Weekly update

Week of 2026-03-30

A full interface management subsystem, offline DNS/RIR resolution tooling, config-driven plugin loading, BGP healthcheck and long-lived graceful restart support, and a Looking Glass overhaul.

← All weekly updates

🔌 Interfaces

A new interface management subsystem landed with a JunOS-style unit model.

  • Netlink-backed interface monitoring, with ze show interface and ze interface migrate over SSH
  • DHCP client, SLAAC, and migration between backends
  • MAC discovery with descriptive interface naming
  • Per-interface sysctl settings and traffic mirroring applied straight from config
  • A declarative config apply/reload pipeline, with admin distance now wired into route selection

🌐 DNS & resolution

  • New offline ze resolve command for DNS, Team Cymru ASN lookups, PeeringDB, and IRR queries, with 1-hour caching for the PeeringDB/IRR lookups
  • DNS queries now advertise a 4096-byte EDNS0 buffer, and truncated responses log a warning instead of failing silently

🧩 Config-driven plugins

  • BGP can now be loaded and unloaded at config reload time without restarting Ze, with plugin startup ordered by a dependency chain
  • Plugins in general can be dynamically loaded and unloaded on reload
  • The config editor now inlines single-child containers for display (remote ip 192.0.2.1 instead of remote { ip 192.0.2.1 }) and flags missing required or suggested fields

🖥️ CLI & Looking Glass

  • One-shot commands via ze -c (replacing --run)
  • Structured, colored help across all commands, with dispatch-key discoverability
  • New rib inject/rib withdraw commands for direct RIB manipulation, and a text-mode AS-path graph terminal for rib show best
  • Looking Glass overhaul: prefix summaries, downloads, dark mode, a next-hop graph view, and a help tab

🛰️ Routing

  • New BGP healthcheck plugin: monitors service availability via shell probes and drives route announce/withdraw (or a MED override) through watchdog groups
  • Long-lived graceful restart (RFC 9494): stale routes are now correctly filtered or withdrawn per peer on egress, based on each peer's LLGR capability
  • New FIB pipeline installs best-path routes from protocol RIBs into the kernel via netlink (a P4 backend is stubbed in)
  • Fixed a VPN next-hop encoding bug where the route-distinguisher slot could carry stale bytes left over from a previous UPDATE instead of the RFC 4364-required zero padding

⚡ Under the hood

Forwarding to peers now defaults to zero-copy, only copying a buffer when an egress filter needs to modify the payload; the forwarding pool also auto-sizes per peer based on burst size instead of using fixed global pools. HTTP responses now carry an X-Ze-Version header.