1. A network-wide verification system comprising: a network device interface configured to read and write packet-forwarding rules of multiple, varied network devices comprising switches and routers; a controller in network communication with the multiple network devices via the interface and configured to transmit packet-forwarding rules in real time to the devices; computer storage in which are stored multiple network invariants expected to be upheld in valid network operations as determined by a combined effect of packet-forwarding rules across multiple devices; and a data plane verification layer positioned between the network device interface and the controller and configured to: monitor packet-forwarding rule modifications in a network, including modifications initiated by the network devices and by the controller; and verify validity of invariants of the monitored network according to the stored multiple network invariants.