[ { "path": "announce", "description": "Announce a route on demand to selected peers.\nUsage: announce [tag ] [for ]", "mode": "daemon", "wire-method": "ze-bgp:announce", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "clear bgp rib in", "description": "Remove all routes received from a peer.\nWipes the Adj-RIB-In for matched peers. They will need to\nre-advertise everything (or you can send a route-refresh).\nSelector: IP, name, AS pattern, glob, or *.", "mode": "daemon", "wire-method": "ze-rib-api:clear-in", "task-support": "forbidden", "global-pipes": true }, { "path": "clear bgp rib out", "description": "Re-advertise all routes to a peer.\nTriggers a full Adj-RIB-Out replay to the selected peers. Useful\nafter a policy change to push updated attributes without tearing\ndown the session. Selector: IP, name, AS pattern, glob, or *.", "mode": "daemon", "wire-method": "ze-rib-api:clear-out", "task-support": "forbidden", "global-pipes": true }, { "path": "clear debug", "description": "Clear the default debug profile.", "mode": "offline" }, { "path": "clear dns cache", "description": "Clear the DNS cache.\nWith no argument, flushes everything. Use 'record ' to evict\none entry, or 'stats' to see hit/miss rates without flushing.", "mode": "daemon", "wire-method": "ze-clear:dns-cache", "global-pipes": true }, { "path": "clear interface counters", "description": "Zero the Rx/Tx counters for every managed interface.\nUsage: clear interface counters.", "mode": "daemon", "wire-method": "ze-clear:interface-counters", "global-pipes": true }, { "path": "clear interface name counters", "description": "Zero the Rx/Tx counters for one interface.\nUsage: clear interface name counters.", "mode": "daemon", "wire-method": "ze-clear:interface-counters", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "clear isis adjacency", "description": "Tear down every IS-IS adjacency so neighbors re-form.\nUsage: clear isis adjacency. Adjacencies re-learn from the next Hello;\nthe circuit is not closed and the configuration is unchanged.", "mode": "daemon", "wire-method": "ze-clear:isis-adjacency", "global-pipes": true }, { "path": "clear isis counters", "description": "Reset IS-IS observational counters and the SPF log.\nUsage: clear isis counters. Monotonic Prometheus series are not reset;\nthe SPF-run history is cleared.", "mode": "daemon", "wire-method": "ze-clear:isis-counters", "global-pipes": true }, { "path": "clear l2tp session teardown", "description": "Disconnect one subscriber session.\nSends a CDN to gracefully close the session. Pass the local\nsession ID.", "mode": "daemon", "wire-method": "ze-l2tp-api:session-teardown", "global-pipes": true }, { "path": "clear l2tp session teardown-all", "description": "Disconnect every L2TP session on this box.\nSends CDN for all sessions across all tunnels. Tunnels themselves\nstay up. Use with care.", "mode": "daemon", "wire-method": "ze-l2tp-api:session-teardown-all", "global-pipes": true }, { "path": "clear l2tp tunnel teardown", "description": "Gracefully tear down one L2TP tunnel.\nSends a StopCCN to the peer. All sessions on this tunnel will be\ndisconnected. Pass the local tunnel ID.", "mode": "daemon", "wire-method": "ze-l2tp-api:tunnel-teardown", "global-pipes": true }, { "path": "clear l2tp tunnel teardown-all", "description": "Tear down every L2TP tunnel on this box.\nSends StopCCN for all tunnels. Every subscriber session will be\ndisconnected. Use with care during maintenance.", "mode": "daemon", "wire-method": "ze-l2tp-api:tunnel-teardown-all", "global-pipes": true }, { "path": "clear ospf counters", "description": "Reset the OSPF SPF-run history.\nUsage: clear ospf counters. Monotonic Prometheus series are not reset;\nthe SPF-run log is cleared.", "mode": "daemon", "wire-method": "ze-clear:ospf-counters", "global-pipes": true }, { "path": "clear ospf neighbor", "description": "Tear down every OSPF adjacency so neighbors re-form.\nUsage: clear ospf neighbor. Adjacencies re-learn from the next Hello.", "mode": "daemon", "wire-method": "ze-clear:ospf-neighbor", "global-pipes": true }, { "path": "clear ospf process", "description": "Full OSPF reset: tear down every adjacency and re-run SPF.\nUsage: clear ospf process. Adjacencies re-form from the next Hello;\nthe configuration is unchanged.", "mode": "daemon", "wire-method": "ze-clear:ospf-process", "global-pipes": true }, { "path": "clear vpn ipsec sa", "description": "Tear down IKE Security Associations.\nWithout arguments, terminates all SAs. Use 'peer ' to clear\njust one peer. The tunnel will renegotiate automatically if the\nconfig is still active.", "mode": "daemon", "wire-method": "ze-clear:vpn-ipsec-sa", "global-pipes": true }, { "path": "config archive", "description": "Save a snapshot of the current running configuration.\nCaptures the config into the store for later rollback or comparison.\nOptional name labels the snapshot; defaults to a timestamp.", "mode": "daemon", "wire-method": "ze-config-archive:trigger", "global-pipes": true }, { "path": "create interface address", "description": "Add an IP address to an interface.\nUsage: create interface address . Interface must already exist.", "mode": "daemon", "wire-method": "ze-iface:interface-addr-add", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface bridge", "description": "Create a Linux bridge for L2 forwarding.\nUsage: create interface bridge .", "mode": "daemon", "wire-method": "ze-iface:interface-create-bridge", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true, "subcommands": [ "address", "unit" ] }, { "path": "create interface bridge address", "description": "Create a bridge (if needed) and add an IP address.\nUsage: create interface bridge address .", "mode": "daemon", "wire-method": "ze-iface:interface-addr-add", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface bridge unit", "description": "Create a bridge (if needed) and add a VLAN sub-interface.\nUsage: create interface bridge unit .", "mode": "daemon", "wire-method": "ze-iface:interface-unit-add", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface dummy", "description": "Create a dummy (loopback-style) interface.\nUsage: create interface dummy .", "mode": "daemon", "wire-method": "ze-iface:interface-create-dummy", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true, "subcommands": [ "address", "unit" ] }, { "path": "create interface dummy address", "description": "Create a dummy interface (if needed) and add an IP address.\nUsage: create interface dummy address .", "mode": "daemon", "wire-method": "ze-iface:interface-addr-add", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface dummy unit", "description": "Create a dummy interface (if needed) and add a VLAN sub-interface.\nUsage: create interface dummy unit .", "mode": "daemon", "wire-method": "ze-iface:interface-unit-add", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface unit", "description": "Add a VLAN sub-interface (802.1Q tagged).\nUsage: create interface unit . Parent must already exist.", "mode": "daemon", "wire-method": "ze-iface:interface-unit-add", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "create interface veth", "description": "Create a veth pair (two linked virtual Ethernet interfaces).\nUsage: create interface veth .", "mode": "daemon", "wire-method": "ze-iface:interface-create-veth", "backend": [ "netlink" ], "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "debug ip ospf inject opaque", "description": "Inject a crafted IPv4 opaque LSA into the local LSDB (RFC 5250).\nUsage: debug ip ospf inject opaque scope id \n[type <128-255>] [hex | tlv ...] [withdraw].\nThe default Opaque Type is Private-Use so a test LSA never collides with a\nstandards-track consumer. Requires `debug ospf inject enable`.", "mode": "daemon", "wire-method": "ze-debug:ospf-inject", "global-pipes": true }, { "path": "debug ipv6 ospf inject lsa", "description": "Inject a crafted OSPFv3 LSA into the local LSDB (RFC 5340).\nUsage: debug ipv6 ospf inject lsa scope type \nid [hex ] [withdraw]. The flooding scope is derived from\nthe LS Type S2/S1 bits (a reserved scope is rejected). Requires\n`debug ospf inject enable`.", "mode": "daemon", "wire-method": "ze-debug:ospfv3-inject", "global-pipes": true }, { "path": "debug ospf inject disable", "description": "Disable OSPF debug LSA injection. Usage: debug ospf inject disable.", "mode": "daemon", "wire-method": "ze-debug:ospf-inject-disable", "global-pipes": true }, { "path": "debug ospf inject enable", "description": "Enable OSPF debug LSA injection (shared across both address\nfamilies). Off by default. Usage: debug ospf inject enable.", "mode": "daemon", "wire-method": "ze-debug:ospf-inject-enable", "global-pipes": true }, { "path": "delete bgp peer", "description": "Remove a peer from the running config.\nTears down the TCP session and deletes the peer from the running\nconfiguration. Does not modify the config file on disk.", "mode": "daemon", "wire-method": "ze-delete:bgp-peer", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "delete debug module", "description": "Disable debug for a subsystem, or remove one of its flags/scopes.", "mode": "offline" }, { "path": "delete debug profile name", "description": "Delete a named debug profile.", "mode": "offline" }, { "path": "delete interface", "description": "Delete an interface from the kernel.\nUsage: delete interface .", "mode": "daemon", "wire-method": "ze-iface:interface-delete", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true, "subcommands": [ "address", "unit" ] }, { "path": "delete interface address", "description": "Remove an IP address from an interface.\nUsage: delete interface address .", "mode": "daemon", "wire-method": "ze-iface:interface-addr-del", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "delete interface unit", "description": "Remove a VLAN sub-interface.\nUsage: delete interface unit.", "mode": "daemon", "wire-method": "ze-iface:interface-unit-del", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "doctor", "description": "Verify kernel features, file descriptor limits, sockets, and required dependencies. Run this before first start or after platform changes.", "mode": "offline" }, { "path": "explain", "description": "Print the meaning, likely cause, and recommended fix for a Ze diagnostic code. Pass the code you saw in a log or error message.", "mode": "offline" }, { "path": "fakel2tp emit", "description": "Emit one synthetic L2TP route-change batch", "mode": "daemon", "wire-method": "ze-fakel2tp-api:fakel2tp-emit", "global-pipes": true }, { "path": "fakel2tp help", "description": "Print the fakel2tp command surface", "mode": "daemon", "wire-method": "ze-fakel2tp-api:fakel2tp-help", "global-pipes": true }, { "path": "fakeredist emit", "description": "Emit one synthetic route-change batch", "mode": "daemon", "wire-method": "ze-fakeredist-api:fakeredist-emit", "global-pipes": true }, { "path": "fakeredist emit-burst", "description": "Emit N synthetic batches sequentially", "mode": "daemon", "wire-method": "ze-fakeredist-api:fakeredist-emit-burst", "global-pipes": true }, { "path": "fakeredist help", "description": "Print the fakeredist command surface", "mode": "daemon", "wire-method": "ze-fakeredist-api:fakeredist-help", "global-pipes": true }, { "path": "generate wireguard keypair", "description": "Generate a WireGuard keypair. Prints private and public keys to stdout for use in your config.", "mode": "offline" }, { "path": "help", "description": "Show available commands at this level.\nLists every registered command verb with a brief description.", "mode": "read-only", "wire-method": "ze-bgp:help", "global-pipes": true }, { "path": "help ai", "description": "AI reference generated from the binary. Sections: cli, api, mcp, dispatch, all (add --json).", "mode": "offline" }, { "path": "help command", "description": "List every command with its description. Use a filter to narrow the list.", "mode": "offline" }, { "path": "metrics pool", "description": "Show attribute pool memory usage and dedup efficiency.\nReturns allocated entries, reference counts, and deduplication hit\nrates per attribute type. Watch the dedup rate to gauge how much\nmemory pooling is saving you.", "mode": "daemon", "wire-method": "ze-bgp:pool-stats", "global-pipes": true }, { "path": "monitor bgp", "description": "Live BGP peer dashboard that refreshes automatically.\nShows all peers with state, uptime, and prefix counts. State changes\nhighlight as they happen. Ctrl-C to stop.", "mode": "read-only", "wire-method": "ze-bgp:monitor", "task-support": "required", "global-pipes": true }, { "path": "monitor event", "description": "Stream live events as they happen.\nShows a real-time feed of internal events. Filter with\ninclude or exclude to focus on what matters.\nPatterns match event type names.", "mode": "read-only", "wire-method": "ze-event:monitor", "task-support": "required", "global-pipes": true }, { "path": "monitor interface rate", "description": "Stream per-second traffic rates for your interfaces.\nShows rx/tx bytes and packets per second, updating every second.\nOptionally pass an interface name to watch just one link.", "mode": "read-only", "wire-method": "ze-monitor:interface-rate", "task-support": "required", "global-pipes": true }, { "path": "monitor ping", "description": "Continuous ping with live loss and RTT statistics.\nPings until you stop it. Adjust interval and timeout as\nneeded. Shows running min/avg/max RTT and packet loss.", "mode": "read-only", "wire-method": "ze-monitor:ping", "task-support": "required", "global-pipes": true }, { "path": "monitor system netlink", "description": "Watch kernel networking changes in real time.\nStreams netlink events: route adds/deletes, link state changes,\naddress assignments. Filter with route, link, address, or all.", "mode": "read-only", "wire-method": "ze-monitor:system-netlink", "task-support": "required", "global-pipes": true }, { "path": "monitor traceroute", "description": "Live mtr-style traceroute that updates continuously.\nShows each hop with running RTT statistics. Keeps probing so you\ncan watch path changes and latency shifts over time.", "mode": "read-only", "wire-method": "ze-monitor:traceroute", "task-support": "required", "global-pipes": true }, { "path": "monitor traffic-stat", "description": "Start streaming traffic monitor (per-second snapshots).\nWithout arguments, shows all interfaces. With 'name ', filters to one interface.", "mode": "read-only", "wire-method": "ze-monitor:traffic-stat", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "monitor vpn ipsec", "description": "Watch IPsec SA events as they happen.\nStreams sa-up, sa-down, child-up, child-down, and child-rekey\nevents. Useful for debugging tunnel flaps or rekey issues.", "mode": "read-only", "wire-method": "ze-monitor:vpn-ipsec", "task-support": "required", "global-pipes": true }, { "path": "peer raw", "description": "Send raw bytes into a peer's TCP stream (dangerous).\nInjects arbitrary bytes with no BGP framing or validation. Intended\nfor conformance testing and fuzzing only. Will likely break the\nsession if used carelessly.", "mode": "daemon", "wire-method": "ze-bgp:peer-raw", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "peer update", "description": "Send a pre-built BGP UPDATE to a peer.\nPayload can be text (human-readable route syntax), hex, or base64.\nUse 'show bgp encode' to build the payload, then send it here.", "mode": "daemon", "wire-method": "ze-bgp:peer-update", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "plugin ack", "description": "Choose sync or async event delivery.\nsync: Ze waits for your plugin to acknowledge each event before\nsending the next one. Safer but slower. async: events fire without\nwaiting, giving higher throughput at the cost of backpressure control.", "mode": "read-only", "wire-method": "ze-bgp:plugin-ack", "global-pipes": true }, { "path": "plugin command complete", "description": "Complete command/args", "mode": "read-only", "wire-method": "ze-plugin:command-complete", "global-pipes": true }, { "path": "plugin command help", "description": "Show command details", "mode": "read-only", "wire-method": "ze-plugin:command-help", "global-pipes": true }, { "path": "plugin command list", "description": "List plugin commands", "mode": "read-only", "wire-method": "ze-plugin:command-list", "global-pipes": true }, { "path": "plugin encoding", "description": "Choose json or text encoding for plugin events.\nControls how events are serialized in this session. JSON is\nstructured and parseable; text is more compact.", "mode": "read-only", "wire-method": "ze-bgp:plugin-encoding", "global-pipes": true }, { "path": "plugin format", "description": "Choose how BGP message bytes appear in events.\nhex and base64 are compact wire representations. parsed decodes\nattributes into structured fields. full includes both wire bytes\nand parsed content.", "mode": "read-only", "wire-method": "ze-bgp:plugin-format", "global-pipes": true }, { "path": "plugin help", "description": "List plugin subcommands", "mode": "read-only", "wire-method": "ze-plugin:help", "global-pipes": true }, { "path": "plugin session bye", "description": "Disconnect", "mode": "read-only", "wire-method": "ze-plugin:session-bye", "global-pipes": true }, { "path": "plugin session ping", "description": "Health check (returns PID)", "mode": "read-only", "wire-method": "ze-plugin:session-ping", "global-pipes": true }, { "path": "plugin session ready", "description": "Signal plugin init complete", "mode": "read-only", "wire-method": "ze-plugin:session-ready", "global-pipes": true }, { "path": "request as112 healthcheck", "description": "One-shot authoritative query against an anycast service\naddress (or the given target), exit 0 iff the expected\nAS112 answer comes back. Finding M4: the tool a\nhealthcheck probe calls, since dig is not on the gokrazy\nappliance and 'ze resolve dns' cannot target a specific\nserver. Usage: request as112 healthcheck [target ].", "mode": "daemon", "wire-method": "ze-as112:health", "args": [ { "name": "target", "type": "string" } ], "global-pipes": true }, { "path": "request bgp rib inject", "description": "Inject a synthetic route into the Adj-RIB-In.\nBehaves as if the route was received from a peer. Use this for\ntesting policy filters or simulating route announcements.", "mode": "daemon", "wire-method": "ze-rib-api:inject", "task-support": "forbidden", "global-pipes": true }, { "path": "request bgp rib withdraw", "description": "Withdraw a route from the Adj-RIB-In.\nRemoves a previously injected or received route from a peer's\nAdj-RIB-In, triggering best-path recomputation.", "mode": "daemon", "wire-method": "ze-rib-api:withdraw", "task-support": "forbidden", "global-pipes": true }, { "path": "request cache expire", "description": "Remove a cached message immediately.\nUsage: request cache expire .", "mode": "daemon", "wire-method": "ze-bgp:cache-expire", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request cache forward", "description": "Forward a cached UPDATE to peers matching a selector.\nUsage: request cache forward .", "mode": "daemon", "wire-method": "ze-bgp:cache-forward", "args": [ { "name": "id", "type": "string", "mandatory": true }, { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request cache release", "description": "Ack without forwarding (cache consumer) or undo retain (API).\nUsage: request cache release .", "mode": "daemon", "wire-method": "ze-bgp:cache-release", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request cache retain", "description": "Prevent eviction of a cached message.\nUsage: request cache retain .", "mode": "daemon", "wire-method": "ze-bgp:cache-retain", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request commit", "description": "Group route changes into named atomic commits.\nActions: start (begin a commit), end (finalize), eor (signal end of\nRIB), rollback (undo), show (inspect), withdraw (remove all routes\nin a commit), list (show all commits). Grammar: request commit \n [args].", "mode": "daemon", "wire-method": "ze-bgp:commit", "global-pipes": true }, { "path": "request halt", "description": "Dump goroutine stacks to stderr and terminate immediately.", "mode": "daemon", "wire-method": "ze-system:daemon-quit", "global-pipes": true }, { "path": "request interface down", "description": "Shut down an interface.\nUsage: request interface down.", "mode": "daemon", "wire-method": "ze-iface:interface-down", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request interface mac", "description": "Set the MAC address on an interface.\nUsage: request interface mac .", "mode": "daemon", "wire-method": "ze-iface:interface-mac", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request interface migrate", "description": "Move IP addresses between interfaces with minimal downtime.\nTakes a source interface, a target interface, and the address to move.\nAdds addresses to the target before removing them from the source\n(make-before-break).", "mode": "daemon", "wire-method": "ze-iface:interface-migrate", "global-pipes": true }, { "path": "request interface mtu", "description": "Set the MTU on an interface.\nUsage: request interface mtu . Range: 68 to 65535.", "mode": "daemon", "wire-method": "ze-iface:interface-mtu", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request interface up", "description": "Bring an interface up.\nUsage: request interface up.", "mode": "daemon", "wire-method": "ze-iface:interface-up", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request log level", "description": "Change a subsystem's log level without restarting.\nUsage: request log level . Takes effect immediately.\nSet to debug when troubleshooting, then back to info when you are done.", "mode": "daemon", "wire-method": "ze-bgp:log-set", "args": [ { "name": "logger", "type": "string" }, { "name": "target", "type": "enum", "values": [ "debug", "disabled", "err", "info", "warn" ] } ], "global-pipes": true }, { "path": "request ospf graceful-restart", "description": "Trigger a planned OSPFv2 graceful restart (RFC 3623 section 2.1).\nUsage: request ospf graceful-restart. The engine originates one Grace-LSA per\ninterface, persists the non-volatile restart fact, and suppresses route churn\nso the FIB is retained across the ensuing control-plane restart. Refused when\ngraceful-restart is not configured.", "mode": "daemon", "wire-method": "ze-ospf:graceful-restart-prepare", "global-pipes": true }, { "path": "request peer borr", "description": "Start an Enhanced Route Refresh cycle (RFC 7313).\nTells the peer to mark existing routes as stale. After re-sending,\nsend EORR to purge anything not refreshed.", "mode": "daemon", "wire-method": "ze-bgp:peer-borr", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer clear soft", "description": "Soft-clear a peer without dropping the session.\nSends ROUTE-REFRESH for every negotiated AFI/SAFI, causing the peer\nto re-send all routes. No session bounce, no traffic impact.", "mode": "daemon", "wire-method": "ze-bgp:peer-clear-soft", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer eorr", "description": "Finish an Enhanced Route Refresh cycle (RFC 7313).\nThe peer purges any routes not re-advertised since the matching\nBORR. Only send this after the peer has finished re-advertising.", "mode": "daemon", "wire-method": "ze-bgp:peer-eorr", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer flush", "description": "Wait until all queued updates for a peer are sent.\nUsage: request peer flush.", "mode": "daemon", "wire-method": "ze-bgp:peer-flush", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer pause", "description": "Pause reading from a peer's TCP socket.\nUsage: request peer pause.", "mode": "daemon", "wire-method": "ze-bgp:peer-pause", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer plugin session ready", "description": "Signal that per-peer plugin setup is complete.\nUsage: request peer plugin session ready.", "mode": "daemon", "wire-method": "ze-plugin:session-peer-ready", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer refresh", "description": "Ask a peer to re-send all routes (RFC 2918).\nSends a ROUTE-REFRESH message for the specified AFI/SAFI. The\npeer will re-advertise its entire Adj-RIB-Out.", "mode": "daemon", "wire-method": "ze-bgp:peer-refresh", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer resume", "description": "Resume reading from a previously paused peer.\nUsage: request peer resume.", "mode": "daemon", "wire-method": "ze-bgp:peer-resume", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request peer teardown", "description": "Tear down a peer session.\nUsage: request peer teardown [cease-subcode].", "mode": "daemon", "wire-method": "ze-bgp:peer-teardown", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "request reboot", "description": "Gracefully shutdown then reboot the system.", "mode": "daemon", "wire-method": "ze-system:daemon-reboot", "global-pipes": true }, { "path": "request reload", "description": "Reload the configuration without restarting.", "mode": "daemon", "wire-method": "ze-system:daemon-reload", "global-pipes": true }, { "path": "request shutdown", "description": "Gracefully shutdown: drain connections, close peers, exit.", "mode": "daemon", "wire-method": "ze-system:daemon-shutdown", "global-pipes": true }, { "path": "request subscribe", "description": "Start receiving events of one or more types.\nEvents are delivered asynchronously to your plugin session until\nyou unsubscribe. Use 'show event list' to see available event types.", "mode": "daemon", "wire-method": "ze-bgp:subscribe", "task-support": "required", "global-pipes": true }, { "path": "request unsubscribe", "description": "Stop receiving events you previously subscribed to.\nRemoves the subscription for the specified event type from your\ncurrent plugin session.", "mode": "daemon", "wire-method": "ze-bgp:unsubscribe", "global-pipes": true }, { "path": "resolve cymru asn-name", "description": "Find out who owns an AS number.\nQueries Team Cymru DNS to return the organization name for the ASN.\nUsage: resolve cymru asn-name .", "mode": "read-only", "wire-method": "ze-resolve:cymru-asn-name", "global-pipes": true }, { "path": "resolve dns a", "description": "Look up IPv4 addresses (A records) for a hostname.\nUsage: resolve dns a .", "mode": "read-only", "wire-method": "ze-resolve:dns-a", "global-pipes": true }, { "path": "resolve dns aaaa", "description": "Look up IPv6 addresses (AAAA records) for a hostname.\nUsage: resolve dns aaaa .", "mode": "read-only", "wire-method": "ze-resolve:dns-aaaa", "global-pipes": true }, { "path": "resolve dns ptr", "description": "Reverse-lookup an IP address to its hostname (PTR).\nUsage: resolve dns ptr .", "mode": "read-only", "wire-method": "ze-resolve:dns-ptr", "global-pipes": true }, { "path": "resolve dns txt", "description": "Look up TXT records for a hostname.\nUsage: resolve dns txt . Returns all TXT strings.", "mode": "read-only", "wire-method": "ze-resolve:dns-txt", "global-pipes": true }, { "path": "resolve irr expand", "description": "Expand an AS-SET into its member AS numbers.\nRecursively resolves nested AS-SET objects via WHOIS into a flat\nlist. Useful for building prefix filters from IRR data.", "mode": "read-only", "wire-method": "ze-resolve:irr-expand", "global-pipes": true }, { "path": "resolve irr prefix", "description": "Get all prefixes announced by an AS-SET's members.\nExpands the AS-SET, then returns every route/route6 object for\neach member ASN. Use this to build or verify prefix filters.", "mode": "read-only", "wire-method": "ze-resolve:irr-prefix", "global-pipes": true }, { "path": "resolve peeringdb as-set", "description": "Find the IRR AS-SET registered for an ASN in PeeringDB.\nUsage: resolve peeringdb as-set . Feed the result into\n'resolve irr expand' to get the full member list.", "mode": "read-only", "wire-method": "ze-resolve:peeringdb-as-set", "global-pipes": true }, { "path": "resolve peeringdb max-prefix", "description": "Get max-prefix limits for an ASN from PeeringDB.\nReturns IPv4 and IPv6 prefix limits. Apply via the config editor. Usage: resolve peeringdb max-prefix .", "mode": "read-only", "wire-method": "ze-resolve:peeringdb-max-prefix", "global-pipes": true }, { "path": "resolve ping", "description": "Ping from the router with optional source binding.\nUsage: resolve ping [source ] [count ] [size ].", "mode": "read-only", "wire-method": "ze-resolve:ping", "global-pipes": true }, { "path": "resolve traceroute", "description": "Traceroute from the router with optional source binding.\nUsage: resolve traceroute [source ] [max-hops N] [timeout D] [probes N].", "mode": "read-only", "wire-method": "ze-resolve:traceroute", "global-pipes": true }, { "path": "set debug active name", "description": "Load a named debug profile and apply it to the running daemon.", "mode": "offline" }, { "path": "set debug module", "description": "Enable debug for a subsystem; optionally set level/flag/scope. E.g. 'set debug module bgp.reactor level debug'.", "mode": "offline" }, { "path": "set debug profile name", "description": "Save the current debug state as a named profile.", "mode": "offline" }, { "path": "set debug timeout", "description": "Set the debug auto-disable timer (e.g. 30m, 1h, 90s; 0 disables).", "mode": "offline" }, { "path": "set system file-descriptors", "description": "Raise the file descriptor limit for the daemon process.\nPass a number or 'max' to go to the hard limit. Takes effect\nimmediately. Check current limits with 'show system file-descriptors'.", "mode": "daemon", "wire-method": "ze-set:system-file-descriptors", "args": [ { "name": "limit", "type": "union", "values": [ "max" ] } ], "global-pipes": true }, { "path": "show aaa accounting", "description": "Show AAA accounting counters and any dropped records.\nTells you whether TACACS+ accounting is working or if records are\nbeing lost due to server unreachability.", "mode": "read-only", "wire-method": "ze-show:aaa-accounting", "global-pipes": true }, { "path": "show announcements", "description": "List active on-demand announcements.\nUsage: show announcements [tag ] [selector ] [family ]", "mode": "read-only", "wire-method": "ze-bgp:show-announcements", "global-pipes": true }, { "path": "show anomaly detect", "description": "Show recent behavioral anomaly incidents (report-only): source entity, cohort,\nfired features with their deviation z-scores, combined score, and severity. The detector reports;\nthe anomaly/shape responder (Spec 2b) acts.", "mode": "read-only", "wire-method": "ze-show:anomaly", "global-pipes": true }, { "path": "show anomaly shape", "description": "Show the shadow-first anomaly responder status: mode (shadow/armed), action,\nkill-switch state, and the currently armed source entities with live firewall actions.", "mode": "read-only", "wire-method": "ze-show:anomaly-shape", "global-pipes": true }, { "path": "show arp", "description": "Show the IPv4 ARP table (shortcut for 'show neighbor ipv4').\nLists IPv4 ARP entries with MAC address and state. ARP is IPv4-only;\nuse 'show neighbor' for both families or 'show neighbor ipv6' for the\nIPv6 ND table.", "mode": "read-only", "wire-method": "ze-show:arp", "global-pipes": true }, { "path": "show as112", "description": "AS112 node status: enabled, address-family, hostname/\nfacility/location, allow-from count, served zone count, and\nthe current SOA serial.", "mode": "read-only", "wire-method": "ze-show:as112", "global-pipes": true }, { "path": "show audit", "description": "Show who did what and when on this box.\nReturns audit log entries with timestamps, actors, and actions.\nFilters (all optional, combinable): action , actor ,\nsurface (cli, web, api), since/until , count .\nActions include config-commit, login, peer-teardown, and more.", "mode": "read-only", "wire-method": "ze-show:audit", "args": [ { "name": "action", "type": "string" }, { "name": "actor", "type": "string" }, { "name": "count", "type": "uint" }, { "name": "since", "type": "string" }, { "name": "surface", "type": "string" }, { "name": "until", "type": "string" } ], "global-pipes": true }, { "path": "show bfd profile", "description": "Show BFD timer profiles with effective values.\nReturns min-tx, min-rx, and detect-multiplier after inheritance.\nUse 'show bfd profile' for every profile or 'show bfd profile name '\nfor one profile.", "mode": "read-only", "wire-method": "ze-bfd-api:show-profile", "global-pipes": true, "subcommands": [ "name" ] }, { "path": "show bfd profile name", "description": "Show one BFD profile by name.", "mode": "read-only", "wire-method": "ze-bfd-api:show-profile", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bfd session address", "description": "Show full detail for one BFD session.\nPass the peer address. Returns local/remote discriminators,\nnegotiated timers, detection time, and packet counters.", "mode": "read-only", "wire-method": "ze-bfd-api:show-session", "args": [ { "name": "address", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bfd sessions", "description": "List all active BFD sessions.\nOne line per session: peer address, state, negotiated tx/rx\nintervals, and detect multiplier.", "mode": "read-only", "wire-method": "ze-bfd-api:show-sessions", "global-pipes": true }, { "path": "show bgp decode", "description": "Decode a hex-encoded BGP message into readable JSON.\nPaste a hex BGP UPDATE and get back parsed attributes, NLRI, and\nwithdrawn prefixes. Handy for reading pcap captures or debugging\nwire issues. Also available in the web UI under tools.", "mode": "read-only", "wire-method": "ze-show:bgp-decode", "global-pipes": true }, { "path": "show bgp encode", "description": "Turn a route announcement into wire-format hex.\nTakes a route in API syntax and returns the BGP UPDATE as a hex\nstring. Useful for building test payloads, feeding to ze-test, or\nverifying that your announcement encodes correctly.", "mode": "read-only", "wire-method": "ze-show:bgp-encode", "global-pipes": true }, { "path": "show bgp irr", "description": "Show IRR filter status per ASN.\nLists each enrolled ASN with its resolved AS-SET, prefix counts,\nlast refresh time, and error status. Use this to confirm that IRR\nprefix-lists are loaded and current.", "mode": "read-only", "wire-method": "ze-show:irr-status", "global-pipes": true, "subcommands": [ "check", "prefix" ] }, { "path": "show bgp irr check", "description": "Check if a prefix is accepted by the IRR filter.\nUsage: show bgp irr check . Reports whether the\nprefix would be accepted or rejected, and which entry matches.", "mode": "read-only", "wire-method": "ze-show:irr-check", "args": [ { "name": "peer", "type": "string", "mandatory": true }, { "name": "prefix", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp irr prefix", "description": "Show IRR-resolved prefixes for a peer.\nUsage: show bgp irr prefix . Lists all IPv4 and IPv6 prefixes\nin the IRR-resolved prefix-list for the given peer address.", "mode": "read-only", "wire-method": "ze-show:irr-prefix", "args": [ { "name": "peer", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp peer capabilities", "description": "Show what capabilities were negotiated with a peer.\nUsage: show bgp peer capabilities.", "mode": "read-only", "wire-method": "ze-bgp:peer-capabilities", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp peer detail", "description": "Show full detail for one or more peers.\nUsage: show bgp peer detail. The selector can be an IP,\npeer name, AS pattern (as65001), glob, or *.", "mode": "read-only", "wire-method": "ze-bgp:peer-detail", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp peer history", "description": "Show FSM state transitions for a peer over time.\nUsage: show bgp peer history.", "mode": "read-only", "wire-method": "ze-bgp:peer-history", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp peer list", "description": "List your peers, one line each.\nShows name, address, ASN, state, and uptime. Quick overview without\nthe detail of 'show bgp peer detail'.", "mode": "read-only", "wire-method": "ze-bgp:peer-list", "global-pipes": true }, { "path": "show bgp peer rib", "description": "Show RIB data scoped to one peer.\nUsage: show bgp peer rib [scope|filters|terminal].", "mode": "read-only", "wire-method": "ze-bgp:peer-rib", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp peer statistics", "description": "Show UPDATE throughput for your peers.\nUsage: show bgp peer statistics.", "mode": "read-only", "wire-method": "ze-bgp:peer-statistics", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show bgp rib", "description": "Query routes in the BGP RIB.\nLook at received or advertised routes with flexible filters: peer,\nfamily, prefix, AS path regex, community, match expression. Pipe\noperators: | count, | prefix-summary, | graph. This is the main\nroute inspection command.", "mode": "read-only", "wire-method": "ze-rib-api:routes", "task-support": "required", "pipes": [ { "name": "advertised", "description": "Select advertised routes" }, { "name": "community", "description": "Filter by standard community", "takes-arg": true }, { "name": "count", "description": "Count matching routes without serializing rows" }, { "name": "family", "description": "Filter by AFI/SAFI", "takes-arg": true }, { "name": "first", "description": "Take first N routes", "takes-arg": true }, { "name": "graph", "description": "Render AS-path topology graph" }, { "name": "last", "description": "Take last N routes", "takes-arg": true }, { "name": "match", "description": "Cross-field structured match", "takes-arg": true }, { "name": "path", "description": "Filter by AS path", "takes-arg": true }, { "name": "peer", "description": "Filter by peer", "takes-arg": true }, { "name": "prefix", "description": "Filter by prefix", "takes-arg": true }, { "name": "prefix-summary", "description": "Summarize by family and prefix length" }, { "name": "received", "description": "Select received routes" } ], "global-pipes": true, "subcommands": [ "best", "rpf", "status" ] }, { "path": "show bgp rib best", "description": "Show the winning route for each prefix.\nSame filters as 'show bgp rib'. Use '| reason' to see why each\npath was selected (local-pref, AS path length, MED, etc.).", "mode": "read-only", "wire-method": "ze-rib-api:best", "pipes": [ { "name": "community", "description": "Filter by standard community", "takes-arg": true }, { "name": "count", "description": "Count matching best paths without serializing rows" }, { "name": "family", "description": "Filter by AFI/SAFI", "takes-arg": true }, { "name": "first", "description": "Take first N best paths", "takes-arg": true }, { "name": "graph", "description": "Render AS-path topology graph" }, { "name": "last", "description": "Take last N best paths", "takes-arg": true }, { "name": "match", "description": "Cross-field structured match", "takes-arg": true }, { "name": "path", "description": "Filter by AS path", "takes-arg": true }, { "name": "peer", "description": "Filter by peer", "takes-arg": true }, { "name": "prefix", "description": "Filter by prefix", "takes-arg": true }, { "name": "prefix-summary", "description": "Summarize by family and prefix length" }, { "name": "reason", "description": "Explain best-path selection" } ], "global-pipes": true, "subcommands": [ "status" ] }, { "path": "show bgp rib best status", "description": "Check whether best-path computation is still running.\nReports idle, pending, or running, plus the last run duration.", "mode": "read-only", "wire-method": "ze-rib-api:best-status", "global-pipes": true }, { "path": "show bgp rib rpf", "description": "Reverse-path forwarding lookup in the Loc-RIB.\nPerforms a longest-prefix-match and returns the best-path entry.\nUse this to verify RPF checks would pass for a given source.", "mode": "read-only", "wire-method": "ze-rib-api:rpf", "pipes": [ { "name": "advertised", "description": "Select advertised routes" }, { "name": "community", "description": "Filter by standard community", "takes-arg": true }, { "name": "count", "description": "Count matching routes without serializing rows" }, { "name": "family", "description": "Filter by AFI/SAFI", "takes-arg": true }, { "name": "first", "description": "Take first N routes", "takes-arg": true }, { "name": "graph", "description": "Render AS-path topology graph" }, { "name": "last", "description": "Take last N routes", "takes-arg": true }, { "name": "match", "description": "Cross-field structured match", "takes-arg": true }, { "name": "path", "description": "Filter by AS path", "takes-arg": true }, { "name": "peer", "description": "Filter by peer", "takes-arg": true }, { "name": "prefix", "description": "Filter by prefix", "takes-arg": true }, { "name": "prefix-summary", "description": "Summarize by family and prefix length" }, { "name": "received", "description": "Select received routes" } ], "global-pipes": true }, { "path": "show bgp rib status", "description": "Get a quick RIB overview without dumping routes.\nShows total peers, received/accepted/advertised route counts, and\nper-family breakdowns. Use this to confirm convergence after a\npeer comes up.", "mode": "read-only", "wire-method": "ze-rib-api:status", "global-pipes": true }, { "path": "show bgp summary", "description": "Show a one-line-per-peer BGP summary.\nLists every peer with state, ASN, prefixes received, and uptime.\nOptionally scope by address family: ipv4, ipv6, or l2vpn.", "mode": "read-only", "wire-method": "ze-bgp:summary", "global-pipes": true }, { "path": "show bgp-health", "description": "Quick health check for all your BGP peers.\nLists every peer with address, state, ASN, and uptime. Reports how\nmany are not Established. Much faster than 'show bgp peer *' when\nyou just need a status overview.", "mode": "read-only", "wire-method": "ze-show:bgp-health", "global-pipes": true }, { "path": "show bmp collectors", "description": "Show BMP collector connection status.\nLists configured collectors with connection state, sent message\ncounts, and error statistics. Check here if your collector is\nnot receiving data.", "mode": "read-only", "wire-method": "ze-show:bmp-collectors", "global-pipes": true }, { "path": "show bmp peers", "description": "Show BGP peers as seen through BMP monitoring.\nLists peers reported via BMP with their state and route statistics.", "mode": "read-only", "wire-method": "ze-show:bmp-peers", "global-pipes": true }, { "path": "show bmp rib", "description": "Show routes received via BMP monitoring sessions.\nReturns the BMP RIB content. Use this to verify what your\ncollector is seeing from remote peers.", "mode": "read-only", "wire-method": "ze-show:bmp-rib", "global-pipes": true }, { "path": "show bmp sessions", "description": "Show active BMP receiver sessions.\nLists each session with connection state and message counters.\nCheck here to confirm your BMP collector is receiving data.", "mode": "read-only", "wire-method": "ze-show:bmp-sessions", "global-pipes": true }, { "path": "show cache", "description": "List cached BGP UPDATE message IDs with their\nretain and consumer state.", "mode": "read-only", "wire-method": "ze-bgp:cache-list", "global-pipes": true }, { "path": "show capture", "description": "Show captured control-plane messages.\nReturns protocol messages you previously enabled capture for. Without\na protocol keyword, shows all protocols. Filters: tunnel-id (L2TP),\npeer (remote address), count (limit entries). Use this to debug\nsession establishment issues.", "mode": "read-only", "wire-method": "ze-show:capture", "args": [ { "name": "count", "type": "uint" }, { "name": "peer", "type": "string" }, { "name": "protocol", "type": "enum", "values": [ "bgp", "l2tp" ] }, { "name": "tunnel-id", "type": "uint" } ], "global-pipes": true, "subcommands": [ "interface", "raw" ] }, { "path": "show capture interface", "description": "Capture live packets on an interface (like tcpdump).\nUses AF_PACKET for zero-copy capture. Filter by protocol and port.\nLimit with count or duration. Output as pcap (for Wireshark) or text.\nSnap-len controls how many bytes per packet are captured.", "mode": "read-only", "wire-method": "ze-show:capture-interface", "args": [ { "name": "count", "type": "uint" }, { "name": "duration", "type": "string" }, { "name": "format", "type": "enum", "values": [ "pcap", "text" ] }, { "name": "iface", "type": "string" }, { "name": "protocol", "type": "string" }, { "name": "snap-len", "type": "uint" } ], "global-pipes": true }, { "path": "show capture raw", "description": "Control raw byte capture for protocol debugging.\nActions: start (begin capturing), stop (halt), dump (retrieve).\nProtocols: l2tp, bgp. Output formats: pcap (for Wireshark), json.\nLimit with count .", "mode": "read-only", "wire-method": "ze-show:capture-raw", "args": [ { "name": "action", "type": "enum", "values": [ "dump", "start", "stop" ] }, { "name": "count", "type": "uint" }, { "name": "format", "type": "enum", "values": [ "json", "pcap" ] }, { "name": "protocol", "type": "enum", "values": [ "bgp", "l2tp" ] } ], "global-pipes": true }, { "path": "show command complete", "description": "Get tab-completion candidates for a partial command.\nReturns possible completions for the given input. Used internally\nby the CLI editor, but also callable for scripting.", "mode": "read-only", "wire-method": "ze-bgp:command-complete", "global-pipes": true }, { "path": "show command help", "description": "Show usage and arguments for a specific command.\nGives you the full description, expected arguments, and usage\npattern for one command.", "mode": "read-only", "wire-method": "ze-bgp:command-help", "global-pipes": true }, { "path": "show command list", "description": "List every command the daemon knows about.\nReturns dispatch key and description for each. Useful for scripting\nor discovering commands not shown in the top-level help.", "mode": "read-only", "wire-method": "ze-bgp:command-list", "global-pipes": true }, { "path": "show config cat", "description": "Print the full text of a stored configuration snapshot.\nUsage: show config cat . Outputs the config as-is.", "mode": "read-only", "wire-method": "ze-show:config-cat", "global-pipes": true }, { "path": "show config diff", "description": "Compare two configuration versions side by side.\nShows what was added, removed, or changed. Commonly used with\nrollback revisions to review what changed before you roll back.", "mode": "read-only", "wire-method": "ze-show:config-diff", "global-pipes": true }, { "path": "show config dump", "description": "Show the fully resolved configuration tree.\nParses the config and outputs it after includes, defaults, and group\ninheritance have been applied. What you see here is exactly what the\ndaemon is using.", "mode": "read-only", "wire-method": "ze-show:config-dump", "global-pipes": true }, { "path": "show config fmt", "description": "Pretty-print the configuration with consistent formatting.\nNormalizes indentation and ordering. Output goes to stdout (read-only).\nTo rewrite the file in place, use 'ze config fmt -w' from the CLI.", "mode": "read-only", "wire-method": "ze-show:config-fmt", "global-pipes": true }, { "path": "show config graph", "description": "Show how components and peers depend on each other (DOT graph format).", "mode": "offline" }, { "path": "show config history", "description": "List available configuration rollback points.\nShows revisions with timestamps and commit metadata. Pair with\n'show config diff' to review changes before rolling back.", "mode": "read-only", "wire-method": "ze-show:config-history", "global-pipes": true }, { "path": "show config ls", "description": "List all configuration files stored in the database.\nShows archived snapshots and the active config.", "mode": "read-only", "wire-method": "ze-show:config-ls", "global-pipes": true }, { "path": "show crashes", "description": "View saved crash reports from panics.\nWithout arguments, lists available crash files. Use 'latest' to see\nthe newest crash or 'name ' to print one specific report.\nSend the output to support when reporting a crash.", "mode": "read-only", "wire-method": "ze-show:crashes", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show data cat", "description": "Print the raw content of a blob store entry.\nUsage: show data cat . Outputs the value for the given key,\nlike 'cat' for ZeFS.", "mode": "read-only", "wire-method": "ze-show:data-cat", "global-pipes": true }, { "path": "show data ls", "description": "List everything stored in the ZeFS blob store.\nShows all keys and their sizes. Use 'show data cat ' to see\nthe content of a specific entry.", "mode": "read-only", "wire-method": "ze-show:data-ls", "global-pipes": true }, { "path": "show data registered", "description": "List the key patterns registered by all subsystems.\nShows you what types of data ZeFS knows about.", "mode": "read-only", "wire-method": "ze-show:data-registered", "global-pipes": true }, { "path": "show ddos flowspec", "description": "Show the upstream FlowSpec/RTBH DDoS mitigation status: whether a rule is\ncurrently announced, the target vector it covers, and whether the leak-probe is running.", "mode": "read-only", "wire-method": "ze-show:ddos-flowspec", "global-pipes": true }, { "path": "show ddos incidents", "description": "Show the recent DDoS incident ring (newest first): per incident the\ntarget vector (prefix/proto/port), attack family, top source addresses, peak pps/bps,\nstart/end time, and whether it is still active.", "mode": "read-only", "wire-method": "ze-show:ddos-incidents", "global-pipes": true }, { "path": "show ddos local", "description": "Show the on-host DDoS mitigation status: whether an nft drop rule is\ncurrently installed and the target vector (prefix / proto / port) it covers.", "mode": "read-only", "wire-method": "ze-show:ddos-local", "global-pipes": true }, { "path": "show ddos status", "description": "Show DDoS observation status: whether the incident store is running, the\nnumber of currently active attacks, and the number of incidents retained in the ring.", "mode": "read-only", "wire-method": "ze-show:ddos-status", "global-pipes": true }, { "path": "show debug", "description": "Show live debug state from the running daemon.\nLists every registered subsystem with its current log level and any\nactive flag or scope filters. Unlike 'debug show' (which reads the\nstored profile), this reflects actual runtime state.", "mode": "read-only", "wire-method": "ze-debug:debug-state", "global-pipes": true }, { "path": "show debug profile", "description": "Show stored debug profiles (list, 'name ' for one, add 'module ' to filter).", "mode": "offline" }, { "path": "show dns cache", "description": "Inspect the DNS cache.\n'stats' shows hit/miss/eviction counters. 'list' shows all cached\nentries. 'record ' shows one specific entry. Requires the DNS\ncomponent to be active.", "mode": "read-only", "wire-method": "ze-show:dns-cache", "args": [ { "name": "action", "type": "enum", "values": [ "list", "record", "stats" ] }, { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show dns lookup", "description": "Look up a DNS name from the router.\nResolves using the daemon's DNS resolver (falls back to\nthe system resolver if no DNS component is configured). Default type\nis A. Returns records, TTL, and query time. Supports A, AAAA, MX,\nNS, TXT, CNAME, and PTR.", "mode": "read-only", "wire-method": "ze-show:dns-lookup", "args": [ { "name": "hostname", "type": "string" }, { "name": "type", "type": "enum", "values": [ "A", "AAAA", "CNAME", "MX", "NS", "PTR", "TXT" ] } ], "global-pipes": true }, { "path": "show doctor", "description": "Check if this box is ready to run Ze.\nVerifies runtime dependencies: required files, sockets, ports, and\nkernel modules. Each check reports pass or fail with a reason. Run\nthis before first start or after changing the platform setup.", "mode": "read-only", "wire-method": "ze-show:doctor", "global-pipes": true }, { "path": "show env get", "description": "Show one environment variable in detail.\nReturns the variable name, current value, default, and what it\ncontrols. Usage: show env get .", "mode": "read-only", "wire-method": "ze-show:env-get", "global-pipes": true }, { "path": "show env list", "description": "List all Ze environment variables with their current values.\nShows which env vars are set and their defaults.", "mode": "read-only", "wire-method": "ze-show:env-list", "global-pipes": true }, { "path": "show env registered", "description": "List every registered environment variable with metadata.\nIncludes type, default, description, and whether it is currently set.", "mode": "read-only", "wire-method": "ze-show:env-registered", "global-pipes": true }, { "path": "show errors", "description": "Show recent errors across all subsystems, newest first.\nThis is the first place to look when something goes wrong. Filter\nwith source to narrow to one subsystem, count to limit\noutput.", "mode": "read-only", "wire-method": "ze-show:errors", "global-pipes": true }, { "path": "show event list", "description": "List every event type you can subscribe to.\nShows event name, category, and payload structure. Use this to\ndiscover what events are available before subscribing.", "mode": "read-only", "wire-method": "ze-bgp:event-list", "global-pipes": true }, { "path": "show event namespaces", "description": "List all event namespaces and how many events each has logged.\nTells you which subsystems are generating events and how active\nthey are.", "mode": "read-only", "wire-method": "ze-show:event-namespaces", "global-pipes": true }, { "path": "show event recent", "description": "Show recent events, newest first.\nEach event includes timestamp, namespace, and type. Filter with\nnamespace to focus on one area, count to limit output.\nUseful for reconstructing what happened before an incident.", "mode": "read-only", "wire-method": "ze-show:event-recent", "global-pipes": true }, { "path": "show firewall group", "description": "Show members of a firewall address/port group.\nWithout arguments, lists all known groups. With a name, shows the\nset elements. Reads from the last applied config, not the kernel.", "mode": "read-only", "wire-method": "ze-show:firewall-group", "backend": [ "nft" ], "global-pipes": true }, { "path": "show firewall irr", "description": "Show IRR filter status for all cached ASN/AS-SET entries.\nLists each cached entry with prefix counts, last refresh time, and\nerror status. Use this to confirm that IRR prefix-lists are loaded\nand current before committing firewall config.", "mode": "read-only", "wire-method": "ze-show:firewall-irr-status", "global-pipes": true, "subcommands": [ "prefix" ] }, { "path": "show firewall irr prefix", "description": "Show IRR-resolved prefixes for a cached entry.\nUsage: show firewall irr prefix . Lists all IPv4 and\nIPv6 prefixes in the cached prefix-list for the given ASN or AS-SET.", "mode": "read-only", "wire-method": "ze-show:firewall-irr-prefix", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show firewall ruleset", "description": "Show the live firewall ruleset with per-term counters.\nUsage: show firewall ruleset . Joins applied desired state with\nkernel counters from the nft backend.", "mode": "read-only", "wire-method": "ze-show:firewall-ruleset", "backend": [ "nft" ], "global-pipes": true }, { "path": "show flow-export", "description": "Show flow export (NetFlow/IPFIX) collector status.\nWithout arguments, lists all configured collectors. With 'name ',\nshows details for that collector including protocol stats and errors.\nReturns not-configured when no exporter is active.", "mode": "read-only", "wire-method": "ze-show:flow-export", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show flow-recent", "description": "Show recent conntrack flow records from the bounded recent-flow ring.\nWithout arguments, returns every ring record (oldest to newest, up to the\nconfigured recent-flow-ring capacity). With 'dst ', filters to flows\nwhose destination is inside that prefix. The ring is fed only while conntrack\nexport is enabled; the filter is by destination prefix (conntrack is host-global\nand carries no ingress interface).", "mode": "read-only", "wire-method": "ze-show:flow-recent", "args": [ { "name": "dst", "type": "string" } ], "global-pipes": true }, { "path": "show geodns", "description": "GeoDNS server status: enabled, bind addresses/port, client-IP\nsource mode, zones, nameserver/host-set/source counts, and the\ncurrent SOA serial.", "mode": "read-only", "wire-method": "ze-show:geodns", "global-pipes": true }, { "path": "show gnmi", "description": "Show whether the gNMI server is running and how it is configured.\nReturns listen address, TLS details, authentication mode, and the\nnumber of active streaming subscribers.", "mode": "read-only", "wire-method": "ze-show:gnmi", "global-pipes": true }, { "path": "show health", "description": "Is this box healthy? One command to find out.\nReturns per-component health (bgp, fib, iface, plugins, l2tp, etc.)\nplus an overall status. Each component reports healthy, degraded, or\nunhealthy with a reason. Start here when troubleshooting.", "mode": "read-only", "wire-method": "ze-show:health", "global-pipes": true }, { "path": "show host all", "description": "Show the full hardware inventory in one shot.\nReturns every section (cpu, nic, dmi, memory, thermal, storage,\nkernel, platform) as a single JSON response. Ideal for support\nbundles or automated inventory collection.", "mode": "read-only", "wire-method": "ze-show:host-all", "global-pipes": true }, { "path": "show host cpu", "description": "Show what CPUs are in this box.\nReturns vendor, model, core/thread topology, hybrid layout, scaling\ndriver, current/min/max frequencies, and throttle counts.", "mode": "read-only", "wire-method": "ze-show:host-cpu", "global-pipes": true }, { "path": "show host dmi", "description": "Show the box's identity from SMBIOS/DMI.\nReturns system vendor, board name, BIOS version, and chassis type.\nUseful for inventory or confirming which hardware model you are on.", "mode": "read-only", "wire-method": "ze-show:host-dmi", "global-pipes": true }, { "path": "show host kernel", "description": "Show the running kernel version and boot parameters.\nReturns kernel release, command line, CPU microcode revision, boot\ntime, and security-relevant CPU flags (spectre mitigations, etc.).", "mode": "read-only", "wire-method": "ze-show:host-kernel", "global-pipes": true }, { "path": "show host memory", "description": "Show installed memory and ECC health.\nReturns DIMM sizes and, when the edac driver is present, correctable\nand uncorrectable error counters. Non-zero ECC counts mean you should\nplan a DIMM replacement.", "mode": "read-only", "wire-method": "ze-show:host-memory", "global-pipes": true }, { "path": "show host nic", "description": "Show physical NICs installed in this box.\nReturns driver, PCI vendor/device IDs, link speed, queue counts, and\nfirmware version. Virtual interfaces are excluded. Use this to confirm\nNIC firmware before an upgrade.", "mode": "read-only", "wire-method": "ze-show:host-nic", "global-pipes": true }, { "path": "show host platform", "description": "Show platform capabilities and constraints.\nReports read-only root, privilege level, systemd presence, gokrazy\nupdate socket, reboot-allowed flag, persistent-storage writability,\nand fd limits. Helps you understand what operations are possible\non this particular deployment.", "mode": "read-only", "wire-method": "ze-show:host-platform", "global-pipes": true }, { "path": "show host storage", "description": "Show storage devices attached to this box.\nReturns size, model, transport type (nvme, sata, mmc, virtio),\nrotational flag, and NVMe firmware version where applicable.", "mode": "read-only", "wire-method": "ze-show:host-storage", "global-pipes": true }, { "path": "show host thermal", "description": "Show temperature sensors and thermal throttle events.\nReturns hwmon sensor readings and per-CPU throttle counters. Non-zero\nthrottle counts mean the box has been running hot enough to slow down.", "mode": "read-only", "wire-method": "ze-show:host-thermal", "global-pipes": true }, { "path": "show interface", "description": "Show network interfaces on this box.\nWithout arguments, returns all interfaces with full detail.\nSubcommands: brief, type , errors, rate [], name detail,\nname counters.", "mode": "read-only", "wire-method": "ze-show:interface", "global-pipes": true, "subcommands": [ "brief", "errors", "name", "rate", "scan", "type" ] }, { "path": "show interface brief", "description": "One-line summary per interface: name, state, IP, and MTU.\nQuick way to see what is up and what addresses are assigned.", "mode": "read-only", "wire-method": "ze-show:interface", "global-pipes": true }, { "path": "show interface errors", "description": "Show interfaces that have errors or drops.\nFilters to only interfaces with non-zero Rx/Tx error or drop\ncounters. Quick way to find troubled links.", "mode": "read-only", "wire-method": "ze-show:interface", "global-pipes": true }, { "path": "show interface name counters", "description": "Show counters for one interface.\nUsage: show interface name counters.", "mode": "read-only", "wire-method": "ze-show:interface-counters", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show interface name detail", "description": "Show full detail for one interface.\nUsage: show interface name detail.", "mode": "read-only", "wire-method": "ze-show:interface-detail", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show interface rate", "description": "Show per-second traffic rates on your interfaces.\nReturns rx/tx bytes and packets per second. Pass an interface name\nto narrow the output. Requires the rate tracker. For continuous\nmonitoring, use 'monitor interface rate' instead.", "mode": "read-only", "wire-method": "ze-show:interface", "global-pipes": true }, { "path": "show interface scan", "description": "Discover and classify all OS interfaces.\nReturns name, Ze type (ethernet, bridge, vxlan, etc.), and MAC for\neach interface found. Pipe to table, yaml, or json for different\nviews. Useful during initial setup to see what the box has.", "mode": "read-only", "wire-method": "ze-show:interface-scan", "global-pipes": true }, { "path": "show interface type", "description": "Show only interfaces of a given type.\nUsage: show interface type . Types include ethernet, bridge,\nvxlan, wireguard, tunnel, bond, and more. If you pick an invalid\ntype, the error lists all valid ones.", "mode": "read-only", "wire-method": "ze-show:interface", "global-pipes": true }, { "path": "show isis database", "description": "Show the IS-IS link-state database.\nLists each LSP with its LSP ID, sequence number, remaining lifetime,\nchecksum, and overload bit, across Level-1 and Level-2.", "mode": "read-only", "wire-method": "ze-show:isis-database", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show isis database detail", "description": "Show the IS-IS link-state database with TLV detail.\nExpands each LSP into its decoded TLVs (type, length, value) so you\ncan read exactly what each node advertises.", "mode": "read-only", "wire-method": "ze-show:isis-database-detail", "global-pipes": true }, { "path": "show isis hostname", "description": "Show the IS-IS dynamic-hostname mapping (RFC 5301).\nMaps each System ID to the hostname it advertises in TLV 137.", "mode": "read-only", "wire-method": "ze-show:isis-hostname", "global-pipes": true }, { "path": "show isis interface", "description": "Show IS-IS-enabled circuits.\nReturns level, circuit type, metric, hello interval, hold multiplier,\npassive flag, DIS state, and the count of Up adjacencies per circuit.", "mode": "read-only", "wire-method": "ze-show:isis-interface", "global-pipes": true }, { "path": "show isis neighbor", "description": "Show IS-IS adjacencies.\nReturns the neighbor System ID, interface, level, adjacency state,\nand hold time for each IS-IS neighbor.", "mode": "read-only", "wire-method": "ze-show:isis-neighbor", "global-pipes": true }, { "path": "show isis route", "description": "Show IS-IS-computed routes.\nLists each prefix the SPF installed with its metric, level, up/down\nbit, and next-hops (address and outgoing interface).", "mode": "read-only", "wire-method": "ze-show:isis-route", "global-pipes": true, "subcommands": [ "ipv6" ] }, { "path": "show isis route ipv6", "description": "Show IS-IS-computed IPv6 routes (RFC 5308).\nLists each IPv6 prefix the SPF installed with its metric, level,\nand next-hops (link-local address and outgoing interface).", "mode": "read-only", "wire-method": "ze-show:isis-route-ipv6", "global-pipes": true }, { "path": "show isis spf-log", "description": "Show recent IS-IS SPF runs.\nReturns the most recent SPF runs with their timestamp, level, trigger,\nduration, and node count.", "mode": "read-only", "wire-method": "ze-show:isis-spf-log", "global-pipes": true }, { "path": "show l2tp", "description": "L2TP tunnel, session, and subscriber state.\nWithout a subcommand, shows a summary of tunnels and sessions.", "mode": "read-only", "wire-method": "ze-l2tp-api:summary", "global-pipes": true, "subcommands": [ "config", "cqm", "echo", "listeners", "observer", "reliable", "session", "session-history", "session-traffic", "sessions", "statistics", "tunnel", "tunnel-history", "tunnels" ] }, { "path": "show l2tp config", "description": "Show the resolved L2TP configuration.\nReturns the effective config after defaults and overrides. Confirms\nwhat the daemon is actually using.", "mode": "read-only", "wire-method": "ze-l2tp-api:config", "global-pipes": true }, { "path": "show l2tp cqm", "description": "Show subscriber line quality (CQM latency buckets).\nPass a login name for one subscriber or 'summary' for an overview.\nHelps diagnose poor subscriber experience.", "mode": "read-only", "wire-method": "ze-l2tp-api:cqm", "global-pipes": true }, { "path": "show l2tp echo", "description": "Show LCP echo health for a subscriber session.\nReturns echo request/reply counters and round-trip times. Rising\nloss or high RTT indicates a degraded line.", "mode": "read-only", "wire-method": "ze-l2tp-api:echo", "global-pipes": true }, { "path": "show l2tp listeners", "description": "Show which UDP sockets are listening for L2TP.\nLists each bound address, port, and the number of tunnels on it.", "mode": "read-only", "wire-method": "ze-l2tp-api:listeners", "global-pipes": true }, { "path": "show l2tp observer", "description": "Show recent events for a session (debug aid).\nReturns the event ring buffer for one session ID or 'all'. Useful\nfor understanding why a session failed to establish.", "mode": "read-only", "wire-method": "ze-l2tp-api:observer", "global-pipes": true }, { "path": "show l2tp reliable", "description": "Show the reliable transport window for a tunnel.\nReturns send/receive sequence numbers, window size, and retransmit\nqueue depth. Check here when tunnel control messages seem stuck.", "mode": "read-only", "wire-method": "ze-l2tp-api:reliable", "global-pipes": true }, { "path": "show l2tp session id", "description": "Show full detail for one L2TP session.\nPass the local session ID. Returns PPP state, assigned addresses,\nnegotiated LCP/NCP options, and traffic counters.", "mode": "read-only", "wire-method": "ze-l2tp-api:session", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show l2tp session-history", "description": "Show state transitions for a session over time.\nTimestamped FSM entries for session establishment. Use this when a\nsubscriber's session fails to come up.", "mode": "read-only", "wire-method": "ze-l2tp-api:session-history", "global-pipes": true }, { "path": "show l2tp session-traffic", "description": "Show traffic counters for a subscriber's PPP interface.\nReturns byte and packet counts, error counters, and current rates.\nCompare with CQM data to get the full picture of subscriber health.", "mode": "read-only", "wire-method": "ze-l2tp-api:session-traffic", "global-pipes": true }, { "path": "show l2tp sessions", "description": "List all active L2TP sessions.\nOne line per session: local/remote ID, parent tunnel, subscriber\nlogin, and uptime.", "mode": "read-only", "wire-method": "ze-l2tp-api:sessions", "global-pipes": true }, { "path": "show l2tp statistics", "description": "Show aggregate L2TP protocol counters.\nTunnels and sessions established, control messages sent/received,\nretransmits, and errors. Your first stop for L2TP health.", "mode": "read-only", "wire-method": "ze-l2tp-api:statistics", "global-pipes": true }, { "path": "show l2tp tunnel id", "description": "Show full detail for one L2TP tunnel.\nPass the local tunnel ID. Returns control channel state, peer\nendpoint, hello interval, and all assigned sessions.", "mode": "read-only", "wire-method": "ze-l2tp-api:tunnel", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show l2tp tunnel-history", "description": "Show state transitions for a tunnel over time.\nTimestamped FSM entries showing how the tunnel reached its current\nstate. Use this to diagnose tunnel establishment failures.", "mode": "read-only", "wire-method": "ze-l2tp-api:tunnel-history", "global-pipes": true }, { "path": "show l2tp tunnels", "description": "List all active L2TP tunnels.\nOne line per tunnel: local/remote ID, peer address, session count,\nand uptime.", "mode": "read-only", "wire-method": "ze-l2tp-api:tunnels", "global-pipes": true }, { "path": "show l2tp-health", "description": "Find your worst L2TP sessions at a glance.\nSorts sessions by echo loss ratio (worst first). Shows subscriber\nlogin, session state, echo count, average RTT, and CQM bucket count.\nReports how many sessions are degraded.", "mode": "read-only", "wire-method": "ze-show:l2tp-health", "global-pipes": true }, { "path": "show ldp binding", "description": "Show LDP FEC-to-label bindings.\nLists local and remote label bindings for each FEC (prefix).\nUse this to verify label distribution is working.", "mode": "read-only", "wire-method": "ze-show:ldp-binding", "global-pipes": true }, { "path": "show ldp neighbor", "description": "Show LDP neighbors and their session state.\nReturns peer address, transport address, session state, and\nhold time for each LDP neighbor.", "mode": "read-only", "wire-method": "ze-show:ldp-neighbor", "global-pipes": true }, { "path": "show log levels", "description": "Show what log level each subsystem is using.\nLists every registered logger with its current level. Use\n'request log level' to change a level at runtime without restarting.", "mode": "read-only", "wire-method": "ze-bgp:log-levels", "global-pipes": true }, { "path": "show log recent", "description": "Show recent log entries from the in-memory ring.\nFilters (all optional): level , component , count .\nNewest entries first. Useful when you cannot access the log file\ndirectly.", "mode": "read-only", "wire-method": "ze-bgp:log-recent", "args": [ { "name": "component", "type": "string" }, { "name": "count", "type": "uint" }, { "name": "level", "type": "enum", "values": [ "debug", "disabled", "err", "info", "warn" ] } ], "global-pipes": true }, { "path": "show metrics list", "description": "List all registered metric names (no values).\nUseful for discovering what metrics exist before querying them.", "mode": "read-only", "wire-method": "ze-bgp:metrics-list", "global-pipes": true }, { "path": "show metrics values", "description": "Dump all metrics in Prometheus text format.\nOutputs every registered metric with labels and values. Suitable\nfor feeding into Prometheus, Grafana, or curl-based monitoring.", "mode": "read-only", "wire-method": "ze-bgp:metrics-values", "global-pipes": true }, { "path": "show metrics-query", "description": "Query a specific Prometheus metric by name.\nUsage: show metrics-query [label=value ...]. Returns matching\ntime series from the internal registry. Multiple label filters are\nANDed. More targeted than the full metrics dump.", "mode": "read-only", "wire-method": "ze-show:metrics-query", "global-pipes": true }, { "path": "show mpls forwarding", "description": "Show MPLS forwarding entries installed in the kernel.\nEach entry shows the incoming label, swap/push/pop operation, and\noutgoing next-hop. Pass 'limit N' to cap large tables. Linux only.", "mode": "read-only", "wire-method": "ze-show:mpls-forwarding", "args": [ { "name": "limit", "type": "uint" } ], "global-pipes": true }, { "path": "show neighbor", "description": "Show the ARP and neighbor discovery table.\nLists IPv4 ARP and IPv6 ND entries with MAC addresses and states.\nPass ipv4 or ipv6 to filter by address family; no argument shows both.\nFor the IPv4-only view, 'show arp' is a shortcut.", "mode": "read-only", "wire-method": "ze-show:neighbor", "args": [ { "name": "family", "type": "enum", "values": [ "all", "any", "ipv4", "ipv6" ] } ], "global-pipes": true }, { "path": "show ospf", "description": "OSPFv2 process summary: router-id, areas, ABR/ASBR status, and stub-router (max-metric) state (RFC 2328).", "mode": "read-only", "wire-method": "ze-show:ospf", "global-pipes": true, "subcommands": [ "border-routers", "database", "graceful-restart", "instance", "interface", "ipv6", "ldp-sync", "neighbor", "route", "segment-routing", "spf", "te-database", "virtual-links" ] }, { "path": "show ospf border-routers", "description": "Show routes to OSPF area-border and AS-boundary routers.\nLists each reachable ABR/ASBR with its router-id, cost, next-hops, and\narea.", "mode": "read-only", "wire-method": "ze-show:ospf-border-routers", "global-pipes": true }, { "path": "show ospf database", "description": "Show the OSPF link-state database.\nLists each LSA with its LS Type, Link State ID, Advertising Router,\nsequence number, age, and checksum.", "mode": "read-only", "wire-method": "ze-show:ospf-database", "global-pipes": true, "subcommands": [ "asbr-summary", "external", "network", "nssa-external", "opaque-area", "opaque-as", "opaque-link", "router", "router-information", "summary" ] }, { "path": "show ospf database asbr-summary", "description": "Show only ASBR-Summary-LSAs (Type 4).", "mode": "read-only", "wire-method": "ze-show:ospf-database-asbr-summary", "global-pipes": true }, { "path": "show ospf database external", "description": "Show only AS-external-LSAs (Type 5).", "mode": "read-only", "wire-method": "ze-show:ospf-database-external", "global-pipes": true }, { "path": "show ospf database network", "description": "Show only Network-LSAs (Type 2).", "mode": "read-only", "wire-method": "ze-show:ospf-database-network", "global-pipes": true }, { "path": "show ospf database nssa-external", "description": "Show only NSSA-external-LSAs (Type 7, RFC 3101).", "mode": "read-only", "wire-method": "ze-show:ospf-database-nssa-external", "global-pipes": true }, { "path": "show ospf database opaque-area", "description": "Show only area-scope opaque-LSAs (Type 10, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-area", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf database opaque-area detail", "description": "Decode each area-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-area-detail", "global-pipes": true }, { "path": "show ospf database opaque-as", "description": "Show only AS-scope opaque-LSAs (Type 11, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-as", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf database opaque-as detail", "description": "Decode each AS-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-as-detail", "global-pipes": true }, { "path": "show ospf database opaque-link", "description": "Show only link-local opaque-LSAs (Type 9, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-link", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf database opaque-link detail", "description": "Decode each link-local opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).", "mode": "read-only", "wire-method": "ze-show:ospf-database-opaque-link-detail", "global-pipes": true }, { "path": "show ospf database router", "description": "Show only Router-LSAs (Type 1).", "mode": "read-only", "wire-method": "ze-show:ospf-database-router", "global-pipes": true }, { "path": "show ospf database router-information", "description": "Show the Router Information LSAs (RFC 7770) for both address\nfamilies -- OSPFv2 opaque type 4 and OSPFv3 function code 12 -- decoded into the\nadvertised informational capability bits and the TLV list.", "mode": "read-only", "wire-method": "ze-show:ospf-database-router-information", "global-pipes": true }, { "path": "show ospf database summary", "description": "Show only Summary-LSAs (Type 3, inter-area network).", "mode": "read-only", "wire-method": "ze-show:ospf-database-summary", "global-pipes": true }, { "path": "show ospf graceful-restart", "description": "Show OSPFv2 (IPv4) Graceful Restart state (RFC 3623): the restarter\nstate (in-restart or not, grace end, reason) and the per-neighbor helper\nsessions (which neighbors are being helped and their remaining grace).", "mode": "read-only", "wire-method": "ze-show:ospf-graceful-restart", "global-pipes": true }, { "path": "show ospf instance", "description": "Show the configured OSPFv2 instances (RFC 6549 Multi-Instance).\nLists each Instance ID with its router-id and the size of its isolated\narea, interface, neighbor, and link-state database state.", "mode": "read-only", "wire-method": "ze-show:ospf-instance", "global-pipes": true }, { "path": "show ospf interface", "description": "Show OSPF-enabled interfaces.\nReturns area, network-type, cost, ISM state, DR/BDR, hello/dead\nintervals, priority, and passive flag per interface.", "mode": "read-only", "wire-method": "ze-show:ospf-interface", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf interface detail", "description": "Show full per-interface state (spec-ospf-ext-14): ISM, DR/BDR election detail, all three timers, and the opaque-capable neighbour count.", "mode": "read-only", "wire-method": "ze-show:ospf-interface-detail", "global-pipes": true }, { "path": "show ospf ipv6", "description": "Show the OSPFv3 (IPv6) address-family instances (RFC 5838).\nLists each configured address family (ipv6-unicast, ipv6-multicast,\nipv4-unicast, ipv4-multicast) with its Instance ID, router-id, and\nneighbor/interface counts, so multiple AF instances on a link are\ndistinguishable.", "mode": "read-only", "wire-method": "ze-show:ospf-ipv6", "global-pipes": true, "subcommands": [ "database", "graceful-restart", "instance", "interface", "neighbor", "segment-routing", "spf" ] }, { "path": "show ospf ipv6 database", "description": "Show the OSPFv3 (IPv6) link-state database with each native scope-aware LSA decoded (RFC 5340). Base types decode into named fields; unknown function codes fall back to a scope-aware header + body-hex view (spec-ospf-ext-14).", "mode": "read-only", "wire-method": "ze-show:ospfv3-database", "global-pipes": true, "subcommands": [ "detail", "extended", "router", "router-information", "scope", "segment-routing" ] }, { "path": "show ospf ipv6 database detail", "description": "Decode every OSPFv3 LSA body with its scope-aware header (RFC 5340 section A.4.2.1).", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-detail", "global-pipes": true }, { "path": "show ospf ipv6 database extended", "description": "Show the RFC 8362 extended OSPFv3 LSAs (E-Router / E-Network / E-Inter-Area / E-AS-External / E-Link / E-Intra-Area-Prefix) decoded into named TLVs.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-extended", "global-pipes": true }, { "path": "show ospf ipv6 database router detail", "description": "Decode each OSPFv3 Router-LSA body.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-router-detail", "global-pipes": true }, { "path": "show ospf ipv6 database router-information", "description": "Show the OSPFv3 Router Information LSAs (RFC 7770, function code 12) decoded into capability bits and TLVs.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-router-information", "global-pipes": true }, { "path": "show ospf ipv6 database scope area", "description": "Show only area-scope (S2/S1 = 01) LSAs.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-scope-area", "global-pipes": true }, { "path": "show ospf ipv6 database scope as", "description": "Show only AS-scope (S2/S1 = 10) LSAs.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-scope-as", "global-pipes": true }, { "path": "show ospf ipv6 database scope link", "description": "Show only link-local (S2/S1 = 00) LSAs, including the per-interface Link-LSA store.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-scope-link", "global-pipes": true }, { "path": "show ospf ipv6 database segment-routing", "description": "Summarise the OSPFv3 Segment Routing content (RFC 8666) carried in the RI and extended LSAs.", "mode": "read-only", "wire-method": "ze-show:ospfv3-database-segment-routing", "global-pipes": true }, { "path": "show ospf ipv6 graceful-restart", "description": "Show OSPFv3 (IPv6) Graceful Restart state (RFC 5187): the restarter\nstate (in-restart or not, grace end, reason) and the per-neighbor helper\nsessions (which neighbors are being helped and their remaining grace).", "mode": "read-only", "wire-method": "ze-show:ospf-ipv6-graceful-restart", "global-pipes": true }, { "path": "show ospf ipv6 instance", "description": "Enumerate the active OSPFv3 address-family instances (RFC 5838 section 2): each with its address family, Instance ID, area count, and neighbor count.", "mode": "read-only", "wire-method": "ze-show:ospfv3-instance", "global-pipes": true }, { "path": "show ospf ipv6 interface", "description": "Show OSPFv3 (IPv6-family) interfaces and their RFC 4552 IPsec status.\nReturns per interface whether IPsec is configured, the protocol (ah/esp) and\nSPI, and whether the kernel SA is installed. The key is never shown.", "mode": "read-only", "wire-method": "ze-show:ospf-ipv6-interface", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf ipv6 interface detail", "description": "Show full per-interface OSPFv3 state (spec-ospf-ext-14): ISM, DR/BDR by Router ID, timers, the local Interface ID and Instance ID.", "mode": "read-only", "wire-method": "ze-show:ospfv3-interface-detail", "global-pipes": true }, { "path": "show ospf ipv6 neighbor", "description": "Show OSPFv3 (IPv6) neighbors: the link-local address as identity, adjacency state, DR/BDR by Router ID, and dead time.", "mode": "read-only", "wire-method": "ze-show:ospfv3-neighbor", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf ipv6 neighbor detail", "description": "Show full per-neighbor OSPFv3 state (spec-ospf-ext-14): the advertised Interface ID, DD sequence, decoded Options (R/V6/E/N/AF), list sizes, last NSM event, and timers.", "mode": "read-only", "wire-method": "ze-show:ospfv3-neighbor-detail", "global-pipes": true }, { "path": "show ospf ipv6 segment-routing", "description": "Show OSPFv3 (IPv6) Segment Routing state (RFC 8666): the configured\nSRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node\nPrefix-SIDs, and the Adjacency-SIDs allocated per adjacency.", "mode": "read-only", "wire-method": "ze-show:ospf-ipv6-segment-routing", "global-pipes": true }, { "path": "show ospf ipv6 spf", "description": "Show the OSPFv3 (IPv6) per-area SPF run history.", "mode": "read-only", "wire-method": "ze-show:ospfv3-spf", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf ipv6 spf detail", "description": "Explain why each OSPFv3 route won (spec-ospf-ext-14), AF/Instance-ID tagged; read-only.", "mode": "read-only", "wire-method": "ze-show:ospfv3-spf-detail", "global-pipes": true }, { "path": "show ospf ldp-sync", "description": "Show OSPF LDP-IGP synchronization state (RFC 5443, RFC 6138).\nLists each ldp-sync interface with its state (not-synchronized /\nhold-down / synchronized), remaining hold-down, effective metric, and\nwhether it is stuck not-synchronized after having been synchronized.", "mode": "read-only", "wire-method": "ze-show:ospf-ldp-sync", "global-pipes": true }, { "path": "show ospf neighbor", "description": "Show OSPF neighbors.\nReturns each neighbor's router-id, interface, adjacency state, DR/BDR,\npriority, dead time, and address.", "mode": "read-only", "wire-method": "ze-show:ospf-neighbor", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf neighbor detail", "description": "Show full per-neighbor state (spec-ospf-ext-14): DD sequence, decoded Options (incl. the RFC 5250 O-bit), request/summary list sizes, last NSM event, and timers.", "mode": "read-only", "wire-method": "ze-show:ospf-neighbor-detail", "global-pipes": true }, { "path": "show ospf route", "description": "Show OSPF-computed routes.\nLists each prefix with its path type (intra/inter/external-1/2), cost,\nnext-hops, and area.", "mode": "read-only", "wire-method": "ze-show:ospf-route", "global-pipes": true, "subcommands": [ "fast-reroute" ] }, { "path": "show ospf route fast-reroute", "description": "Show OSPF fast-reroute (LFA / TI-LFA) backups (RFC 5286).\nLists each prefix's primary next-hops with their pre-computed loop-free\nbackup, protection class (node/link/downstream), and TI-LFA repair label\nstack. Unprotected primaries are shown as unprotected.", "mode": "read-only", "wire-method": "ze-show:ospf-route-fast-reroute", "global-pipes": true }, { "path": "show ospf segment-routing", "description": "Show OSPFv2 (IPv4) Segment Routing state (RFC 8665): the configured\nSRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node\nPrefix-SIDs, and the Adjacency-SIDs allocated per adjacency.", "mode": "read-only", "wire-method": "ze-show:ospf-segment-routing", "global-pipes": true }, { "path": "show ospf spf", "description": "Show recent OSPF SPF runs.\nReturns the most recent per-area SPF runs with their timestamp,\nduration, node count, and pending state.", "mode": "read-only", "wire-method": "ze-show:ospf-spf", "global-pipes": true, "subcommands": [ "detail" ] }, { "path": "show ospf spf detail", "description": "Explain why each route won (spec-ospf-ext-14): the candidate paths considered per prefix, the winning cost, and the RFC 2328 section 16.4 path-preference tie-break. Read-only; the route table and SPF run count are unchanged.", "mode": "read-only", "wire-method": "ze-show:ospf-spf-detail", "global-pipes": true }, { "path": "show ospf te-database", "description": "Show the OSPF Traffic Engineering Database (RFC 3630 / RFC 5392):\nrouter addresses plus TE links with their Link ID, local/remote address, link\ntype, TE metric, bandwidths, admin group, and (for inter-AS links) remote AS and\nremote ASBR.", "mode": "read-only", "wire-method": "ze-show:ospf-te-database", "global-pipes": true }, { "path": "show ospf virtual-links", "description": "Show OSPF virtual links (RFC 2328 section 15).\nLists each configured virtual link with its transit area, remote\nrouter-id, adjacency state, computed cost, and transit next hop.", "mode": "read-only", "wire-method": "ze-show:ospf-virtual-links", "global-pipes": true }, { "path": "show ping", "description": "Ping a target from the router itself.\nSends ICMP echo requests to (IP or hostname). Default count\nis 5. Timeout uses Go duration syntax (e.g. 3s, 500ms). Confirms\nreachability from this box, not from your workstation.", "mode": "read-only", "wire-method": "ze-show:ping", "args": [ { "name": "count", "type": "uint" }, { "name": "dest", "type": "string" }, { "name": "timeout", "type": "string" } ], "global-pipes": true }, { "path": "show pki certificate name", "description": "Inspect a specific certificate in detail.\nUsage: show pki certificate name [pem | bundle pem | fingerprint\n[sha256|sha384|sha512]]. Use 'pem' to export for another system,\n'fingerprint' to verify identity.", "mode": "read-only", "wire-method": "ze-show:pki-certificate", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show pki certificates", "description": "List all loaded certificates with expiry dates.\nShows name, type (CA or device), subject, issuer, expiry, and\nvalidity status. Check here to find certificates approaching\nexpiration.", "mode": "read-only", "wire-method": "ze-show:pki-certificates", "global-pipes": true }, { "path": "show policy chain peer", "description": "Show the import/export filter chain applied to a peer.\nUsage: show policy chain peer [import|export]. The selector\n(IP, name, as) and the optional direction are parsed by the handler.\nShows the effective chain after group inheritance is resolved. Without\na direction keyword, shows both import and export.", "mode": "read-only", "wire-method": "ze-show:policy-chain", "global-pipes": true }, { "path": "show policy list", "description": "List all available filter types and named instances.\nShows each filter type and its implementing plugin. Check here\nwhen building a new policy chain to see what filters you can use.", "mode": "read-only", "wire-method": "ze-show:policy-list", "global-pipes": true }, { "path": "show policy test peer", "description": "Test what your policy does to a specific UPDATE.\nFeed a hex-encoded BGP UPDATE through a peer's filter chain and see\nthe accept/reject result plus attribute modifications at each stage.\nRead-only: no routes are actually forwarded. Great for validating\npolicy changes before you commit.\nUsage: show policy test peer import|export [filter ]\nupdate [source-asn4 true|false]. The selector and the\nimport/export/filter/update/source-asn4 tokens are parsed by the\nhandler so the peer selector can be a free-form name or address.", "mode": "read-only", "wire-method": "ze-show:policy-test", "global-pipes": true }, { "path": "show policy-routes", "description": "Show policy-based routing rules.\nLists PBR rules with match criteria and routing actions.", "mode": "read-only", "wire-method": "ze-show:policy-routes", "global-pipes": true }, { "path": "show pppoe", "description": "PPPoE session and protocol state.\nWithout a subcommand, shows a summary of active sessions.", "mode": "read-only", "wire-method": "ze-pppoe-api:summary", "global-pipes": true, "subcommands": [ "interfaces", "session", "sessions", "statistics" ] }, { "path": "show pppoe interfaces", "description": "Show which interfaces are accepting PPPoE sessions.\nLists each PPPoE-enabled interface with its service name, session\nlimit, and how many sessions are currently active.", "mode": "read-only", "wire-method": "ze-pppoe-api:interfaces", "global-pipes": true }, { "path": "show pppoe session id", "description": "Show full detail for one PPPoE session.\nPass the session ID. Returns discovery tags, LCP/NCP state,\nassigned addresses, and traffic counters.", "mode": "read-only", "wire-method": "ze-pppoe-api:session", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show pppoe sessions", "description": "List all active PPPoE sessions.\nOne line per session: session ID, MAC, subscriber login, uptime,\nand assigned addresses.", "mode": "read-only", "wire-method": "ze-pppoe-api:sessions", "global-pipes": true }, { "path": "show pppoe statistics", "description": "Show PPPoE protocol message counters.\nReturns PADI, PADO, PADR, PADS, PADT counts, active sessions, and\nerrors. A rising PADI count with flat PADS means sessions are not\ncompleting.", "mode": "read-only", "wire-method": "ze-pppoe-api:statistics", "global-pipes": true }, { "path": "show probe-round", "description": "Run a parallel traceroute probe round to a target.\nSends all probes concurrently for faster results than sequential\ntraceroute. Returns per-hop RTT and IP. Use probes and max-hops\nto tune accuracy vs speed.", "mode": "read-only", "wire-method": "ze-show:probe-round", "args": [ { "name": "dest", "type": "string" }, { "name": "max-hops", "type": "uint" }, { "name": "probes", "type": "uint" }, { "name": "timeout", "type": "string" } ], "global-pipes": true }, { "path": "show route", "description": "Show the kernel routing table.\nLists installed routes with next-hop, interface, protocol, and metric.\nPass a CIDR prefix or 'default' to filter, or a route limit to cap the\noutput.", "mode": "read-only", "wire-method": "ze-show:route", "args": [ { "name": "limit", "type": "uint" }, { "name": "prefix", "type": "string" } ], "global-pipes": true, "subcommands": [ "lookup" ] }, { "path": "show route lookup", "description": "Look up which route the kernel would use for a given IP.\nPerforms a longest-prefix-match and returns the matching route with\ngateway, interface, protocol, and metric. Usage: show route lookup\n.", "mode": "read-only", "wire-method": "ze-show:route-lookup", "global-pipes": true }, { "path": "show rr peers", "description": "Show route reflector client peers.\nLists each RR client with session state and reflected route counts.", "mode": "read-only", "wire-method": "ze-show:rr-peers", "global-pipes": true }, { "path": "show rr status", "description": "Show whether the route reflector is active.\nReturns cluster ID, running state, and summary statistics\n(reflected routes, client count).", "mode": "read-only", "wire-method": "ze-show:rr-status", "global-pipes": true }, { "path": "show rsvp-te fast-reroute", "description": "Show RSVP-TE Fast Reroute (RFC 4090) protection state.\nReturns each configured facility-backup bypass LSP and each protected\nLSP with its armed bypass, mode, and whether local protection is\navailable and in use.", "mode": "read-only", "wire-method": "ze-show:rsvp-te-fast-reroute", "global-pipes": true }, { "path": "show rsvp-te interface", "description": "Show RSVP-TE bandwidth allocation per interface.\nReturns reserved, available, and maximum bandwidth for each\nTE-enabled interface.", "mode": "read-only", "wire-method": "ze-show:rsvp-te-interface", "global-pipes": true }, { "path": "show rsvp-te lsp", "description": "Show RSVP-TE label-switched paths.\nReturns state, role (ingress/transit/egress), reserved bandwidth,\nand in/out labels for each LSP.", "mode": "read-only", "wire-method": "ze-show:rsvp-te-lsp", "global-pipes": true }, { "path": "show rsvp-te tunnel", "description": "Show configured RSVP-TE tunnels and their current state.\nReturns tunnel name, endpoints, signaling state, and active LSP.", "mode": "read-only", "wire-method": "ze-show:rsvp-te-tunnel", "global-pipes": true }, { "path": "show schema events", "description": "List all notification types defined in YANG API modules.\nShows which events a plugin can subscribe to.", "mode": "read-only", "wire-method": "ze-show:schema-events", "global-pipes": true }, { "path": "show schema handlers", "description": "Show which handler serves each YANG module.\nMaps module names to their implementing Go handler.", "mode": "read-only", "wire-method": "ze-show:schema-handlers", "global-pipes": true }, { "path": "show schema list", "description": "List all YANG schemas loaded by the daemon.\nShows module name, namespace, and revision for each schema.", "mode": "read-only", "wire-method": "ze-show:schema-list", "global-pipes": true }, { "path": "show schema methods", "description": "List all RPC methods defined in YANG API modules.\nUseful for plugin developers to discover available operations.", "mode": "read-only", "wire-method": "ze-show:schema-methods", "global-pipes": true }, { "path": "show schema protocol", "description": "Show the wire protocol version and format details.\nUseful for checking compatibility between Ze versions.", "mode": "read-only", "wire-method": "ze-show:schema-protocol", "global-pipes": true }, { "path": "show static", "description": "Show static routes defined in the configuration.\nLists each static route with its prefix, next-hop, and interface.", "mode": "read-only", "wire-method": "ze-show:static", "global-pipes": true }, { "path": "show status", "description": "Show process status, uptime, and resource usage.", "mode": "read-only", "wire-method": "ze-system:daemon-status", "global-pipes": true }, { "path": "show storage smart", "description": "Show disk health via SMART data.\nReturns health status, temperature, power-on hours, and self-test\nschedule for each block device. Replace drives that report failing\nhealth before they cause data loss.", "mode": "read-only", "wire-method": "ze-show:storage-smart", "global-pipes": true }, { "path": "show subscriber", "description": "Show a summary of all subscriber sessions.\nCounts by access type (PPPoE, L2TP, IPoE) with totals. Quick way\nto see how many subscribers are online.", "mode": "read-only", "wire-method": "ze-subscriber-api:summary", "global-pipes": true, "subcommands": [ "id" ] }, { "path": "show subscriber id detail", "description": "Show everything about one subscriber session.\nPass the session ID. Returns access type, assigned addresses,\nauthentication state, uptime, and traffic counters.", "mode": "read-only", "wire-method": "ze-subscriber-api:detail", "args": [ { "name": "id", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show system conntrack", "description": "Show the kernel connection tracking table.\nReturns conntrack entry count, table size, timeouts, and loaded\nmodules. Requires the nft backend. Check this when you suspect\nconntrack table exhaustion is dropping traffic.", "mode": "read-only", "wire-method": "ze-show:system-conntrack", "backend": [ "nft" ], "global-pipes": true }, { "path": "show system cpu", "description": "Show CPU utilization context for the daemon.\nReturns goroutine count, logical CPU count, and GOMAXPROCS setting.\nUseful when the box feels sluggish and you want to see if Ze is\nhogging threads.", "mode": "read-only", "wire-method": "ze-show:system-cpu", "global-pipes": true }, { "path": "show system date", "description": "Show the daemon's current wall-clock time and timezone.\nUseful for correlating log timestamps when the box is in a\ndifferent timezone than you are.", "mode": "read-only", "wire-method": "ze-show:system-date", "global-pipes": true }, { "path": "show system file-descriptors", "description": "Show how many file descriptors the daemon has open.\nSummary mode: totals by type (socket, pipe, file). Detail mode: every\nfd with its path and type. Linux only (reads /proc/self/fd). Check\nthis when you suspect fd exhaustion.", "mode": "read-only", "wire-method": "ze-show:system-file-descriptors", "args": [ { "name": "mode", "type": "enum", "values": [ "detail", "summary" ] } ], "global-pipes": true }, { "path": "show system goroutines", "description": "Dump goroutine stacks for debugging hangs or deadlocks.\nModes: summary (groups by state), blocked (only lock/channel waiters),\nfull (all stacks). Default: summary. Share the output with support\nwhen the daemon stops responding.", "mode": "read-only", "wire-method": "ze-show:system-goroutines", "args": [ { "name": "mode", "type": "enum", "values": [ "blocked", "full", "summary" ] } ], "global-pipes": true }, { "path": "show system kernel-log", "description": "Show kernel log messages (dmesg-style).\nReads from /dev/kmsg. Filter by syslog level (emerg through debug)\nand limit with count. Without count, you get everything available.\nLinux only. Useful for spotting NIC errors or OOM events.", "mode": "read-only", "wire-method": "ze-show:system-kernel-log", "args": [ { "name": "count", "type": "uint" }, { "name": "level", "type": "enum", "values": [ "alert", "crit", "debug", "emerg", "err", "info", "notice", "warn" ] } ], "global-pipes": true }, { "path": "show system memory", "description": "Show how much memory the daemon is using.\nReturns allocated bytes, heap in-use, total allocations, GC cycles,\nand last GC pause duration. Compare over time to spot leaks.", "mode": "read-only", "wire-method": "ze-show:system-memory", "global-pipes": true }, { "path": "show system memory-map", "description": "Show the process memory footprint from the kernel's view.\nReturns VmRSS, VmSize, VmSwap, and thread count from /proc/self/status.\nComplements 'show system memory' (Go runtime) with the OS-level picture.", "mode": "read-only", "wire-method": "ze-show:system-memory-map", "global-pipes": true }, { "path": "show system ntp", "description": "NTP clock synchronization status", "mode": "read-only", "wire-method": "ze-show:system-ntp", "global-pipes": true, "subcommands": [ "peers" ] }, { "path": "show system ntp peers", "description": "Show NTP peers with offset, RTT, stratum, and reachability.\nTells you whether your clock is synced and how far off each\nNTP server thinks you are.", "mode": "read-only", "wire-method": "ze-show:system-ntp-peers", "global-pipes": true }, { "path": "show system platform", "description": "Show what kind of platform the daemon is running on.\nReports whether this is gokrazy, systemd, container, plain-linux, or\ndarwin, along with platform-specific capabilities.", "mode": "read-only", "wire-method": "ze-show:system-platform", "global-pipes": true }, { "path": "show system profile", "description": "Capture a runtime profile for performance analysis.\nTypes: cpu (requires duration, e.g. 30s), heap, goroutine, allocs\n(instant snapshots). Output is pprof format you can open with\n'go tool pprof'. Send the file to support for deep analysis.", "mode": "read-only", "wire-method": "ze-show:system-profile", "args": [ { "name": "duration", "type": "string" }, { "name": "type", "type": "enum", "values": [ "allocs", "cpu", "goroutine", "heap" ] } ], "global-pipes": true }, { "path": "show system sockets", "description": "Show open TCP and UDP sockets on this box.\nFilters: [tcp|udp] [state ] [port ], all optional and\ncombinable. States use kernel names (ESTABLISHED, LISTEN, TIME_WAIT).\nLinux only. Good for confirming listeners or spotting stuck connections.", "mode": "read-only", "wire-method": "ze-show:system-sockets", "args": [ { "name": "port", "type": "uint" }, { "name": "protocol", "type": "enum", "values": [ "tcp", "udp" ] }, { "name": "state", "type": "string" } ], "global-pipes": true }, { "path": "show system subsystem list", "description": "List every registered subsystem and whether it is running.\nShows you which components (bgp, dns, web, l2tp, etc.) are active,\nstopped, or failed.", "mode": "read-only", "wire-method": "ze-show:system-subsystem-list", "global-pipes": true }, { "path": "show system update", "description": "Check if a firmware update is available.\nShows the running version, latest available version, and when the\nlast check ran. Use 'update system firmware check' to trigger an\nimmediate re-check.", "mode": "read-only", "wire-method": "ze-show:system-update", "global-pipes": true, "subcommands": [ "history" ] }, { "path": "show system update history", "description": "Show recent firmware update activity.\nLists the last 20 update events: checks, downloads, installs,\nand rollbacks with timestamps and outcomes.", "mode": "read-only", "wire-method": "ze-show:system-update-history", "global-pipes": true }, { "path": "show tcp-check", "description": "Test TCP connectivity to a remote host and port.\nTries to open a TCP connection and reports success or failure with\nthe connection time. Use 'source ' to bind a specific local\naddress. Quick way to verify a peer's BGP port is reachable.", "mode": "read-only", "wire-method": "ze-show:tcp-check", "args": [ { "name": "host", "type": "string", "mandatory": true }, { "name": "port", "type": "uint", "mandatory": true }, { "name": "source", "type": "string" }, { "name": "timeout", "type": "string" } ], "global-pipes": true }, { "path": "show traceroute", "description": "Trace the network path from this router to a target.\nShows each hop with its IP and round-trip time. Dest can be an IP\nor hostname. Defaults: 30 max hops, 3 probes per hop. Increase\nprobes for more reliable RTT measurements.", "mode": "read-only", "wire-method": "ze-show:traceroute", "args": [ { "name": "dest", "type": "string" }, { "name": "max-hops", "type": "uint" }, { "name": "probes", "type": "uint" }, { "name": "timeout", "type": "string" } ], "global-pipes": true }, { "path": "show traffic control", "description": "Show traffic control (QoS) configuration per interface.\nWithout arguments, lists every interface with its qdisc type and\nclass/filter counts. With an interface name, shows the full qdisc\nand class breakdown. Use this to verify your shaping is applied.", "mode": "read-only", "wire-method": "ze-show:traffic", "global-pipes": true }, { "path": "show traffic usage", "description": "Show per-interface traffic byte counters captured by eBPF TCX.\nPer destination/source port and protocol counters are always present; per-IP\ntop-talker counters appear when track-ip is enabled. Without arguments, lists\nall monitored interfaces. With 'name ', shows that one interface.", "mode": "read-only", "wire-method": "ze-show:traffic-usage", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show traffic-feature", "description": "Show neutral per-source traffic feature signals: fan-out (distinct destinations),\nout/in byte ratio (exfiltration), destination-port entropy, new-peer, rare-port/proto, and coarse beaconing.\nWithout arguments, shows the top source entities. With 'name
', filters to one source.", "mode": "read-only", "wire-method": "ze-show:traffic-feature", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show traffic-stat", "description": "Show aggregated traffic snapshot (interface rates, top talkers, top ports, severity).\nWithout arguments, shows all interfaces. With 'name ', filters to one interface.", "mode": "read-only", "wire-method": "ze-show:traffic-stat", "args": [ { "name": "name", "type": "string" } ], "global-pipes": true }, { "path": "show uptime", "description": "Show how long the daemon has been running.\nReturns the start time and elapsed uptime. Handy after a maintenance\nwindow to confirm the process restarted.", "mode": "read-only", "wire-method": "ze-show:uptime", "global-pipes": true }, { "path": "show version", "description": "Show the running Ze version and build date.\nYou can verify which release is deployed on this box.", "mode": "read-only", "wire-method": "ze-show:version", "global-pipes": true }, { "path": "show vpn ipsec peer name", "description": "Show full detail for one IPsec peer.\nReturns IKE SA state, all child SAs with traffic selectors, and\nbyte counts. Usage: show vpn ipsec peer name .", "mode": "read-only", "wire-method": "ze-show:vpn-ipsec-peer", "args": [ { "name": "name", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "show vpn ipsec sa", "description": "Show all IKE and Child Security Associations.\nLists every SA with peer, negotiated algorithms, byte counts, rekey\ntimers, and uptime. Includes SPIs, NAT detection, and child SA\ntraffic selectors. Your main IPsec status command.", "mode": "read-only", "wire-method": "ze-show:vpn-ipsec-sa", "global-pipes": true }, { "path": "show vpn ipsec status", "description": "Quick IPsec health check.\nReports whether the IKE engine is running, how many peers are\nconfigured, and how many IKE SAs are Established.", "mode": "read-only", "wire-method": "ze-show:vpn-ipsec-status", "global-pipes": true }, { "path": "show vpp runtime", "description": "Show VPP graph node processing statistics.\nReturns per-node packet counts, vectors, clocks, and suspends.\nHelps you find which node is the bottleneck. Requires the VPP\nbackend.", "mode": "read-only", "wire-method": "ze-show:vpp-runtime", "global-pipes": true }, { "path": "show vpp trace clear", "description": "Discard the captured VPP trace buffer.\nClears all packets so you can start a fresh trace. Requires the\nVPP backend.", "mode": "read-only", "wire-method": "ze-show:vpp-trace-clear", "global-pipes": true }, { "path": "show vpp trace show", "description": "Retrieve packets captured since the last trace start.\nShows per-packet VPP graph node traversal. Requires the VPP backend.", "mode": "read-only", "wire-method": "ze-show:vpp-trace-show", "global-pipes": true }, { "path": "show vpp trace start", "description": "Start capturing packets in the VPP dataplane.\nDefault input node is dpdk-input, default count is 100 (max 10000).\nAfter starting, use 'show vpp trace show' to retrieve the captured\npackets. Requires the VPP backend.", "mode": "read-only", "wire-method": "ze-show:vpp-trace-start", "global-pipes": true }, { "path": "show warnings", "description": "Show active warnings across all subsystems.\nDisplays any conditions that need your attention (degraded peers,\nresource limits approaching, etc.). Use 'source ' to filter\nto a single subsystem.", "mode": "read-only", "wire-method": "ze-show:warnings", "global-pipes": true }, { "path": "show yang completion", "description": "Show YANG paths available for tab completion.\nLists every valid completion point in the command tree.", "mode": "read-only", "wire-method": "ze-show:yang-completion", "global-pipes": true }, { "path": "show yang doc", "description": "Generate command reference docs from YANG schemas.\nProduces structured documentation with descriptions, arguments, and\nusage patterns for every registered command.", "mode": "read-only", "wire-method": "ze-show:yang-doc", "global-pipes": true }, { "path": "show yang tree", "description": "Print the YANG tree for a module in a readable hierarchy.\nShows node types, data types, and config-vs-state annotations.\nSimilar to 'pyang -f tree'. Useful for understanding the config\nor command structure.", "mode": "read-only", "wire-method": "ze-show:yang-tree", "global-pipes": true }, { "path": "skills", "description": "List or retrieve agent skill definitions matching this Ze version. Use 'get ' to fetch a specific skill.", "mode": "offline" }, { "path": "support", "description": "Bundle logs, config, state, and diagnostics into one archive file. Send the result to support when reporting an issue.", "mode": "offline" }, { "path": "system command complete", "description": "Complete command/args", "mode": "read-only", "wire-method": "ze-system:command-complete", "global-pipes": true }, { "path": "system command help", "description": "Show command details", "mode": "read-only", "wire-method": "ze-system:command-help", "global-pipes": true }, { "path": "system command list", "description": "List all commands", "mode": "read-only", "wire-method": "ze-system:command-list", "global-pipes": true }, { "path": "system dispatch", "description": "Dispatch a text command", "mode": "read-only", "wire-method": "ze-system:dispatch", "global-pipes": true }, { "path": "system help", "description": "Show available commands", "mode": "read-only", "wire-method": "ze-system:help", "global-pipes": true }, { "path": "system subsystem list", "description": "List available subsystems", "mode": "read-only", "wire-method": "ze-system:subsystem-list", "global-pipes": true }, { "path": "system version api", "description": "Show IPC protocol version", "mode": "read-only", "wire-method": "ze-system:version-api", "global-pipes": true }, { "path": "system version software", "description": "Show ze version", "mode": "read-only", "wire-method": "ze-system:version-software", "global-pipes": true }, { "path": "update bgp irr all", "description": "Refresh all IRR prefix-lists immediately.\nRe-queries the IRR server for every enrolled ASN and atomically\nswaps prefix-lists on success. Failed refreshes preserve the\nexisting prefix-list and report an error.", "mode": "daemon", "wire-method": "ze-update:irr-all", "global-pipes": true }, { "path": "update bgp irr as-set", "description": "Refresh IRR prefix-list for a specific AS-SET.\nUsage: update bgp irr as-set . Re-queries the IRR server\nfor all peers using the given AS-SET name.", "mode": "daemon", "wire-method": "ze-update:irr-as-set", "args": [ { "name": "as-set", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "update bgp irr asn", "description": "Refresh IRR prefix-list for a specific ASN.\nUsage: update bgp irr asn . Re-queries the IRR server for\nthe given ASN only.", "mode": "daemon", "wire-method": "ze-update:irr-asn", "args": [ { "name": "asn", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "update bgp peer prefix", "description": "Refresh max-prefix limits from PeeringDB.\nUsage: update bgp peer prefix. Queries PeeringDB for each\nmatched peer's ASN, applies the configured margin, and writes the\nresult to the config draft. Run 'config commit' to apply.", "mode": "daemon", "wire-method": "ze-update:bgp-peer-prefix", "args": [ { "name": "selector", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "update firewall irr all", "description": "Refresh all cached IRR prefix-lists.\nRe-queries the IRR server for every cached ASN/AS-SET entry and\nupdates the zefs cache on success. Failed refreshes preserve the\nexisting cache and report an error.", "mode": "daemon", "wire-method": "ze-update:firewall-irr-all", "global-pipes": true }, { "path": "update firewall irr as-set", "description": "Fetch or refresh IRR prefix-list for an AS-SET.\nUsage: update firewall irr as-set . Queries the IRR server\nand saves resolved prefixes to the zefs cache.", "mode": "daemon", "wire-method": "ze-update:firewall-irr-as-set", "args": [ { "name": "as-set", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "update firewall irr asn", "description": "Fetch or refresh IRR prefix-list for an ASN.\nUsage: update firewall irr asn . Queries the IRR server and\nsaves resolved prefixes to the zefs cache. Creates the cache entry\nif it does not exist.", "mode": "daemon", "wire-method": "ze-update:firewall-irr-asn", "args": [ { "name": "asn", "type": "string", "mandatory": true } ], "global-pipes": true }, { "path": "update system firmware apply", "description": "Full upgrade: download, verify, stage, and restart.\nRuns the complete update cycle in one command. Only available on\nplatforms where Ze owns the update lifecycle (e.g. gokrazy).\nThe box will reboot into the new version.", "mode": "daemon", "wire-method": "ze-update:system-firmware-apply", "global-pipes": true }, { "path": "update system firmware check", "description": "Check for a new firmware version right now.\nBypasses the scheduled interval timer and contacts the update server\nimmediately. Compare the result with 'show system update'.", "mode": "daemon", "wire-method": "ze-update:system-firmware-check", "global-pipes": true }, { "path": "update system firmware download", "description": "Download the latest firmware image right now.\nBypasses the maintenance window and spread timers. The image is\nstaged but not applied. Use 'update system firmware apply' or\n'restart' to activate it.", "mode": "daemon", "wire-method": "ze-update:system-firmware-download", "global-pipes": true }, { "path": "update system firmware restart", "description": "Reboot into the already-staged firmware.\nNo download happens. Use this after 'update system firmware download'\nwhen you are ready to activate the new version.", "mode": "daemon", "wire-method": "ze-update:system-firmware-restart", "global-pipes": true }, { "path": "update system firmware rollback", "description": "Roll back to the previous firmware and restart.\nReverts to the prior image. Only available on platforms with A/B\npartitioning (e.g. gokrazy). Use this if the new version has issues.", "mode": "daemon", "wire-method": "ze-update:system-firmware-rollback", "global-pipes": true }, { "path": "validate config", "description": "Check your config for errors without applying anything. Reports syntax and semantic issues.", "mode": "offline" }, { "path": "withdraw", "description": "Withdraw on-demand announcements.\nUsage: withdraw tag | withdraw tag * | withdraw id | withdraw all", "mode": "daemon", "wire-method": "ze-bgp:withdraw", "global-pipes": true } ]