To meet ever more stringent requirements, network operators often need to reason about worst-case link loads. Doing so involves analyzing traffic forwarding after failures and BGP route changes. State-of-the-art systems identify failure scenarios causing congestion, but they ignore route changes. We present Viper, the first verification system that efficiently finds maximum link loads under failures and route changes. The key building ...