Ze features are composed from plugins. This catalog is generated from the live registry and explains what each plugin is for, what it configures, and which other plugins it relies on. Click any plugin to open a local detail page.
Generated from 95 registry entries: 89 runtime plugins and 6 test fixtures. Among runtime plugins, 68 declare configuration roots, 48 declare dependencies, and 69 ship YANG modules.
No plugins match this search.
Generated group for registry entries mapped to the Anomaly area. Config roots: anomaly. Source area: internal/plugins/anomaly.
anomaly-detect-feature-sourceBehavioral anomaly detector (report-only): per-entity pattern-of-life over trafficfeature
anomaly-shape-firewallShadow-first autonomous anomaly responder: per-source rate-limit with arm/auto-revert/kill-switch
Generated group for registry entries mapped to the BFD area. Config roots: bfd. Source area: internal/component/bfd.
bfdBidirectional Forwarding Detection (RFC 5880, 5881, 5883)
Generated group for registry entries mapped to the BGP area. Config roots: bgp, environment. Source area: internal/component/bgp.
bgpBGP routing daemon
bgp-adj-rib-inAdj-RIB-In storage (raw hex replay)
bgp-aigpAccumulated IGP Metric (RFC 7311)
bgp-bmpBMP receiver and sender (RFC 7854, 8671)
bgp-capaCore BGP capability decoding (multiprotocol, asn4, add-path, paths-limit, extended-nexthop, extended-message)
bgp-grGraceful Restart capability and mechanism plugin
bgp-healthcheckService healthcheck plugin with watchdog route control
bgp-hostnameFQDN capability decoding
bgp-llnhLink-Local Next-Hop capability plugin
bgp-persistRoute Persistence
bgp-ribRoute Information Base storage
bgp-roleRFC 9234 BGP Role capability
bgp-route-refreshRoute Refresh capability decoding
bgp-rpkiRPKI origin validation via RTR protocol
bgp-rpki-decoratorCorrelates UPDATE + RPKI events into merged update-rpki events
bgp-rrRoute Reflector
bgp-rsRoute Server
bgp-softverSoftware Version capability (code 75)
bgp-watchdogWatchdog route management plugin
Generated group for registry entries mapped to the BGP Filter area. Config roots: bgp. Source area: internal/component/bgp.
bgp-filter-aspathNamed AS-path regex filter (ordered entries, first match wins, accept/reject)
bgp-filter-aspath-lengthNamed AS-path length filter (accept/reject based on hop count)
bgp-filter-communityCommunity tag/strip filter (standard, large, extended)
bgp-filter-community-matchNamed community match filter (ordered entries, first match wins, accept/reject)
bgp-filter-familyNamed address-family policy filter: remove a family's NLRI or tear down the session
bgp-filter-irrIRR-based prefix-list filter for eBGP peers
bgp-filter-modifyNamed route attribute modifier (set local-preference, med, origin, next-hop)
bgp-filter-prefixNamed prefix-list filter (CIDR + ge/le + accept/reject)
bgp-filter-remove-private-asNamed AS-path action filter that removes RFC 6996 Private Use ASNs
loopRoute loop detection (RFC 4271 S9, RFC 4456 S8)
Generated group for registry entries mapped to the BGP NLRI area. Source area: internal/component/bgp.
bgp-nlri-evpnEVPN family plugin
bgp-nlri-flowspecFlowSpec NLRI encoding/decoding
bgp-nlri-labeledLabeled Unicast family plugin (RFC 8277)
bgp-nlri-lsBGP-LS family plugin
bgp-nlri-mupMobile User Plane family plugin (draft-ietf-bess-mup-safi)
bgp-nlri-mvpnMulticast VPN family plugin (RFC 6514)
bgp-nlri-rtcRoute Target Constraint family plugin (RFC 4684)
bgp-nlri-srpolicySR-Policy family plugin (RFC 9830, SAFI 73)
bgp-nlri-vplsVPLS family plugin (RFC 4761)
bgp-nlri-vpnVPN family plugin
Generated group for registry entries mapped to the BGP Redistribute area. Config roots: redistribute. Source area: internal/component/bgp.
bgp-redistributeRoute redistribution ingress filter with loop prevention and family filtering
redistribute-orchestratorRedistribute orchestrator: dispatches protocol route events to registered consumers
Generated group for registry entries mapped to the Class of Service area. Config roots: class-of-service. Source area: internal/plugins/cos.
cos802.1p class-of-service profile definitions
Generated group for registry entries mapped to the Connected area. Config roots: connected. Source area: internal/plugins/connected.
connectedConnected routes: redistribute directly connected interface prefixes
Generated group for registry entries mapped to the Control Plane Protection area. Config roots: control-plane-protection. Source area: internal/plugins/copp.
copp-input-chainControl-plane policing: rate-limit new TCP connections to BGP listen port
Generated group for registry entries mapped to the DDoS area. Config roots: ddos. Source area: internal/plugins/ddos.
ddos-detect-flow-sourceAutomatic DDoS attack detector with two-stage detection
ddos-flowspecDDoS FlowSpec/RTBH responder: upstream mitigation with leak-probe clear
ddos-flowtriqDDoS incident reporter for Flowtriq cloud API
ddos-localDDoS local responder: on-host nft drop on attack detection
ddos-observeDDoS observability: incident store and show ddos status/incidents CLI
Generated group for registry entries mapped to the Environment area. Config roots: environment. Source area: internal/plugins/ntp.
ntpNTP client: system clock synchronization
Generated group for registry entries mapped to the Exabgp area. Config roots: exabgp. Source area: internal/plugins/exabgp.
exabgp-bridgeIn-process ExaBGP compatibility bridge: runs an operator ExaBGP-format script as a subprocess and translates to/from ze events (RFC-agnostic transport shim)
Generated group for registry entries mapped to the FIB area. Config roots: fib. Source area: internal/plugins/fib.
fib-kernelFIB kernel: programs OS routes from system RIB via netlink/route socket
fib-p4FIB P4: programs P4 switch forwarding entries from system RIB via gRPC/P4Runtime
fib-vppFIB VPP: programs VPP FIB entries from system RIB via GoVPP binary API
Generated group for registry entries mapped to the Firewall area. Config roots: firewall. Source area: internal/component/firewall.
firewallPacket filter and NAT rules (nftables on Linux)
firewall-irrIRR-based prefix-list filtering for firewall rules
Generated group for registry entries mapped to the Flow Export area. Config roots: flow-export. Source area: internal/plugins/flowexport.
flow-export-conntrack-trackingsFlow, NetFlow v9, and IPFIX counter export
Generated group for registry entries mapped to the Flowspec Firewall area. Source area: internal/plugins/flowspec-firewall.
flowspec-firewallTranslates BGP FlowSpec routes into nftables firewall rules
Generated group for registry entries mapped to the IS-IS area. Config roots: isis. Source area: internal/plugins/isis.
isisIntermediate System to Intermediate System (ISO/IEC 10589, RFC 1195): native link-state IGP
Generated group for registry entries mapped to the Interface area. Config roots: interface. Source area: internal/component/iface, internal/plugins/iface, internal/plugins/vrrp.
iface-dhcpDHCP client: DHCPv4/DHCPv6 lease acquisition and renewal
iface-raRouter Advertisement sender: advertises IPv6 prefixes, flags, and resolvers on a LAN (RFC 4861)
interfaceOS network interface monitoring and management
vrrpVirtual Router Redundancy Protocol (RFC 9568 / RFC 3768): first-hop gateway redundancy
Generated group for registry entries mapped to the Kernel area. Config roots: kernel. Source area: internal/plugins/kernel.
kernelKernel routes: redistribute externally-installed kernel routes into BGP
Generated group for registry entries mapped to the L2TP area. Config roots: l2tp. Source area: internal/component/l2tp.
l2tp-auth-localStatic local user list for L2TP PPP authentication
l2tp-auth-radius-serversRADIUS authentication and accounting for L2TP PPP sessions
l2tp-poolIPv4 address and IPv6 prefix pool for L2TP PPP sessions
l2tp-shaperTraffic shaping for L2TP subscriber sessions
Generated group for registry entries mapped to the LDP area. Config roots: ldp. Source area: internal/plugins/ldp.
ldp-portLabel Distribution Protocol (RFC 5036): MPLS label distribution
Generated group for registry entries mapped to the MRT area. Config roots: mrt. Source area: internal/plugins/mrt.
mrtMRT routing information export (RFC 6396)
Generated group for registry entries mapped to the OSPF area. Config roots: ospf. Source area: internal/plugins/ospf.
ospfOpen Shortest Path First v2 (RFC 2328): native link-state IPv4 IGP
Generated group for registry entries mapped to the Policy area. Config roots: policy. Source area: internal/plugins/policyroute.
policy-routesPolicy-based routing: nftables packet marking and ip rule table selection
Generated group for registry entries mapped to the RIB area. Config roots: rib. Source area: internal/component/sysrib.
ribSystem RIB: selects best route across protocols by admin distance
Generated group for registry entries mapped to the RSVP TE area. Config roots: rsvp-te. Source area: internal/plugins/rsvpte.
rsvp-te-rawsockRSVP-TE: Resource Reservation Protocol - Traffic Engineering (RFC 3209)
Generated group for registry entries mapped to the Routing Table area. Config roots: routing-table. Source area: internal/plugins/routingtable.
routing-tableNamed routing table registry: maps names to kernel table IDs
Generated group for registry entries mapped to the Service area. Config roots: service. Source area: internal/plugins/as112, internal/plugins/dhcpserver, internal/plugins/geodns.
as112AS112 anycast DNS node: authoritative sink for misdirected RFC 1918 / link-local reverse-DNS queries (RFC 7534, RFC 7535)
dhcpserverDHCP server: address assignment for LAN clients (RFC 2131)
geodnsGeoDNS server: DNS answers selected by client source IP (RFC 1035, RFC 7871 client-subnet)
imageserverImage server: HTTP provisioning for disk images and boot files
tftpserverTFTP server: read-only file serving for PXE boot (RFC 1350, RFC 2347 option negotiation)
Generated group for registry entries mapped to the Static area. Config roots: static. Source area: internal/plugins/static.
staticStatic routes: config-driven kernel/VPP route programming with ECMP
Generated group for registry entries mapped to the Sysctl area. Config roots: sysctl. Source area: internal/component/sysctl.
sysctlKernel tunable management: three-layer precedence, restore on stop
Generated group for registry entries mapped to the Traffic area. Config roots: traffic. Source area: internal/component/traffic, internal/plugins/trafficusage.
trafficTraffic control (tc) qdisc, class, and filter management
traffic-usageeBPF TCX per-port and per-IP byte accounting
Generated group for registry entries mapped to the VPN area. Config roots: pki, vpn. Source area: internal/component/ike.
ipsec-xfrmIKEv2 engine for native IPsec VPN
Generated group for registry entries mapped to the VPP area. Config roots: vpp. Source area: internal/component/vpp.
vppVPP data plane lifecycle management
Generated group for registry entries mapped to the Test Harness area. Config roots: ddos. Source area: internal/test/plugins.
ddos-fakeTest-only synthetic DDoS attack injector for the ddos-local withdraw test (harmless unless `ddos { fake { enabled true; } }` is configured)
fakeas112Test-only synthetic AS112 route producer (use ze.fakeas112; harmless when not invoked)
fakeenrichTest-only in-process enricher (harmless when not invoked)
fakefibTest-only sysrib event emitter for FIB functional tests (use ze.fakefib)
fakel2tpTest-only synthetic L2TP route producer (use ze.fakel2tp; harmless when not invoked)
fakeredistTest-only synthetic route producer (use ze.fakeredist; harmless when not invoked)