Compare

Open Source Network OS comparison

A source-grounded comparison of Ze, VyOS, and freeRtr as router operating systems rather than only BGP implementations.

Scope and evidence: this page summarizes the local research artifact produced from the checked-out Ze, VyOS vyos-1x, and freeRtr sources. Runtime protocol daemons external to vyos-1x are intentionally labeled that way, and VyOS rows may cite FRR or other integrated projects when those projects own the runtime behavior. Not found means not found in the inspected source roots after targeted searches, not a universal upstream absence claim. The inline code paths link to upstream source where the site can map them.

Status legend

Mark Meaning
✓ Direct source evidence found in inspected checkout.
∿ Source evidence exists, but scope is narrower than the comparable feature in at least one other product.
Unclear Related source evidence exists, but the exact feature or behavior was not traced to a producer.
✕ Targeted and alternate searches did not find the feature in inspected sources. This is not a global claim about every version or external package.

Executive conclusion

Feature matrices by category

These are the operator-facing feature matrices. Cells intentionally start with Yes, No, Partial, or Unclear so the table reads like the BGP comparison. The detailed source evidence remains in the appendices below.

Routing and control plane matrix

Feature Ze VyOS freeRtr Notes
IPv4/IPv6 static routing ✓ ✓ ✓ Ze and VyOS include ECMP style static route surfaces; freeRtr has static route objects.
BGP core ✓ ✓ ✓ Ze and freeRtr implement BGP in source; VyOS exposes BGP through FRR config.
BGP extended AFI/SAFI ✓ ✓ ✓ Ze and freeRtr have broad in-tree AFI/SAFI support; VyOS exposes FRR AFI/SAFI config.
BGP capabilities ✓ ✓ ✓ ADD-PATH, route refresh, extended messages, extended nexthop and related capability surfaces are evidenced.
BGP Graceful Restart / LLGR ✓ ✓ ✓ VyOS evidence is config-surface level through FRR.
Route server and route reflector ✓ ✓ ✓ All three expose route-reflector-client and route-server-client modes; freeRtr has both as per-neighbor knobs.
RPKI / ASPA ✓ ✓ ✓ Ze and freeRtr include RPKI source; VyOS exposes RPKI config.
Route maps, route policy, import/export chains ✓ ✓ ✓ Ze uses plugin chains; VyOS uses policy and FRR templates; freeRtr has route-map and route-policy classes.
Route redistribution / protocol import-export ✓ ✓ ✓ Separate from IS-IS route leaking: all three expose redistribution, with Ze and freeRtr source-backed and VyOS documented for protocol route import/export.
Prefix filters ✓ ✓ ✓ All three have prefix-list style evidence.
AS-path filters ✓ ✓ ✓ All three have AS-path filter or manipulation evidence.
Community filters ✓ ✓ ✓ Standard, large, and extended community evidence exists for all three.
OSPFv2 ✓ ✓ ✓ Ze and freeRtr implement; VyOS exposes OSPF config.
OSPFv3 ✓ ✓ ✓ Evidence exists for all three.
OSPF extensions: SR, TE, BFD, LDP sync ✓ ✓ ✓ Scope differs by implementation and config surface.
IS-IS L1/L2 ✓ ✓ ✓ Evidence exists for all three.
IS-IS route leaking ✓ Unclear ✓ Ze implements RFC 2966 L1/L2 leaking; VyOS documents IS-IS redistribution and attached-bit but no leak-specific command was found; freeRtr has source-visible IS-IS inter-level route handling tests.
RIP / RIPng ✕ ✓ ✓ Not found in Ze inspected source.
EIGRP ✕ ∿ ✓ VyOS schema exists, but generated templates are removed by Makefile in inspected source.
Babel / OpenFabric / OLSR style IGPs ✕ ∿ ✓ VyOS has Babel/OpenFabric files; freeRtr has broader IGP classes.
BFD ✓ ✓ ✓ Ze BFD attaches to BGP/OSPF/static; all three have evidence.
RIB / FIB programming ✓ ✓ ✓ Ze targets kernel and VPP, VyOS delegates through FRR/Linux/VPP, freeRtr has own forwarding core and dataplane exports.
VRF / routing instances ✕ ✓ ✓ Ze has named routing tables and some per-feature VRF fields, but no full product VRF/interface binding yet.
Cross-VRF route leaking ✕ ✓ ✓ Ze does not have VRF yet, so cross-VRF route leaking is not present.
MPLS labels/dataplane ✓ ✓ ✓ Evidence exists for all three.
LDP ✓ ✓ ✓ Evidence exists for all three.
RSVP-TE ✓ ✕ ✓ VyOS RSVP-TE was not found in inspected vyos-1x.
Segment Routing / SRv6 ✓ ✓ ✓ Evidence exists for all three.
EVPN control plane ✓ ✓ ✓ VXLAN dataplane integration differs and is covered under interfaces.
Multicast routing: PIM, PIM6, IGMP, MSDP ✕ ✓ ✓ Ze BGP multicast tooling is not a multicast routing daemon.
Policy-based routing ✓ ✓ ✓ Ze is experimental; VyOS has policy route/route6 interface-applied PBR with set table/VRF; freeRtr has interface and VRF PBR.
BMP ✓ ✓ ✓ VyOS evidence is BGP monitor config surface.
MRT dump/import/export ✓ ✕ ✓ VyOS MRT was not found in inspected source.
Routing telemetry exports ✓ ∿ ✓ All have some export hooks, with different scope.

Interfaces, L2, L3, and dataplane matrix

Feature Ze VyOS freeRtr Notes
Interface management model ✓ ✓ ✓ Ze uses typed Go config and backend selection; VyOS uses XML plus Python owners; freeRtr uses central Java interface config.
Linux netdev backend ✓ ✓ ∿ Ze has a netlink backend; VyOS manages Linux interfaces; freeRtr abstracts interfaces through Java and helpers rather than a Ze-like netlink backend.
VPP interface backend or VPP interface surface ✓ ✓ ✕ Ze registers a VPP iface backend; VyOS has VPP root config plus selected VPP interface definitions; freeRtr VPP interface support was not found.
Ethernet adoption/config ✓ ✓ ✓ All three have ethernet interface evidence.
Loopback ✓ ✓ ✓ Evidence exists for all three.
Dummy interfaces ✓ ✓ ✕ freeRtr normal interface type list did not show dummy.
Bridge ✓ ✓ ✓ Evidence exists for all three.
Bonding / LAG ✕ ✓ ✓ freeRtr calls this bundle.
VLAN 802.1Q ✓ ✓ ✓ Evidence exists for all three.
QinQ / stacked VLAN ✕ ✓ ✓ Ze QinQ was not found.
Interface VRF binding ✕ ✓ ✓ Ze has routing tables elsewhere, but no iface VRF binding was found.
VXLAN ✕ ✓ ✓ Ze EVPN NLRI exists, but VXLAN interface/dataplane integration was not found.
GRE / GRETAP ✓ ✓ ✓ Evidence exists for all three.
IPIP / SIT / IPv6 tunnel ✓ ✓ ∿ freeRtr evidence is protocol imports and tunnel surface, not exact CLI lines for every name.
WireGuard interface/tunnel ✓ ✓ ✓ Evidence exists for all three.
OpenVPN ✕ ✓ ✓ Ze OpenVPN was not found.
PPP / PPPoE ✓ ✓ ✓ Evidence exists for all three.
L2TP ✓ ✓ ✓ Ze focuses on L2TPv2/PPP BNG; VyOS evidence is L2TPv3 interface plus VPN L2TP; freeRtr has v2 and v3.
Generic TUN/TAP ✕ ✓ ∿ VyOS exposes TUN/TAP through OpenVPN; Ze and freeRtr tunnel abstractions do not prove a generic TUN/TAP feature.
veth ✓ ✓ ∿ freeRtr evidence is host helper integration, not a normal interface type.
MACsec ✕ ✓ ✓ Ze MACsec was not found.
Wireless / WWAN ✕ ✓ ∿ freeRtr has CAPWAP wireless-AP provisioning (servCapwap/clntCapwap), not a wireless interface type.
MTU, MAC, addressing ✓ ✓ ✓ Evidence exists for all three.
DHCP client on interfaces ✓ ✓ ✓ Evidence exists for all three.
IPv6 Router Advertisements ∿ ✓ ✓ Ze source evidence is BNG/PPP RA, not a general LAN RA sender.
LLDP ✕ ✓ ✓ Ze LLDP was not found.
QoS, traffic policy, shaping ✓ ✓ ✓ Ze supports tc/VPP backends and L2TP shaping; VyOS and freeRtr have broader policy surfaces.
Netns/container interface binding ✕ ✓ ∿ VyOS exposes netns/container integration; Ze did not in inspected iface source.
Native/P4/XDP dataplane helpers ✕ ✕ ✓ freeRtr has native, P4 and XDP helper sources.

Firewall, security, VPN, and AAA matrix

Feature Ze VyOS freeRtr Notes
Firewall tables, chains, hooks, policies ✓ ✓ ✓ Ze uses nftables; VyOS has firewall/zone model; freeRtr has ACL/filter surfaces.
Rich match/action rules ✓ ✓ ✓ Exact action vocabulary differs.
Stateful firewall / conntrack ✓ ✓ ∿ freeRtr has session-based inspect stateful tracking (tabSession) but no rule-level conntrack-state match.
Conntrack operations and observability ✓ ✓ ∿ Ze exposes Linux conntrack; VyOS has conntrack config/op files; freeRtr NAT state was found.
NAT44 source/destination/static/masquerade ✓ ✓ ✓ Evidence exists for all three.
NAT66 / NPTv6 / NAT64 ∿ ✓ ∿ Ze can express IPv6 NAT with nft chains, but no dedicated NPT/NAT64 model was found.
Zone-based firewall ✕ ✓ ✕ Explicit zone model was found only in VyOS.
Address, network, port and interface groups ✓ ✓ ✓ Scope differs by product.
Dynamic firewall groups/sets ✓ ✓ ∿ freeRtr ACL reflect is dynamic behavior, not a named dynamic group.
Rate limiting and security policing ✓ ✓ ✓ Evidence exists for all three.
Generic IPsec/IKE ✕ ✓ ✓ Ze has IPsec references for specific protocols, not a generic VPN IPsec/IKE subsystem.
WireGuard VPN ✓ ✓ ✓ Evidence exists for all three.
OpenVPN ✕ ✓ ✓ Ze OpenVPN was not found.
L2TP/IPsec remote-access coupling ∿ ✓ ∿ Ze and freeRtr have L2TP and IPsec-related pieces, but explicit L2TP/IPsec profile coupling was not found.
PKI / certificates ∿ ✓ ✓ Ze has self-cert and appliance cert replacement; VyOS and freeRtr expose broader PKI/config surfaces.
SSH service ✓ ✓ ✓ Evidence exists for all three.
Local users/passwords/keys/OTP ✓ ✓ ✓ OTP breadth differs.
RADIUS ∿ ✓ ✓ Ze RADIUS was source-confirmed for L2TP PPP sessions, not generic system login.
TACACS+ ✓ ✓ ✓ Evidence exists for all three.
Command RBAC / authorization ✓ ✓ ∿ Ze has explicit command authorization; freeRtr privilege behavior is less RBAC-like.
Sensitive storage and redaction ✓ ✓ ✓ Evidence exists for all three.
Control-plane hardening/sysctls ✓ ✓ ∿ Named CoPP is separate below.
Named CoPP feature ✕ ✕ ✕ Related controls exist, but named CoPP was not found in inspected sources.

Network services and operations matrix

Feature Ze VyOS freeRtr Notes
DHCPv4 server ✓ ✓ ✓ Evidence exists for all three.
DHCPv4 client ✓ ✓ ✓ Evidence exists for all three.
DHCPv4 relay ✕ ✓ ✓ Ze DHCPv4 relay was not found.
DHCPv6 server ∿ ✓ ✓ Ze source evidence is PPP/L2TP DHCPv6-PD, not a general LAN DHCPv6 server.
DHCPv6 client ✓ ✓ ✓ Evidence exists for all three.
DHCPv6 relay ✕ ✓ ✓ Ze DHCPv6 relay was not found.
Recursive DNS forwarder/resolver service ✕ ✓ ✓ Ze DNS lookup tooling and GeoDNS do not prove a recursive/forwarding DNS service.
Authoritative DNS ✓ ✓ ✓ Ze has GeoDNS authoritative-style service.
GeoDNS ✓ ✕ ✕ Ze-only in inspected sources.
NTP ∿ ✓ ✓ Ze NTP client found; NTP server not found.
PTP ✕ ✓ ✓ Ze PTP was not found.
SNMP ✕ ✓ ✓ Ze SNMP was not found.
LLDP service ✕ ✓ ✓ Repeated here because it is an operator service as well as L2 discovery.
TFTP/image server ✕ ✓ ✓ Ze can advertise PXE/TFTP options, but a TFTP server was not found.
HTTP server / API ✓ ✓ ✓ Scope differs: Ze REST/web/LG, VyOS API, freeRtr HTTP service.
Web proxy ✕ ✓ ✓ Ze proxy was not found.
Load balancing ✕ ✓ ✓ Ze load balancer was not found.
Captive portal ✕ ∿ ✕ VyOS advertises captive portal endpoints, not portal enforcement in inspected source.
Remote syslog destination ✕ ✓ ✓ Ze structured logging exists, but remote syslog destination was not found.
Flow telemetry: NetFlow/sFlow/IPFIX ✓ ✓ ∿ freeRtr has NetFlow; sFlow/IPFIX were not found.
Ping ✓ ✓ ✓ Evidence exists for all three.
Traceroute ✓ ✓ ✓ Evidence exists for all three.
MTR ✕ ✓ ✓ Ze MTR was not found.
Packet capture ✓ ✓ ✓ Evidence exists for all three.
Traffic generation/statistics ∿ ∿ ✓ Ze has traffic usage and BGP replay tools; VyOS has monitoring/iperf; freeRtr has generators.
Route looking glass/viewer ✓ ∿ ∿ Ze has a dedicated looking glass service; the others have route show surfaces.
Update, config archive, backup ✓ ✓ ✓ Scope differs by product.
Diagnostic support bundle/archive ✕ ✓ ✕ VyOS tech-support archive is the strongest inspected support bundle.

Management, automation, UI, and API matrix

Feature Ze VyOS freeRtr Notes
Operational and configuration modes ✓ ✓ ✓ Evidence exists for all three.
Submode/context editing ✓ ✓ ✓ Evidence exists for all three.
Interactive completion and help ✓ ✓ ✓ Evidence exists for all three.
Generated command reference/cache ✓ ✓ ∿ freeRtr generates NETCONF/YANG from help, but not a Ze/VyOS style command catalog.
Register-once operator surfaces ✓ ∿ ∿ Ze registers commands, config, plugins, RPCs, and events once, then exposes them through CLI, web, REST/gRPC, MCP, generated docs, completion, authorization, and audit. VyOS has generated CLI/config artifacts. freeRtr has broad CLI plus NETCONF/help generation. The inspected sources did not show the same Ze-style all-surface pipeline.
Candidate/draft config model ✓ ✓ ∿ freeRtr commit buffer exists, but the model differs from Ze/VyOS candidate storage.
Commit/apply ✓ ✓ ✓ Evidence exists for all three.
Commit confirm ∿ ✓ ✕ Ze supports commit confirmed <N> with timer, confirm, confirm abort, and timeout auto-revert in file mode; session mode still rejects it. VyOS supports commit-confirm. freeRtr has a session-drop auto-revert, not timed commit-confirm.
Rollback/revert ✓ ✓ ∿ freeRtr reverts running to startup and has an auto-revert session, but no numbered-revision rollback.
Config diff/compare ✓ ✓ ✓ Evidence exists for all three.
Command/config history ✓ ✓ ∿ freeRtr has command history; config revision history was not found.
Persistent config store ✓ ✓ ✓ Evidence exists for all three.
Remote archive upload ✓ ✓ ∿ freeRtr sets the upload target via client config-server credentials.
Machine-readable config schema ✓ ✓ ∿ Ze uses YANG; VyOS uses XML/RNG; freeRtr can generate YANG from help/config.
REST API ✓ ✓ ∿ freeRtr has HTTP API permissions, not a typed REST/OpenAPI surface.
GraphQL ✕ ✓ ✕ VyOS-only in inspected sources.
OpenAPI docs ✓ ✓ ✕ Ze and VyOS have OpenAPI evidence.
gNMI ✓ ✕ ✕ Ze-only in inspected sources.
NETCONF ✕ ✕ ✓ freeRtr-only among inspected sources.
SSH CLI transport ✓ ✓ ✓ Ze terminates SSH inside the daemon and lands operators in the Ze CLI/config editor. VyOS configures OpenSSH for device access. freeRtr has in-process SSH via secSsh, so it is also built in rather than OS-sidecar SSH.
Management SSH without host shell account ✓ ✕ ∿ Ze users can manage the router over SSH without Unix shell accounts. VyOS SSH is an OpenSSH/system-login path. freeRtr has built-in SSH and local users, but the inspected evidence did not show the same Ze AAA/RBAC/audit/accounting pipeline.
Browser router UI ✓ ✕ ∿ freeRtr has HTTP/web utilities, but a Ze-like router config UI was not found in inspected sources.
HTMX frontend ✓ ✕ ✕ Ze-only in inspected sources.
MCP / AI integration ✓ ✕ ✕ Ze-only in inspected sources.
External plugin SDK/API ✓ ✕ ✕ VyOS and freeRtr have extension mechanisms, not a Ze-like external SDK.
JSON outputs ✓ ✓ ✓ All three emit JSON; freeRtr exposes a json table-output mode.
Automation hooks/scripts/schedulers ✓ ✓ ✓ Shape differs by product.

Platform, packaging, and appliance matrix

Feature Ze VyOS freeRtr Notes
Primary build automation ✓ ✓ ∿ freeRtr README says no formal build system, but shell scripts exist.
Compile-time feature selection ✓ ✕ ✕ Ze build tags and feature gates are explicit.
Generated registries/schema artifacts ✓ ✓ ✕ Ze and VyOS generate runtime command/schema artifacts.
Native OS package output ✕ ✓ ✓ VyOS and freeRtr both ship full Debian package sources; Ze local install copies a binary.
Jar/archive package ✕ ✕ ✓ freeRtr Java artifact is first class.
Appliance disk image ✓ ✓ ✓ VyOS image build internals live in vyos-build, outside vyos-1x.
In-tree installer ISO flow ✓ ✕ ∿ Ze ISO flow is in-tree; VyOS points to external image builder; freeRtr has image recipes.
Installer initrd/kernel tooling ✓ ∿ ✓ VyOS uses live ISO/squashfs model in inspected source.
Local host install ✓ ∿ ✓ VyOS primary install is appliance/image oriented.
Disk partition installer ∿ ✓ ∿ VyOS has an interactive target-disk installer; freeRtr partitions/formats/bootstraps disks during image build but has no interactive installer.
RAID install ✕ ✓ ✕ VyOS-only in inspected sources.
Multi-image boot management ✕ ✓ ✕ VyOS-only in inspected sources.
Upgrade download/signature/hash verification ✓ ✓ ✓ Ze self-update downloads and verifies a SHA256 hash; VyOS uses minisign signatures; freeRtr verifies release hashes.
Rollback or auto-revert update ∿ ✓ ✓ VyOS auto-reverts to the previous image on a failed upgrade boot; freeRtr auto-revert was traced; Ze has gokrazy A/B.
Upgrade compatibility checks ✕ ✓ ∿ VyOS explicit arch/flavor checks were found.
systemd support ✓ ✓ ✓ Evidence exists for all three.
Non-systemd appliance mode ✓ ✕ ∿ Ze gokrazy mode uses gokrazy init to start Ze, with no systemd, package manager, or general shell; freeRtr has SysV compatibility but no no-systemd appliance claim.
Runtime platform detection ✓ ✓ ✓ Evidence exists for all three.
Runtime env/config integration ✓ ✓ ✓ Evidence exists for all three.
Kernel command line tuning ∿ ✓ ✓ Ze kernel tooling exists; exact sysctl/kernel tuning surface is broader in VyOS/freeRtr.
Runtime sysctl management ✓ ✓ ∿ Ze has a runtime sysctl component; freeRtr writes sysctl files at install time.
Container image/runtime ✓ ∿ ✓ VyOS inspected source focuses on managed podman containers more than a published image.
Managed guest containers ✕ ✓ ✕ VyOS-only in inspected sources.
PXE/remote provisioning ✓ ∿ ✕ Ze has the clearest in-tree PXE/TFTP/HTTP provisioning flow.
Seed/bootstrap config database ✓ ✓ ✓ Evidence exists for all three.

Observability, diagnostics, and testing matrix

Feature Ze VyOS freeRtr Notes
Native metrics / Prometheus endpoint ✓ ✓ ✓ VyOS uses exporters; Ze and freeRtr have in-source service evidence.
OS metrics ✓ ✓ ✓ Evidence exists for all three.
Push telemetry ✕ ✓ ✓ Ze push telemetry beyond Prometheus/events was not found.
Live dashboard ✓ ✕ ✓ Ze CLI/web dashboards and freeRtr dashboard objects were found.
HTTP health endpoint ✓ ∿ ✕ VyOS health checks are feature-specific, not one generic endpoint.
Doctor/check framework ✓ ✕ ∿ Ze has ze doctor, health registry checks, a warning/error report bus, support bundles, crash capture, and built-in runtime probes. freeRtr has checks/consistency references, but not a Ze-like doctor registry.
Symptom-based diagnostics ✓ ✓ ✓ Evidence exists for all three.
Structured logging ✓ ✓ ✓ Evidence exists for all three.
Runtime debug switches ✓ ✓ ✓ Evidence exists for all three.
Panic/core/crash capture ✓ ∿ ∿ Ze crashlog is explicit; the others have support/core or exception handling evidence.
MRT/BMP/log export tooling ✓ ∿ ✓ VyOS BMP/flow exports found; MRT tooling not found.
Packet capture diagnostics ✓ ✓ ✓ Evidence exists for all three.
Unit tests ✓ ✓ ✓ Evidence exists for all three.
Functional/smoketests ✓ ✓ ✓ Evidence exists for all three.
Topology/interop tests ✓ ∿ ✓ VyOS broader topology harness may live outside vyos-1x.
Performance benchmark harness ✓ ∿ ✓ Ze has ze-perf; VyOS inspected source has iperf operational testing.
Verify/release evidence gates ✓ ✓ ∿ Ze and VyOS have more explicit CI/release gates.
Lint/static gates ✓ ✓ ∿ freeRtr runs CodeQL static analysis on push/PR (C/Java/Python); no style linter found.
Mutation testing ✓ ✕ ✕ Ze-only in inspected sources.
Support bundle ✓ ✓ ✕ Ze has ze support with doctor, host, platform, sanitized config, crashes, disk, interfaces, routes, neighbors, DNS, firewall, and runtime modules. VyOS has support archive evidence. freeRtr support bundle evidence was not found.

Architecture and extensibility matrix

Feature Ze VyOS freeRtr Notes
Explicit module/dependency manifest ✓ ✓ ✕ Ze has; VyOS has Debian/Python package metadata; freeRtr has shell scripts and JDK assumptions. go.mod
Component/plugin modularity ✓ ∿ ∿ Ze has registries and generated imports; VyOS has XML owner scripts; freeRtr has Java registries.
Internal and external plugin process model ✓ ✕ ✕ Ze-only in inspected sources.
Startup/command registration ownership ✓ ✓ ✓ Mechanisms differ strongly.
Generated composition roots ✓ ✓ ✕ Ze and VyOS generate key wiring.
Schema validation ✓ ✓ ∿ Ze validates YANG; VyOS validates XML/RNG; freeRtr CLI/help schema is embedded and can generate YANG.
Protobuf/gRPC API boundary ✓ ∿ ✕ VyOS has protobuf-over-Unix-socket IPC (vyconf), not a Ze-like gRPC API; freeRtr has neither.
External SDK boundary ✓ ∿ ✕ VyOS Python APIs work inside VyOS; Ze publishes plugin SDK APIs.
Daemon plus child process supervision ✓ ✓ ∿ Ze supervises plugins; VyOS relies on systemd; freeRtr has JVM loop and service start/stop.
Source-owned protocol implementations ✓ ∿ ✓ VyOS mostly wraps external daemons for routing.
Allocation/zero-copy tuning patterns ✓ ✕ ✓ Ze and freeRtr have explicit packet/text buffer patterns.
Test seams and injectable components ✓ ✓ ✓ Evidence exists for all three, with different shapes.
Config verify/apply/rollback model ✓ ✓ ∿ freeRtr config mutation model is more immediate/in-process.

Scope FAQ

Does Ze support everything VyOS, FRR, or freeRtr does?

No. As a full Network OS, VyOS plus FRR and freeRtr still cover many features Ze does not: RIP/RIPng, EIGRP, Babel/OpenFabric/OLSR, multicast routing, bonding, QinQ, VXLAN dataplane integration, MACsec, wireless, DHCP relay, SNMP, LLDP, PTP, proxy, load balancing, TFTP, support bundles, NETCONF, GraphQL, multi-image boot management, and broader package or installer flows. Ze has source-confirmed commit confirmed in file mode, but not yet in ZeFS session mode. Ze also has strong source-confirmed coverage in BGP, OSPF, IS-IS, LDP, RSVP-TE, RPKI, BMP, MRT, YANG-modeled config, REST/OpenAPI, gNMI, MCP, plugin SDKs, VPP/netlink backends, PPPoE/L2TP BNG, appliance tooling, testing, and diagnostics. The important answer is not "Ze matches everything"; it is "Ze is deeper in selected modern control-plane and API areas, while VyOS and freeRtr are broader router OSes today."

This question belongs on this page, not the BGP daemon page, because it asks about non-BGP router OS breadth.

Product model snapshot

Area Ze VyOS freeRtr Evidence notes
Product identity Present. Go module, own Network OS architecture, Go 1.26, OpenConfig/YANG, netlink, govpp, gNMI, gokrazy dependencies. codeberg.org/thomas-mangin/ze Present. vyos-1x is the command definitions, configuration scripts, data, Python libraries, validators, templates, and tests package. Image build lives in vyos-build. Present. Free/open router process, speaks routing protocols, re-encapsulates packets, can export FIBs to external dataplanes. Ze. VyOS. freeRtr. go.mod:1-40docs/architecture/core-design.md:1-40README.md:1-45readme.md:1-15
Implementation style Small Go core plus registration/plugin pattern, generated plugin import root, YANG schemas, typed components. XML schema plus Python conf/op scripts, Jinja2 templates, external daemons, generated old-backend node.def and op caches. Java router process with large config/runtime registries, protocol classes, built-in services, native/P4/XDP helpers. Detailed evidence: Architecture and Extensibility appendix.
Routing breadth Present for BGP, BFD, OSPFv2/v3, IS-IS, LDP, RSVP-TE, static, policy route, RPKI, BMP, MRT, SR/SRv6, route server/reflector. Not found for RIP/RIPng/EIGRP/Babel/PIM/MSDP in inspected source. Present for BGP, static, OSPF, OSPFv3, IS-IS, RIP, RIPng, EIGRP schema caveat, Babel/OpenFabric files, BFD, RPKI, MPLS/LDP, SRv6/SR, PIM/PIM6/IGMP proxy. RSVP-TE and MRT not found in inspected source. Broadest protocol list in inspected source. BGP, OSPF, IS-IS, RIP, EIGRP, Babel, OLSR, PIM, MSDP, LDP, RSVP, RPKI, EVPN, MRT, BMP, BFD, SR/SRv6, MPLS labels, many AFI/SAFI classes. Routing and Control Plane appendix.
BGP depth Native BGP engine, capabilities, ADD-PATH, ExtNH, extended messages, route server/reflector, RPKI/ASPA, BMP, MRT, filters, RIB plugins, many NLRI plugins. FRR-oriented BGP schema/include tree with AFI/SAFI, route-maps, EVPN, VPN/VRF leak controls, route server/reflector, BMP policy leaves. Native BGP classes with broad AFI/SAFI and attributes, EVPN, MRT, BMP, RPKI, communities, SR attrs. Routing and Control Plane appendix.
Interfaces and L2/L3 Present. Ze has a typed interface backend abstraction with netlink as the default backend and a registered vpp backend; apply loads the configured backend and dispatches interface lifecycle, addressing, link state, tunnel, VLAN, bridge, MAC, MTU and route queries through it. Some interface kinds remain Linux/netlink-gated, so Ze is narrower than VyOS/freeRtr in appliance breadth, but interface control is not netlink-only. Present and broad. Many first-class XML interface nodes, Python owners, common includes for addressing, DHCP, VRF, MTU, IPv6 ND, mirror, VLAN, QoS, containers, selected VPP interface definitions. Present and broad. Central cfgIfc model, VPDN/tunnel types, bridge/VLAN/PPP/LLDP/MACsec classes, native/P4/XDP dataplane support. Ze. internal/component/iface/backend.go:56-59internal/component/iface/register.go:198-214,413-418internal/plugins/iface/netlink/register.go:10-12internal/plugins/iface/vpp/register.go:13-15internal/plugins/iface/vpp/ifacevpp.go:8-10
Firewall, NAT, security, VPN, AAA Present for nft/VPP firewall, NAT, dynamic sets, conntrack, IRR source validation, IPsec/IKE, PKI, SSH, AAA/RADIUS/TACACS, L2TP PPP auth/accounting. Some VPN/service gaps remain. Present and broad. Firewall/NAT, zone/group model, conntrack helpers, WireGuard, OpenVPN, IPsec, L2TP, SSTP/PPTP, PPPoE server, PKI, system login, RADIUS/TACACS, HTTPS API auth. Present and broad. ACL/QoS/NAT/PBR in readme, IPsec/IKE/OpenVPN/WireGuard/MACsec/SGT, RADIUS/TACACS/local auth, SSH/TLS/DTLS service code, RPKI. Security, VPN, AAA appendix.
Network services Present for DHCPv4 server, DHCP clients, GeoDNS, NTP client, flow export, looking glass, REST/gRPC/web, diagnostics, config archive/update. Not found for general DHCP relay, SNMP, LLDP, PTP, proxy, load balancer, TFTP server, captive portal. Present and broad. DHCPv4/v6 server/relay, DNS forwarding/authoritative records, NTP/PTP, SNMP, LLDP, TFTP, webproxy, HAProxy/WAN load balancing, syslog, sFlow/IPFIX, support archive. Present and broad. DHCPv4/v6 server/relay, DNS, NTP/PTP, SNMP, LLDP, HTTP/TFTP, proxy/client helpers, load balancer, syslog, NetFlow, upgrade/archive tools. Network Services and Ops appendix.
Management and automation Strong in inspected source. Config editor, ZeFS active/draft/history store, completion/ghost text, JSON diff, rollback, archive, REST/OpenAPI, gNMI, MCP, HTMX web UI, plugin SDK, and file-mode commit confirmed with auto-revert. No NETCONF found. Strong in inspected source. XML config/op definitions, config session API, commit-confirm, rollback, archive, REST/OpenAPI, GraphQL, API keys/CORS/introspection, config management scripts, and OpenSSH service for device access. No gNMI/NETCONF/web UI/HTMX/MCP found in this root. Strong CLI and NETCONF. Exec/config modes, help/completion, commit buffer, XML, NETCONF RFC 6241, HTTP API permissions, scripts/schedulers/aliases. No gNMI/OpenAPI/GraphQL/HTMX/MCP found. Management, Automation, UI appendix.
Observability and testing Strong for diagnostics, logs, profiles, packet capture, BGP MRT/analyze/perf/chaos/functional tests, lint/mutation inventory in repo. Strong for smoketest CLI/system suite, op-mode diagnostics, support archive, syslog/SNMP/flow exports, Python tests. Strong for .tst topology tests, userTester, many diagnostic commands, Prometheus/server sensors, logging/debugging, packet capture. Observability and Testing appendix.
Platform and packaging Strong appliance focus. Go build tags, host/target binary distinction, gokrazy image generation, installer/initrd/ISO/PXE, QEMU evidence, systemd install docs, update/export/import. VyOS package layer. Debian package metadata, systemd/sysctl integration, image install/add-image commands, GRUB/squashfs management, containers, QEMU smoketest via vyos-build context. Java jar plus native helpers. Shell build/package flows, Docker/Debian/systemd artifacts, VM image recipes, signed upgrade, backup/auto-revert, native/P4/XDP dependencies. Platform and Packaging appendix.
Extensibility Strong explicit plugin SDK/registry and YANG/RPC/event registration. Strong source extension pattern via XML definitions plus conf/op Python scripts, templates, validators, tests. No standalone external plugin SDK found. Strong internal extensibility via Java registries, scripts/schedulers/aliases, NETCONF YANG generation, HTTP script/API permissions. No Ze-like external plugin SDK found. Architecture and Extensibility appendix.

Product strengths and limits

Ze

VyOS

freeRtr

Source roots inspected

Product Inspected root Primary evidence surface
Ze ze/ checkout Go components, plugins, YANG modules, command/RPC declarations, docs, tests, appliance tooling.
VyOS vyos-1x/ checkout XML config/op definitions, Python conf_mode and op_mode, API services, tests, Debian metadata.
freeRtr freeRtr/ checkout Java router, config, routing, service, interface, auth, packet and user packages, plus cfg/ tests and misc/ platform files.

Evidence appendix: routing and control plane

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Static routing IPv4/IPv6 static routes Present. Static schema says prefixes validate ipv4-prefix|ipv6-prefix, grouped under named tables, with metric/tag, ECMP gateway/interface next-hops, blackhole/reject. User guide says static routes support ECMP, weighted load balancing, BFD failover, blackhole/reject, kernel/VPP programming. internal/plugins/static/yang/ze-static-conf.yang:1-15, :24-43, :59-132docs/guide/static-routes.md:1-8 Present. CLI node protocols static includes static-route.xml.i and static-route6.xml.i, plus non-main kernel table. Also static multicast route mroute: :13-23. interface-definitions/protocols_static.xml.in:7-13, :55-76 Present. Static route object has prefix, next-hop, interface, distance, metric, tag, route-map, route-policy, MPLS mode. src/org/freertr/ip/ipFwdRoute.java:29-88 All three have IPv4/IPv6 static route support. Ze and VyOS expose schema-level named/non-main tables. freeRtr object model is direct forwarding core evidence.
BGP core BGP daemon, peers, ASN, router ID Present. BGP config root with mandatory router-id and local ASN, peer groups and standalone peers. Plugin registry imports BGP plugin. internal/component/bgp/yang/ze-bgp-conf.yang:10-31, :75-82, :107-182internal/component/plugin/all/all.go:146-147 Present. protocols bgp node owned by protocols_bgp.py. interface-definitions/protocols_bgp.xml.in:3-13 Present. rtrBgp extends ipRtr implements prtServS on TCP port 179, with local AS, address families and router ID fields. src/org/freertr/rtr/rtrBgp.java:70-103 All three implement BGP. VyOS is schema/template wrapper around FRR.
BGP extensions AFI/SAFI, multiprotocol, labeled, VPN, EVPN, flowspec, MVPN, RTC, SR policy, MUP, VPLS Ze supports extensible AFI/SAFI via registered-address-family and plugin imports for EVPN, flowspec, labeled, link-state, MUP, MVPN, RTC, SR policy, VPLS, VPN. BGP attributes include labels, RD, path-information, Prefix-SID and SRv6 Prefix-SID. internal/component/bgp/yang/ze-bgp-conf.yang:552-561internal/component/plugin/all/all.go:168-178internal/component/bgp/yang/ze-bgp-conf.yang:229-244 VyOS BGP include tree has IPv4/IPv6 unicast and multicast, flowspec, l2vpn EVPN, link-state, route-map, route server and route reflector includes. Evidence: multicast AFI nodes in; neighbor includes for IPv4/IPv6 multicast, l2vpn EVPN, link-state; EVPN common route-target/RD. include/bgp/protocol-common-config.xml.i:152-157, :485-490include/bgp/protocol-common-config.xml.i:1055-1059include/bgp/afi-l2vpn-common.xml.i:1-15 freeRtr has many AFI classes: IPv4/IPv6 unicast, labeled, VPNv4/v6 unicast/multicast, link-state, MUP, EVPN, VPLS, MSPW. Attributes include AS_PATH, communities, extended/large/IPv6 communities, PMSI, Prefix-SID/SRv6, and Prefix-SID/SRv6 in class rtrBgpAttrPrefSid. src/org/freertr/rtr/rtrBgpAfi.java:658-838, :901-938, :1222-1285src/org/freertr/rtr/rtrBgpAttr.java:411-493, :736-858, :936-953src/org/freertr/rtr/rtrBgpAttr.java:1127-1191 freeRtr and Ze have source-level plugin/code evidence for broad AFI/SAFI. VyOS exposes FRR CLI schemas.
BGP capability ADD-PATH, route refresh, extended message, extended nexthop, 4-byte ASN, prefix limits Present. Capability container covers ASN4, route-refresh, ADD-PATH with per-family limit, extended-message, extended-nexthop. Prefix limits per family: :562-585. internal/component/bgp/yang/ze-bgp-conf.yang:593-669 Present for many capabilities in include tree, including prefix-list ORF; route refresh and capabilities found in BGP include tree via includes, route-server/reflector at. ADD-PATH is a per-neighbor addpath-tx-all/addpath-tx-per-as leaf. interface-definitions/include/bgp/afi-capability-orf.xml.i:7-10afi-route-reflector-client.xml.i:1-5afi-route-server-client.xml.i:1-5include/bgp/neighbor-afi-ipv4-ipv6-common.xml.i:2-10 Present in BGP implementation and AFI/attribute structures. freeRtr exposes per-family ADD-PATH rx/tx: addpathRmode/addpathTmode fields. 4-byte AS support in AS_PATH reader/writer uses peer32bitAS. src/org/freertr/rtr/rtrBgpParam.java:489-494, :2499-2500src/org/freertr/rtr/rtrBgpAttr.java:411-493 Additional capabilities exist in all three; only the cited ones are enumerated here.
BGP GR Graceful Restart, LLGR Present. GR plugin configures restart-time and long-lived-stale-time, augments peer/group capability. internal/component/bgp/plugins/gr/yang/ze-graceful-restart.yang:1-44 Present. Global BGP graceful-restart node with stalepath-time; per-neighbor graceful-restart leaf (enable/disable/restart-helper). include/bgp/protocol-common-config.xml.i:1520-1538include/bgp/neighbor-graceful-restart.xml.i:2-24 Present. freeRtr default filters set graceful-restart 60000 and longlived-graceful 0 for BGP; capability encode with restart/long-lived timers is source-visible. src/org/freertr/cfg/cfgRtr.java:377-378src/org/freertr/rtr/rtrBgpSpeak.java:211-216, :984, :995 All three have source evidence, with VyOS at the config-surface (FRR) level.
Route server and route reflector RS and RR Ze supports route-server client and route-reflector client in core schema; plugin registry also imports rr and rs. internal/component/bgp/yang/ze-bgp-conf.yang:524-542internal/component/plugin/all/all.go:187-188 VyOS BGP includes route-reflector-client and route-server-client leaves; also included in AFI common flowspec and neighbor common. interface-definitions/include/bgp/afi-route-reflector-client.xml.i:1-5interface-definitions/include/bgp/afi-route-server-client.xml.i:1-5include/bgp/afi-common-flowspec.xml.i:4-5neighbor-afi-ipv4-ipv6-common.xml.i:172-175 Present. Per-neighbor route-reflector-client (reflectClnt field) and route-server-client (serverClnt param "unmodified attributes to this client", render :2557), plus a dedicated route-server peer type peerServr→routeServerClient. src/org/freertr/rtr/rtrBgp.java:116rtrBgpParam.java:319, :2246, :2608rtrBgpParam.java:654, :2294src/org/freertr/rtr/rtrBgpUtil.java:623, :1448-1449 All three have route-reflector and route-server evidence.
RPKI RPKI origin validation, RTR, ASPA Present. RPKI plugin augments BGP with rpki, cache-server address/port/source, invalid/not-found policy, ASPA validation and policy. internal/component/bgp/plugins/rpki/yang/ze-rpki.yang:1-67 Present. protocols rpki node owned by protocols_rpki.py; dependency file ties service rpki to protocols_rpki. interface-definitions/protocols_rpki.xml.in:1-14data/config-mode-dependencies/vyos-1x.json:64-65 Present. rtrRpki is "resource public key infrastructure (rfc6810) protocol", holds IPv4/IPv6 ROAs, ASPAs, keys. src/org/freertr/rtr/rtrRpki.java:1-37, :72-91src/org/freertr/tab/tabRpkiRoa.java, tabRpkiAspa.java, tabRpkiKey.java, tabRpkiUtil.java All three have RPKI evidence.
Route policy Route maps, route policies, import/export chains Ze has BGP policy container and import/export filter chains at global/group/peer levels. Filter plugin imports include as-path, community, family, IRR, modify, prefix, remove-private-as. internal/component/bgp/yang/ze-bgp-conf.yang:85-106internal/component/plugin/all/all.go:150-157 VyOS has route-map includes under BGP AFIs and policy route-map definitions. Evidence: contains community and route-map match/set sections such as :963-972, :1337-1360. include/bgp/afi-route-map.xml.i:1-10afi-route-map-vrf.xml.i:1-14afi-route-map-vpn.xml.i:1-14interface-definitions/policy.xml.in freeRtr has tabRtrmapN, tabRtrplc, tabRtrplcN, tabListing, prefix list classes. CLI route-map/route-policy match/set includes AS path, RD, VRF, SRv6, segment routing. src/org/freertr/tab/tabRtrmapN.java:26-28tabRtrplc.java:15-16tabRtrplcN.java:20-21tabListing.java:28-29tabPrfxlstN.java:15-16src/org/freertr/cfg/cfgRoump.java:284-355, :414-428cfgRouplc.java:198-274, :335-349 All three have route policy mechanisms. Ze names policy as filter chains rather than traditional route-map.
Route redistribution Protocol import/export Present. Ze uses the protocol-agnostic redistribute framework; IS-IS guide documents redistribute { destination bgp { import isis } } and destination isis { import connected/static/bgp }; IS-IS source/consumer code registers source isis and injects accepted routes into TLV 135/236 LSP entries. docs/guide/isis.md:135-189internal/plugins/isis/redistribute/source.go:41-55, :79-107internal/plugins/isis/redistribute/consumer.go:6-18, :147-158 Present. VyOS official docs document IS-IS redistribution into Level-1 and Level-2 with route-map policy; local XML includes redistribution in the IS-IS include tree. https://docs.vyos.io/en/rolling/configuration/protocols/isis.html#route-redistributioninclude/isis/protocol-common-config.xml.i:493-616 Present. freeRtr IS-IS calls generic redistribution help/config and supports per-level route-map/route-policy in/from directions. src/org/freertr/rtr/rtrIsis.java:1282, :1551-1554, :1975-2034 Redistribution is route import/export policy and must not be used as proof of IS-IS inter-level leaking.
Prefix filters Prefix lists Ze prefix-list filter has ordered entries, IPv4/IPv6 CIDR, ge/le, accept/reject. internal/component/bgp/plugins/filter_prefix/yang/ze-filter-prefix.yang:1-59 VyOS BGP prefix-list imports for IPv4 and IPv6; RIP also has prefix-list includes. interface-definitions/include/bgp/afi-ipv4-prefix-list.xml.i:1-39afi-ipv6-prefix-list.xml.i:1-39include/rip/prefix-list.xml.i:1-5prefix-list6.xml.i:1-5 freeRtr prefix-list class tabPrfxlstN; route-map/policy match network in. src/org/freertr/tab/tabPrfxlstN.java:15-16cfgRoump.java:301-302cfgRouplc.java:215-216 All three have prefix filtering evidence.
AS path filters AS-path list or regex Ze AS-path regex filter with ordered entries and accept/reject. internal/component/bgp/plugins/filter_aspath/yang/ze-filter-aspath.yang:1-61 VyOS BGP AS-path filter list under AFI filter-list references policy as-path-list. interface-definitions/include/bgp/afi-filter-list.xml.i:1-22 freeRtr AS_PATH read/write in BGP attrs; route-map/route-policy set aspath. src/org/freertr/rtr/rtrBgpAttr.java:411-493src/org/freertr/cfg/cfgRoump.java:340-343cfgRouplc.java:261-264 All three have AS-path evidence.
Community filters Standard, extended, large communities Ze community plugin defines named standard, large, extended communities and tag/strip ingress/egress filters. BGP session community send control. internal/component/bgp/plugins/filter_community/yang/ze-filter-community.yang:1-84internal/component/bgp/yang/ze-bgp-conf.yang:475-501 VyOS policy has extcommunity-list, large-community-list, large community match and set. interface-definitions/policy.xml.in:277-279, :326-368, :963-972, :1337-1360 freeRtr BGP attributes read/write standard, extended, large, IPv6 communities. Route-map/policy community set. src/org/freertr/rtr/rtrBgpAttr.java:736-858src/org/freertr/cfg/cfgRouplc.java:260-274 All three have community support.
OSPF OSPFv2 Present. Ze OSPF container described as OSPFv2 routing instance. Plugin registry imports OSPF: and OSPF files present in internal/plugins/ospf. internal/plugins/ospf/yang/ze-ospf-conf.yang:206-223internal/component/plugin/all/all.go:260-261 Present. protocols ospf node owned by protocols_ospf.py. interface-definitions/protocols_ospf.xml.in:1-14 Present. OSPF classes found in freeRtr routing package: rtrOspf4 and interface classes in src/org/freertr/rtr, plus config defaults for router ospf[46]. src/org/freertr/cfg/cfgRtr.java:283-298 All three have OSPFv2 evidence.
OSPF OSPFv3 Present. Ze OSPF schema has reusable OSPFv3 AF topology, OSPFv3 areas/interfaces, virtual-link, IPv6 BFD, SR. internal/plugins/ospf/yang/ze-ospf-conf.yang:14-111, :175-204 Present. protocols ospfv3 node owned by protocols_ospfv3.py. interface-definitions/protocols_ospfv3.xml.in:1-14 Present. freeRtr config defaults match router ospf[46], covering OSPF4 and OSPF6; interface defaults also router ospf[46]. src/org/freertr/cfg/cfgRtr.java:283-298src/org/freertr/cfg/cfgIfc.java:1876-1880 All three have OSPFv3 evidence.
OSPF extensions SR, TE, BFD, LDP sync, GR Ze OSPF schema has BFD container, LDP sync, IPsec, SR MPLS with SRGB/SRLB/prefix-sid, and OSPF GR files in package. Evidence; OSPF GR files listed in glob including gr.go, gr_helper.go, gr_lsa.go. internal/plugins/ospf/yang/ze-ospf-conf.yang:94-111, :149-173, :175-204 VyOS OSPF include has segment-routing and redistribution; traffic-engineering protocol has TE metric/bandwidth/admin-groups. include/ospf/protocol-common-config.xml.i:675-678, :759-833interface-definitions/protocols_traffic_engineering.xml.in:1-91 freeRtr OSPF defaults include traffic engineering, segrout, srv6 and bier at router/area and interface levels. src/org/freertr/cfg/cfgRtr.java:283-298src/org/freertr/cfg/cfgIfc.java:1876-1880 All have OSPF extensions. RSVP-TE is separate below.
IS-IS IS-IS L1/L2 Present. Ze IS-IS config root with NET, System ID, L1/L2/L1-L2, interfaces and metrics. Registration says native link-state IGP ISO/IEC 10589, RFC 1195. internal/plugins/isis/yang/ze-isis-conf.yang:1-45, :65-120internal/plugins/isis/register.go:122-130 Present. protocols isis node owned by protocols_isis.py. Include supports multi-topology and redistribution. interface-definitions/protocols_isis.xml.in:1-14include/isis/protocol-common-config.xml.i:169-198, :493-616 Present. rtrIsis extends ipRtr. IS-IS neighbor implements BFD client. Config defaults include IS-IS segrout/bier/srv6/TE. src/org/freertr/rtr/rtrIsis.java:60-61rtrIsisNeigh.java:30-31src/org/freertr/cfg/cfgRtr.java:316-333 All three have IS-IS.
IS-IS route leaking L1/L2 leaking Present. Ze implements L1<->L2 inter-level route leaking with RFC 2966 up/down bit for IPv4 and IPv6. spf/leak.gointernal/plugins/isis/spf/leak.go:1-20, :69-110 Unclear. VyOS documents L1/L2 operation, attached-bit, and redistribution into Level-1/Level-2 with route-map policy, but the checked docs/source did not show a leak-specific command. https://docs.vyos.io/en/rolling/configuration/protocols/isis.html#route-redistributioninterface-definitions/include/isis/protocol-common-config.xml.i:493-616 Present as IS-IS inter-level route handling. freeRtr includes an isis inter-level routes test with level2, both, and level1 routers and IPv4/IPv6 route checks; IS-IS config exposes level1, level2, and both. cfg/rout-isis017.tst:1-19, :45-55, :90-100, :120-140src/org/freertr/rtr/rtrIsis.java:1271-1274 Route leaking and redistribution are separate features.
RIP RIPv2 not found in inspected sources. Searches over Ze internal and docs/guide for package rip, Routing Information Protocol, and alternate rtrRip found only kernel protocol labels/port names/docs catalogue, not a protocol implementation. internal/plugins/iface/netlink/route_linux.go:41-43internal/core/portname/services_table.go:855-857 Present. protocols rip node owned by protocols_rip.py, with distribute-list, interfaces, MD5 auth, passive interface, redistribution. interface-definitions/protocols_rip.xml.in:1-83 Present. freeRtr routing package contains RIP classes, including rtrRip4 and rtrRip6 in the routing package; cfgRtr.java imports rtrRip6. src/org/freertr/cfg/cfgRtr.java:35 Ze lacks RIP implementation in inspected source. VyOS and freeRtr have it.
RIPng RIPng not found in inspected sources. Same Ze absence searches as RIP. Present. protocols ripng node owned by protocols_ripng.py, with aggregate-address, distribute-list, interface, network, passive-interface, redistribute. interface-definitions/protocols_ripng.xml.in:1-83 Present. freeRtr has rtrRip6 class found in protocol class search and imported by cfgRtr. src/org/freertr/cfg/cfgRtr.java:35 Ze lacks RIPng implementation in inspected source.
Other IGPs EIGRP not found in inspected sources. Ze alternate searches for eigrp, Enhanced Interior Gateway found only kernel route protocol labels and external comparison docs. internal/plugins/iface/netlink/route_linux.go:41-43 Present. protocols eigrp node owned by protocols_eigrp.py. Note: Makefile removes EIGRP templates during build as support caveat. interface-definitions/protocols_eigrp.xml.in:1-14Makefile:46-49 Present. rtrEigrp extends ipRtr implements Runnable; neighbor implements BFD client. src/org/freertr/rtr/rtrEigrp.java:33-34rtrEigrpNeigh.java:22-23 VyOS exposes EIGRP schema but Makefile suggests generated templates are removed, so final should characterize carefully.
Other IGPs Babel, OpenFabric, OLSR, PVRP/LSRP Ze: Babel/OpenFabric not found as protocols in inspected source. VyOS has Babel and OpenFabric protocol files in glob; not read in detail for table. interface-definitions/protocols_babel.xml.in, protocols_openfabric.xml.in freeRtr has Babel and OLSR classes: rtrBabel extends ipRtr: rtrOlsr extends ipRtr; PVRP/LSRP config defaults. src/org/freertr/rtr/rtrBabel.java:37-38src/org/freertr/rtr/rtrOlsr.java:34-35src/org/freertr/cfg/cfgRtr.java:232-263 Non-goal protocols are noted because user asked "other IGPs".
BFD BFD core and protocol clients Present. BFD schema says RFC 5880/5881/5883, profiles, explicit and protocol-driven sessions from BGP/OSPF/static. BGP peer BFD attachment; static next-hop BFD; OSPF BFD. internal/component/bfd/yang/ze-bfd-conf.yang:1-16, :47-183internal/component/bgp/yang/ze-bgp-conf.yang:326-395internal/plugins/static/yang/ze-static-conf.yang:91-100internal/plugins/ospf/yang/ze-ospf-conf.yang:159-172 Present. protocols bfd node with peer IPv4/IPv6, source address/interface, common timers, multihop, VRF, profiles. BGP neighbor BFD include; static route BFD includes. interface-definitions/protocols_bfd.xml.in:1-76interface-definitions/include/bgp/neighbor-bfd.xml.i:1-5include/static/static-route.xml.i:55-59static-route6.xml.i:54-58 Present. rtrBfdIface implements RFC5880 interface with UDP handler, timers, multiplier, key/password, neighbors. Protocol neighbor classes implement rtrBfdClnt, for example BGP speaker, EIGRP neighbor, IS-IS neighbor. src/org/freertr/rtr/rtrBfdIface.java:19-83rtrBgpSpeak.java:37-38rtrEigrpNeigh.java:22-23rtrIsisNeigh.java:30-31 All three have BFD.
RIB/FIB RIB, FIB, kernel/VPP/P4 Ze has BGP RIB plugin tracking Adj-RIB-In/Out with ADD-PATH; static routes program kernel/VPP per schema; FIB plugins imported for kernel/P4/VPP. internal/component/bgp/plugins/rib/yang/ze-rib.yang:1-43internal/plugins/static/yang/ze-static-conf.yang:1-11internal/component/plugin/all/all.go:245-247 VyOS uses FRR templates for routing protocols and staticd, bgpd, ospfd, zebra etc in data/templates/frr glob, including staticd.frr.j2, bgpd.frr.j2, zebra.route-map.frr.j2, zebra.segment_routing.frr.j2. freeRtr has ipFwd forwarding core with VRF name/number, route distinguisher and RT import lists: tabRoute route table class; route entries. src/org/freertr/ip/ipFwd.java:52-143src/org/freertr/tab/tabRoute.java:18-20tabRouteEntry.java:18-22 Ze and freeRtr own FIB/RIB source. VyOS delegates to FRR/Linux via templates/scripts.
VRF VRF/routing instances Ze has no full VRF feature yet. Ze has named routing-table config and some per-feature VRF fields, including BFD loop/session VRF strings, but the comparison treats those as not equivalent to product VRF/interface binding. internal/plugins/routingtable/yang/ze-routing-table-conf.yang:1-35internal/component/bfd/yang/ze-bfd-conf.yang:177-228 VyOS dependencies and BGP include tree support VRF import/export and route leaking. data/config-mode-dependencies/vyos-1x.json:3-5include/bgp/afi-export-import.xml.i:25-35include/bgp/afi-route-map-vrf.xml.i:7-13include/bgp/afi-label.xml.i:3-15include/bgp/afi-rd.xml.i:13-20 freeRtr has global list of VRFs, VRF creation in config parser: cfgVrf class; forwarding core has VRF name/number/RD/RTs. src/org/freertr/cfg/cfgAll.java:507-508src/org/freertr/cfg/cfgConfig.java:5195-5205src/org/freertr/cfg/cfgVrf.java:51-53src/org/freertr/ip/ipFwd.java:52-143 Ze named tables and protocol-local VRF fields are not counted as full VRF.
Route leaking VRF route leaking Not present for Ze because full VRF is not present yet. IS-IS inter-level route leaking is tracked separately above and should not be conflated with cross-VRF route leaking. Present in BGP VPN/VRF includes: export/import VRF; route-map between current AF and VRF; labels/RD/RT for leaked VPN routes. include/bgp/afi-export-import.xml.i:25-35include/bgp/afi-route-map-vrf.xml.i:7-13include/bgp/afi-label.xml.i:13-39afi-rd.xml.i:13-20afi-route-target-vpn.xml.i:1-20 Present. freeRtr route-map/route-policy can set VRF; BGP VRF classes. src/org/freertr/cfg/cfgRoump.java:354-355cfgRouplc.java:273-274cfgRouplc.java:901-904rtrBgpVrf.java:9-10rtrBgpVrfRtr.java:5-9 Cross-VRF leaking is No for Ze until a full VRF feature exists.
MPLS MPLS dataplane/labels Ze has MPLS command plugin imported: and component command import :283; OSPF SR config uses shared mpls-fib; LDP depends on FIB/kernel. internal/component/plugin/all/all.go:132internal/plugins/ospf/yang/ze-ospf-conf.yang:177-204 Present. protocols mpls node owned by protocols_mpls.py; LDP subtree: :12-23. interface-definitions/protocols_mpls.xml.in:1-11 Present. Label table classes tabLabel, tabLabelEntry, etc: ipMpls; BGP labeled AFIs. src/org/freertr/tab/tabLabel.java:16-17tabLabelEntry.java:20-21src/org/freertr/cfg/cfgIfc.java:125-126src/org/freertr/rtr/rtrBgpAfi.java:688-716 All have MPLS evidence.
LDP Label Distribution Protocol Present. Ze LDP package says RFC 5036, downstream unsolicited mode; registration name ldp, config root ldp, dependencies FIB/kernel/sysctl. internal/plugins/ldp/register.go:1-12, :76-91, :190-223 Present. MPLS ldp node with router-id, allocation IPv4/IPv6, neighbor, discovery timers. interface-definitions/protocols_mpls.xml.in:12-183 Present. LDP interface and neighbor classes. src/org/freertr/rtr/rtrLdpIface.java:32-33rtrLdpNeigh.java:36-37rtrLdpTrgtd.java:21-22 All have LDP.
RSVP-TE RSVP Traffic Engineering Present. Ze RSVP-TE registration describes RFC 3209, config root rsvp-te, dependencies FIB/kernel/sysctl, raw socket doctor. internal/plugins/rsvpte/register.go:440-462 Not found in inspected sources. Alternate VyOS search for rsvp, RSVP, resource reservation over interface definitions, conf mode, templates found only generic packet protocol enum in NAT include, not routing protocol RSVP-TE. interface-definitions/include/nat-rule.xml.i:75, :182-183 Present. RSVP interface class; config interface imports rtrRsvpIface; MPLS TE client classes found in cfgIfc imports. src/org/freertr/rtr/rtrRsvpIface.java:27-28src/org/freertr/cfg/cfgIfc.java:166-167src/org/freertr/cfg/cfgIfc.java:35-37 Ze and freeRtr have RSVP-TE. VyOS RSVP-TE not found in inspected source.
Segment Routing SR-MPLS and SRv6 Ze supports OSPF SR-MPLS with SRGB/SRLB/prefix-SID; BGP update attrs include Prefix-SID and SRv6 Prefix-SID; OSPFv3 SRv6 wire files exist. internal/plugins/ospf/yang/ze-ospf-conf.yang:175-204internal/component/bgp/yang/ze-bgp-conf.yang:239-244internal/plugins/ospf/sr_origination_v6.go:1-4sr_reception_v6.go:1-4 Present. protocols segment-routing has SRv6 interface and global locator/encapsulation/TE DB import; OSPF and IS-IS include segment-routing nodes. interface-definitions/protocols_segment-routing.xml.in:1-183include/ospf/protocol-common-config.xml.i:675-678include/isis/protocol-common-config.xml.i:280-283 Present. BGP has segment routing fields/labels; BGP Prefix-SID/SRv6 attrs parse/write; SRH interface and SRv6 translation exist; OSPF/ISIS SR config defaults. src/org/freertr/rtr/rtrBgp.java:120-136src/org/freertr/rtr/rtrBgpAttr.java:1127-1191src/org/freertr/rtr/rtrSrhIface.java:17-18src/org/freertr/prt/prtSrv6.java:20-25src/org/freertr/cfg/cfgRtr.java:284-297, :317-333 All have Segment Routing evidence, including SRv6.
EVPN/VXLAN EVPN control plane, VXLAN data/tunnel Ze BGP plugin imports nlri/evpn; EVPN NLRI plugin source exists. VXLAN data-plane support not found in inspected Ze routing/control-plane source. internal/component/plugin/all/all.go:168 Present. BGP EVPN common includes advertise default-gw/SVI MAC-IP, RD, route-target; neighbor includes l2vpn EVPN; VXLAN interface supports multicast group. interface-definitions/include/bgp/afi-l2vpn-common.xml.i:1-15include/bgp/protocol-common-config.xml.i:1058interface-definitions/interfaces_vxlan.xml.in:29-43 Present. BGP EVPN classes; EVPN AFI class; VXLAN service imported/listed in cfgAll. src/org/freertr/rtr/rtrBgpEvpn.java:34-35rtrBgpEvpnPeer.java:21-22rtrBgpEvpnVpws.java:14-15src/org/freertr/rtr/rtrBgpAfi.java:938-973src/org/freertr/cfg/cfgAll.java:108-109, :702-705 Ze has EVPN NLRI support, but VXLAN integration not found in inspected source. VyOS/freeRtr have both EVPN and VXLAN evidence.
Multicast routing PIM, PIM6, IGMP/MLD, MSDP, multicast RIB/BGP multicast Ze: No PIM/MSDP multicast routing daemon found in inspected sources. BGP multicast AFI support appears in chaos/test/MRT handling but routing daemon multicast feature not source-confirmed. internal/analyze/mrt.go:29-32internal/chaos/peer/simulator_reader.go:195-200 Present. PIM IPv4 node; PIM6/MLD node; IGMP proxy; static multicast route; BGP IPv4/IPv6 multicast AFI nodes. interface-definitions/protocols_pim.xml.in:1-8protocols_pim6.xml.in:1-8protocols_igmp-proxy.xml.in:1-8protocols_static.xml.in:13-17include/bgp/protocol-common-config.xml.i:152-157, :485-490 Present. PIM interface class; MSDP router and neighbor classes; BGP VPN multicast AFIs in; PMSI tunnel attr. src/org/freertr/rtr/rtrPimIface.java:28-29src/org/freertr/rtr/rtrMsdp.java:37-38rtrMsdpNeigh.java:31-32rtrBgpAfi.java:807-837rtrBgpAttr.java:936-953 VyOS/freeRtr have multicast routing. Ze control-plane multicast routing not found, aside from BGP multicast family tooling.
Policy routing Policy based routing / table steering Present. Ze policy routing schema steers packets to alternate tables or next-hops using nftables marks and ip rule table selection; match criteria and then table/next-hop/drop/accept actions: :24-112. internal/plugins/policyroute/yang/ze-policyroute-conf.yang:1-13 Present. VyOS exposes policy route and policy route6 rule sets via policy_route.py; shared rule config includes packet match criteria and set table/set vrf; apply installs nftables policy and ip rule fwmark table steering; official docs confirm route policies attach to interfaces and set table/VRF. interface-definitions/policy_route.xml.in:245-313include/policy/route-common.xml.i:1-73include/firewall/set-packet-modifications-table-and-vrf.xml.i:1-30src/conf_mode/policy_route.py:190-241https://docs.vyos.io/en/latest/configuration/policy/route.html Present. freeRtr has interface PBR help configure policy based routing, target VRF/interface/nexthop parsing, and forwarding through target interface/VRF/next-hop. src/org/freertr/ip/ipFwdIface.java:809-819, :1449-1466src/org/freertr/tab/tabPbrN.java:35-48, :67-120src/org/freertr/ip/ipFwd.java:2125-2168 All three have PBR/table-steering evidence, with different models.
MRT MRT dumps / import / export Present. Ze MRT config has RFC 6396, BGP4MP_ET, peer filter, direction, updates/all/routes dump streams. Ze analyze tools can export BMP and parse MRT, but runtime config is enough. internal/plugins/mrt/yang/ze-mrt-conf.yang:1-93 Not found in inspected sources as a VyOS routing config feature. Search focused on BGP and templates did not yield MRT lines. Present. rtrBgpMrt is "multi-threaded routing toolkit" with MRT header/read/dump functions; BGP CLI dump setup: servMrt2bgp serves MRT into BGP. src/org/freertr/rtr/rtrBgpMrt.java:15-20, :156-168, :197-207, :428-451src/org/freertr/rtr/rtrBgp.java:2116-2120, :3312-3323src/org/freertr/serv/servMrt2bgp.java:25-43, :75-82, :148-158 Ze/freeRtr confirmed. VyOS MRT not found in inspected sources.
Telemetry exports Flow/export, routing telemetry Ze has BMP, MRT, and flow export plugins imported; BMP/MRT schemas cited above. internal/component/plugin/all/all.go:129, :245-247, :248-251 VyOS has op-mode standardized entries for BGP, EVPN, multicast, VRF. Flow exports (NetFlow/sFlow/IPFIX) are covered in the services matrix. data/op-mode-standardized.json:3, :14, :21, :37 freeRtr has BMP2MRT, MRT2BGP, Netflow service imports/listing in cfgAll; servGenList exposes bmp2mrt, mrt2bgp. src/org/freertr/cfg/cfgAll.java:23-64, :607-660src/org/freertr/serv/servGenList.java:235-253, :428-475 All three have export/ops hooks, with different scope.

Gaps and unclear items

Evidence appendix: interfaces, L2, L3, and dataplane

Architecture notes for the final comparison: - Ze uses a typed Go interface backend abstraction. The iface component parses config into typed entries, then dispatches lifecycle, addressing, routes, link state, tunnels, VLANs, bridge operations, MAC, MTU and route queries through the active Backend. netlink is the default backend, vpp is also registered, and OnConfigure loads the configured backend. Some interface leaves and kinds are still explicitly Linux/netlink-gated, including DHCP client, mirror, veth, bridge, tunnel, WireGuard, XFRM and PPPoE, so Ze is narrower than VyOS/freeRtr in appliance breadth, but its interface control plane is not netlink-only. - VyOS is schema-first around interface-definitions XML and Python conf_mode owners. Feature breadth is high in the inspected source: many discrete interface kinds are first-class CLI nodes, with includes for common addressing, DHCP, VRF, MTU, IPv6 ND, mirror, VLAN, QoS and containers. VPP has parallel interface definitions for selected kinds. - freeRtr centralizes a very large router-native interface model in cfgIfc.java and related cfg classes, with broad protocol handlers and custom dataplane backends. It exposes many interface and tunnel functions through cfgIfc commands, VPDN types, service daemons and native/P4/XDP dataplane code. It is broad and router-specific, but feature evidence often lives in large Java config surfaces rather than small per-feature files. - Paths likely worth citing in the final comparison are the files listed above, especially Ze backend.go, register.go, netlink and VPP backend registrations, ifacevpp.go, VyOS interface-definitions/interfaces_*.xml.in and include/interface/vif-s.xml.i, and freeRtr cfgIfc.java, cfgVpdn.java, cfgInit.java, misc/native/p4emu_*.h and p4xdp_*.c.

Evidence appendix: security, firewall, NAT, VPN, and AAA

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Firewall primitives Tables, chains, hooks, policies Ze firewall guide says Ze manages nftables packet filter and NAT from one firewall {} YANG section, with tables, base chains, type, hook, priority, policy. YANG enumerates families inet, ip, ip6, arp, bridge, netdev, chain types filter, nat, route, hooks input, output, forward, prerouting, postrouting, ingress, egress, policies accept/drop. docs/guide/firewall.md:1-24internal/component/firewall/yang/ze-firewall-conf.yang:16-51 VyOS firewall root and flowtable present; IPv4, IPv6, bridge hook includes. interface-definitions/firewall.xml.in:1-30interface-definitions/firewall.xml.in:361-394 freeRtr ACL object is access-list; ACL help covers permit/deny, protocol, source/target address and ports, flags, TOS, DSCP, TTL, SGT, length, log. Interface attaches access groups. src/org/freertr/cfg/cfgAceslst.java:63-73src/org/freertr/cfg/cfgAceslst.java:81-146src/org/freertr/cfg/cfgIfc.java:1697-1700 Ze and VyOS expose nft/netfilter concepts. freeRtr exposes router-style ACLs and interface attachments rather than nft-style tables.
Firewall primitives Match/action richness Ze match table includes source/destination address, ports, protocol, interfaces, ICMP/ICMPv6, conntrack state, marks, DSCP, TCP flags, named sets; actions include accept, drop, reject, jump, goto, return, SNAT, DNAT, masquerade, redirect, notrack, flow-offload, marks, DSCP set, TCP MSS, counter, log, limit-rate, exclude. docs/guide/firewall.md:59-83docs/guide/firewall.md:104-129 VyOS firewall group/match model includes address, domain, remote, interface, IPv4/IPv6 network, MAC and port groups; group and zone roots are present (rule-include files not expanded here). interface-definitions/firewall.xml.in:30-334 freeRtr ACL help covers object groups for source and target address and ports; packet fields include flags, TOS, flow, DSCP, precedence, length, TTL, SGT and log. src/org/freertr/cfg/cfgAceslst.java:105-126src/org/freertr/cfg/cfgAceslst.java:127-146 freeRtr has broad packet match support but not inspected as a stateful nft-style ruleset language.
Stateful firewall Conntrack state match Ze YANG has connection-state pattern new|established|related|invalid and marks it conntrack-driven. internal/component/firewall/yang/ze-firewall-conf.yang:74-80, :154-166 VyOS has a dedicated system conntrack model for table sizing and ignore rules; ignore rules cover IPv4 and IPv6 rule nodes with protocol, source, destination, interfaces, TCP flags. interface-definitions/system_conntrack.xml.in:1-44interface-definitions/system_conntrack.xml.in:45-211 freeRtr provides stateful inspection via interface inspect, which builds a bidirectional session table: (inspect = new tabSession(true, 180000)), with tabSession bidir collecting plus dropRx/dropTx (allow established, drop unsolicited new); service security workers can also drop inbound connections. There is no rule-level established/related/invalid match keyword. src/org/freertr/ip/ipFwdIface.java:150, :1594src/org/freertr/tab/tabSession.java:62-105src/org/freertr/serv/servGeneric.java:1028-1089 Ze and VyOS are conntrack-backed. freeRtr has session-based stateful inspection (inspect/tabSession) but no rule-level state-match keyword.
Stateful firewall Conntrack operations and observability Ze show command reads /proc/sys/net/netfilter/nf_conntrack_count, max, buckets, expectation max, accounting, timestamp, checksum, log-invalid, modules and per-protocol timeouts. internal/component/firewall/cmd_show_conntrack.go:18-66 VyOS op and conf files exist for conntrack. Config model evidence above. src/op_mode/clear_conntrack.pysrc/op_mode/conntrack.pysrc/op_mode/conntrack_sync.pysrc/conf_mode/system_conntrack.pysrc/conf_mode/service_conntrack-sync.py freeRtr NAT processing keeps current translation state in ipFwd.natTrns, parses NAT config, finds current NAT, updates last-used and packet. src/org/freertr/ip/ipFwd.java:259-267, :2220-2233 Ze explicitly shows Linux conntrack. VyOS has full subsystem files. freeRtr has NAT translation state plus inspect session tracking.
NAT/NPT IPv4 source, destination, static, masquerade, redirect Ze actions: snat, dnat, masquerade, redirect, exclude; NAT exclude example and SNAT ranges. docs/guide/firewall.md:113-129docs/guide/firewall.md:131-173 VyOS IPv4 destination NAT, source NAT, static one-to-one NAT, destination redirect, source masquerade. interface-definitions/nat.xml.in:10-44, :62-104, :106-132 freeRtr NAT config entry models original source/target address and ports, new source/target address and ports, source pools, randomization, session/rate limits, filter and logging; VRF emits IPv4/IPv6 NAT rules. src/org/freertr/tab/tabNatCfgN.java:21-119, :120-183src/org/freertr/cfg/cfgVrf.java:456-460 All three have NAT. Ze models NAT in firewall chains. VyOS has explicit NAT config trees. freeRtr uses ipv[46] nat <vrf> entries.
NAT/NPT NAT66/NPTv6 and NAT64 Ze: not found in inspected sources as dedicated NPTv6 or NAT64. It can use nft ip6/inet NAT chain actions, but dedicated NPT/NAT64 model not found. VyOS NAT66/NPTv6 model help says Network Prefix Translation (NAT66/NPTv6) and has source and destination NAT66 rules plus masquerade. NAT64 source translation: (owner node, source rule, translation). interface-definitions/nat66.xml.in:3-5, :15-24, :93-111, :128-145interface-definitions/nat64.xml.in:3-16 freeRtr: IPv4/IPv6 NAT rules are emitted from VRF for both families. NAT64 translation is supported and tested via the family-agnostic ipv[46] nat, but there is no dedicated nat64 keyword and NPTv6 is absent. src/org/freertr/cfg/cfgVrf.java:456-460, :696-699src/rtr.ftr:988src/rtr.csv:992 VyOS has the clearest dedicated NPTv6/NAT64 configuration surface.
Zones Zone-based firewall Ze: not found in inspected sources. Search for zone, zone-policy, security-zone found no Ze firewall zone model beyond unrelated DNS zones and AS112 zone docs. VyOS has firewall zone with default-action, default-firewall, from zones, member interface/VRF, intra-zone filtering and local-zone. interface-definitions/firewall.xml.in:397-568 freeRtr: search for zone|zone-policy|security-zone|firewall zone|inspect .*zone found no freeRtr zone firewall model in inspected source, only DNS/test zones. Only VyOS has explicit firewall zones in inspected sources.
Groups Address, network, port, interface, domain, remote groups Ze named sets support source-address @set and set elements with optional timeout; YANG set types include IPv4, IPv6, ether, inet-service, mark, ifname. docs/guide/firewall.md:82-83, :179-199internal/component/firewall/yang/ze-firewall-conf.yang:53-68 VyOS firewall group supports address-group with include, domain-group, dynamic address and IPv6 address groups, remote-group URL, interface-group, IPv6 address/network groups, MAC group, IPv4 network group, port group. interface-definitions/firewall.xml.in:30-334 freeRtr ACL supports object group matching for source address, source port, target address, target port. src/org/freertr/cfg/cfgAceslst.java:105-126 Ze named sets are closer to nft sets. VyOS has named group taxonomy. freeRtr object-group matching is in ACL help. src/org/freertr/cfg/cfgAceslst.java:103-119
Groups Dynamic groups Ze sets have flags-dynamic and per-element timeouts: SetFlagDynamic and timeout; parser handles per-element timeout. internal/component/firewall/yang/ze-firewall-conf.yang:637-672internal/component/firewall/model.go:594-603internal/component/firewall/config.go:1183-1248 VyOS has firewall group dynamic-group address-group and ipv6-address-group. interface-definitions/firewall.xml.in:103-132 freeRtr: not found in inspected sources as a named dynamic firewall group. ACL reflect can create forward entries on match with timeout, which is dynamic behavior but not a named dynamic group. src/org/freertr/cfg/cfgAceslst.java:94-97 Ze and VyOS have explicit dynamic set/group surfaces.
QoS/security policing Rate limiting and security-relevant policing Ze firewall action limit-rate supports packet or byte rate plus burst: limit-rate { rate 10/second; burst 5; }. Ze L2TP RADIUS extracts Filter-Id, Cisco, Juniper, Nokia, Huawei CoS/rate VSAs; L2TP guide states RADIUS Access-Request, accounting and CoA/DM. internal/component/firewall/yang/ze-firewall-conf.yang:354-363docs/guide/firewall.md:128-129internal/component/l2tp/plugins/authradius/extract.go:64-91extract_vsa.go:18-70docs/guide/l2tp.md:171-179 VyOS QoS class police include found in; RADIUS rate-limit for PPP/VPN accel-ppp uses Filter-Id default and enable bandwidth shaping. interface-definitions/qos.xml.in:289-307interface-definitions/include/accel-ppp/radius-additions-rate-limit.xml.i:1-23 freeRtr interfaces have rate-limit-in, rate-limit-out, service-policy-in, service-policy-out; NAT can use a policy-map as max session rate. src/org/freertr/cfg/cfgIfc.java:1576-1622src/org/freertr/tab/tabNatCfgN.java:176-187 All have security-relevant rate control. Scope did not cover general QoS beyond security-relevant evidence.
IPsec/IKE Site-to-site IPsec/IKE Ze: not found as a first-class IPsec/IKE subsystem in inspected source. Alternate search found OSPF IPsec files and interop plan/test references, but no generic VPN IPsec config component. VyOS full IPsec/IKE: PSK and post-quantum preshared key; ESP group lifetimes, bytes, packets, mode, PFS, proposals: :83-263; IKE group DPD, reauth, IKEv1/IKEv2, lifetime, MOBIKE, mode, DH, PRF, proposals: :288-700. interface-definitions/vpn_ipsec.xml.in:13-77 freeRtr IPsec profile: transform group, cipher, hash, PRF, seconds, random, bytes, preshared key, role, protected IPv4/IPv6, ISAKMP version, replay window. src/org/freertr/cfg/cfgIpsec.java:83-96, :118-160, :192-195 VyOS has strongest inspected IPsec/IKE surface. freeRtr has native crypto IPsec profile. Ze lacks generic VPN IPsec in inspected sources.
WireGuard WireGuard tunnels Ze: not found in inspected sources. Alternate search found vendor in Ze repo and test filename test-tx-iface-wireguard, but no source-owned WireGuard config/daemon component in inspected code. golang.zx2c4.com/wireguard VyOS WireGuard interface with private-key, peer public-key, preshared-key, allowed-ips, endpoint address/host-name/port, keepalive, fwmark. interface-definitions/interfaces_wireguard.xml.in:1-145 freeRtr imports and fields for clntWireguard, tunnel type wireguard; implementation is clntWireguard with protocol class and UDP packetConnect. src/org/freertr/cfg/cfgIfc.java:53-55, :977-985, :1519-1526, :2614-2618, :2810-2815src/org/freertr/clnt/clntWireguard.java:30-40, :375-377 VyOS and freeRtr have WireGuard. Ze not found as product feature.
OpenVPN OpenVPN tunnels Ze: not found in inspected sources. Alternate search found no Ze-owned OpenVPN component. VyOS OpenVPN supports tun/tap, ciphers, hashes, mode site-to-site/client/server, UDP and TCP variants, local and remote hosts/ports, server clients/pools, reject-unconfigured-clients, TOTP MFA, shared-secret, TLS certs/CA/DH, tls-auth/crypt, peer fingerprint, TLS version and active/passive TLS role, mode site-to-site/client/server :297-312, server node :452, TOTP MFA :745, shared-secret-key :828. interface-definitions/interfaces_openvpn.xml.in:1-263 freeRtr imports and fields for clntOpenvpn, tunnel type openvpn; implementation is clntOpenvpn and connects UDP as openvpn. src/org/freertr/cfg/cfgIfc.java:41-42, :977-980, :1519-1522, :2614-2617, :2810-2812src/org/freertr/clnt/clntOpenvpn.java:26-36, :408-410 VyOS has broad OpenVPN server/client surface. freeRtr has client/tunnel implementation. Ze not found.
L2TP/IPsec L2TP and L2TP/IPsec Ze native L2TPv2 LNS/LAC guide says terminates L2TP tunnels, PPP auth, IP assignment, kernel dataplane via l2tp_ppp; YANG has auth-method, no-auth opt-in, shared-secret, hello retries and listener defaults. No IPsec coupling found. docs/guide/l2tp.md:1-15internal/component/l2tp/yang/ze-l2tp-conf.yang:13-107, :198-229 VyOS remote-access L2TP VPN includes authentication, local users, auth mode/protocols, RADIUS, RADIUS rate-limit, IPsec settings with PSK or X.509 auth and ESP group. interface-definitions/vpn_l2tp.xml.in:5-63, :66-92 freeRtr supports L2TPv2 and L2TPv3 servers and clients; client/tunnel evidence in. L2TP over IPsec specific coupling not found. src/org/freertr/serv/servL2tp2.java:27-33, :89-93, :190-195src/org/freertr/serv/servL2tp3.java:29-35, :101-106, :201-231cfgVpdn.java:783-785cfgIfc.java:4942-4950 VyOS explicitly has L2TP/IPsec. Ze has L2TP without inspected IPsec. freeRtr has L2TP but IPsec coupling not found in inspected sources.
PKI/certificates PKI, certificates, TLS secrets Ze self-cert generates self-signed ECDSA P-256 certificates and TLS config min TLS 1.2; appliance cert replacement supports CA-signed cert/key or self-signed regeneration and writes key as secret. internal/core/selfcert/selfcert.go:41-133, :167-183internal/appliance/cmd_cert.go:20-83, :93-106 VyOS PKI supports CA certs/private keys, CRLs, system install, certificates, ACME with RSA 2048/3072/4096, DH params, key pairs, OpenSSH keys, OpenVPN shared secrets, X.509 defaults. interface-definitions/pki.xml.in:1-263 freeRtr has crypto certificate and key config storing imported PEM through secret encoding; server security wrapper accepts RSA, DSA, ECDSA, MLDSA keys and certs for TLS/SSH. src/org/freertr/cfg/cfgCert.java:74-77src/org/freertr/cfg/cfgKey.java:69-72src/org/freertr/sec/secServer.java:24-55 VyOS has the broadest PKI model. Ze has web/appliance certificate machinery. freeRtr has crypto key/cert plumbing.
SSH SSH server and management access Ze SSH server built under ze_ssh with listen addresses, host key/cert paths, idle timeout, max sessions, users, authenticator, audit recorder, command executor, streaming authorization and accounting. cmd/ze/hub/service_ssh.go:1-67, :84-137 VyOS SSH service supports allow/deny users/groups, ciphers, disable password auth, FIDO2 PIN/touch, dynamic protection, hostkey and pubkey algorithms, KEX, MAC, port, rekey, client keepalive, trusted user CA, VRF. interface-definitions/service_ssh.xml.in:1-263, :264-315 freeRtr generic secure server supports protoSsh, proto2string maps ssh, help says select secure shell, and server config has security protocol: secServer.openSec starts secSsh with auth and key material. src/org/freertr/serv/servGeneric.java:221-259, :392-416, :1189-1193, :1276-1279src/org/freertr/sec/secServer.java:24-55 VyOS exposes most SSH hardening knobs. Ze SSH is integrated with AAA dispatcher. freeRtr SSH appears as generic server security mode.
Users/authentication Local users, passwords, keys, OTP Ze local AAA backend uses built-in bcrypt user authentication according to comments and is registered priority 200 fallback; appliance init hashes password with bcrypt and writes password.hash as a secret. internal/component/authz/register.go:43-72internal/appliance/cmd_init.go:128-146 VyOS login supports operator groups, local users, encrypted-password regex for DES/MD5/SHA/yescrypt-like formats, OTP with rate-limit/rate-time/window/key, plaintext-password for encryption, SSH principals, public keys and key types. interface-definitions/system_login.xml.in:10-234 freeRtr local user entries render password, secret, otpseed, hidata, pubkey and decode password/secret on config; authenticator supports local. src/org/freertr/auth/authLocalEntry.java:170-180, :259-298src/org/freertr/cfg/cfgAuther.java:116-143 All support local accounts. VyOS has explicit OTP model. freeRtr stores OTP/HID data. Ze bcrypt local auth is present; its full local-user config model is not detailed here.
AAA RADIUS Ze L2TP RADIUS plugin handles Access-Request, accounting and CoA/DM per docs; code has config fields servers, timeout, retries, accounting interval, NAS identifier, source address, CoA port; handler sends async RADIUS auth; accounting and CoA evidence. System RADIUS for SSH/login not found. docs/guide/l2tp.md:171-179internal/component/l2tp/plugins/authradius/config.go:17-31handler.go:17-67acct.go:41-87coa.go:26-55 VyOS system login RADIUS servers with mandatory/optional mode and auth port; include supports IPv4/IPv6 server, key, auth port, source address, security-mode. L2TP RADIUS and CoA rate additions. interface-definitions/system_login.xml.in:260-275interface-definitions/include/radius-server-ipv4-ipv6.xml.i:1-44interface-definitions/vpn_l2tp.xml.in:21-30include/accel-ppp/radius-additions.xml.i:119-143 freeRtr AAA supports RADIUS authenticator and authRadius stores port, secret, server, proxy, privilege. src/org/freertr/cfg/cfgAuther.java:9-11, :83-104, :116-143src/org/freertr/auth/authRadius.java:61-89 Ze RADIUS is L2TP PPP-focused in inspected sources, not general management AAA. VyOS and freeRtr have management login RADIUS.
AAA TACACS+ Ze TACACS+ guide says SSH login TACACS+ with local fallback, authentication, accounting START/STOP, command authorization with strict fallback option; YANG server key sensitive, timeout, source-address, authorization, strict-fallback, accounting, privilege profile mapping. docs/guide/tacacs.md:1-21internal/component/tacacs/yang/ze-tacacs-conf.yang:17-82 VyOS TACACS+ login servers with key, port 49, source address, security-mode mandatory/optional, timeout, VRF. interface-definitions/system_login.xml.in:276-325 freeRtr AAA supports TACACS and authTacacs stores port, secret, server, proxy, privilege. src/org/freertr/cfg/cfgAuther.java:9-11, :83-104, :116-143src/org/freertr/auth/authTacacs.java:61-89 All three have TACACS+ in inspected sources. Ze documents command accounting and per-command authorization in detail.
RBAC/authz Command authorization and RBAC Ze authz has profile-based command authorization, ordered allow/deny entries, run/edit sections, prefix or regex matching; TACACS maps priv levels to local profiles. internal/component/authz/authz.go:1-25, :32-80, :184-205docs/guide/tacacs.md:38-50, :77-100 VyOS operator-group command-policy allow and users restricted to operator groups. interface-definitions/system_login.xml.in:10-36, :45-67 freeRtr user entries can have privilege and autocommand defaults are filtered; local entry supports privilege, config parse at :255-300. src/org/freertr/cfg/cfgAuther.java:84-89src/org/freertr/auth/authLocalEntry.java:170-180 Ze has explicit allow/deny RBAC. VyOS has operator command policies. freeRtr has privilege levels plus autocommand/filter authz but no rich allow/deny RBAC. cfgAuther.java:84-99
Secrets/password storage Sensitive storage and redaction Ze YANG marks L2TP shared-secret as ze:sensitive; TACACS server key ze:sensitive; TACACS guide says shared secrets are stored as $9$ ciphertext, CLI strips private data: database.zefs contains plaintext secrets and auto-deletes unless kept; password hash uses bcrypt. internal/component/l2tp/yang/ze-l2tp-conf.yang:67-76internal/component/tacacs/yang/ze-tacacs-conf.yang:32-38docs/guide/tacacs.md:141-148internal/appliance/cmd_assemble.go:20-67internal/appliance/cmd_init.go:136-146 VyOS encrypted passwords accepted via regex, plaintext-password exists to generate encrypted password; default config includes a SHA-512 style $6$ encrypted password and empty plaintext-password; RADIUS/TACACS include shared secret key. interface-definitions/system_login.xml.in:77-89, :154-158data/config.boot.default:38-39interface-definitions/include/radius-server-key.xml.i:1-4 freeRtr encodes passwords/secrets via authLocal.passwdEncode in many configs, and documents a 2=hide secrets filter mode; local entries encode password, secret, otpseed, hidata; RADIUS/TACACS secrets encoded. src/org/freertr/cfg/cfgGeneric.java:23-26src/org/freertr/auth/authLocalEntry.java:170-180src/org/freertr/auth/authRadius.java:61-89authTacacs.java:61-89 Ze has explicit sensitive markers in YANG. freeRtr has encoded/hide-secrets rendering. VyOS stores encrypted passwords and separate plaintext inputs.
Control-plane protection Control-plane policy, DoS/DDoS, hardening Ze global-options map to sysctls: all-ping, broadcast-ping, syn-cookies, redirects, source-validation, log-martians, IPv6 redirects/source-route; YANG describes syn-cookies as SYN flood protection and source-validation as rp_filter. IRR per-interface source validation drops packets not in AS-SET prefixes. Dedicated CoPP not found. docs/guide/firewall.md:224-248internal/component/firewall/yang/ze-firewall-conf.yang:406-441, :458-472docs/guide/firewall.md:276-308 VyOS firewall global options include all-ping, broadcast-ping, log-martians, source-validation, syn-cookies, IPv6 source validation; template maps log_martians and syn_cookies sysctls; SSH dynamic-protection blocks source IPs with score threshold/block-time/detect-time/allow-from. Dedicated CoPP not found in inspected sources. interface-definitions/include/firewall/global-options.xml.i:7-27, :195-196, :275-344, :412-415data/templates/firewall/sysctl-firewall.conf.j2:9-13interface-definitions/service_ssh.xml.in:83-143 freeRtr service generic checks srvIpInf and can drop inbound service connections; interface source verification exists; interface rate limits and inspect exist. Dedicated CoPP not found in inspected sources. src/org/freertr/serv/servGeneric.java:1029-1085src/org/freertr/cfg/cfgIfc.java:1705-1709cfgIfc.java:1576-1578, :1738-1739 None had an explicit CoPP feature in inspected sources. All have some control-plane hardening or service filtering hooks.
Route filters only Route filters, access-lists, prefix-lists Ze firewall IRR prefix-list filtering resolves ASN/AS-SET to nft interval sets and can bind per-interface source validation; BGP RPKI config below. General route policy intentionally out of scope. docs/guide/firewall.md:250-308 VyOS policy model has access-list, access-list6, as-path-list, route-filter communities, and other policy objects. interface-definitions/policy.xml.in:8-36, :81-97, :140-152, :204-248 freeRtr route filters exist via access-list, prefix-list, route-map, route-policy in startup/defaults and router/interface filtering; route-policy can match access-list and prefix-list. src/org/freertr/cfg/cfgInit.java:208-214src/org/freertr/cfg/cfgRouplc.java:227-234, :435-448 Route policy beyond filters was not expanded per non-goal.
RPKI RPKI validation/servers Ze RPKI config parses RTR cache servers with address, port 323 default, preference, source-address, validation-timeout, ASPA validation and invalid/unknown actions. internal/component/bgp/plugins/rpki/rpki_config.go:13-45, :47-132 VyOS has protocols RPKI node and includes common config; PKI dependency mentions RPKI under PKI dependencies in. interface-definitions/protocols_rpki.xml.in:1-14data/config-mode-dependencies/vyos-1x.json:58-65 freeRtr has servRpki, documented as RFC6810 server with configured IPv4/IPv6 ROAs, ASPA and keys: rtrRpki protocol has neighbors, accepted ROAs, ASPAs, keys. src/org/freertr/serv/servRpki.java:27-80, :112-183src/org/freertr/rtr/rtrRpki.java:33-94 All three have RPKI-related source evidence. Ze RPKI appears under BGP plugin, not firewall.

Gaps and unclear items

Explicitly unclear or not found in inspected sources:

  1. Ze generic VPNs: WireGuard, OpenVPN, and generic VPN IPsec/IKE were not found as first-class Ze components in inspected sources. Searches did find vendor WireGuard code and IPsec-related OSPF/interoperability references, but no source-owned generic VPN config subsystem.
  2. Ze firewall zones: no explicit zone-policy/security-zone model found.
  3. Ze NPTv6/NAT64: no dedicated NPTv6 or NAT64 model found. Ze can express NAT in nft ip6/inet chains, but dedicated NPT/NAT64 was not found.
  4. Ze system RADIUS AAA: RADIUS was found for L2TP PPP sessions. Management login RADIUS was not found in inspected sources.
  5. freeRtr stateful firewall: interface inspect builds a bidirectional tabSession (src/org/freertr/ip/ipFwdIface.java:150, :1594; src/org/freertr/tab/tabSession.java:62-105) giving CBAC/reflexive-style state; there is no rule-level established/related match keyword.
  6. freeRtr firewall zones: no explicit zone-policy/security-zone model found after alternate searches.
  7. freeRtr dynamic groups: ACL reflect with timeout was found, but named dynamic firewall groups were not found.
  8. freeRtr NPTv6/NAT64: IPv4/IPv6 NAT support was found, but dedicated NPTv6 or NAT64 was not found in inspected sources.
  9. freeRtr L2TP/IPsec coupling: L2TPv2/v3 and IPsec exist separately. An explicit L2TP/IPsec remote-access profile was not found.
  10. CoPP: explicit control-plane policing as a named feature was not found in Ze, VyOS, or freeRtr inspected sources. Related controls exist, such as sysctls, SSH dynamic protection, service filters, rate limits, and source validation.

Evidence appendix: network services and operations

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Address services DHCPv4 server Present. service dhcp-server YANG has enabled, listen-interface, shared-network, subnet ranges, lease time, default router, DNS servers, domain name, static MAC mappings. PXE boot option injection supports TFTP server, BIOS/UEFI bootfiles, iPXE HTTP boot-script URL: same file :21-45. internal/plugins/dhcpserver/yang/ze-dhcp-server-conf.yang:11-118 Present. CLI node service dhcp-server owned by service_dhcp-server.py, help says DHCP server. interface-definitions/service_dhcp-server.xml.in:1-15 Present. servDhcp4 comment says "dynamic host config protocol (rfc2131) server and relay"; mode enum includes server and relay. Registered as DHCP4 daemon. src/org/freertr/serv/servDhcp4.java:29-55src/org/freertr/cfg/cfgAll.java:502-510 All three have DHCPv4 server support in inspected sources.
Address services DHCPv4 client Present per interface. interface. ipv4 dhcp enabled, client-id, hostname. Runtime uses nclient4.New, DORA Request, installs lease, renews at T1/T2. internal/component/iface/yang/ze-iface-conf.yang:319-343internal/plugins/iface/dhcp/dhcp_v4_linux.go:16-84 Present via interface DHCP options include. defines DHCP client settings/options. DNS forwarding can use DHCP client nameservers. include/interface/dhcp-options.xml.iinterface-definitions/include/interface/dhcp-options.xml.i:2-4interface-definitions/service_dns_forwarding.xml.in:29-36 Present. cfgIfc imports clntDhcp4 and has public clntDhcp4 dhcp4c. src/org/freertr/cfg/cfgIfc.java:13-14src/org/freertr/cfg/cfgIfc.java:1224-1232 Ze and freeRtr runtime client code inspected. VyOS evidence is CLI/schema level from interface include and dependent DNS forwarding.
Address services DHCPv4 relay not found in inspected sources. Searches for dhcp relay, relay, dhcpserver, service dhcp found DHCP server and client but no Ze DHCPv4 relay implementation or YANG. Present. service dhcp-relay node, listen/upstream interfaces, relay options. interface-definitions/service_dhcp-relay.xml.in:1-83 Present. servDhcp4 is "server and relay" and has mode enum server, relay. Interface has public servDhcp4 dhcp4r relay service field. src/org/freertr/serv/servDhcp4.java:29-55src/org/freertr/cfg/cfgIfc.java:1008-1015 Ze absence is based on inspected source searches, not a product claim beyond sources inspected.
Address services DHCPv6 server ∿ Present. service dhcpv6-server node, help "DHCP for IPv6 (DHCPv6) server". interface-definitions/service_dhcpv6-server.xml.in:1-14 Present. servDhcp6 comment says "dynamic host config protocol (rfc3315) server", mode enum includes server and relay. Registered as DHCP6 daemon. src/org/freertr/serv/servDhcp6.java:29-55src/org/freertr/cfg/cfgAll.java:512-520 Ze DHCPv6 server is tied to PPP/L2TP prefix delegation in inspected sources.
Address services DHCPv6 client Present per interface. ipv6 dhcpv6 enabled, PD length, DUID. Runtime has dhcp_v6_linux.go listed and searched. internal/component/iface/yang/ze-iface-conf.yang:377-424 Present via, DHCPv6 client settings/options. include/interface/dhcpv6-options.xml.iinterface-definitions/include/interface/dhcpv6-options.xml.i:2-4 Present. clntDhcp6 client class and socket binding to DHCPv6 client/server ports; interface config emits ipv6 dhcp-client enable. src/org/freertr/clnt/clntDhcp6.java:27-28, :237-243src/org/freertr/cfg/cfgIfc.java:6925-6929 All three have DHCPv6 client evidence.
Address services DHCPv6 relay not found in inspected Ze service sources. L2TP PPP DHCPv6 server and interface DHCPv6 client found, but no general relay. Present. service dhcpv6-relay node, help "DHCPv6 Relay Agent parameters". interface-definitions/service_dhcpv6-relay.xml.in:6-8 Present. servDhcp6 mode enum includes relay: public servDhcp6 dhcp6r. src/org/freertr/serv/servDhcp6.java:40-55src/org/freertr/cfg/cfgIfc.java:1013-1020
DNS Resolver and forwarder DNS lookup tooling present, resolver service not found except GeoDNS authoritative. Diagnostics include show dns lookup <name>. Dedicated recursive/forwarding DNS service not found in inspected Ze sources. docs/guide/production-diagnostics.md:12-16, :31-34 Present. service dns forwarding node, cache size, DHCP-derived upstreams, DNS64 prefix, DNSSEC modes. Conf mode uses PowerDNS recursor paths. interface-definitions/service_dns_forwarding.xml.in:20-83src/conf_mode/service_dns_forwarding.py:33-39 Present. servDns is RFC1035 DNS server with zones, resolvs, rcrsvia, recursEna. Registered DNS daemon. src/org/freertr/serv/servDns.java:29-72src/org/freertr/cfg/cfgAll.java:517-520 Ze has command DNS lookup and GeoDNS server, not a general resolver/forwarder in inspected sources.
DNS Authoritative DNS GeoDNS authoritative-style server present. YANG describes DNS answers selected by client source IP and zones served. SOA fields and synthesized glue: same file :74-126. Host records A/AAAA/SRV and source prefix mapping: same file :128-223. internal/plugins/geodns/yang/ze-geodns-conf.yang:7-13, :65-72 Present inside forwarding service. authoritative-domain, records, A/AAAA/CNAME/MX and more; conf mode builds authoritative_zones and records. interface-definitions/service_dns_forwarding.xml.in:109-180, :208-254src/conf_mode/service_dns_forwarding.py:66-88 Present. servDns has zones and RFC1035 server. src/org/freertr/serv/servDns.java:29-47 VyOS authoritative records are integrated into DNS forwarding/recursor path.
DNS GeoDNS Present. Explicit GeoDNS server, EDNS0 client-subnet and packet source selection, client-source prefix mapping. internal/plugins/geodns/yang/ze-geodns-conf.yang:7-13, :49-63, :207-223 not found in inspected sources. EDNS Client Subnet forwarding options exist but no source-IP-based answer selection (GeoDNS). interface-definitions/service_dns_forwarding.xml.in:744-780 not found in inspected sources. Search for geodns, geo dns, client-subnet, captive only found EDNS0 option type in packet codec, not a GeoDNS service. src/org/freertr/pack/packDnsRec.java:280-283 GeoDNS is a Ze differentiator in inspected network services.
Time NTP client/server Client present. NTP plugin queries configured and DHCP option 42 servers, sets system clock, writes RTC and persists time. Config has servers, interval, max step, persist path: same file :27-47. No NTP server found in inspected Ze sources. internal/plugins/ntp/ntp.go:1-10 Present. service ntp node, allow/listen includes, timestamping, servers and pools. Default config enables NTP allow-client and servers: (syslog at :46-55); conf mode renders chrony and manages chrony.service. interface-definitions/service_ntp.xml.in:1-18, :113-177data/config.boot.default:5-23src/conf_mode/service_ntp.py:34-36, :142, :152 Present. Registered NTP daemon. servNtp accepts connections and replies. src/org/freertr/cfg/cfgAll.java:574-575src/org/freertr/serv/servNtp.java:24-31, :63-64, :152-172 Ze evidence is client only; VyOS renders chrony and also has an NTP server.
Time PTP not found in inspected Ze sources. Present as NTP PTP transport and hardware timestamp filters. service ntp ptp and server ptp leaf. interface-definitions/service_ntp.xml.in:15-73, :168-172 Present. Interface PTP handler (public ifcPtp ptp) and config defaults; Ethernet PTP handler parses IEEE1588 and adjusts time; routed UDP PTP registers PTP ports. src/org/freertr/cfg/cfgIfc.java:388-390, :96, :1555-1562, :1739-1741src/org/freertr/ifc/ifcPtp.java:15-20, :71-85src/org/freertr/rtr/rtrPtpIface.java:81-90
Management services SNMP not found in inspected Ze sources. Search found no SNMP service or YANG, except unrelated conntrack protocol name constants. Present. service snmp node with community authorization and client/network controls. interface-definitions/service_snmp.xml.in:1-60 Present. SNMP service imported and registered: servGenList maps server snmp to servSnmp. src/org/freertr/cfg/cfgAll.java:88-90, :599-600src/org/freertr/serv/servGenList.java:459-460
Discovery LLDP not found in inspected Ze sources. Present. service lldp node with per-interface mode disable/rx-tx/tx/rx and LLDP-MED location, per-interface mode disable/rx-tx/tx/rx: :32-58; LLDP SNMP database toggle: same file :209-211. interface-definitions/service_lldp.xml.in:1-73 Present. Interface LLDP handler field and defaults. LLDP implementation stores neighbors and transmits advertisements. src/org/freertr/cfg/cfgIfc.java:372-375, :1555-1557, :6585-6587src/org/freertr/ifc/ifcLldp.java:27-48, :157-164, :387-390
NAT and conntrack NAT helpers or ALGs NAT implementation present, helper list found in system conntrack. Ze lists helper/protocol names including snmp, sqlnet, netbios-ns. VPP firewall NAT Linux code exists. A full ALG/helper service inventory beyond the listed names is not established from inspected source. internal/component/config/system/conntrack.gointernal/component/config/system/conntrack.go:121-124internal/plugins/firewall/vpp/nat_linux.go Present. CLI has helpers for FTP, H.323, PPTP, SIP, TFTP. Conf mode maps ALGs to kernel modules and nft helper rules for FTP, H323, NFS, PPTP, RTSP, SIP, SQLNet, TFTP. interface-definitions/system_conntrack.xml.in:272-320src/conf_mode/system_conntrack.py:38-73 NAT support present and PPTP protocol handling present, but explicit generic NAT ALG/helper list not found in inspected sources. NAT config defaults exist; PPTP client/server protocol classes are imported and registered; PPTP client uses TCP 1723. src/org/freertr/cfg/cfgVrf.java:239-242src/org/freertr/cfg/cfgAll.java:77-78, :792-795src/org/freertr/clnt/clntPptp.java:289-300 VyOS has the clearest explicit ALG inventory. freeRtr has protocol services and NAT config, but no source-grounded "NAT helper list" beyond protocol implementations found.
File and boot services TFTP/image server DHCP PXE option injection present, TFTP server service not found. PXE config points clients at TFTP server and bootfiles. Appliance installer supports HTTP/PXE in plans, but a general TFTP server was not found in inspected sources. internal/plugins/dhcpserver/yang/ze-dhcp-server-conf.yang:21-45 Present. service tftp-server node, directory, allow-upload, port 69, listen address/VRF. interface-definitions/service_tftp-server.xml.in:1-29 Present. TFTP daemon registered; service imported: same file :97-99; client default supports client tftp-proxy: same file :1532. src/org/freertr/cfg/cfgAll.java:557-560 Ze can advertise TFTP/PXE settings but no TFTP server found.
HTTP and API HTTP server or API Present. Feature-gated REST HTTP API server starts listeners and OpenAPI spec. Web service feature-gated, default, registers portal services, starts web server. gRPC also present. cmd/ze/hub/service_rest.go:1-830.0.0.0:3443cmd/ze/hub/service_web.go:1-83cmd/ze/hub/service_grpc.go:1-78 Present. service https node with HTTP API keys, REST API, GraphQL API. interface-definitions/service_https.xml.in:1-83 Present. HTTP daemon registered: servHttp is HTTP RFC2616 server with clear/secure ports 80/443 and host list. src/org/freertr/cfg/cfgAll.java:490src/org/freertr/serv/servHttp.java:22-48 All three have HTTP server/API evidence, with different scope.
HTTP and API Proxy not found in inspected Ze sources. Present. service webproxy node with safe ports, SSL safe ports, authentication settings. System proxy config also exists. interface-definitions/service_webproxy.xml.in:1-83interface-definitions/system_proxy.xml.in Present. client http-proxy, client name-proxy, client tftp-proxy, generic client proxy defaults: clntProxy class. src/org/freertr/cfg/cfgAll.java:1528-1534src/org/freertr/clnt/clntProxy.java
HTTP and API Load balancing not found in inspected Ze sources. Present. HAProxy load balancing node, service frontend, backend members, listen address, mode, HTTP compression, redirect HTTP to HTTPS. WAN load balancing also present. interface-definitions/load-balancing_haproxy.xml.in:1-83interface-definitions/load-balancing_wan.xml.in Present. Load balancer daemon registry: servLoadBalancer imported: same file :56. src/org/freertr/cfg/cfgAll.java:452-460
Captive portal Captive portal service or options not found in inspected Ze sources. DHCP/RA captive portal option present, not a portal implementation. defines "Captive portal API endpoint"; included in DHCP option-v4/v6 and router-advert. include/dhcp/captive-portal.xml.iinterface-definitions/include/dhcp/captive-portal.xml.i:1-10interface-definitions/include/dhcp/option-v4.xml.i:6-8interface-definitions/include/dhcp/option-v6.xml.i:6-8interface-definitions/service_router-advert.xml.in:18-19 not found in inspected sources. Search for captive, portal, hotspot found no freeRtr captive portal service. VyOS has endpoint advertisement, not captive portal enforcement based on inspected sources.
Logging Syslog and logging destinations Structured logging present, remote syslog destination not found in inspected Ze sources. Logging commands exist under show log YANG anchor. internal/component/cmd/log/yang/ze-cli-log-cmd.yang:4-8 Present. System syslog has console, remote host, port 514, TCP/UDP, source address, VRF, TLS auth modes, local messages. interface-definitions/system_syslog.xml.in:1-123 Present. Syslog daemon registered; syslog client implements RFC3164 and UDP to servSyslog port. Logging defaults include buffered, monitor, syslog, file, IRC. src/org/freertr/cfg/cfgAll.java:452-455src/org/freertr/clnt/clntSyslog.java:10-15, :91-96src/org/freertr/cfg/cfgAll.java:1492-1501
Flow telemetry NetFlow, sFlow, IPFIX Present. Flow-export YANG explicitly covers "sFlow, NetFlow v9, IPFIX", collector protocol enum, packet sampling, conntrack export, BGP enrichment. internal/plugins/flowexport/yang/ze-flowexport-conf.yang:5-43, :73-119, :121-141 Present. sFlow config with agent, polling, sampling, server port 6343, VPP sampling, egress. VPP IPFIX config requires interfaces and has op show collectors/interfaces/table. interface-definitions/system_sflow.xml.in:1-123src/conf_mode/vpp_ipfix.py:1-83op-mode-definitions/vpp_ipfix.xml.in:1-31 NetFlow present. clntNetflow says "netflow (rfc3954) client", exports sessions over UDP. servNetflow says "netflow (rfc3954) server" with sample/rate/mac/before/after/dropped options. sFlow/IPFIX not found in inspected freeRtr sources. src/org/freertr/clnt/clntNetflow.java:11-16, :94-100src/org/freertr/serv/servNetflow.java:17-23, :34-60 Ze and VyOS cover all three named protocols in inspected sources. freeRtr inspected source evidence supports NetFlow only.
Diagnostics Ping Present. Diagnostics guide lists monitor ping <target>; CLI model supports monitor ping parser, defaults and rendering. docs/guide/production-diagnostics.md:12-17internal/component/cli/model_ping.go:97-121, :180-218 Present. Makefile explicitly wires recursive op command templates for ping: exists. Makefile:64-70, ping.py Present. CLI help has ping, implementation calls doPing, output line "pinging …". src/org/freertr/user/userExec.java:2309-2312, :3396-3398, :4788-4955
Diagnostics Traceroute Present. Diagnostics guide lists show traceroute and monitor traceroute. docs/guide/production-diagnostics.md:8-15, :31-34 Present. Makefile wires traceroute and monitor/traceroute: exists. Makefile:64-71, traceroute.py Present. CLI help has traceroute and mtr; implementation uses prtTraceroute and prints "tracing …". src/org/freertr/user/userExec.java:2279-2284, :4400-4420, :4594-4615
Diagnostics MTR not found as MTR command in inspected Ze sources. Ze has monitor ping and traceroute. Present. Makefile wires mtr: exist. Makefile:64-70, mtr.py, mtr_execute.py Present. CLI help includes mtr next to traceroute; mtracker status is also exposed: same file :1605-1608. src/org/freertr/user/userExec.java:2279-2282
Diagnostics Packet capture Present. Diagnostics guide: show capture interface eth0. format text/pcap, show capture raw start/dump, "replaces tcpdump". MRT conversion to pcap exists. docs/guide/production-diagnostics.md:35-49, :62-65internal/analyze/convert.go:18-30, :115-131 Present. Makefile comment says "tcpdump, ping, traceroute and mtr" recursive templates and wires monitor traffic interface; op mode traffic/capture tooling appears in src/op_mode glob and monitor traffic interface. Makefile:64-71 Present. Packet command class exists: packet capture <ifc> <file>.pcap. src/org/freertr/user/userPacket.java:91-120src/org/freertr/user/userTester.java:2423-2429, :2480-2482
Diagnostics and stats Traffic generation and traffic statistics Traffic statistics present, BGP traffic replay/generation present. Traffic usage eBPF counters and show traffic usage. MRT inject/replay/serve tools send BGP UPDATE traffic: inject: sent and serve: sent. General L3 traffic generator not found in inspected sources. docs/guide/traffic-usage.md:1-17, :104-119internal/analyze/register.go:23-25internal/analyze/inject.go:146-147internal/analyze/serve.go:169-170 Traffic monitoring present, plus an iperf-based bandwidth generator via execute bandwidth-test initiate. Makefile wires monitor traffic interface. op-mode-definitions/execute-bandwidth-test.xml.in:30-52src/op_mode/execute_bandwidth_test.sh:32Makefile:64-71 Traffic stats present, testing tping present. show interface traffic/hwtraffic/swtraffic/ptraffic commands; interface show table mode documents traffic, packet traffic and totals. Tests use tping. src/org/freertr/user/userShow.java:2197-2229src/org/freertr/cfg/cfgIfc.java:6354-6359cfg/basic01.tst:19 "Traffic generation" is strongest in Ze for BGP replay and freeRtr test harness tping; VyOS provides an iperf bandwidth generator, not a generic packet crafter.
Route visibility Route looking glass or route viewer Present. Looking-glass service starts HTTP server, dispatches commands, binds listeners, TLS optional. Env keys include. BGP RIB show routes command exists. cmd/ze/hub/service_lg.go:1-37, :39-103ze.looking-glass.enabled/listen/tlsinternal/component/config/environment.go:87-91internal/component/bgp/plugins/rib/rib_commands.go:130-146 Dedicated looking glass not found in inspected sources. Route op-mode exists, but no "looking glass" server or route viewer found. src/op_mode/route.py Dedicated web looking glass not found in inspected sources. CLI route show tables are present: show ipx route tables and show route style help in userExec; BGP packet/route dump tools exist in userPacket. src/org/freertr/user/userExec.java:360-390 Ze has the clearest actual looking-glass service. VyOS and freeRtr have CLI route visibility, not an inspected looking-glass service.
Lifecycle Update, config archive, backup Present for appliances. Encrypted ze appliance export, export --all, archives always encrypted. OTA push via gokrazy updater with --testboot, --no-reboot, --all. Import validates restored config. internal/appliance/cmd_export.go:20-78, :107-132internal/appliance/cmd_push.go:1-80internal/appliance/cmd_import.go:88-120 Present. Config management op-mode exposes commit diff/file/log. Config-sync service definition exists. Tech support archive and upload support. src/op_mode/config_mgmt.py:20-68interface-definitions/service_config-sync.xml.in:6-7src/op_mode/generate_tech-support_archive.py:31, :55-103 Present. Config backup/archive defaults and variables. Flash archive/extract/clean backup/upgrade/simulate/backup/revert. Software upgrade backup. src/org/freertr/cfg/cfgAll.java:1457-1465, :1545-1560src/org/freertr/user/userFlash.java:310-380src/org/freertr/user/userUpgrade.java:354-356
Supportability Diagnostics and support bundle Present. Production diagnostics guide covers tcp-check, traceroute, kernel logs, CPU/heap profiles, file descriptors, goroutines, DNS lookup, ping, netlink, packet capture, sockets, memory. Doctor checks registered for appliances. No single "support bundle" archive command found in inspected Ze sources. docs/guide/production-diagnostics.md:1-65, :70-183internal/appliance/doctor_checks.go:13-26, :37-56 Present. generate_tech-support_archive.py creates tech-support archive, runs show tech-support report, archives /var/log, /tmp, /home, config dirs with filters. src/op_mode/generate_tech-support_archive.py:28-31, :43-63, :65-103 ∿ VyOS has explicit support archive. Ze has broad built-in diagnostics but no inspected bundle. freeRtr has operational diagnostics and archive/backup, no inspected bundle.

Gaps and unclear items

Evidence appendix: management, automation, UI, and API

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
CLI modes Operational and configuration mode split ze config edit help lists config editor commands and mode switching: command switches to operational mode and edit switches back. ze config dispatcher separates storage-aware config commands from plain validation/migration/completion handlers. internal/component/config/cli/cmd_edit.go:343-380internal/component/config/cli/main.go:31-61 Repo layout explicitly separates configuration interface definitions, operational command definitions, src/conf_mode, and src/op_mode. Config session API wraps CLI shell config mode. README.md:15-26python/vyos/configsession.py:34-82 userExec.getHelping defines exec commands including show, watch, netconf, xml, terminal. userConfig has config mode prompt (cfg) or (cfg-<submode>) via getPrompt. src/org/freertr/user/userExec.java:2108-2185src/org/freertr/user/userConfig.java:179-185 All three have CLI modes. Ze and freeRtr evidence shows mode switching in source. VyOS source root has definitions and APIs, while full shell implementation is outside this repo.
CLI modes Submode/context editing Ze editor help lists edit <path>, edit <list> *, top, up. internal/component/config/cli/cmd_edit.go:356-361 XML interface definitions model hierarchical configuration commands, and README says conf-mode definitions are generated from unified XML format. README.md:34-43 userConfig routes commands to submode.doCfgStr(cmd) when submode is set, getPrompt reflects submode. src/org/freertr/user/userConfig.java:286-294src/org/freertr/user/userConfig.java:179-185 All support hierarchical config context.
Completion and help Interactive completion and ? help Ze editor help documents Tab completion, dropdown cycling, and ghost text. Ze also has non-interactive completion with --json and --ghost. internal/component/config/cli/cmd_edit.go:374-379internal/component/config/cli/cmd_completion.go:1-132 VyOS has completion helpers under src/completion in README layout, completionHelp is used, for example commit-confirm action values reload reboot. README.md:23-27interface-definitions/system_config-management.xml.in:66-86 userReader stores help context and handles tab completion via help.guessLine(curr), ? help via cmdShowHelp and help.getHelp(curr, false). src/org/freertr/user/userReader.java:1213-1215src/org/freertr/user/userReader.java:1505-1510,1734-1735 All have completion/help. Ze is most explicit about machine-queryable completions.
Completion and help Generated command reference Ze ze help command [filter] [--json] walks YANG verbs plus offline local commands and emits command catalog entries. cmd/ze/help_command.go:1-54,73-127 VyOS Makefile generates config node templates and op-mode templates from XML, and exports op_cache.json. README says all raw node.def files are generated from unified XML. Makefile:29-63README.md:34-43 userHelp builds help trees and generates YANG via getYang, userNetconf.makeYang builds YANG from config help/context, (makeYang at :104). src/org/freertr/user/userHelp.java:1249src/org/freertr/user/userNetconf.java:87-139 VyOS generates command implementation templates and op cache, not necessarily final human docs in this repo. Ze directly exposes a command catalog.
Candidate config Candidate/draft model ZeFS namespaces include, and dated history. Startup clears stale candidate on boot via storage.ClearCandidate. file/active/file/draft/docs/architecture/zefs-format.md:177-183cmd/ze/hub/main.go:127-165 ConfigSession creates a session with session env and uses _session_config/_running_config in ConfigMgmt; ConfigSession has set, delete, commit, discard. python/vyos/config_mgmt.py:184-193python/vyos/configsession.py:265-368 userConfig has an optional commits buffer. If commits != null, config commands are stored instead of applied, and commit executes buffered commands. userExec tracks rollback-protected and committed config sessions. src/org/freertr/user/userConfig.java:286-306src/org/freertr/user/userExec.java:158-166 Ze and VyOS clearly expose candidate/session semantics. freeRtr has a commit buffer mechanism in source, but default execution path also applies directly when commits == null.
Commit Commit/apply Ze web commit handler calls mgr.Commit(username) and handles conflicts. Ze editor help documents commit as saving changes and creating backup. API setup wires session commit hook to reload hook. internal/component/web/handler_config_commit.go:112-160internal/component/config/cli/cmd_edit.go:365-366cmd/ze/hub/api.go:64-68 ConfigSession commit invokes my_commit or vyconf_session.commit. ConfigMgmt has post-commit hooks for commit revision and archive. python/vyos/configsession.py:345-352python/vyos/config_mgmt.py:59-64 userConfig global help includes commit and executeCommand executes buffered commits through cfgInit.executeSWcommands(commits, false), (commit help item at :315). src/org/freertr/user/userConfig.java:290-298 All support commit/apply in inspected code.
Commit Commit confirm Ze commit confirmed <N> validates, saves a .live.conf, writes active config, starts a confirm timer, and exposes confirm / confirm abort; timeout auto-reverts via rollbackConfirmed. Command dispatch accepts commit [force] confirmed <N> but rejects it in ZeFS session mode. internal/component/cli/model_load.go:30-46,72-125,128-219internal/component/cli/model_commands.go:84-105 system config-management commit-confirm action supports reload and reboot; ConfigSession has commit_confirm and confirm; ConfigMgmt documents timer behavior. interface-definitions/system_config-management.xml.in:61-91python/vyos/configsession.py:353-361python/vyos/config_mgmt.py:196-260 ✕ Ze has file-mode commit-confirm with auto-revert; ZeFS session mode is not supported yet. freeRtr has a session-drop auto-revert but no timed commit-confirm.
Rollback Rollback/revert Ze ze config rollback <N> <file> restores from backup revision. Ze has health revert to previous/seed config. internal/component/config/cli/cmd_rollback.go:1-80cmd/ze/health_revert.go:97-112 ConfigMgmt has rollback(rev) and rollback_soft(rev). It stores rollback and pre-rollback files. python/vyos/config_mgmt.py:333-368python/vyos/config_mgmt.py:74-75 freeRtr reverts running to startup via configure revert, (help at :2658), and offers a session-drop auto-revert, show rollback-config shows running-to-startup differences, :1715-1723. No numbered-revision rollback was found. src/org/freertr/user/userExec.java:3759-3772src/org/freertr/user/userLine.java:445-483 Ze and VyOS have explicit numbered restore. freeRtr reverts to startup and has an auto-revert session, but no numbered-revision rollback.
Diff Config diff/compare Ze ze config diff compares two configs or revision N against current, supports --json. internal/component/config/cli/cmd_diff.go:1-94,146-163 ConfigMgmt compare and show_commit_diff exist, ConfigSession.show_config exposes candidate/running show paths. python/vyos/config_mgmt.py:388-654python/vyos/configsession.py:369-377 Exec help includes compare1, compare2, show uncommitted-config, show config-differences, and show rollback-config. src/org/freertr/user/userExec.java:1715-1723,2114-2117 All have diff/compare.
History Command/config history Ze ze config history <file> lists rollback revisions and shows draft state. internal/component/config/cli/cmd_history.go:1-77 Op-mode show history reads bash history and supports brief and last N. ConfigMgmt rotates archived config revisions. op-mode-definitions/show-history.xml.in:1-27python/vyos/config_mgmt.py:556-569 userReader maintains command history with configurable size and getHistory. src/org/freertr/user/userReader.java:224-246,279-305 Ze history is config rollback history. VyOS evidence includes both command history and commit revisions. freeRtr evidence is command-line history, not config revision history.
Config storage/archive Persistent config store ZeFS stores active/draft/historical entries in one .zefs blob; daemon owns blob and terminal commands connect over SSH. docs/architecture/zefs-format.md:104-183docs/architecture/zefs-format.md:139-173 ConfigMgmt paths include, archive directory, commit log, rollback files, commit-revisions "100". /config/config.bootpython/vyos/config_mgmt.py:68-76data/config.boot.defaultdata/config.boot.default:26-27 cfgAll renders client config-backup, client config-save, and client config-archive lines; config files are run by cfgInit.executeSWcommands. src/org/freertr/cfg/cfgAll.java:4018-4025src/org/freertr/cfg/cfgInit.java:1119-1163 Ze uses custom blob storage. VyOS uses config.boot plus archive directory. freeRtr has config save/archive flags and startup execution model.
Config storage/archive Remote/archive upload Ze ze config archive <name> triggers request config archive <name> via daemon and requires system { archive { } }. internal/component/config/cli/cmd_archive.go:1-76 system config-management commit-archive location supports http, https, ftp, sftp, scp, tftp, and git+ URLs, commit_archive uploads to remote archive. interface-definitions/system_config-management.xml.in:11-49python/vyos/config_mgmt.py:570-573 client config-archive and client config-backup defaults exist; the upload target is set via client config-server/config-username/config-password (:1557-1559). src/org/freertr/cfg/cfgAll.java:1560-1562,4021-4024 All have archive hooks/settings; freeRtr sets its upload target through client config-server credentials.
Schema/model Config schema Ze builds config schema from YANG and plugin YANG. internal/component/config/yang_schema.go:87-143 VyOS uses XML definitions conforming to; Makefile validates XML against RNG while generating templates. schema/interface_definition.rngschema/op-mode-definition.rngREADME.md:34-43Makefile:38-63 freeRtr builds help/config trees in Java and can generate YANG via userNetconf.makeYang and userHelp.getYang, seed starts with config global. src/org/freertr/user/userNetconf.java:87-139misc/netconf/global.txtmisc/netconf/global.txt:1-4 Ze has native YANG config. VyOS uses custom XML schemas, not YANG in inspected repo. freeRtr has generated YANG artifacts for NETCONF, not a primary source model.
REST/HTTP API REST API Ze REST server exposes shared API engine as RESTful JSON API and handles routing, JSON, auth, CORS, OpenAPI. internal/component/api/rest/server.go:1-60,93-141 FastAPI REST router defines /configure, /configure-section, /retrieve, /config-file, /image, /container-image, /generate, /show, /reboot, /renew, /reset, /import-pki, /poweroff, /traceroute, (endpoints :576-962). HTTPS service config has API keys and REST strict/debug settings. src/services/api/rest/routers.py:291interface-definitions/service_https.xml.in:11-54 HTTP host help allows api exec, api show, api script, api config, and ipinfo. Dedicated REST/OpenAPI implementation not found in inspected sources. src/org/freertr/serv/servHttp.java:436-445 Ze and VyOS have first-class JSON HTTP APIs. freeRtr exposes HTTP API permissions, but a typed REST contract was not found.
HTTP API GraphQL not found in inspected sources GraphQL README shows endpoint /graphql, config mutations, SaveConfigFile, LoadConfigFile, and Show query; router registers GraphQL ASGI app at /graphql. src/services/api/graphql/README.graphql:1-139src/services/api/graphql/routers.py:1-64 not found in inspected sources GraphQL is VyOS-only among inspected sources.
HTTP API OpenAPI/docs Ze REST server has an OpenAPIProvider for. /openapi.jsoninternal/component/api/rest/server.go:61-63,93-96 VyOS HTTP API server regenerates docs routes /docs, /redoc; FastAPI app imported in same server. /openapi.jsonsrc/services/vyos-http-api-server:158-168src/services/vyos-http-api-server:27-30 not found in inspected sources Ze and VyOS have OpenAPI evidence. freeRtr OpenAPI/swagger search returned no inspected source evidence.
gNMI gNMI server/API Ze gNMI server implements OpenConfig gNMI service over gRPC, supports token and TLS, and registers with gpb.RegisterGNMIServer. internal/component/gnmi/server.go:1-22,115-150 not found in inspected sources not found in inspected sources ✕
NETCONF NETCONF server/API not found in inspected sources not found in inspected sources. Search found only a netlink event formatter comment/class named NetconfFormatter, not a NETCONF management server. src/services/vyos-network-event-logger:1054-1075 userNetconf is an RFC 6241 handler, declares NETCONF port 830, base 1.0/1.1, writable-running, startup capabilities, get-config, edit-config. src/org/freertr/user/userNetconf.java:17-59,140-176,224-320 freeRtr has NETCONF. Ze has gNMI but no NETCONF found. VyOS repo search did not find NETCONF API implementation in inspected root.
SSH CLI SSH CLI access Ze config editor probes daemon SSH and executes commands via SSH. ZeFS doc states terminal commands connect to daemon over SSH and ephemeral daemon starts when needed. internal/component/config/cli/cmd_edit.go:224-242,421-474docs/architecture/zefs-format.md:139-173 VyOS has a service ssh config node owned by service_ssh.py; the service script generates OpenSSH host keys, renders sshd_config, validates it with /usr/sbin/sshd -t, and reloads or restarts ssh@<vrf>.service. interface-definitions/service_ssh.xml.in:1-10src/conf_mode/service_ssh.py:122-197 servTelnet default includes protocol setting, server telnet ssh and security protocol ssh. src/org/freertr/serv/servTelnet.java:52-56cfg/crypt-ssh01.tst:22-33 All three expose SSH device access; Ze's is embedded daemon/editor transport, VyOS uses OpenSSH service integration, freeRtr has an SSH protocol server path.
Web UI Web UI Ze has HTTPS web server with TLS and route registration; config view handler renders HTML or JSON and supports HTMX partial requests. internal/component/web/server.go:1-25,84-139internal/component/web/handler_config.go:132-180 not found in inspected sources for a browser UI. The inspected root has HTTP API service, not a web UI. HTTP server supports directory listing, scripts, API, markdown, etc.; README lists miscellaneous web apps such as sniffer, mailer, pastebin, gallery, motion, player, thermostat, monitoring. A router config web UI comparable to Ze was not found in inspected sources. src/org/freertr/serv/servHttp.java:428-445readme.md:70-88 Ze has clear router web UI. freeRtr has web server and web utilities. VyOS web UI not present in inspected repo.
Frontend implementation HTMX/frontend Ze web source uses HTMX headers and attributes, including HX-Request, HX-Redirect, hx-post, hx-target, and bundled htmx.min.js. internal/component/web/auth.go:170-274internal/component/web/cli_terminal.go:895-901internal/component/web/assets/htmx.min.js:1 not found in inspected sources not found in inspected sources HTMX was found only in Ze.
MCP/AI MCP / AI integration Ze help_ai.go generates AI help from plugin registry, YANG schemas, and RPC registrations and lists MCP tools. MCP handler exposes JSON-RPC tools generated from command registry. cmd/ze/help_ai.go:25-48,84-105internal/component/mcp/handler.go:1-46 not found in inspected sources not found in inspected sources Ze-only in inspected sources.
Plugin SDK/API Internal/external plugin SDK/API Ze plugin registry defines Registration with CLI handler, engine handler, config roots, YANG, RPC handlers, dependencies, event/send types, config verifiers, metrics/event bus/server hooks. Plugin package documents Unix socket server, CLI/external tool communication, JSON encoder, and subprocess management. internal/component/plugin/registry/registry.go:1-120internal/component/plugin/types.go:1-11 not found as an external plugin SDK/API in inspected sources. VyOS has extension by adding XML definitions and conf/op scripts per README layout. README.md:15-27 freeRtr has Java classes for scripts, schedulers, aliases, processes, VDCs, etc., in global lists. External plugin SDK/API not found in inspected sources. src/org/freertr/cfg/cfgAll.java:292-300,372-375 Ze has explicit plugin API. VyOS and freeRtr are extensible by source/config constructs, but no standalone external plugin SDK was confirmed.
JSON output JSON outputs Ze command catalog supports --json; config completion and diff support JSON; REST/MCP use JSON. cmd/ze/help_command.go:31-54internal/component/config/cli/cmd_completion.go:19-37,99-132internal/component/config/cli/cmd_diff.go:24-41,146-163 REST API parses JSON/form data into commands; completion helpers call FRR JSON and jq, for example show evpn es json, imports JSON and API routes are Pydantic/FastAPI models. src/services/api/rest/routers.py:98-225src/completion/list_esi.sh:19-20, configsession.py userFormat has a first-class json table-output mode: enum at str2tabmod at :100-101, JSON serialization at :874, :894, CLI-wired via the tabMod pipe setting rendered by userReader.formatAll: userReader also supports csv/html/xml modes: :172-182. src/org/freertr/user/userFormat.java:39src/org/freertr/user/userReader.java:1000-1004 All three have JSON management output; freeRtr exposes it as a json table mode.
Command/op-mode organization Command registration/organization Ze command catalog collects YANG command tree, wire-to-path mappings, local command registry, read-only/daemon modes, backend metadata. cmd/ze/help_command.go:73-127 VyOS explicitly stores configuration XML under interface-definitions/ and op-mode XML under op-mode-definitions/, generated via Makefile into templates and op cache. README.md:15-20Makefile:29-63 freeRtr organizes exec commands in userExec, config commands in userConfig, and many config object classes implement getHelp and doCfgStr, for example cfgBndl delegates help/config to bundle object. src/org/freertr/cfg/cfgBndl.java:96-112 VyOS has the most explicit filesystem split for command definitions. Ze uses YANG/local registries. freeRtr uses Java help/method dispatch.
Automation hooks Scripts, schedulers, aliases, hooks Ze archive command is daemon-driven, API has session hooks for commit validation and reload. Plugin registry supports event bus and RPC handlers. cmd/ze/hub/api.go:41-68internal/component/plugin/registry/registry.go:101-119 ConfigMgmt defines post-commit hook names 01vyos-commit-revision and 02vyos-commit-archive. Makefile generates activation-scripts JSON. python/vyos/config_mgmt.py:61-64Makefile:132-138 cfgAll has global lists for schedulers, scripts, chat scripts, and aliases; HTTP server can allow scripts and config/API commands. src/org/freertr/cfg/cfgAll.java:292-300,327-330,372-375src/org/freertr/serv/servHttp.java:436-445 All have automation hooks, with different models.
Generated docs/references Generated docs or command refs Ze help_ai.go says AI reference is generated from code, plugin registry, YANG schemas, and RPC registrations. help_command.go outputs JSON consumable by external tooling/wiki generators. cmd/ze/help_ai.go:25-34,60-64cmd/ze/help_command.go:1-10 Makefile generates config reference cache and op cache JSON; README says schema checks happen at build time. Makefile:38-63README.md:41-43 userNetconf.makeYang generates YANG from help/config inputs, misc/netconf contains text seed files for generated netconf definitions. src/org/freertr/user/userNetconf.java:87-139misc/netconf/global.txt:1-4 All generate some machine/reference artifacts, but Ze has source-level AI/command catalog generation.

Gaps and unclear items

Evidence appendix: platform, packaging, and appliance

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Build system Primary build tool Go Makefile with split modules and generated code: top-level phony targets and included modules in; build target depends on generate and binary targets in; individual Go build targets in. Makefile:1-10Makefile:80-91Makefile:94-123Makefile:124-186 Debian-oriented Makefile generates config/op XML templates and runs tests: XML source patterns and BUILD_ARCH in interface_definitions pipeline in op_mode_definitions in all target in deb target runs dpkg-buildpackage -uc -us -tc -b in. Makefile:1-14Makefile:29-54Makefile:56-76Makefile:86-88Makefile:129-130 ✕ Ze and VyOS use Make, but VyOS is a Debian package build and generated CLI layer. freeRtr is script-driven.
Build system Compile-time feature selection Ze build tags differentiate distro and appliance builds: ZE_FEATURES derives from feature-gates.txt in; distro binary uses ze_core ze_distro in; appliance binary uses ze_core ze_appliance in; stripped binary uses only ze_core ze_ssh in. Makefile:48-55Makefile:124-126Makefile:128-130Makefile:136-138 not found in inspected sources for equivalent compile-time product variants. VyOS uses package/dependency selection and XML generation, not source-level build tags in inspected files. not found in inspected sources for equivalent compile-time feature gates. Ze is the only inspected tree with explicit compile-out tags in the main build.
Build system Generated registries or schema artifacts Ze codegen for YANG glue and plugin imports in; plugin snapshots in. Makefile:97-103Makefile:109-113 VyOS transcludes XML and builds node templates and caches: scripts/transclude-template in build-command-templates and generate_cache.py in build-command-op-templates and generate_op_cache.py in. Makefile:18-25Makefile:34-40Makefile:58-64 not found in inspected sources. Ze and VyOS both generate runtime command/schema artifacts, but with different stacks.
Packaging Native package output not found in inspected sources for .deb or .rpm packaging. Ze local install copies binary to prefix instead, per. docs/guide/ze-install.md:3-28 Debian packaging present. declares source package and build dependencies; Package: vyos-1x and Architecture: amd64 arm64; /etc, /usr/bin, /usr/libexec/vyos, /usr/share, etc.; deb. debian/control:1-36debian/control:50-51debian/vyos-1x.install:1-46Makefile:129-130 Full Debian package sources present: (Source freerouter, build-deps, two binary packages freerouter/freerouter-native), (debhelper dh. --with=javahelper --with=systemd --with=sysuser), plus changelog/compat/*.install/*.postinst/*.service/*.sysuser, mirrored in. The in-tree shell build (binDwn/binDsk/binImg/binOut/binTmp) does not invoke them. misc/debian1/control:1-38misc/debian1/rules:1-14misc/debian2/readme.md:54-60 VyOS and freeRtr both carry complete Debian packaging; freeRtr's is Debian-maintainer packaging not wired into its own shell build.
Packaging Jar or archive packaging not applicable, not found in inspected sources. not applicable, not found in inspected sources. normalizes timestamps with touch -d "2010-01-01 00:00:00", and creates rtr.jar with zip. verifies the main archive and extra files. src/cp.sh:1-12META-INF/MANIFEST.MFuserUpgrade.java:253-285 freeRtr's Java distribution artifact is first class in inspected source.
Image generation Appliance disk image defines gokrazy instance, arch, raw image path, image size, and /perm offsets; builds image with bin/gok overwrite, formats /perm, and injects database.zefs; gokrazy/ directory contains ze/config.json, ze/ze.conf, builddir, modcache, and kernel files. mk/gokrazy.mk:35-43mk/gokrazy.mk:68-113 ISO image generation itself is delegated to vyos-build: says use vyos-build to build an image, and CI calls ./build-vyos-image --architecture amd64. generic in. README.md:8-10.github/workflows/package-smoketest.yml:167-180 Demo VM image creator exists: misc/image is a demo VM ISO creator and misc/img2ova is OVA creator. selects Debian packages and excludes large subsystems; assembles kernel/initrd/rootfs artifacts. readme.md:89-90misc/image/image.beg:1-40misc/image/image.end:1-54 Ze has source-local image generation. VyOS image generation is in a sibling repo, with this root contributing packages and tests. freeRtr has demo image recipes.
Image generation Installer ISO ze-iso flow initializes appliance, builds installer kernel, initrd, disk image, and ISO; ze-iso-build; describes bare-metal flow and disk image output. mk/appliance.mk:42-72mk/appliance.mk:83-99docs/guide/ze-install.md:98-141 This root exposes install/add image commands, not ISO builder internals. CI builds a custom ISO through vyos-build in. .github/workflows/package-smoketest.yml:167-180 java -jar rtr.jar test image. image.dsk and image.gns; image finalization in. misc/image/ci.sh:1-3misc/image/image.end:1-54 Ze ISO builder is in-tree. VyOS ISO builder is external. freeRtr image recipes use router test image commands.
Image generation Installer initrd and kernel documents building installer kernel and initrd for target arch, and profiles qemu versus hardware; appliance kernel, appliance initrd; ze-installer for linux amd64 and arm64; GOOS=linux, CGO_ENABLED=0, arch from GOARCH or runtime.GOARCH, and ze_installer tag at lines 73-76, 122-155. docs/guide/ze-install.md:122-142mk/appliance.mk:86-90mk/appliance.mk:101-104internal/appliance/cmd_initrd.go Installer uses the live ISO squashfs and boot files: filesystem.squashfs; install flow copies boot files and squashfs in 1029-1033. src/op_mode/image_installer.py:143-145/boot/ moves boot kernel to %img%.krn, creates cpio initrd, compresses with zstd, and wraps with wraplinux; linux-image-%kern%, busybox, udev, kmod and libs. misc/image/image.end:1-54misc/image/image.beg:57-66 Ze's installer is a Go initrd path. VyOS uses live ISO rootfs installation. freeRtr demo image creates custom initrd artifacts.
Installer Local install to host OS ze install local copies the running binary to <prefix>/bin/ze, creates config dir if needed, and supports /usr/local, /usr, /opt/ze. docs/guide/ze-install.md:3-28 install image for installing VyOS to hard drive, backed by image_installer.py --action install. op-mode-definitions/system-image.xml.in:108-118 installs into a target directory, writes rtr.jar, rtr.ver, native binaries and .so files. misc/service/c.sh:1-120/etc/init.d/rtr/lib/systemd/system/rtr.service Ze local install is daemon-oriented. VyOS installer is appliance OS install. freeRtr service installer modifies the host.
Installer Disk partitioning and filesystem install Ze docs describe the installer writing a disk image with a QEMU test verifying boot/SSH. docs/guide/ze-install.md:98-220 creates partitions after disk cleanup; single-disk flow creates EFI and ext4 filesystems in 413-418; install target mounting and config/squashfs copy in 999-1037; GRUB install in 1054-1078. image_installer.py:232-250 freeRtr partitions and formats a disk during image build: (qemu-img create, sfdisk < native.sfdsk, mkfs.ext3, extlinux via guestfish) with the partition table in even formats a physical device. What is absent is an interactive guided installer. is a host service installer. misc/image/image.dsk:27-32misc/image/native.sfdskmisc/image/burn2usb.shmisc/service/c.sh:1-116 VyOS has the most detailed interactive disk installer in inspected source; Ze's flow is established by its docs and Make/QEMU targets.
Installer RAID install not found in inspected sources. RAID prompts and creation in image_installer.py: messages 96-100, check_raid_install 422-490, raid_create, update_initramfs, ext4 on RAID, and GRUB modules/install 1042-1074. not found in inspected sources. VyOS only.
Boot/update Multi-image boot management not found in inspected Ze sources for boot menu multi-image management. Ze has an update backend with a rollback method, but no boot-menu multi-image management. add system image, set system image default-boot, delete system image, rename system image, and show system image; image_installer.py sets GRUB default in 1054-1059. op-mode-definitions/system-image.xml.in:1-220 not found in inspected sources for boot menu multi-image management. VyOS has first-class installed image management.
Boot/update Upgrade download, signature or hash verification Ze self-update downloads (500 MB cap) and verifies a SHA256 hash: (crypto/sha256, downloadSHA256, download/verify/stage/restart) with selfupdate_validate.go; ze-self-update and gokrazy-ab backends with Check, Download, Apply, Rollback, History; command catalog lists show/update firmware operations. internal/component/config/system/selfupdate.gobackend.go:15-74docs/architecture/api/commands.md:185-189 fetches local or remote ISO, supports latest, downloads minisign signature, calls validate_signature when available, and warns/prompts if absent; compatibility checks in. image_installer.py:704-760image_installer.py:886-929 verifies release info, archive, and file hashes; downloads to temp, checks hash before and after rename; signature verification in. userUpgrade.java:253-285userUpgrade.java:705-727userUpgrade.java:1010-1028 All three verify downloads: Ze by SHA256 hash, VyOS by minisign signature, freeRtr by release/file hash.
Boot/update Rollback or auto-revert UpdateBackend includes Rollback (FirmwareResult, error) in NewBackend switches to gokrazy A/B for gokrazy at. internal/component/config/system/backend.go:62-74backend.go:96-107 VyOS auto-reverts to the previously-booted image on a failed upgrade boot: system option reboot-on-upgrade-failure, and on failed config load re-sets the previous image as default boot (image_manager.py --action set) and reboots; the previous image is recorded by the installer at. It can also keep older images and set default boot via. src/init/vyos-router:641-664image_installer.py:1253, :1278system-image.xml.in:84-101 doRevert by renaming .bak back and doBackup; auto-revert flow in starts a reverter thread after boot and calls doAutoRevert; config knobs found in. userUpgrade.java:340-359userUpgrade.java:362-437userUpgrade.java:737-777cfgAll.java:1064-1080userConfig.java:523-529userConfig.java:3593-3617 freeRtr has the clearest explicit auto-revert in inspected code. Ze has a gokrazy A/B backend (Check/Download/Apply/Restart) alongside ze-self-update. internal/component/config/system/backend_gokrazy.go
Boot/update Upgrade compatibility checks Ze: not found in inspected sources beyond backend selection. VyOS checks architecture and flavor: error constants in; current/new version read and compared in; current arch falls back to dpkg --print-architecture at line 894. image_installer.py:85-89image_installer.py:886-929 freeRtr release blob signature/hash verifies package contents, but CPU/platform compatibility checks were not found in inspected userUpgrade.java. VyOS only for explicit arch/flavor checks.
OS integration systemd support ze install systemd and the generated unit, including ExecStart=<prefix>/bin/ze start, restart policy, ZE_CONFIG_DIR, XDG_RUNTIME_DIR, capabilities, RuntimeDirectory=ze. Doctor checks validate systemd unit and skip gokrazy/container: in 217-260, 901-918. docs/guide/ze-install.md:31-94internal/component/doctor/checks_platform.go:128-147 Debian dependencies include systemd in etc/systemd; many op-mode commands restart services with systemctl, e.g.; container conf writes under /run/systemd/system at. debian/control:82-93debian/vyos-1x.install:1-21src/op_mode/restart.py:139-144src/conf_mode/container.py:58 Systemd units in, reloads systemd, unmasks and enables rtr. misc/debian1/freerouter.service:1-27misc/debian2/freerouter-native@.service:1-29misc/service/c.sh:61-95/lib/systemd/system/rtr.service All three support systemd in some mode. Ze also explicitly supports non-systemd gokrazy.
OS integration Non-systemd appliance mode The gokrazy appliance runtime is kernel, gokrazy init, and Ze, with no systemd, no package manager, and no general shell: builds a gokrazy image and injects /perm. mk/gokrazy.mk:68-113 not found in inspected sources. VyOS uses Debian/systemd as a base in inspected package dependencies. also writes SysV init script; however it still uses systemd later in. Dedicated non-systemd appliance mode not found. misc/service/c.sh:21-59/etc/init.d/rtrmisc/service/c.sh:61-95 Ze is source-grounded as gokrazy appliance. freeRtr has SysV script compatibility, not a standalone no-systemd OS claim.
OS integration Runtime platform detection PlatformType and PlatformInfo with gokrazy, systemd, container, plain-linux, darwin and capability fields; show system platform. internal/component/host/inventory.go:320-391ze-cli-show-cmd.yang:55-70 UEFI detection helper in; image installer reads serial console flavor and kernel cmdline in 150-158, 622-660; hardware/interface detection include lspci. python/vyos/utils/boot.py:37-39src/op_mode/interfaces.py:343-349show_sensors.py:24-41show_usb_serial.py:20-50 Platform descriptor files under, e.g. defines arch, qemu, Debian arch, kernel, grub, boot, UEFI, image output. Runtime hardware detection script generated by captures serial, interfaces and routes and runs java -jar. test hwdet. misc/image/platform.*platform.mips32:1-8misc/service/c.sh:111-118 Ze has runtime platform taxonomy. VyOS has hardware/boot helpers. freeRtr has image platform descriptors and generated hwdet scripts.
OS integration Environment/runtime config Ze caches build in repo and runtime socket location: GOCACHE, GOLANGCI_LINT_CACHE, CGO_ENABLED=0; ZE_CONFIG_DIR and XDG_RUNTIME_DIR; in show socket path resolution order. Appliance init uses env password/passphrase keys, 236-257, 374-376. Makefile:13-16docs/guide/ze-install.md:58-71internal/component/config/environment.go:244-255cmd_init.go:26-32 VyOS uses environment variables for installer credentials passed to download scripts; config defaults in include reboot-on-upgrade-failure and syslog defaults. image_installer.py:692-703data/config.boot.default:43-52 Docker entrypoint uses ENV FREERTR_HOSTNAME and FREERTR_INTF_LIST in consumes those flags and starts Java. misc/docker/Dockerfile:32-35misc/docker/scripts/freertr.sh:1-83 All three have env/runtime config, but Ze's env registry is more typed.
Kernel/sysctl Kernel command line tuning Ze runtime/installer kernel build and profiles are present in; custom runtime kernel build comments in; QEMU runtime kernel tests in. Specific sysctl defaults are not enumerated here. docs/guide/ze-install.md:122-142mk/gokrazy.mk:162-193mk/test-integration.mk:334-360 VyOS maps config options to GRUB kernel cmdline: image_installer.py 532-576 include mitigations, power saving, panic, CPU isolate/nohz/rcu_nocbs/NMI watchdog; the runtime counterpart renders the same cmdline in. src/conf_mode/system_option.py:307-369 net.ipv6.conf.*.disable_ipv6=1 and kernel.panic=10, and edits /etc/default/grub to add panic=10 nomodeset nofb and lower timeout. misc/service/c.sh:10-15 VyOS and freeRtr have direct kernel/sysctl tuning evidence. Ze has kernel build evidence and a runtime sysctl component. internal/component/sysctl/
Kernel/sysctl Runtime sysctl management Ze has a runtime sysctl component: (registers the component with set/applied events and a CLI handler) and (writes /proc/sys). internal/component/sysctl/register.gointernal/component/sysctl/backend_linux.go system sysctl, renders sysctl -f; dependency graph has sysctl dependencies in 100-112. src/conf_mode/system_sysctl.py:19-63/run/sysctl/99-vyos-sysctl.confdata/config-mode-dependencies/vyos-1x.json writes sysctl files. No dynamic CLI sysctl manager found in inspected sources. misc/service/c.sh:10-12 Ze and VyOS both manage runtime sysctls; freeRtr writes sysctl files at install time.
Container support Build or runtime container image ze-docker, building docker/Dockerfile with version/build date args and optional tags. Host inventory exposes a container platform type. Makefile:202-220 VyOS package-smoketest runs inside privileged container with sysctl option; runtime podman containers configured by; package deps include many container-related tools elsewhere in debian/control, but podman dep line not in the read segment. .github/workflows/package-smoketest.yml:129-132src/conf_mode/container.py:1-223 builds Debian-based freeRtr container, installs JRE, DPDK, OVS, downloads router artifacts, sets env and CMD; configures interfaces and starts router. misc/docker/Dockerfile:1-29misc/docker/scripts/freertr.sh:1-83 All three have container evidence. VyOS supports configured runtime containers; freeRtr and Ze have project container images/builds.
Container support Managed guest containers not found in inspected Ze sources. /run/systemd/system; discovers config and restart lists; validates images, networks, CPU quota, devices, sysctls; warning about shared container storage across VyOS images in. src/conf_mode/container.py:58container.py:52-90container.py:99-223container.py:131-140 not found in inspected sources. VyOS only for router-managed containers.
Provisioning PXE or remote provisioning ze install remote with DHCP/PXE, TFTP, HTTP image server, iPXE chainloading, generated boot script, and credential database.zefs; stages PXE boot files and builds iPXE binaries. docs/guide/ze-install.md:144-193mk/appliance.mk:106-130 not found in inspected vyos-1x sources. VyOS installer can fetch remote images by URL/VRF in, but no PXE provisioning server found. image_installer.py:692-760 not found in inspected sources. Ze only in inspected sources.
Provisioning Init/bootstrap database or seed config Ze creates or reuses database.zefs, writes SSH/TLS credentials and template config; 111-116 write credential keys and 209-223 append environment listener overrides. mk/gokrazy.mk:72-104internal/appliance/cmd_assemble.go VyOS install creates target config dir, copies config, configures auth and serial console, touches .vyatta_config, 1011-1022; default boot config exists at. data/config.boot.default:43-52 Docker script starts with run/<hostname>-hw.txt and run/<hostname>-sw.txt in; service installer copies default.cfg to rtr-sw.txt and runs hwdet in. misc/docker/run/freertr-hw.txt, freertr-sw.txtmisc/docker/scripts/freertr.sh:49-54misc/service/c.sh:107-118 All three have bootstrap/config seed paths.
Crash reporting Crash reporting or crash inspection Ze offline show crashes is described in, the systemd unit sets LimitCORE=infinity in, and the implementation is in (crashlog.go, persist.go, list.go). docs/architecture/api/commands.md:100-109docs/guide/ze-install.md:60-66internal/core/crashlog/ not found in inspected sources for a dedicated crash reporting feature. Tech-support report collection exists but not crash reporting. not found in inspected sources for crash reporting. userUpgradeRevert catches and logs tracebacks in, but not crash reporting. userUpgrade.java:771-775 Ze has crash capture and inspection in. internal/core/crashlog/
Testing harness Unit and functional tests tied to build Ze has unit, functional, fuzz, chaos, mutation, release and integration modules included in; unit target in; functional suites including install in; release preflight in. Makefile:80-91mk/test-unit.mk:31-49mk/test-functional.mk:52-55mk/test-release.mk:83-86 runs compileall and nose2; lists test dependencies. Makefile:105-107debian/control:24-35smoketest/scripts/system/test_kernel_options.py, test_module_load.pysmoketest/scripts/cli/test_system*.py selftest and examples tw.sh, twd.sh; cfg/ contains self tests per; CodeQL workflow builds Java with. readme.md:89-112, t.shreadme.md:36-40src/d.shsrc/cj.sh.github/workflows/codeql.yml:59-66 All have tests, but Ze and VyOS have more formal build/test integration in inspected files.
Testing harness Image/QEMU tests Ze has QEMU and image installer targets: ze-qemu-integration-test, FRR interop QEMU, installer QEMU, ISO QEMU, scenarios, Ventoy, L2TP/PPPoE runtime kernel, traffic usage; boots gokrazy image in x86_64 or aarch64 QEMU. mk/test-integration.mk:260-360mk/gokrazy.mk:119-159 CI builds ISO and passes to test jobs; builds and uploads ISO. README says runtime tests execute inside QEMU and smoketests are placed into vyos-1x-smoketest. .github/workflows/package-smoketest.yml:167-193README.md:70-72 rtr.jar test image for dsk and gns image recipes; lists image/test output dirs; defines qemu target. misc/image/ci.sh:1-3readme.md:36-44platform.mips32:1-8 Ze has the richest QEMU matrix in inspected source.
Cross-compilation and architecture Target architectures Ze installer is built for linux/amd64 and linux/arm64 in; gokrazy arch defaults to amd64 and supports amd64/arm64 QEMU run in 119-159; kernel target only accepts amd64 or arm64 in GOARCH or runtime.GOARCH and GOOS=linux in 122-155. mk/appliance.mk:101-104mk/gokrazy.mk:35-47mk/gokrazy.mk:190-193cmd_initrd.go:73-76 Debian package Architecture: amd64 arm64 in; CI ISO build passes --architecture amd64 in; installer compatibility compares current/new architecture in. debian/control:38-43.github/workflows/package-smoketest.yml:167-176image_installer.py:886-929 shows mips32/mipsel descriptors; many files; Docker pulls rtr-$(uname -m).tgz in; native dependencies are documented in. misc/image/platform.mips32:1-8misc/image/platform.*misc/docker/Dockerfile:15-18readme.md:28-35 Ze and VyOS explicitly support amd64/arm64 in inspected build/package files. freeRtr image descriptors show broader platform concept, with at least mips32 read.
Distro integration Debian base/package integration not found in inspected sources for Debian packages, but Ze can install to standard Linux prefixes and systemd per. docs/guide/ze-install.md:3-94 Strong Debian integration: declares source/build/runtime deps; builds Debian package; install list in; image installer uses dpkg --print-architecture fallback at. debian/control:1-223Makefile:129-130debian/vyos-1x.install:1-21image_installer.py:892-895 Dockerfile and image recipes use Debian. FROM debian and installs Debian packages; reads Debian catalogs and selects Debian packages; says up-to-date Debian sid and JDK are needed. misc/docker/Dockerfile:1-7misc/image/image.beg:3-40readme.md:37 VyOS is the most Debian-integrated as a package. freeRtr uses Debian for images/containers. Ze is distro-neutral binary/systemd install.
Appliance mode Router appliance behavior Ze gokrazy appliance image is first class via; install guide builds disk image with TLS, SSH credentials and seed config baked into /perm zefs. mk/gokrazy.mk:68-113docs/guide/ze-install.md:132-141 VyOS is a router OS image managed as live/installable images; default config includes system option reboot-on-upgrade-failure in. system-image.xml.in:1-220image_installer.py:929-1080data/config.boot.default:43-45 freeRtr service/image scripts aim at router appliance behavior: disables network managers, sets default target, creates router service, masks services; creates initrd and default config. misc/service/c.sh:10-95misc/image/image.end:37-54 All can be appliance-like, but Ze and VyOS have clearer end-to-end image/install flows in inspected source.

Gaps and unclear items

Item Status
Ze self-update and gokrazy A/B implementation Present. selfupdate.go (download + SHA256 verify), backend_gokrazy.go (A/B Check/Download/Apply/Restart), and backend_ze_appliance.go/backend_ze_distro.go in. internal/component/config/system/
Ze sysctl implementation Present. Runtime sysctl component at /backend_darwin.go, and sysctl.go. internal/component/sysctl/, register.go, backend_linux.go
Ze crash reporting implementation Present. Crash capture, persistence and listing in (crashlog.go, persist.go, list.go, stderr.go). internal/core/crashlog/
VyOS image generation internals Not in this root. CI and README point to vyos-build, and this root builds vyos-1x packages plus smoketest package. Image builder internals live in vyos-build, outside this root.
VyOS upgrade rollback Present. Automatic revert to the previous image on a failed upgrade boot at (driven by system option reboot-on-upgrade-failure). src/init/vyos-router:641-664
VyOS dedicated crash reporting Not found in inspected sources.
freeRtr package build metadata Full Debian package sources present at, though not wired into the in-tree shell build. misc/debian1/{control,rules,changelog,*.install}misc/debian2/
freeRtr installer partitioning Image-build disk partitioning + filesystem + bootloader exist; no interactive target-disk installer. misc/image/image.dsk:27-32, native.sfdsk, burn2usb.sh
freeRtr systemd versus init Both SysV init and systemd setup are in, plus Debian systemd units. No dedicated no-systemd appliance OS was found. misc/service/c.sh
freeRtr crash reporting Not found in inspected sources.
freeRtr runtime container orchestration Docker image exists, but router-managed guest/container support was not found.

Evidence appendix: observability, diagnostics, and testing

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Metrics Native metrics registry and Prometheus endpoint Prometheus metrics exposed by telemetry { prometheus {. } }, default /metrics, BGP refreshed every 10s, docs; HTTP exporter handles configured path via registry.Handler and health endpoint via health.DefaultRegistry.Handler. 127.0.0.1:9273docs/guide/monitoring.md:117-163internal/component/telemetry/exporter/server.go:87-106 Prometheus integration is via external exporters: node_exporter, frr_exporter, blackbox_exporter, built from config paths and rendered as systemd services. src/conf_mode/service_monitoring_prometheus.py:47-82, :119-151, :153-199 Built-in Prometheus server default port 9001, configured metric sensors and all-metrics; global Prometheus daemon list in cfgAll. src/org/freertr/serv/servPrometheus.java:35-71, :98-127src/org/freertr/cfg/cfgAll.java:647-650 Ze and freeRtr have in-process exporters. VyOS delegates to common exporter daemons.
Metrics OS metrics Netdata-compatible OS collector metrics, 138 metrics, /proc and /sys sources; exporter config distinguishes Netdata-compatible OS metrics from Ze-native ze_*. docs/guide/monitoring.md:183-220internal/component/telemetry/exporter/server.go:45-63 node_exporter configured by service monitoring prometheus node-exporter, service render/restart in. src/conf_mode/service_monitoring_prometheus.py:53-61, :119-139, :189-195 Sensor framework can execute commands and define metric columns, local memory/file collection, directories. src/org/freertr/cfg/cfgSensor.java:155-180, :216-263misc/sensor/misc/prometheus/ Ze docs explicitly call out Netdata compatibility. freeRtr is highly generic sensor-driven.
Telemetry Streaming telemetry not found in inspected sources for a full external streaming telemetry protocol beyond Prometheus and event streams. Telegraf config exports to InfluxDB, Prometheus client, Azure Data Explorer, Loki, Splunk and renders telegraf plus rsyslog integration. src/conf_mode/service_monitoring_telegraf.py:70-120, :122-183, :184-223 Streaming telemetry destinations export sensors to target/port with intervals, delays, randomization, time ranges and proxy; client sends sensor reports and warns on empty reports. src/org/freertr/cfg/cfgTlmtry.java:60-108, :120-207src/org/freertr/clnt/clntTelemetry.java:155-163 VyOS and freeRtr have stronger source evidence for push telemetry than Ze in inspected source.
Dashboards Live dashboard or dashboard config Live BGP peer dashboard via ze cli -c "monitor bgp", auto-refreshing peer table; web workbench dashboard tests and pages found under. docs/guide/monitoring.md:5-14internal/component/web/workbench_dashboard_test.go, page_logs.go not found in inspected sources for a native dashboard framework. Configurable dashboard object with command and sensor cells, misc/trackmap as web based monitoring. src/org/freertr/cfg/cfgDshbrd.java:18-26, :81-95, :283-331readme.md:75-86 Ze has an operator CLI dashboard. freeRtr has configurable dashboards.
Health checks HTTP health endpoint Prometheus HTTP service registers /health unless metrics path is /health; docs state Basic Auth protects metrics and health endpoints. internal/component/telemetry/exporter/server.go:98-106docs/guide/monitoring.md:164-181 Health checks are feature-specific: container health command/interval/timeout/retry; VRRP health check validation for script/ping; WAN load-balancing interface health tests. src/conf_mode/container.py:482-498src/conf_mode/high-availability.py:177-197src/conf_mode/load-balancing_wan.py:67-82 not found in inspected sources as a generic HTTP /health endpoint. Watchdog show commands exist. src/org/freertr/user/userShow.java:659-682 Ze has a generic service health endpoint. VyOS has config health checks. freeRtr has watchdog/process diagnostics.
Doctor and diagnostics Doctor framework Registry supports phases pre-config, missing-config, post-config, platform filtering, dependencies, codes, validation and duplicate checking; appliance doctor checks registered for kernel/initrd/grub/xorriso/e2fsprogs. internal/core/diagnostic/doctor_registry.go:19-57, :59-87, :101-160internal/appliance/doctor_checks.go:15-66 ✕ ✕ Ze is strongest for first-class doctor checks.
Diagnostics Symptom-based operational diagnostics Production diagnostics guide maps symptoms to built-in commands: TCP check, traceroute, kernel log, CPU profile, heap profile, FDs, goroutines, DNS, ping, netlink, capture; detailed BGP, CPU, memory, FD and goroutine workflows, :26-136; platform limitations for /proc commands, :238-243. docs/guide/production-diagnostics.md:1-24 Tech-support report gathers version, uptime, load, CPU, process stats, storage, devices, memory, config, routes, protocols, neighbor tables, nftables, connections and logs; report runner executes command sections and writes stdout or files. src/op_mode/tech_support.py:293-401src/op_mode/show_techsupport_report.py:75-121, :142-205 show platform prints uptime, pid, config files, class, CPU and memory, show process cpu, show watchdog gc/thread/iface/memory, show logging process, and show sensor handlers appear in. src/org/freertr/cfg/cfgInit.java:415-430src/org/freertr/user/userShow.java:536-543, :659-682, :691-717, :936 Ze diagnostics are command-focused and appliance-aware. VyOS tech support is broad collection. freeRtr has extensive show diagnostics.
Logs Structured logging Uses log/slog, per-subsystem env levels, backends stderr/stdout/syslog/kmsg, destination and relay settings, env registrations :37-46; subsystem descriptions include BGP, plugin, chaos, web, test, :56-109. internal/core/slogutil/slogutil.go:1-24 Logging wrapper supports syslog, stderr and rotating files; operational log command uses journalctl with boot, count, unit, since, UTC, reverse, raw JSON filters. python/vyos/logger.py:1-24, :37-98src/op_mode/log.py:22-49, :52-66 Logger supports levels, file, terminal, syslog, IRC, buffer, position format, stack trace dumps, and default logging config includes buffered, monitor, format, milliseconds. src/org/freertr/util/logger.java:26-110, :112-159src/org/freertr/cfg/cfgAll.java:1490-1495 All three have mature logging, but with different models.
Debug commands Runtime debug switches Debug command test files found for Ze under debug-invalid-subsystem.ci, debug-enable-show.ci; debug plugin source. Production diagnostics includes raw BGP capture commands. test/ui/debug-help.ciinternal/plugins/debug/debug.godocs/guide/production-diagnostics.md:42-69 Debug flags enabled by environment or files under /tmp and /config, registered flags developer, log, ifconfig, command; smoketest shim has and prints set/del/commit/op outputs. python/vyos/debug.py:21-49, :52-84, :101-135/tmp/vyos.smoketest.debugsmoketest/scripts/cli/base_vyostest_shim.py:43-50, :70-111 Debugger has hundreds of static flags by subsystem, including user commands and protocol/service traffic; Prometheus traffic debug logs rx/tx. src/org/freertr/util/debugger.java:12-80, :121-180src/org/freertr/serv/servPrometheus.java:165-166, :215-216 freeRtr exposes the broadest explicit debug flag surface in inspected code.
Crash and core support Panic/core/crash capture Crashlog captures stderr including Go panics, writes syslog and crash file; reports include time, version, build, commit, Go version, OS/arch, PID, goroutine count, uptime, command, stack trace and recent log, :102-199. internal/core/crashlog/crashlog.go:1-17, :38-59 Tech-support archive includes /var/core as core-dump, and /var/log, /run, config, etc.; debug developer flag says unhandled exceptions can drop into PDB. src/op_mode/generate_tech-support_archive.py:83-111python/vyos/debug.py:52-66 Uncaught JVM exception handler is installed; logger can dump stack traces. No support bundle style core archive found. src/org/freertr/cfg/cfgInit.java:604-608src/org/freertr/util/logger.java:112-159 Ze has first-class crash report files. VyOS archives core dumps. freeRtr catches/logs JVM exceptions.
MRT/BMP/log export MRT analysis and BMP export ze-analyze export bmp sends MRT BGP4MP records as BMP v3 route monitoring to a collector, parses target and peer filters :42-76, reads MRT and writes BMP frames :90-116; ze-analyze convert pcap/json, filter, inject, dump found in. internal/analyze/export_bmp.go:16-39internal/analyze/convert.go:17-30, :49-68, :81-109 BMP config validation in BGP checks that bgpd runs with bmp module and target address exists; NetFlow, sFlow and VPP IPFIX are present. MRT tooling not found in inspected sources. src/conf_mode/protocols_bgp.py:217-228src/conf_mode/system_flow-accounting.py:75-100src/conf_mode/system_sflow.py:41-84src/conf_mode/vpp_ipfix.py:32-41, :81-102, :171-174 BMP-to-MRT service documented in class comment as RFC 7854 BMP to RFC 6396 MRT toolkit; supports file output/rotation, listeners for BMP/RIS/BGP, relays and rate controls, :86-144, :166-223; config tests. src/org/freertr/serv/servBmp2mrt.java:24-31cfg/serv-bmp01.tstcfg/serv-bmp02.tst Ze has offline analysis and BMP export. freeRtr has an online BMP-to-MRT service. VyOS relies on FRR BMP plus flow exporters.
Packet capture and traffic diagnostics Packet capture Built-in capture commands in diagnostics include raw BGP capture, interface packet capture in text or pcap format; MRT convert to pcap. docs/guide/production-diagnostics.md:42-69internal/analyze/convert.go:17-30, :49-68 Interface dump completion reads tcpdump interfaces via tcpdump -D; bandwidth test uses iperf. src/completion/list_dumpable_interfaces.py:2-11src/op_mode/execute_bandwidth_test.sh:16-32 Tester supports capture option and emits packet capture <ifc>. pcap, and pcap test command, :2480-2482; readme lists misc/captures and misc/sniffer. src/org/freertr/user/userTester.java:906-914, :2422-2429readme.md:67-70 All have capture evidence, with Ze most integrated into diagnostic CLI docs.
Testing Unit tests Go unit tests throughout, group targets and full race target in; docs say all groups run with -race. mk/test-unit.mk:1-35, :37-55, :66-91docs/functional-tests.md:202-222 Makefile test compiles all Python and runs nose2, files. Makefile:104-107src/tests/test_*.py Source readme states cfg contains self tests and t.sh selftest, userTester is process image tester. readme.md:50-60, :98-99src/org/freertr/user/userTester.java:18-30 Ze has the clearest source-grounded unit target structure.
Testing Functional and smoke tests Functional release gate runs 18 suites: encode, plugin, parse, decode, reload, ui, editor, managed, l2tp, firewall, policy, ldp, rsvpte, isis, ospf, ospfv3, web, install; docs enumerate suites and non-gated suites. mk/test-functional.mk:47-86docs/functional-tests.md:1-49, :51-71, :139-199 Runtime tests are QEMU-based smoketests in smoketest, README says QEMU CI and vyos-1x-smoketest package; smoketest shim snapshots/restores config and checks FRR mgmtd continuity; workflow builds ISO and runs CLI smoketests. README.md:70-72smoketest/scripts/cli/base_vyostest_shim.py:31-41, :52-68.github/workflows/package-smoketest.yml:166-183, :192-218 userTester supports parallel workers, retries, result tracking, summaries, HTML/CSV/FTR, binTmp output of testing. src/org/freertr/user/userTester.java:96-103, :170-180, :1098-1146, :1167-1185readme.md:55-60 Ze and VyOS both have explicit release/smoke gates. freeRtr has a custom test harness.
Testing Topology and interop tests Docker interop against FRR, BIRD, GoBGP, ExaBGP, scenario orchestration, container lifecycle, 97 scenarios, and BGP, IS-IS, OSPF coverage; Make targets for interop and IPsec interop. docs/architecture/testing/interop.md:1-16, :29-53, :97-113, :167-186mk/test-integration.mk:35-50 GitHub workflow builds a custom ISO and runs smoketests in containers with privileged options; VPP smoketest and config-load jobs, :225-252, :325-352. Topology/interop beyond QEMU/VPP smoketest not found in inspected vyos-1x source. .github/workflows/package-smoketest.yml:150-183, :192-218 Readme says img VM images are used for interop and dataplane testing; tester can launch multiple routers with generated ports and captures, selftest/topology scripts and. readme.md:55-60src/org/freertr/user/userTester.java:36-48, :1437-1440, :2422-2429src/t*.shcfg/*.tst Ze has most explicit source docs for third-party interop.
Performance Benchmarks and performance tools ze-perf BGP propagation benchmark with sender/DUT/receiver, modes, repeats/warmups, outlier removal, JSON/HTML/MD reporting and regression checks, bin/ze-perf; perf targets in. docs/guide/benchmarking.md:1-37, :39-94, :96-146, :148-221Makefile:145-148, :184-187mk/perf.mk:1-22 Bandwidth test wraps iperf, choosing IPv6 option based on address/FQDN; no benchmark harness found in inspected sources. src/op_mode/execute_bandwidth_test.sh:16-32 Native dataplane benchmark script runs p4bench.bin for IPv4, IPv6, VLAN, PPPoE, MPLS, misc/tests as volumetric generators and native dataplanes. misc/native/p4emu_bench.sh:1-13readme.md:64-85 Ze has most complete benchmark and regression tooling.
CI helpers Verify, status, release evidence ze-verify writes, per-stage logs, failure logs JSON, status fingerprint, ze-verify and smoke target; release-check via clean Docker. tmp/ze-verify.logdocs/functional-tests.md:9-24Makefile:261-264, :318-321docs/functional-tests.md:72-84mk/test-integration.mk:93-112 Make all includes pylint, tests, j2lint, XML definitions, OCaml; GitHub workflow builds ISO, uploads artifact, runs smoketests and comments. Makefile:86-87.github/workflows/package-smoketest.yml:150-183, :192-223, :225-255 Shell scripts c.sh, r.sh, t.sh for compile/run/selftest; tester writes summaries and result files. readme.md:95-99userTester.java:1138-1185 Ze and VyOS have more explicit CI helper evidence in inspected source.
Lint and static gates Lint gates .golangci.yml enables diagnostic, style, performance gocritic tags, many linters, and forbids legacy log package, ze-lint in smoke, installs golangci-lint and agent-browser. .golangci.yml:54-85, :105-108, :156-165MakefileMakefile:318-319.woodpecker/verify.yml.woodpecker/verify.yml:13-17 Makefile pylint and j2lint; GitHub reusable darker/ruff lint workflow. Makefile:115-127.github/workflows/darker-ruff-lint.yml:1-13 freeRtr runs CodeQL static-analysis code-scanning on push/PR and weekly cron for C/Java/Python. No style linter was found; the readme notes shell-script builds only. .github/workflows/codeql.yml:20-45, :69-72readme.md:95-99 VyOS and Ze have visible lint/static gates.
Mutation testing Mutation gomu mutation testing advisory targets, changed-only, package, JSON/HTML reports, .gomuignore excludes build-tagged/platform paths. mk/test-mutation.mk:1-18, :20-61, :63-126, :128-143.gomuignore:1-18 not found in inspected sources. not found in inspected sources. Ze only.
Support bundles Support bundle or archive ✕ generate tech-support archive saves tech-support reports, archives /etc, /home, /var/log, /root, /tmp, /var/core, config and /run, syncs/flushes journal, rotates old tmp archives; can upload to. src/op_mode/generate_tech-support_archive.py:36-46, :48-111, :201-223ftp://scp://, :208-211, :244-251 not found in inspected sources. VyOS is strongest for support bundles.

Gaps and unclear items

Evidence appendix: architecture, extensibility, and implementation model

Feature inventory

Area Feature Ze evidence VyOS evidence freeRtr evidence Notes
Implementation language and runtime Primary implementation language/runtime Go module declares module codeberg.org/thomas-mangin/ze and go 1.26 in. go.mod:1-3 Python is first-class: python3 (>= 3.10), and conf mode scripts are Python, for example shebang. OCaml helper package exists in, and C/lib build dependencies are listed in. debian/control:11src/conf_mode/protocols_bgp.py:1src/ocaml/vyos-1x.opam:1-18debian/control:7-15 Java entry point, plus source package tree under src/org/freertr. Build scripts call Java/JAR paths, for example java -jar. rtr.jar. src/org/freertr/router.java:1-19misc/docker/scripts/freertr.sh:51 [analysis] Ze is a compiled Go daemon with internal Go packages and external Go SDK. VyOS is a Debian/Linux integration layer built around Python scripts, XML schemas, C/OCaml helpers, and system packages. freeRtr is an in-process Java router with optional native-image packaging.
Dependency model Language and system dependencies lists direct Go dependencies including Bubble Tea, goyang, nftables, DHCP, DNS, Prometheus, netlink, govpp, WireGuard control, gRPC/protobuf. go.mod:5-28 lists build deps, including gcc, libzmq3-dev, Python libs, protobuf compiler, lxml, xmltodict. Runtime depends on system packages and Python libraries in. debian/control:5-38debian/control:45-87 ✕ [analysis] Ze has explicit module-managed dependencies. VyOS depends heavily on distribution packages and external daemons/libraries. freeRtr appears self-contained in inspected Java sources, with fewer package-manager dependency boundaries.
Modularity Top-level modularity shape Components and plugins are split under, discovered by registries and generated imports. Generated import root states it imports plugins and schema packages to trigger init registration in. internal/component/internal/plugins/internal/component/plugin/all/all.go:1-8 Each feature is typically an XML definition plus a conf mode script. protocols bgp to, with priority at :6. interface-definitions/protocols_bgp.xml.in:3${vyos_conf_scripts_dir}/protocols_bgp.py Static global registries in cfgAll: routers at, interfaces and policy objects around :224-361, service daemon lists around :379-500. src/org/freertr/cfg/cfgAll.java:229-230 [analysis] Ze modularity is registry and generated composition-root based. VyOS modularity is command-owner/script based. freeRtr modularity is class/package based but centrally anchored in global registries.
Plugin/component model Internal plugins and external plugins PluginConfig includes Run, Encoder, Respawn, WorkDir, ReceiveUpdate, StageTimeout, and Internal fields in. Plugin YANG has plugin internal and plugin external lists in. internal/component/plugin/types.go:187-203internal/component/plugin/yang/ze-plugin-conf.yang:62-115 ✕ ✕ [analysis] Ze has the richest plugin boundary, including external processes. VyOS supports feature extension at package/script/schema level, but not a generic third-party plugin API in inspected sources. freeRtr extension likely requires source changes and recompilation.
Registration patterns Startup and command registration Ze plugin command registry validates names, blocks built-in shadowing, and records owning process in. Static plugin registers by init with registry.Registration in. internal/component/plugin/server/command_registry.go:147-208internal/plugins/static/register.go:37-68 XML owner and priority drive CLI generation, as shown by. Runtime dependencies call script lifecycle functions dynamically in. interface-definitions/protocols_bgp.xml.in:3-6python/vyos/configdep.py:98-116 Service registry uses find(create) to add entries and call srvInitialize in del calls srvDeinit in :59-72. Global service lists are hard-coded fields in. serv/servGenList.java:31-57cfgAll.java:379-500 [analysis] Ze and freeRtr both use explicit registration, but Ze has declarative metadata and process ownership while freeRtr uses generic typed lists plus central switch/entry maps. VyOS registration is mostly data-driven by XML and script filenames.
Generated composition roots Generated imports or command lists is generated by and imports all internal plugins/schema packages. Makefile exposes ze-regen and ze-regen-check in. internal/component/plugin/all/all.go:1-8scripts/codegen/plugin_imports.goMakefile:360-368 generates XML templates and reftree cache. src/conf_mode. generates activation lists. Makefile:29-40scripts/generate-configd-include-json.py:1-31data/configd-include.jsonscripts/generate-activation-scripts-json.py:17-35 ✕ [analysis] Ze and VyOS rely on generated composition/index artifacts to keep large feature sets wired. freeRtr appears to rely more on manually maintained Java registries.
Schema generation and validation Schema source and validation model YANG validator uses, maps config prefixes to modules in :153-180, and validates YANG types in :205-223. github.com/openconfig/goyang/pkg/yanginternal/component/config/yang/validator.go:7-13 XML definitions are transcluded and converted to command templates by, then caches are generated by. The README confirms node.def files are generated from unified XML and schemas at. Makefile:24-40python/vyos/xml_ref/generate_cache.pyMakefile:40README.md:35-44 freeRtr generates YANG from its embedded CLI/help tree: userHelp.getYang, userNetconf.makeYang, exposed as CLI yangconfig/yangsensor; the help and defaults themselves are Java-embedded, for example cfgRtr.defaultF at servGenList.srvHelp at. user/userHelp.java:1249user/userNetconf.java:104user/userExec.java:3072-3075cfg/cfgRtr.java:211-228serv/servGenList.java:188-282 [analysis] Ze and VyOS have machine-checkable schema layers. freeRtr encodes schema/help in Java code, which keeps code and config close and generates external YANG on demand from that embedded schema.
Code generation protobuf and generated code Ze has API protobuf schema in ZeService and ZeConfigService; generated plugin aggregator in. includes grpc/protobuf. api/proto/ze.proto:1-40internal/component/plugin/all/all.go:1-8go.mod:26-28 VyOS uses XML to templates/cache generation and configd/activation JSON generation. lists the protobuf compiler for serialization functions; VyOS ships a protobuf-over-Unix-socket IPC client, not gRPC. Makefile:24-40Makefile:56-63scripts/generate-configd-include-json.py:1-31scripts/generate-activation-scripts-json.py:17-35debian/control:30-31python/vyos/proto/vyconf_client.py:16-86python/vyos/proto/vyconf_pb2.py Native/JAR release scripts found, but no code generation framework found in inspected Java sources. native-image. rel-jar.sh:1-6src/cb.sh:1-5 [analysis] Generated artifacts are central to Ze and VyOS maintainability. freeRtr maintainability leans on uniform Java coding conventions and central registries instead of generation, based on inspected files.
External SDKs and API boundaries SDK/API offered to extensions Ze SDK package documents plugin communication over YANG RPC, net.Pipe for internal plugins, TLS for external, MuxConn, and five-stage startup in. Callback registry is in. pkg/plugin/sdk/sdk.go:1-30sdk.go:60-97 states Config is used internally by all config scripts and its API should be stable and safe for user scripts, but also notes it will not work outside VyOS at :21. python/vyos/config.py:17-20 ✕ [analysis] Ze explicitly exposes a plugin SDK boundary. VyOS exposes Python scripting APIs within a VyOS runtime. freeRtr exposes CLI/config and source-level Java classes, not a separate SDK in inspected sources.
API boundaries CLI, RPC, web, config Ze hub startup resolves web, looking glass, MCP, config file, env, and CLI precedence in; plugin server is created and registered as dispatcher/event bus in :422-454. Protobuf API includes Execute, Stream, ListCommands, DescribeCommand, Complete in. cmd/ze/hub/main.go:227-314api/proto/ze.proto:7-20 VyOS API boundary is command scripts and process execution. Conf mode script protocols_bgp.py uses get_config, verify, generate, apply, then main calls all four in. Process boundary uses subprocess.Popen wrapper in. src/conf_mode/protocols_bgp.py:596-611python/vyos/utils/process.py:35-104 freeRtr API boundary is mostly in-process CLI/config classes and services. Main entry cfgInit.doMain(args). servGeneric implements common service config and protocol flags in. router.java:15-18serv/servGeneric.java:44-154 [analysis] Ze centralizes API fan-in through hub/plugin server. VyOS distributes API behavior across per-feature scripts and system commands. freeRtr keeps APIs in a monolithic JVM object model.
Process model Daemon and child process model Ze cmdStart starts daemon or managed client, then calls hub.Run or hub.RunWithManagedClient in. ProcessManager starts plugin processes with context and stores them in a map in. cmd/ze/ze_core_start.go:176-221, :248-291manager.go:125-173 VyOS conf scripts are executable Python scripts with lifecycle functions and if __name__ == '__main__' path in. System services are managed via systemd commands, for example container.py systemctl calls in, HA reload at. protocols_bgp.py:604-611src/conf_mode/container.py:647-684high-availability.py:213-234 freeRtr runs in a JVM with an infinite management loop. cfgInit implements Runnable at, starts a thread via logger.startThread(this) in :1688-1696, and mainLoop runs forever in :1698-1724. cfg/cfgInit.java:61 [analysis] Ze owns its Go process and plugin subprocess lifecycle. VyOS delegates most long-running services to systemd or external daemons. freeRtr is a single long-lived in-process router with Java threads.
Daemon supervision Respawn and supervision Ze plugin manager enforces per-window respawn limit 5/60s and cumulative max 20 in Respawn disables processes and reports warnings at :311-390. manager.go:18-27 VyOS uses systemd for supervised services. Examples: container units rendered under /run/systemd/system and systemctl daemon-reload/restart in; HA keepalived systemd override and reload/restart in. container.py:633-684high-availability.py:40-234 freeRtr has its own periodic checks and exception logging in cfgInit.mainLoop at, but no systemd-like respawn mechanism found in inspected Java sources. Some config objects have start/stop methods, for example cfgXconn.start2run at. cfgInit.java:1698-1724cfgXconn.java:187-206 [analysis] Ze and freeRtr supervise from inside the application for their internal components. VyOS relies on the OS service manager for many dataplane/control daemons.
Protocol implementation model Own implementations vs external reuse Ze implements protocol engines/plugins in Go and also imports protocol-related libs for integration. Evidence: BGP plugin registration and SDK engine in; dependencies include, DHCP, netlink, govpp, WireGuard control in. internal/component/bgp/plugins/redistribute_egress/register.go:23-47github.com/miekg/dnsgo.mod:12-26 VyOS often renders external daemon configs and applies them. BGP conf mode uses FRRender in generate/apply call FRRender.generate/apply at :596-601; system services are restarted via systemd as shown above. protocols_bgp.py:26-27 freeRtr has many in-tree protocol classes by package names and fields, for example cfgRtr fields rtrOspf4, rtrOspf6, rtrIsis, rtrBgp, rtrRpki in; no external Java imports found by dependency scan. cfg/cfgRtr.java:108-166 [analysis] Ze is mixed: own control-plane code plus Go libraries for OS/protocol helpers. VyOS is primarily orchestration over Linux and daemons such as FRR, nft, strongSwan, VPP, etc. freeRtr is closest to an own-stack protocol implementation in inspected sources.
Zero-copy and performance patterns Avoiding allocations and copies Ze has explicit zero-allocation text formatting: textbuf.Buffer with inline [128]byte, sync.Pool, unsafe noescape, zero-copy Slice, and stack-residence comments in and pool in :108-125. Command registry freezes immutable snapshots for lock-free lookup in. internal/core/textbuf/textbuf.go:54-93command_registry.go:19-26, :131-145 Performance patterns found are mostly system-level and command execution, not zero-copy. popen supports buffered or live line output in. The only zero-copy reference in VyOS Python is a VPP memif mode toggle, not application-level buffer reuse. python/vyos/utils/process.py:35-104python/vyos/vpp/control_vpp.py:358-380 packHolder keeps packet header and payload byte arrays, offset/size fields, and a clear method that resets variables except buffers in. pack/packHolder.java:18-44, :365-430 [analysis] Ze and freeRtr show source-level performance-oriented buffer reuse. VyOS performance is mostly delegated to external daemons/kernel and Python orchestration, based on inspected sources.
Testability seams Unit and integration seams Ze has explicit seams: ProcessManager.AddProcess is documented as used by tests to inject mock processes in; SDK callbacks are maps, not switches, in; generated build-tag tests are present in. manager.go:257-263sdk.go:60-97cmd/ze/hub/build_tag_protocols_absent_test.go:7-12 VyOS has unit tests under src/tests and smoketest CLI harness. Unit tests use unittest in ConfigSession in patches process calls in. src/tests/test_config_tree.py:17-48smoketest/bin/vyos-configtest:21-52, test_utils.pysrc/tests/test_utils.py:31-38 freeRtr has a large process image tester harness: userTester fields for temp path, config path, parallel workers, persistent process, captures, runner in. No JUnit was found in inspected sources. user/userTester.java:35-153 [analysis] Ze favors in-process unit seams and build-tag checks. VyOS favors Python unit tests plus full CLI/system smoketests. freeRtr appears to favor scenario/process image testing over Java unit frameworks.
Configuration transaction model Verify/generate/apply or verify/apply/rollback Ze plugin SDK supports config verify/configure/apply/rollback callbacks in static plugin registration: OnConfigVerify, OnConfigure, OnConfigApply, and OnConfigRollback appear in; rollback journal uses sdk.NewJournal in :148-177. internal/plugins/static/register.go:104-204 VyOS conf scripts implement get_config, verify, generate, apply, then execute in main. Dependencies can run target scripts with verify/generate/apply via. protocols_bgp.py:596-611configdep.py:98-116 freeRtr config model is immediate object mutation with start/stop hooks in inspected snippets, for example servGenList.find(create) calls srvInitialize in srvDeinit in :59-72; xconnect stop/start pattern in. servGenList.java:31-57cfgXconn.java:115-206 [analysis] Ze and VyOS have explicit staged config lifecycles. Ze has rollback callbacks in plugin SDK. VyOS scripts raise ConfigError before generate/apply but rollback behavior is outside inspected snippets. freeRtr changes appear object-oriented and live.
Configuration storage and config tree Storage abstractions and tree representations Ze cmdStart resolves blob or filesystem storage in and requires blob storage unless auto-init or fallback applies in :150-174; hub reads active/candidate configs and writes active versions in. ze_core_start.go:29-40hub/main.go:126-154, :209-226 VyOS Config API describes running/session config semantics in Config.__init__ chooses ConfigSourceVyconfSession or ConfigSourceSession and stores running/session trees at :137-154. python/vyos/config.py:44-57 freeRtr stores global state in static Java registries, such as cfgAll.routers, cfgAll.ifaces, daemon lists at; config file handling exists in cfgInit fields cfgFileHw/cfgFileSw at. cfgAll.java:229-500cfgInit.java:100-109 [analysis] Ze has explicit storage backends and versioned active/candidate behavior. VyOS has running/session tree sources. freeRtr represents runtime config as live Java objects backed by config files.
External process integration Calling out to OS or subprocesses Ze external plugins use process manager, context cancellation, TLS acceptor, and net.Pipe/TLS SDK. Ze also imports netlink/nftables/govpp/wgctrl in. manager.go:125-173pkg/plugin/sdk/sdk.go:1-30go.mod:15-26 VyOS process boundary is central: popen wraps subprocess, shell detection, VRF/netns exec, environment, timeout, stdout/stderr in. Conf mode scripts call systemctl, nft, ip, podman, etc. python/vyos/utils/process.py:35-104 freeRtr has Java process execution and shell helpers in imports, for example imports pipeShell, pipeTcp, pipeConsole, userExec, etc., but no generic external SDK found. cfgInit.java:28-41 [analysis] VyOS has the most external process integration by design. Ze uses external process boundaries primarily for plugins and system integration libraries. freeRtr mostly keeps network behavior in-process.
Feature gating and compile-out Optional feature inclusion Ze build-tag tests prove protocols compile out, for example; dispatch comments mention gated CLI imports in. cmd/ze/hub/build_tag_protocols_absent_test.go:1-12cmd/ze/ze_core_dispatch.go:43-48 ✕ ✕ [analysis] Ze can reduce binary surface by build tags. VyOS and freeRtr feature surface appears package/source included rather than mechanically gated in inspected sources.

Concrete implications

  1. [analysis] Adding a new feature in Ze usually means adding a component/plugin package, YANG, register.go metadata, tests, and regenerating composition roots. This has high mechanical overhead but strong discoverability, schema validation, command ownership, and optional compile-out. Evidence: generated all.go:1-8, static plugin registration internal/plugins/static/register.go:37-68, YANG validator validator.go:153-223.
  2. [analysis] Adding a new feature in VyOS usually means adding or modifying XML command definitions, a Python conf mode script with get_config/verify/generate/apply, Jinja templates or process calls, dependencies, and tests. This enables broad feature parity with Linux packages and daemons quickly, but behavior is distributed across XML, Python, templates, generated node.def/cache files, and systemd. Evidence: Makefile:24-40, protocols_bgp.xml.in:3-6, protocols_bgp.py:596-611, process helper process.py:35-104.
  3. [analysis] Adding a new feature in freeRtr likely means adding Java protocol/service/config classes and wiring them into central registries or command handlers. This keeps runtime behavior in one process and one language, but source changes can require touching central objects such as cfgAll, cfgRtr, or service registry maps. Evidence: cfgAll.java:229-500, cfgRtr.java:78-166, servGenList.java:133-220.
  4. [analysis] Feature parity between Ze and VyOS may be fastest when Ze can reuse kernel or Go library interfaces, but parity with VyOS features backed by mature external daemons may require either writing Ze-native protocol/service implementations or adding plugin/subprocess integration. Evidence: Ze deps include netlink/govpp/wgctrl in go.mod:15-26; VyOS BGP renders to FRR via FRRender in protocols_bgp.py:26-27 and :596-601.
  5. [analysis] Feature parity between Ze and freeRtr is architecturally different: freeRtr has many own in-process protocol implementations, while Ze uses component/plugin boundaries and SDKs. A Ze feature port from freeRtr may need decomposition into YANG, plugin registration, engine subsystem, and API callbacks rather than a single in-process class. Evidence: freeRtr cfgRtr one field per protocol handler in cfgRtr.java:78-166; Ze plugin config, SDK, and process manager in types.go:187-203, sdk.go:1-30, manager.go:125-173.
  6. [analysis] Ze and freeRtr are better positioned for source-level performance tuning than VyOS scripts, because Ze has explicit allocation-aware helpers and freeRtr has reusable packet buffers. VyOS performance-sensitive forwarding/control behavior is more likely in external daemons/kernel, outside this repo. Evidence: Ze textbuf.go:54-93; freeRtr packHolder.java:18-44 and :365-430; the only VyOS zero-copy reference is a VPP memif toggle, not application buffer reuse.
  7. [analysis] Ze has clearer external plugin isolation and restart policies than freeRtr in inspected sources, while VyOS gets service restart/isolation from systemd. Evidence: Ze respawn limits manager.go:18-27, disable path :311-390; VyOS systemctl examples from container.py:647-684 and high-availability.py:213-234; freeRtr no systemd-like respawn found in inspected Java source.
  8. [analysis] Test maintainability differs strongly: Ze offers focused unit seams around registries/processes and compile-time gate tests, VyOS offers Python unit tests plus system-level CLI smoketests, freeRtr offers a process image tester. Evidence: Ze manager.go:257-263 and build-tag tests; VyOS src/tests/test_utils.py:31-38 and smoketest/bin/vyos-configtest:21-52; freeRtr userTester.java:35-153.

Gaps and unclear items