This page never writes configuration to a link, so the tool has no share link and never writes either paste to the page's URL. Copy results includes the changed lines, so run the configuration through the config sanitizer before you send the copy to anyone.
The tool compares text, not behavior. It does not know which commands have defaults that IOS hides, so a line added in B that only restates a default still shows as added. It matches sections by their exact first line, so a renamed access list or a renumbered route-map clause is shown as one section removed and another added. Spacing inside a line counts, which matches two captures from the same device but can show differences between configurations written by hand. Expected noise is the header lines, "end", and the two console-session lines named above; other tools can change other lines. The section rules were checked against "show running-config" captured from Cisco IOS XE 17.12.1 running as IOL on Cisco Modeling Labs, before and after four known changes. Other releases and platforms can print configurations differently.