# Ze > Ze is an open-source configuration and protocol engine. The network operating system built on it speaks BGP, manages Linux interfaces, programs the FIB, and serves the same YANG-modeled configuration through CLI, SSH, web, API, and MCP. Its core holds the supervisor, message bus, config provider, and plugin manager; protocols and services arrive as subsystems or plugins. Pre-release: no tagged versions yet, built continuously from the main branch. AGPLv3 open source. See ExaBGP [migration path](usage/exabgp-migration/index.md). This file is intentionally denormalized for AI use. It includes the high-signal product inventory and then the normal page map, so common questions should not require fetching many separate pages. Page links still point at Markdown `index.md` files first, with rendered web URLs beside them for humans. ## Product snapshot - Purpose: configuration and protocol engine for Linux routing, plus a network operating system built on that core. - Protocols and subsystems in the shipped daemon: BGP, IS-IS, OSPF, BFD, static routes, policy routing, FIB programming, interfaces, firewall, traffic control, DNS, DHCP, NTP, IPsec, L2TP, PPPoE, telemetry, web UI, SSH CLI, MCP, and plugins. - Operator surfaces: SSH CLI with commit and rollback, generated command reference, server-rendered web workbench, looking glass, telemetry, gNMI, gRPC, MCP, JSON/YAML/NDJSON/table output, and shell-like output pipes derived from the schema where possible. - Dataplane: Linux netlink, nftables, eBPF, AF_PACKET, psample, optional VPP integrations, and namespace-aware testing. - Release state: pre-release, main-branch builds, no tagged stable release yet. - License and repos: AGPLv3. Canonical repository: https://github.com/ze-software/ze. Discord: https://discord.gg/T8s7CjPDne. - Current generated counts: 51 shipped or experimental feature cards, 4 roadmap cards, 390 CLI commands, 36 config sections, 95 plugin registrations, 40 direct Go dependencies, 35 weekly change entries. - Test evidence counts: 22,200+ unit tests, 78 fuzz targets, 1,500+ end-to-end transcript steps, 121 interop scenarios across 9 target implementations. - Generated date: 2026-08-13. ## Quality and verification model Ze uses layered proof because bugs appear at different boundaries. - Local Go tests: package behavior, parser rules, encoders, state transitions, validation paths, and error shapes. Current scale: 22,200+ unit tests. - Race, coverage, and fuzz: fuzz targets are normal Go tests with generated input. Current scale: 78 fuzz targets. - gomu mutation checks: mutate production Go code and rerun tests to find weak assertions. gomu is advisory, not the default CI gate. - Functional `.ci` transcripts: drive processes, CLI commands, files, HTTP, syslog, peers, daemons, exits, and BGP wire expectations. BGP failures are decoded structurally, not shown as raw hex only. - Browser `.wb` transcripts: drive the rendered web UI through real browser flows. - Editor `.et` transcripts: drive the headless interactive editor. - QEMU: runs Linux-only behavior from macOS or CI where netlink, nftables, eBPF, PPP, network namespaces, and kernel modules exist. - Interop: 121 scenarios against 9 target implementations, including FRR, BIRD, GoBGP, RustyBGP, OpenBGPD, ExaBGP, and other real daemons where applicable. - Verify workflow: `make ze-verify` takes a shared lock, writes stage logs under `tmp/`, groups related failures, and prints narrow rerun commands. `make ze-verify-changed` and `make ze-validate` are narrower handoff gates. - Rule for regressions: do not hide a failure with a skip or loose assertion. Move the proof to the layer that can see the real behavior, add the narrow test, rerun it, then rerun the gate that should have caught it. Useful commands: `go test -race -run TestName ./internal/...`, `make ze-fuzz-one FUZZ=FuzzName PKG=./path TIME=30s`, `make ze-mutation-changed`, `bin/ze-test bgp plugin 42 -v`, `make ze-qemu-needs-linux-test`, `make ze-interop-test`, `make ze-release-evidence`. ## Comparison positioning - BGP comparison lens: Ze is compared with BIRD, FRR, OpenBGPD, GoBGP, bio-rd, ExaBGP, RustyBGP, rustbgpd, and freeRtr across AFI/SAFI, core protocol, policy, security, observability, APIs, operations, and best-path behavior. - Network OS lens: Ze is compared with VyOS and freeRtr across routing, interfaces, firewall, NAT, VPN, AAA, services, management APIs, automation, packaging, observability, tests, and implementation model. - Evidence policy: capability claims should cite upstream code, official feature documentation, or the integration layer that owns the behavior. `Unclear`, `Partial`, and `Not found` are valid outcomes when evidence does not support a stronger claim. - Comparison pages are advice for product decisions, not marketing copy. ## Feature inventory ### Built for demanding operators. (33 cards: 33 current) Ze starts with a configuration and protocol engine. The shipped network operating system adds BGP, interface management, FIB programming, plugins, operator tools, a minimal appliance runtime, and diagnostics as one product. - AI Tool Interfaces [automate, current]: chips: MCP, Generated, AI tools; MCP exposes CLI/API commands; AI tools read structured output; Plugins expose discoverable tools; link: https://ze-software.net/docs/features/ai-first/index.md - SSH CLI [operate, current]: chips: Built-in SSH, RBAC; Manage Ze without OS shell accounts; Profiles, audit, and accounting; commit, rollback, diff, completion; link: https://ze-software.net/docs/features/cli-commands/index.md - YANG Configuration [operate, current]: chips: YANG, ExaBGP; Schema-driven validation; One model feeds every surface; Plugin defined config and commands; link: https://ze-software.net/docs/features/configuration/index.md - Output Formatting [operate, current]: chips: Shell-like pipes, Offline; table, json, yaml, ndjson; match, count, first/last; Offline via ze format; link: https://ze-software.net/docs/features/formatting/index.md - Web Workbench [operate, current]: chips: HTMX, SSE; YANG-driven config tree; Same CLI grammar in browser; Live updates via SSE; link: https://ze-software.net/docs/features/web-interface/index.md - Looking Glass [operate, current]: chips: Routes, Topology, Birdwatcher; Peer and route viewer; Topology graph; SSE streaming for live state; link: https://ze-software.net/docs/features/looking-glass/index.md - System Readiness [operate, current]: chips: ze doctor, ze explain; Offline pre-start checks; Health, warnings, and errors; Structured remediation with `ze explain`; link: https://ze-software.net/docs/guide/production-diagnostics/index.md - Native BGP Engine [routing, current]: chips: BGP, IPv4/IPv6, FlowSpec; Full implementation in Go; Lazy parsing, buffer-first encoding; Negotiated capabilities; link: https://ze-software.net/docs/features/bgp-protocol/index.md - Static Routes [routing, current]: chips: ECMP, BFD, PBR; Named tables, policy routing; BFD-tracked failover; Multi-path ECMP groups; link: https://ze-software.net/docs/guide/static-routes/index.md - BFD [routing, current]: chips: RFC 5880, Auth; Single-hop and multi-hop; GTSM, jitter, BGP integration; SHA1/MD5 auth, echo mode; link: https://ze-software.net/docs/features/bgp-protocol/index.md - MRT Recording [routing, current]: chips: RFC 6396, Analysis; Updates, messages, RIB snapshots; Strftime file rotation; Show, inject, replay, filter; link: https://ze-software.net/docs/guide/mrt-analysis/index.md - DNS Resolver [services, current]: chips: Cache, Pipes; Built-in cached resolver; | resolve and | origin pipe operators; No external daemon needed; link: https://ze-software.net/docs/features/dns-resolver/index.md - Plugin System [automate, current]: chips: ExaBGP, RPKI, Policy; Plugins add commands, RPCs, events; YANG roots join CLI and web; Independent, composable; link: https://ze-software.net/docs/features/plugins/index.md - Programmable [automate, current]: chips: REST, gRPC, gNMI; REST API, gRPC, gNMI; Shared engine for identical output; Automate from any language; link: https://ze-software.net/docs/features/api-commands/index.md - AI-First Design [automate, current]: chips: Self-describing, Skills; Self-describing command catalogue from the live binary; Every command is an automation surface; Structured diagnostics and repair plans; link: https://ze-software.net/docs/features/ai-first/index.md - MCP Integration [automate, current]: chips: MCP, OAuth 2.1; Streamable HTTP transport, OAuth 2.1 resource server; Server-initiated elicitation, task-augmented tool calls; MCP Apps UI with embedded panels; link: https://ze-software.net/docs/features/mcp-integration/index.md - ExaBGP Compatibility [automate, current]: chips: Migration, Bridge; Automatic config migration; Plugin bridge for existing workflows; Migration path for existing scripts; link: https://ze-software.net/docs/features/exabgp-compatibility/index.md - Evidence Over Claims [observe, current]: chips: Fuzz, Interop, Docker; Unit, functional, fuzz, chaos; Performance benchmarks; Interop vs FRR, BIRD, GoBGP; link: https://ze-software.net/docs/features/interoperability-testing/index.md - Development Activity [observe, current]: chips: Heatmap, Live data; A year of commits and added lines, at a glance; Built from git history each time; Current Go code composition; link: https://ze-software.net/activity/index.md - Prometheus Telemetry [observe, current]: chips: Netdata, Prometheus; 138 metrics from /proc and /sys; Netdata naming, drop-in replacement; Existing Grafana dashboards keep working; link: https://ze-software.net/docs/guide/monitoring/index.md - Health Registry [observe, current]: chips: HTTP, 503; /health HTTP endpoint; Per-component status checks; BGP, FIB, IPsec, L2TP, VPP; link: https://ze-software.net/docs/features/index.md - Host Inventory [observe, current]: chips: CPU, NIC, SMART; CPU, NIC, DMI, memory, thermal; SMART disk health and self-tests; JSON output for pipelines; link: https://ze-software.net/docs/features/index.md - Crash Capture [observe, current]: chips: Panic, Syslog; Automatic panic stack traces; Ring buffer context (last 64 entries); show crashes CLI command; link: https://ze-software.net/docs/features/index.md - Tech-Support Bundle [observe, current]: chips: Offline, JSON; 20 modules, pure Go, no shell-outs; Structured JSON per module; Privacy-by-default, gokrazy-safe; link: https://ze-software.net/docs/features/index.md - Production Diagnostics [observe, current]: chips: CLI, MCP; 11 built-in tools replacing ss, dmesg, lsof; tcpdump, traceroute, ping, mtr; All exposed via MCP for AI debugging; link: https://ze-software.net/docs/guide/production-diagnostics/index.md - Secure by Default [secure, current]: chips: SSH, RBAC, RPKI, ASPA; SSH access to the CLI; RPKI route origin validation; No other daemons needed; link: https://ze-software.net/docs/features/plugins/index.md - TACACS+ AAA [secure, current]: chips: RFC 8907, Accounting; SSH login via TACACS+; Command accounting START/STOP; Server failover, local fallback; link: https://ze-software.net/docs/guide/tacacs/index.md - Audit Trail [secure, current]: chips: Commits, Auth; Config commit, discard, and reload; Failed auth on every interface; Filter by action, actor, and time; link: https://ze-software.net/docs/guide/audit/index.md - PKI Store [secure, current]: chips: X.509, TLS; YANG-modelled certificate management; Chain validation, expiry checks; Shared by IPsec, TLS, mutual auth; link: https://ze-software.net/docs/features/index.md - Minimal Appliance Mode [platform, current]: chips: Appliance, Server; Kernel, init, Ze runtime; No package manager or general shell; ISO/PXE bare-metal install; Linux server with systemd; link: https://ze-software.net/docs/guide/appliance/index.md - Runs Itself [platform, current]: chips: Update, Systemd; Binary self-update; Built-in readiness checks; No orchestrator needed; link: https://ze-software.net/docs/features/introspection/index.md - Docker Support [platform, current]: chips: Daemon only, Scratch, Compose; Static binary on scratch base; Compose support included; Optional build tags; link: https://ze-software.net/docs/features/index.md - Feature Gates [platform, current]: chips: 36 subsystems, Default on; Compile out whole subsystems, BGP included; Smaller binary, smaller attack surface; Config fails closed on blocks the build lacks; link: https://ze-software.net/docs/guide/quickstart/index.md ### Experimental and growing. (18 cards: 18 experimental) Implemented and tested, still waiting for production evidence. - IPsec VPN [services, experimental]: chips: IKEv2, X.509, EAP; Full IKEv2 engine, rekeying, DPD; NAT-T, keepalive, XFRM interfaces; EAP-MSCHAPv2, EAP-TLS, road warrior; link: https://ze-software.net/docs/features/index.md - L2TPv2 BNG [services, experimental]: chips: PPP, RADIUS, CQM; RFC 2661 LNS and LAC with PPP; RADIUS auth, accounting, CoA; CQM monitoring, shaping, web UI; link: https://ze-software.net/docs/guide/l2tp/index.md - PPPoE Access [services, experimental]: chips: RFC 2516, PPP; Access concentrator with discovery FSM; Shared PPP driver with L2TP; HMAC-SHA256 cookie, rate limiting; link: https://ze-software.net/docs/guide/pppoe/index.md - Interface Management [services, experimental]: chips: Netlink, DHCP; Ethernet, VLAN, bridge, WireGuard; 8 tunnel kinds, DHCP client; NTP sync, offload tuning, mirroring; link: https://ze-software.net/docs/features/interfaces/index.md - Firewall [services, experimental]: chips: nftables, NAT; 15 match types, 19 actions; SNAT, DNAT, masquerade; FlowSpec-to-firewall bridge; link: https://ze-software.net/docs/guide/firewall/index.md - Policy Routing [services, experimental]: chips: nftables, PBR; L3/L4 match criteria; Table steering, next-hop actions; TCP-MSS clamping, interface wildcards; link: https://ze-software.net/docs/guide/policy-routing/index.md - VPP Data Plane [services, experimental]: chips: DPDK, GoVPP; FIB programming via GoVPP; MPLS label operations; Per-interface Prometheus metrics; link: https://ze-software.net/docs/guide/vpp/index.md - MPLS / LDP / RSVP-TE [routing, experimental]: chips: Labels, Signaling; Kernel MPLS FIB, push/swap/pop; LDP discovery and sessions; RSVP-TE ERO, bandwidth admission; link: https://ze-software.net/docs/features/index.md - OSPFv2 / OSPFv3 [routing, experimental]: chips: RFC 2328, RFC 5340, ECMP; One ospf engine, IPv4 and IPv6 address families; SPF/ABR, NSSA, virtual links, NBMA/P2MP; Redistribution, SR, BFD, graceful restart; link: https://ze-software.net/docs/guide/ospf/index.md - IS-IS [routing, experimental]: chips: ISO 10589, Dual-stack; L1/L2 link-state IGP over Layer 2; RFC 5304/5310 authentication, key chains; Dual-stack IPv6, redistributes with BGP; link: https://ze-software.net/docs/guide/isis/index.md - VRRP [routing, experimental]: chips: RFC 9568, RFC 3768, Virtual MAC; First-hop gateway redundancy, IPv4 and IPv6; Per-group virtual-MAC macvlan for L2 failover; keepalived interop, compile-out; link: https://ze-software.net/docs/guide/vrrp/index.md - Flow Export [observe, experimental]: chips: sFlow, NetFlow, IPFIX; sFlow v5, NetFlow v9, IPFIX; Packet sampling, conntrack flows; BGP next-hop enrichment; link: https://ze-software.net/docs/guide/flow-export/index.md - ISO and PXE Install [platform, experimental]: chips: PXE, ISO; PXE bare-metal provisioning; Installer ISO media; Local systemd install and uninstall; link: https://ze-software.net/docs/guide/ze-install/index.md - Kernel Tunables [platform, experimental]: chips: Sysctl, Profiles; Three-layer precedence; Named profiles (DSR, router, hardened); Originals restored on stop; link: https://ze-software.net/docs/features/index.md - AS112 Anycast DNS [services, experimental]: chips: AS112, Anycast; Authoritative sink zones on four fixed anycast addresses (RFC 7534/7535); Conditional BGP origination via healthcheck-gated watchdog; Anycast IPs bound on lo automatically, never operator-typed; link: https://ze-software.net/docs/guide/as112/index.md - Segment Routing [routing, experimental]: chips: SAFI 73, SRv6; SR-Policy NLRI (RFC 9830), SAFI 73; MPLS and SRv6 binding SID, tunnel encap; ExaBGP bridge for SR-Policy migration; link: https://github.com/ze-software/ze/blob/main/internal/component/bgp/plugins/nlri/srpolicy - Fleet Management [automate, experimental]: chips: Managed config, TLS hub; Per-client configuration and authentication; Cached config with reconnect and heartbeat; Version hashing and two-phase fetch; link: https://ze-software.net/docs/guide/fleet-config/index.md - IRR Route Filtering [secure, experimental]: chips: IRR, as-set; Prefix-lists from IRR data, live in the engine; Sourced from PeeringDB and RADB; Opt-in per peer, group or global filter chain; link: https://ze-software.net/docs/guide/irr-filtering/index.md ### Specified, not built. (4 cards: 4 aspiration) Aspirations with written, reviewed specs. Nothing here is usable today. - OSPF L3VPN PE-CE [routing, aspiration]: chips: RFC 4576, RFC 4577, L3VPN; PE-CE DN bit loop prevention; Domain ID, route type, VPN route tag; Blocked on VRF/MPLS L3VPN infrastructure; link: https://github.com/ze-software/ze/blob/main/plan/spec-ospf-ext-13-l3vpn-dn-bit.md - VRF [routing, aspiration]: chips: VRF, L3VPN; VRF as a first-class concept; Per-VRF BGP stacks, YANG config; Kernel VRF devices, table binding; link: https://github.com/ze-software/ze/blob/main/plan/spec-vrf-0-umbrella.md - Kernel Lockdown [secure, aspiration]: chips: Lockdown, Integrity; Kernel lockdown integrity mode; Blocks unsigned modules, kexec, /dev/mem; Design reviewed, waiting for schedule; link: https://github.com/ze-software/ze/blob/main/plan/spec-kernel-lockdown-hardening.md - Cloud-Init Provisioning [platform, aspiration]: chips: Cloud-init, User-data; Appliance identity from cloud metadata; SSH keys and config via user-data; No pre-baked seed image needed; link: https://github.com/ze-software/ze/blob/main/plan/spec-install-9-cloud-init.md ## Configuration model roots Top-level YANG-derived config roots. Child names are direct children only, enough to orient without fetching the full reference. - `anomaly`: Behavioral anomaly detection and response subsystem. Children: detect, shape. - `bfd`: BFD control configuration for Ze. Children: bind-v6, enabled, multi-hop-session, persist-dir, profile, single-hop-session. - `bgp`: Border Gateway Protocol routing configuration. Peers inherit from group defaults; groups inherit from this global level. Children: admin-distance, bmp, community, filter, group, healthcheck, multipath, peer, policy, rib, route-server, router-id, rpki, session, .... - `class-of-service`: Named class-of-service profiles Children: ieee-802.1p. - `connected`: Connected route redistribution. Presence enables the plugin. Children: none. - `control-plane-protection`: Control-plane policing configuration. Children: bgp. - `ddos`: Distributed denial-of-service detection and mitigation subsystem. Children: detect, flowspec, flowtriq, local, observe. - `environment`: Environment settings for API transports Children: api-server, bgp, bmp, chaos, cli, daemon, exabgp, gnmi, l2tp, log, looking-glass, mcp, ntp, pprof, .... - `exabgp`: Top-level container for ExaBGP-compatibility configuration. Children: bridge. - `fib`: Forwarding Information Base configuration. Children: kernel, p4, vpp. - `firewall`: Ze-managed nftables firewall tables. Table names are bare in config; ze_ prefix added by component. Children: backend, flush-on-shutdown, global-options, irr, table. - `flow-export`: Flow export (sFlow, NetFlow v9, IPFIX) configuration Children: collector, conntrack, enrichment, sampling. - `interface`: Interface-level class-of-service bindings and inline QoS maps (container-merge with ze-iface-conf). Removing the cos plugin removes all QoS surface from interfaces. Children: backend, bridge, dhcp-auto, dummy, ethernet, loopback, monitor, pppoe-client, tunnel, veth, wireguard, xfrm. - `isis`: IS-IS routing instance configuration. Children: hostname, interfaces, key-chains, level, level-1, level-2, lsp-lifetime, lsp-refresh-interval, net, overload, system-id. - `kernel`: Kernel route redistribution. Presence enables the plugin. Children: none. - `l2tp`: L2TPv2 tunnel subsystem settings (RFC 2661). Presence of this block with any content implies the subsystem is enabled. Use 'enabled false' to disable explicitly, or 'enabled true'... Children: allow-no-auth, auth, auth-method, authentication, cqm-enabled, enabled, event-ring-size-per-session, hello-interval, hello-retries, max-logins, max-sessions, max-tunnels, ncp, pool, .... - `ldp`: Label Distribution Protocol configuration Children: hello-hold-time, hello-interval, interfaces, keepalive-time, lsr-id, transport-address. - `mrt`: MRT dump configuration Children: add-path, all, direction, extended-timestamp, peer-filter, routes, updates. - `ospf`: OSPFv2 routing instance configuration. Children: address-family, areas, default-information, extended-link, extended-prefix, fast-reroute, graceful-restart, interfaces, key-chains, max-metric, maximum-paths, opaque, redistribute, reference-bandwidth, .... - `pki`: PKI certificate and key store. Presence of this block enables certificate-based authentication for IPsec VPN, TLS, and other subsystems. Children: ca, certificate. - `plugin`: Plugin configuration Children: external, hub, internal. - `policy`: Policy routing configuration. Children: route. - `pppoe`: PPPoE access concentrator settings (RFC 2516). Presence of this block with any content implies the subsystem is enabled. Use 'enabled false' to disable explicitly, or 'enabled... Children: ac-name, cookie-timeout, enabled, interface, max-sessions, padi-rate-limit, service-name. - `redistribute`: Route redistribution between protocols. Each destination protocol has its own container with import rules. Adding a new destination protocol means adding a new key here. Children: destination. - `rib`: System RIB configuration. Children: admin-distance. - `routing-table`: Named routing table definitions. Each entry maps a name to a kernel routing table ID. Children: table. - `rsvp-te`: RSVP-TE traffic engineering configuration Children: bypass, interface, refresh-multiplier, refresh-period, router-id, tunnel. - `service`: Service settings Children: as112, dhcp-server, geodns, image-server, tftp-server. - `static`: Static route configuration. Children: table. - `storage`: Storage device management Children: smart. - `sysctl`: Kernel tunable management. Children: profile, setting. - `system`: System-level settings Children: archive, authentication, authorization, commit-revisions, conntrack, console, dns, domain, host, name-server, peeringdb, tuning, update-check. - `telemetry`: Telemetry export configuration Children: prometheus. - `traffic`: Traffic subsystem: QoS control and byte-usage accounting. Children: control, usage. - `vpn`: VPN subsystems. Children: ipsec. - `vpp`: VPP data plane configuration. Children: api-socket, cpu, dpdk, enabled, external, lcp, memory, plugins, stats. ## Plugin registry Each registration comes from the Go runtime registry. Config roots come from plugin metadata and YANG files. - `anomaly-detect-feature-source`: Behavioral anomaly detector (report-only): per-entity pattern-of-life over trafficfeature Config roots: anomaly/detect. Dependencies: config-loaded. Optional: none. YANG files: 1. Source: `internal/plugins/anomaly/detect`. - `anomaly-shape-firewall`: Shadow-first autonomous anomaly responder: per-source rate-limit with arm/auto-revert/kill-switch Config roots: anomaly/shape. Dependencies: config-loaded. Optional: none. YANG files: 1. Source: `internal/plugins/anomaly/shape`. - `as112`: AS112 anycast DNS node: authoritative sink for misdirected RFC 1918 / link-local reverse-DNS queries (RFC 7534, RFC 7535) Config roots: service. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/plugins/as112`. - `bfd`: Bidirectional Forwarding Detection (RFC 5880, 5881, 5883) Config roots: bfd. Dependencies: none. Optional: none. YANG files: 3. Source: `internal/component/bfd`. - `bgp`: BGP routing daemon Config roots: bgp. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/component/bgp/plugin`. - `bgp-adj-rib-in`: Adj-RIB-In storage (raw hex replay) Config roots: none. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/adj_rib_in`. - `bgp-aigp`: Accumulated IGP Metric (RFC 7311) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/aigp`. - `bgp-bmp`: BMP receiver and sender (RFC 7854, 8671) Config roots: bgp, environment. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/component/bgp/plugins/bmp`. - `bgp-capa`: Core BGP capability decoding (multiprotocol, asn4, add-path, paths-limit, extended-nexthop, extended-message) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/capa`. - `bgp-filter-aspath`: Named AS-path regex filter (ordered entries, first match wins, accept/reject) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_aspath`. - `bgp-filter-aspath-length`: Named AS-path length filter (accept/reject based on hop count) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_aspath_length`. - `bgp-filter-community`: Community tag/strip filter (standard, large, extended) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_community`. - `bgp-filter-community-match`: Named community match filter (ordered entries, first match wins, accept/reject) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_community_match`. - `bgp-filter-family`: Named address-family policy filter: remove a family's NLRI or tear down the session Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_family`. - `bgp-filter-irr`: IRR-based prefix-list filter for eBGP peers Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 2. Source: `internal/component/bgp/plugins/filter_irr`. - `bgp-filter-modify`: Named route attribute modifier (set local-preference, med, origin, next-hop) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_modify`. - `bgp-filter-prefix`: Named prefix-list filter (CIDR + ge/le + accept/reject) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_prefix`. - `bgp-filter-remove-private-as`: Named AS-path action filter that removes RFC 6996 Private Use ASNs Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/filter_remove_private_as`. - `bgp-gr`: Graceful Restart capability and mechanism plugin Config roots: bgp. Dependencies: bgp, bgp-rib. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/gr`. - `bgp-healthcheck`: Service healthcheck plugin with watchdog route control Config roots: bgp. Dependencies: bgp, bgp-watchdog. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/healthcheck`. - `bgp-hostname`: FQDN capability decoding Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/hostname`. - `bgp-llnh`: Link-Local Next-Hop capability plugin Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/llnh`. - `bgp-nlri-evpn`: EVPN family plugin Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/evpn`. - `bgp-nlri-flowspec`: FlowSpec NLRI encoding/decoding Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/flowspec`. - `bgp-nlri-labeled`: Labeled Unicast family plugin (RFC 8277) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/labeled`. - `bgp-nlri-ls`: BGP-LS family plugin Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/ls`. - `bgp-nlri-mup`: Mobile User Plane family plugin (draft-ietf-bess-mup-safi) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/mup`. - `bgp-nlri-mvpn`: Multicast VPN family plugin (RFC 6514) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/mvpn`. - `bgp-nlri-rtc`: Route Target Constraint family plugin (RFC 4684) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/rtc`. - `bgp-nlri-srpolicy`: SR-Policy family plugin (RFC 9830, SAFI 73) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/srpolicy`. - `bgp-nlri-vpls`: VPLS family plugin (RFC 4761) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/vpls`. - `bgp-nlri-vpn`: VPN family plugin Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/nlri/vpn`. - `bgp-persist`: Route Persistence Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/persist`. - `bgp-redistribute`: Route redistribution ingress filter with loop prevention and family filtering Config roots: none. Dependencies: bgp. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/redistribute_ingress`. - `bgp-rib`: Route Information Base storage Config roots: bgp. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/component/bgp/plugins/rib`. - `bgp-role`: RFC 9234 BGP Role capability Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/role`. - `bgp-route-refresh`: Route Refresh capability decoding Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 3. Source: `internal/component/bgp/plugins/route_refresh`. - `bgp-rpki`: RPKI origin validation via RTR protocol Config roots: bgp. Dependencies: bgp, bgp-adj-rib-in. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/rpki`. - `bgp-rpki-decorator`: Correlates UPDATE + RPKI events into merged update-rpki events Config roots: none. Dependencies: bgp, bgp-rpki. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/rpki_decorator`. - `bgp-rr`: Route Reflector Config roots: none. Dependencies: bgp-adj-rib-in. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/rr`. - `bgp-rs`: Route Server Config roots: bgp. Dependencies: none. Optional: bgp-adj-rib-in. YANG files: 1. Source: `internal/component/bgp/plugins/rs`. - `bgp-softver`: Software Version capability (code 75) Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 1. Source: `internal/component/bgp/plugins/softver`. - `bgp-watchdog`: Watchdog route management plugin Config roots: bgp. Dependencies: bgp. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/watchdog`. - `connected`: Connected routes: redistribute directly connected interface prefixes Config roots: connected. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/connected`. - `copp-input-chain`: Control-plane policing: rate-limit new TCP connections to BGP listen port Config roots: control-plane-protection. Dependencies: firewall. Optional: none. YANG files: 1. Source: `internal/plugins/copp`. - `cos`: 802.1p class-of-service profile definitions Config roots: class-of-service. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/cos`. - `ddos-detect-flow-source`: Automatic DDoS attack detector with two-stage detection Config roots: ddos/detect. Dependencies: config-loaded. Optional: none. YANG files: 1. Source: `internal/plugins/ddos/detect`. - `ddos-fake`: Test-only synthetic DDoS attack injector for the ddos-local withdraw test (harmless unless `ddos { fake { enabled true; } }` is configured) Config roots: ddos/fake. Dependencies: firewall. Optional: none. YANG files: 1. Source: `internal/test/plugins/fakeddos`. - `ddos-flowspec`: DDoS FlowSpec/RTBH responder: upstream mitigation with leak-probe clear Config roots: ddos/flowspec. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/ddos/flowspec`. - `ddos-flowtriq`: DDoS incident reporter for Flowtriq cloud API Config roots: ddos/flowtriq. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/ddos/flowtriq`. - `ddos-local`: DDoS local responder: on-host nft drop on attack detection Config roots: ddos/local. Dependencies: firewall. Optional: none. YANG files: 1. Source: `internal/plugins/ddos/local`. - `ddos-observe`: DDoS observability: incident store and show ddos status/incidents CLI Config roots: ddos/observe. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/ddos/observe`. - `dhcpserver`: DHCP server: address assignment for LAN clients (RFC 2131) Config roots: service. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/dhcpserver`. - `exabgp-bridge`: In-process ExaBGP compatibility bridge: runs an operator ExaBGP-format script as a subprocess and translates to/from ze events (RFC-agnostic transport shim) Config roots: exabgp. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/exabgp/bridgeplugin`. - `fakeas112`: Test-only synthetic AS112 route producer (use ze.fakeas112; harmless when not invoked) Config roots: none. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/test/plugins/fakeas112`. - `fakeenrich`: Test-only in-process enricher (harmless when not invoked) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/test/plugins/fakeenrich`. - `fakefib`: Test-only sysrib event emitter for FIB functional tests (use ze.fakefib) Config roots: none. Dependencies: none. Optional: none. YANG files: 0. Source: `internal/test/plugins/fakefib`. - `fakel2tp`: Test-only synthetic L2TP route producer (use ze.fakel2tp; harmless when not invoked) Config roots: none. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/test/plugins/fakel2tp`. - `fakeredist`: Test-only synthetic route producer (use ze.fakeredist; harmless when not invoked) Config roots: none. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/test/plugins/fakeredist`. - `fib-kernel`: FIB kernel: programs OS routes from system RIB via netlink/route socket Config roots: fib/kernel. Dependencies: rib, sysctl. Optional: none. YANG files: 1. Source: `internal/plugins/fib/kernel`. - `fib-p4`: FIB P4: programs P4 switch forwarding entries from system RIB via gRPC/P4Runtime Config roots: fib/p4. Dependencies: rib. Optional: none. YANG files: 1. Source: `internal/plugins/fib/p4`. - `fib-vpp`: FIB VPP: programs VPP FIB entries from system RIB via GoVPP binary API Config roots: fib/vpp. Dependencies: rib, vpp. Optional: none. YANG files: 1. Source: `internal/plugins/fib/vpp`. - `firewall`: Packet filter and NAT rules (nftables on Linux) Config roots: firewall. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/component/firewall`. - `firewall-irr`: IRR-based prefix-list filtering for firewall rules Config roots: firewall. Dependencies: firewall. Optional: none. YANG files: 2. Source: `internal/component/firewall/plugins/irr`. - `flow-export-conntrack-tracking`: sFlow, NetFlow v9, and IPFIX counter export Config roots: flow-export. Dependencies: config-loaded. Optional: none. YANG files: 1. Source: `internal/plugins/flowexport`. - `flowspec-firewall`: Translates BGP FlowSpec routes into nftables firewall rules Config roots: none. Dependencies: firewall. Optional: none. YANG files: 0. Source: `internal/plugins/flowspec-firewall`. - `geodns`: GeoDNS server: DNS answers selected by client source IP (RFC 1035, RFC 7871 client-subnet) Config roots: service. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/plugins/geodns`. - `iface-dhcp`: DHCP client: DHCPv4/DHCPv6 lease acquisition and renewal Config roots: none. Dependencies: interface. Optional: none. YANG files: 0. Source: `internal/plugins/iface/dhcp`. - `iface-ra`: Router Advertisement sender: advertises IPv6 prefixes, flags, and resolvers on a LAN (RFC 4861) Config roots: none. Dependencies: interface. Optional: none. YANG files: 0. Source: `internal/plugins/iface/ra`. - `imageserver`: Image server: HTTP provisioning for disk images and boot files Config roots: service. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/imageserver`. - `interface`: OS network interface monitoring and management Config roots: interface. Dependencies: sysctl. Optional: none. YANG files: 6. Source: `internal/component/iface`. - `ipsec-xfrm`: IKEv2 engine for native IPsec VPN Config roots: vpn, pki. Dependencies: config-loaded. Optional: none. YANG files: 0. Source: `internal/component/ike/engine`. - `isis`: Intermediate System to Intermediate System (ISO/IEC 10589, RFC 1195): native link-state IGP Config roots: isis. Dependencies: fib-kernel, sysctl. Optional: none. YANG files: 2. Source: `internal/plugins/isis`. - `kernel`: Kernel routes: redistribute externally-installed kernel routes into BGP Config roots: kernel. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/kernel`. - `l2tp-auth-local`: Static local user list for L2TP PPP authentication Config roots: l2tp. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/l2tp/plugins/authlocal`. - `l2tp-auth-radius-servers`: RADIUS authentication and accounting for L2TP PPP sessions Config roots: l2tp. Dependencies: radius-server. Optional: none. YANG files: 1. Source: `internal/component/l2tp/plugins/authradius`. - `l2tp-pool`: IPv4 address and IPv6 prefix pool for L2TP PPP sessions Config roots: l2tp. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/l2tp/plugins/pool`. - `l2tp-shaper`: Traffic shaping for L2TP subscriber sessions Config roots: l2tp. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/l2tp/plugins/shaper`. - `ldp-port`: Label Distribution Protocol (RFC 5036): MPLS label distribution Config roots: ldp. Dependencies: fib-kernel. Optional: none. YANG files: 2. Source: `internal/plugins/ldp`. - `loop`: Route loop detection (RFC 4271 S9, RFC 4456 S8) Config roots: none. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/bgp/reactor/filter`. - `mrt`: MRT routing information export (RFC 6396) Config roots: mrt. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/mrt`. - `ntp`: NTP client: system clock synchronization Config roots: environment. Dependencies: none. Optional: none. YANG files: 2. Source: `internal/plugins/ntp`. - `ospf`: Open Shortest Path First v2 (RFC 2328): native link-state IPv4 IGP Config roots: ospf. Dependencies: interface, fib-kernel, sysctl. Optional: none. YANG files: 2. Source: `internal/plugins/ospf`. - `policy-routes`: Policy-based routing: nftables packet marking and ip rule table selection Config roots: policy. Dependencies: firewall. Optional: none. YANG files: 2. Source: `internal/plugins/policyroute`. - `redistribute-orchestrator`: Redistribute orchestrator: dispatches protocol route events to registered consumers Config roots: redistribute. Dependencies: bgp. Optional: none. YANG files: 0. Source: `internal/component/bgp/plugins/redistribute_egress`. - `rib`: System RIB: selects best route across protocols by admin distance Config roots: rib. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/sysrib`. - `routing-table`: Named routing table registry: maps names to kernel table IDs Config roots: routing-table. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/routingtable`. - `rsvp-te-rawsock`: RSVP-TE: Resource Reservation Protocol - Traffic Engineering (RFC 3209) Config roots: rsvp-te. Dependencies: fib-kernel. Optional: none. YANG files: 2. Source: `internal/plugins/rsvpte`. - `static`: Static routes: config-driven kernel/VPP route programming with ECMP Config roots: static. Dependencies: routing-table. Optional: interface. YANG files: 2. Source: `internal/plugins/static`. - `sysctl`: Kernel tunable management: three-layer precedence, restore on stop Config roots: sysctl. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/sysctl`. - `tftpserver`: TFTP server: read-only file serving for PXE boot (RFC 1350, RFC 2347 option negotiation) Config roots: service. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/plugins/tftpserver`. - `traffic`: Traffic control (tc) qdisc, class, and filter management Config roots: traffic/control. Dependencies: none. Optional: vpp. YANG files: 1. Source: `internal/component/traffic`. - `traffic-usage`: eBPF TCX per-port and per-IP byte accounting Config roots: traffic/usage. Dependencies: interface. Optional: none. YANG files: 2. Source: `internal/plugins/trafficusage`. - `vpp`: VPP data plane lifecycle management Config roots: vpp. Dependencies: none. Optional: none. YANG files: 1. Source: `internal/component/vpp`. - `vrrp`: Virtual Router Redundancy Protocol (RFC 9568 / RFC 3768): first-hop gateway redundancy Config roots: interface. Dependencies: interface. Optional: none. YANG files: 2. Source: `internal/plugins/vrrp`. ## CLI command surface The command catalog is generated from `ze help command --json`, not hand-written. Modes: 85 daemon, 18 offline, 287 read-only. `daemon` commands require a running Ze daemon. `read-only` commands query state. `offline` commands can run without daemon state. `pipes` means the command supports the shared output pipeline. ### `announce` commands (1) - `announce` (daemon; wire ze-bgp:announce; pipes; args selector): Announce a route on demand to selected peers. Syntax: `announce [tag ] [for ]`. ### `clear` commands (19) - `clear bgp rib in` (daemon; wire ze-rib-api:clear-in; pipes): Remove all routes received from a peer. Wipes the Adj-RIB-In for matched peers. They will need to re-advertise everything (or you can send a route-refresh). Selector... - `clear bgp rib out` (daemon; wire ze-rib-api:clear-out; pipes): Re-advertise all routes to a peer. Triggers a full Adj-RIB-Out replay to the selected peers. Useful after a policy change to push updated attributes without tearing down... - `clear debug` (offline): Clear the default debug profile. - `clear dns cache` (daemon; wire ze-clear:dns-cache; pipes): Flush all DNS cache entries and reset all DNS cache counters. - `clear dns cache record` (daemon; wire ze-clear:dns-cache-record; pipes; args name, type): Evict DNS cache entries for one record name, or one name and type when a type is provided. - `clear dns cache stats` (daemon; wire ze-clear:dns-cache-stats; pipes): Reset DNS cache hit, miss, eviction, and expiry counters without removing cached entries. - `clear interface counters` (daemon; wire ze-clear:interface-counters; pipes): Zero the Rx/Tx counters for every managed interface. - `clear interface name counters` (daemon; wire ze-clear:interface-counters; pipes; args name): Zero the Rx/Tx counters for one interface. - `clear isis adjacency` (daemon; wire ze-clear:isis-adjacency; pipes): Tear down every IS-IS adjacency so neighbors re-form. - `clear isis counters` (daemon; wire ze-clear:isis-counters; pipes): Reset IS-IS observational counters and the SPF log. - `clear l2tp session all` (daemon; wire ze-l2tp-api:session-teardown-all; pipes): Disconnect every L2TP session on this box. Sends CDN for all sessions across all tunnels. Tunnels themselves stay up. Use with care. - `clear l2tp session id` (daemon; wire ze-l2tp-api:session-teardown; pipes): Disconnect one subscriber session. Sends a CDN to gracefully close the session. Pass the local session ID: clear l2tp session id [reason ] [cause ]. - `clear l2tp tunnel all` (daemon; wire ze-l2tp-api:tunnel-teardown-all; pipes): Tear down every L2TP tunnel on this box. Sends StopCCN for all tunnels. Every subscriber session will be disconnected. Use with care during maintenance. - `clear l2tp tunnel id` (daemon; wire ze-l2tp-api:tunnel-teardown; pipes): Gracefully tear down one L2TP tunnel. Sends a StopCCN to the peer. All sessions on this tunnel will be disconnected. Pass the local tunnel ID: clear l2tp tunnel id . - `clear ospf counters` (daemon; wire ze-clear:ospf-counters; pipes): Reset the OSPF SPF-run history. - `clear ospf neighbor` (daemon; wire ze-clear:ospf-neighbor; pipes): Tear down every OSPF adjacency so neighbors re-form. - `clear ospf process` (daemon; wire ze-clear:ospf-process; pipes): Full OSPF reset: tear down every adjacency and re-run SPF. - `clear vpn ipsec sa` (daemon; wire ze-clear:vpn-ipsec-sa; pipes): Tear down IKE Security Associations. Without arguments, terminates all SAs. Use 'peer ' to clear just one peer. The tunnel will renegotiate automatically if the config... - `clear vrrp statistics` (daemon; wire ze-clear:vrrp-statistics; pipes): Reset every VRRP virtual router's counters to zero. Protocol state is untouched: clearing counters never triggers a failover. ### `create` commands (9) - `create interface address` (daemon; wire ze-iface:interface-addr-add; pipes; args name): Add an IP address to an interface. - `create interface bridge name` (daemon; wire ze-iface:interface-create-bridge; pipes; args name): Create a Linux bridge for L2 forwarding. - `create interface bridge name address` (daemon; wire ze-iface:interface-addr-add; pipes; args name): Add an IP address to the bridge. - `create interface bridge name unit` (daemon; wire ze-iface:interface-unit-add; pipes; args name): Add a VLAN sub-interface to the bridge. - `create interface dummy name` (daemon; wire ze-iface:interface-create-dummy; pipes; args name): Create a dummy (loopback-style) interface. - `create interface dummy name address` (daemon; wire ze-iface:interface-addr-add; pipes; args name): Add an IP address to the dummy. - `create interface dummy name unit` (daemon; wire ze-iface:interface-unit-add; pipes; args name): Add a VLAN sub-interface to the dummy. - `create interface unit` (daemon; wire ze-iface:interface-unit-add; pipes; args name): Add a VLAN sub-interface (802.1Q tagged). - `create interface veth name` (daemon; wire ze-iface:interface-create-veth; pipes; args name): Create a veth pair (two linked virtual Ethernet interfaces). ### `debug` commands (4) - `debug ip ospf inject opaque` (daemon; wire ze-debug:ospf-inject; pipes): Inject a crafted IPv4 opaque LSA into the local LSDB (RFC 5250). Syntax: `debug ip ospf inject opaque scope id`. - `debug ipv6 ospf inject lsa` (daemon; wire ze-debug:ospfv3-inject; pipes): Inject a crafted OSPFv3 LSA into the local LSDB (RFC 5340). Syntax: `debug ipv6 ospf inject lsa scope type`. - `debug ospf inject disable` (daemon; wire ze-debug:ospf-inject-disable; pipes): Disable OSPF debug LSA injection. - `debug ospf inject enable` (daemon; wire ze-debug:ospf-inject-enable; pipes): Enable OSPF debug LSA injection (shared across both address families). Off by default. ### `delete` commands (6) - `delete bgp peer` (daemon; wire ze-delete:bgp-peer; pipes; args selector): Remove a peer from the running config. Tears down the TCP session and deletes the peer from the running configuration. Does not modify the config file on disk. - `delete debug module` (offline): Disable debug for a subsystem, or remove one of its flags/scopes. - `delete debug profile name` (offline): Delete a named debug profile. - `delete interface name` (daemon; wire ze-iface:interface-delete; pipes; args name): Delete an interface from the kernel. - `delete interface name address` (daemon; wire ze-iface:interface-addr-del; pipes; args name): Remove an IP address from an interface. - `delete interface name unit` (daemon; wire ze-iface:interface-unit-del; pipes; args name): Remove a VLAN sub-interface. ### `doctor` commands (1) - `doctor` (offline): Verify kernel features, file descriptor limits, sockets, and required dependencies. Run this before first start or after platform changes. ### `explain` commands (1) - `explain` (offline): Print the meaning, likely cause, and recommended fix for a Ze diagnostic code. Pass the code you saw in a log or error message. ### `generate` commands (1) - `generate wireguard keypair` (offline): Generate a WireGuard keypair. Prints private and public keys to stdout for use in your config. ### `help` commands (3) - `help` (read-only; wire ze-bgp:help; pipes): Show available commands at this level. Lists every registered command verb with a brief description. - `help ai` (offline): AI reference generated from the binary. Sections: cli, api, mcp, dispatch, all (add --json). - `help command` (offline): List every command with its description. Use a filter to narrow the list. ### `monitor` commands (8) - `monitor bgp` (read-only; wire ze-bgp:monitor; pipes): Live BGP peer dashboard that refreshes automatically. Shows all peers with state, uptime, and prefix counts. State changes highlight as they happen. Ctrl-C to stop. - `monitor event` (read-only; wire ze-event:monitor; pipes): Stream live events as they happen. Shows a real-time feed of internal events. Filter with include or exclude to focus on what matters. Patterns match event type names. - `monitor interface rate` (read-only; wire ze-monitor:interface-rate; pipes): Stream per-second traffic rates for your interfaces. Shows rx/tx bytes and packets per second, updating every second. Optionally pass an interface name to watch just one... - `monitor ping` (read-only; wire ze-monitor:ping; pipes): Continuous ping with live loss and RTT statistics. Pings until you stop it. Adjust interval and timeout as needed. Shows running min/avg/max RTT and packet loss. - `monitor system netlink` (read-only; wire ze-monitor:system-netlink; pipes): Watch kernel networking changes in real time. Streams netlink events: route adds/deletes, link state changes, address assignments. Filter with route, link, address, or... - `monitor traceroute` (read-only; wire ze-monitor:traceroute; pipes): Live mtr-style traceroute that updates continuously. Shows each hop with running RTT statistics. Keeps probing so you can watch path changes and latency shifts over time. - `monitor traffic stat` (read-only; wire ze-monitor:traffic-stat; pipes; args name): Start streaming traffic monitor (per-second snapshots). Without arguments, shows all interfaces. With 'name ', filters to one interface. - `monitor vpn ipsec` (read-only; wire ze-monitor:vpn-ipsec; pipes): Watch IPsec SA events as they happen. Streams sa-up, sa-down, child-up, child-down, and child-rekey events. Useful for debugging tunnel flaps or rekey issues. ### `peer` commands (2) - `peer raw` (daemon; wire ze-bgp:peer-raw; pipes; args selector): Send raw bytes into a peer's TCP stream (dangerous). Injects arbitrary bytes with no BGP framing or validation. Intended for conformance testing and fuzzing only. Will... - `peer update` (daemon; wire ze-bgp:peer-update; pipes; args selector): Send a pre-built BGP UPDATE to a peer. Payload can be text (human-readable route syntax), hex, or base64. Use 'show bgp encode' to build the payload, then send it here. ### `plugin` commands (10) - `plugin ack` (read-only; wire ze-bgp:plugin-ack; pipes): Choose sync or async event delivery. sync: Ze waits for your plugin to acknowledge each event before sending the next one. Safer but slower. async: events fire without... - `plugin command complete` (read-only; wire ze-plugin:command-complete; pipes): Complete command/args - `plugin command help` (read-only; wire ze-plugin:command-help; pipes): Show command details - `plugin command list` (read-only; wire ze-plugin:command-list; pipes): List plugin commands - `plugin encoding` (read-only; wire ze-bgp:plugin-encoding; pipes): Choose json or text encoding for plugin events. Controls how events are serialized in this session. JSON is structured and parseable; text is more compact. - `plugin format` (read-only; wire ze-bgp:plugin-format; pipes): Choose how BGP message bytes appear in events. hex and base64 are compact wire representations. parsed decodes attributes into structured fields. full includes both wire... - `plugin help` (read-only; wire ze-plugin:help; pipes): List plugin subcommands - `plugin session bye` (read-only; wire ze-plugin:session-bye; pipes): Disconnect - `plugin session ping` (read-only; wire ze-plugin:session-ping; pipes): Health check (returns PID) - `plugin session ready` (read-only; wire ze-plugin:session-ready; pipes): Signal plugin init complete ### `request` commands (33) - `request as112 healthcheck` (daemon; wire ze-as112:health; pipes; args target): One-shot authoritative query against an anycast service address (or the given target), exit 0 iff the expected AS112 answer comes back. Finding M4: the tool a... Syntax: `request as112 healthcheck [target ]`. - `request bgp rib inject` (daemon; wire ze-rib-api:inject; pipes): Inject a synthetic route into the Adj-RIB-In. Behaves as if the route was received from a peer. Use this for testing policy filters or simulating route announcements. - `request bgp rib withdraw` (daemon; wire ze-rib-api:withdraw; pipes): Withdraw a route from the Adj-RIB-In. Removes a previously injected or received route from a peer's Adj-RIB-In, triggering best-path recomputation. - `request cache expire` (daemon; wire ze-bgp:cache-expire; pipes; args id): Remove a cached message immediately. - `request cache forward` (daemon; wire ze-bgp:cache-forward; pipes; args id, selector): Forward a cached UPDATE to peers matching a selector. - `request cache release` (daemon; wire ze-bgp:cache-release; pipes; args id): Ack without forwarding (cache consumer) or undo retain (API). - `request cache retain` (daemon; wire ze-bgp:cache-retain; pipes; args id): Prevent eviction of a cached message. - `request commit` (daemon; wire ze-bgp:commit; pipes): Group route changes into named atomic commits. Actions: start (begin a commit), end (finalize), eor (signal end of RIB), rollback (undo), show (inspect), withdraw... - `request config archive` (daemon; wire ze-config-archive:trigger; pipes): Save a snapshot of the current running configuration. Captures the config into the store for later rollback or comparison. Optional name labels the snapshot; defaults to... - `request halt` (daemon; wire ze-system:daemon-quit; pipes): Dump goroutine stacks to stderr and terminate immediately. - `request interface down` (daemon; wire ze-iface:interface-down; pipes; args name): Shut down an interface. - `request interface mac` (daemon; wire ze-iface:interface-mac; pipes; args name): Set the MAC address on an interface. - `request interface migrate` (daemon; wire ze-iface:interface-migrate; pipes): Move IP addresses between interfaces with minimal downtime. Takes a source interface, a target interface, and the address to move. Adds addresses to the target before... - `request interface mtu` (daemon; wire ze-iface:interface-mtu; pipes; args name): Set the MTU on an interface. - `request interface up` (daemon; wire ze-iface:interface-up; pipes; args name): Bring an interface up. - `request l2tp outgoing-call remote called` (daemon; wire ze-l2tp-api:outgoing-call; pipes; args called, remote): Place an LNS-side outgoing call (RFC 2661 S10.4). - `request log level` (daemon; wire ze-bgp:log-set; pipes; args logger, target): Change a subsystem's log level without restarting. - `request ospf graceful-restart` (daemon; wire ze-ospf:graceful-restart-prepare; pipes): Trigger a planned OSPFv2 graceful restart (RFC 3623 section 2.1). - `request peer borr` (daemon; wire ze-bgp:peer-borr; pipes; args selector): Start an Enhanced Route Refresh cycle (RFC 7313). Tells the peer to mark existing routes as stale. After re-sending, send EORR to purge anything not refreshed. - `request peer clear soft` (daemon; wire ze-bgp:peer-clear-soft; pipes; args selector): Soft-clear a peer without dropping the session. Sends ROUTE-REFRESH for every negotiated AFI/SAFI, causing the peer to re-send all routes. No session bounce, no traffic... - `request peer eorr` (daemon; wire ze-bgp:peer-eorr; pipes; args selector): Finish an Enhanced Route Refresh cycle (RFC 7313). The peer purges any routes not re-advertised since the matching BORR. Only send this after the peer has finished... - `request peer flush` (daemon; wire ze-bgp:peer-flush; pipes; args selector): Wait until all queued updates for a peer are sent. - `request peer pause` (daemon; wire ze-bgp:peer-pause; pipes; args selector): Pause reading from a peer's TCP socket. - `request peer plugin session ready` (daemon; wire ze-plugin:session-peer-ready; pipes; args selector): Signal that per-peer plugin setup is complete. - `request peer refresh` (daemon; wire ze-bgp:peer-refresh; pipes; args selector): Ask a peer to re-send all routes (RFC 2918). Sends a ROUTE-REFRESH message for the specified AFI/SAFI. The peer will re-advertise its entire Adj-RIB-Out. - `request peer resume` (daemon; wire ze-bgp:peer-resume; pipes; args selector): Resume reading from a previously paused peer. - `request peer teardown` (daemon; wire ze-bgp:peer-teardown; pipes; args selector): Tear down a peer session. Syntax: `request peer teardown [cease-subcode]`. - `request quiesce` (daemon; wire ze-system:quiesce; pipes): Block until every subsystem has drained pending async work, then reply. A test/operator barrier that replaces a fixed sleep. - `request reboot` (daemon; wire ze-system:daemon-reboot; pipes): Gracefully shutdown then reboot the system. - `request reload` (daemon; wire ze-system:daemon-reload; pipes): Reload the configuration without restarting. - `request shutdown` (daemon; wire ze-system:daemon-shutdown; pipes): Gracefully shutdown: drain connections, close peers, exit. - `request subscribe` (daemon; wire ze-bgp:subscribe; pipes): Start receiving events of one or more types. Events are delivered asynchronously to your plugin session until you unsubscribe. Use 'show event list' to see available... - `request unsubscribe` (daemon; wire ze-bgp:unsubscribe; pipes): Stop receiving events you previously subscribed to. Removes the subscription for the specified event type from your current plugin session. ### `resolve` commands (11) - `resolve cymru asn-name` (read-only; wire ze-resolve:cymru-asn-name; pipes): Find out who owns an AS number. Queries Team Cymru DNS to return the organization name for the ASN. - `resolve dns a` (read-only; wire ze-resolve:dns-a; pipes): Look up IPv4 addresses (A records) for a hostname. - `resolve dns aaaa` (read-only; wire ze-resolve:dns-aaaa; pipes): Look up IPv6 addresses (AAAA records) for a hostname. - `resolve dns ptr` (read-only; wire ze-resolve:dns-ptr; pipes): Reverse-lookup an IP address to its hostname (PTR). - `resolve dns txt` (read-only; wire ze-resolve:dns-txt; pipes): Look up TXT records for a hostname. - `resolve irr expand` (read-only; wire ze-resolve:irr-expand; pipes): Expand an AS-SET into its member AS numbers. Recursively resolves nested AS-SET objects via WHOIS into a flat list. Useful for building prefix filters from IRR data. - `resolve irr prefix` (read-only; wire ze-resolve:irr-prefix; pipes): Get all prefixes announced by an AS-SET's members. Expands the AS-SET, then returns every route/route6 object for each member ASN. Use this to build or verify prefix... - `resolve peeringdb as-set` (read-only; wire ze-resolve:peeringdb-as-set; pipes): Find the IRR AS-SET registered for an ASN in PeeringDB. - `resolve peeringdb max-prefix` (read-only; wire ze-resolve:peeringdb-max-prefix; pipes): Get max-prefix limits for an ASN from PeeringDB. Returns IPv4 and IPv6 prefix limits. Apply via the config editor. - `resolve ping` (read-only; wire ze-resolve:ping; pipes): Ping from the router with optional source binding. Syntax: `resolve ping [source ] [count ] [size ]`. - `resolve traceroute` (read-only; wire ze-resolve:traceroute; pipes): Traceroute from the router with optional source binding. Syntax: `resolve traceroute [source ] [max-hops N] [timeout D] [probes N]`. ### `set` commands (5) - `set debug active name` (offline): Load a named debug profile and apply it to the running daemon. - `set debug module` (offline): Enable debug for a subsystem; optionally set level/flag/scope. E.g. 'set debug module bgp.reactor level debug'. - `set debug profile name` (offline): Save the current debug state as a named profile. - `set debug timeout` (offline): Set the debug auto-disable timer (e.g. 30m, 1h, 90s; 0 disables). - `set system file-descriptors` (daemon; wire ze-set:system-file-descriptors; pipes; args limit): Raise the file descriptor limit for the daemon process. Pass a number or 'max' to go to the hard limit. Takes effect immediately. Check current limits with 'show system... ### `show` commands (251) - `show aaa accounting` (read-only; wire ze-show:aaa-accounting; pipes): Show AAA accounting counters and any dropped records. Tells you whether TACACS+ accounting is working or if records are being lost due to server unreachability. - `show announcements` (read-only; wire ze-bgp:show-announcements; pipes): List active on-demand announcements. Syntax: `show announcements [tag ] [selector ] [family ]`. - `show anomaly detect` (read-only; wire ze-show:anomaly; pipes): Show recent behavioral anomaly incidents (report-only): source entity, cohort, fired features with their deviation z-scores, combined score, and severity. The detector... - `show anomaly shape` (read-only; wire ze-show:anomaly-shape; pipes): Show the shadow-first anomaly responder status: mode (shadow/armed), action, kill-switch state, and the currently armed source entities with live firewall actions. - `show arp` (read-only; wire ze-show:arp; pipes): Show the IPv4 ARP table (shortcut for 'show neighbor ipv4'). Lists IPv4 ARP entries with MAC address and state. ARP is IPv4-only; use 'show neighbor' for both families... - `show as112` (read-only; wire ze-show:as112; pipes): AS112 node status: enabled, address-family, hostname/ facility/location, allow-from count, served zone count, and the current SOA serial. - `show audit` (read-only; wire ze-show:audit; pipes; args action, actor, count, since, surface, until): Show who did what and when on this box. Returns audit log entries with timestamps, actors, and actions. Filters (all optional, combinable): action , actor , surface... - `show bfd profile` (read-only; wire ze-bfd-api:show-profile; pipes): Show BFD timer profiles with effective values. Returns min-tx, min-rx, and detect-multiplier after inheritance. Use 'show bfd profile' for every profile or 'show bfd... - `show bfd profile name` (read-only; wire ze-bfd-api:show-profile; pipes; args name): Show one BFD profile by name. - `show bfd session address` (read-only; wire ze-bfd-api:show-session; pipes; args address): Show full detail for one BFD session. Pass the peer address. Returns local/remote discriminators, negotiated timers, detection time, and packet counters. - `show bfd sessions` (read-only; wire ze-bfd-api:show-sessions; pipes): List all active BFD sessions. One line per session: peer address, state, negotiated tx/rx intervals, and detect multiplier. - `show bgp decode` (read-only; wire ze-show:bgp-decode; pipes): Decode a hex-encoded BGP message into readable JSON. Paste a hex BGP UPDATE and get back parsed attributes, NLRI, and withdrawn prefixes. Handy for reading pcap captures... - `show bgp encode` (read-only; wire ze-show:bgp-encode; pipes): Turn a route announcement into wire-format hex. Takes a route in API syntax and returns the BGP UPDATE as a hex string. Useful for building test payloads, feeding to... - `show bgp health` (read-only; wire ze-show:bgp-health; pipes): Quick health check for all your BGP peers. Lists every peer with address, state, ASN, and uptime. Reports how many are not Established. Much faster than 'show bgp peer... - `show bgp irr` (read-only; wire ze-show:irr-status; pipes): Show IRR filter status per ASN. Lists each enrolled ASN with its resolved AS-SET, prefix counts, last refresh time, and error status. Use this to confirm that IRR... - `show bgp irr check` (read-only; wire ze-show:irr-check; pipes; args peer, prefix): Check if a prefix is accepted by the IRR filter. - `show bgp irr prefix` (read-only; wire ze-show:irr-prefix; pipes; args peer): Show IRR-resolved prefixes for a peer. - `show bgp peer capabilities` (read-only; wire ze-bgp:peer-capabilities; pipes; args selector): Show what capabilities were negotiated with a peer. - `show bgp peer detail` (read-only; wire ze-bgp:peer-detail; pipes; args selector): Show full detail for one or more peers. - `show bgp peer history` (read-only; wire ze-bgp:peer-history; pipes; args selector): Show FSM state transitions for a peer over time. - `show bgp peer list` (read-only; wire ze-bgp:peer-list; pipes): List your peers, one line each. Shows name, address, ASN, state, and uptime. Quick overview without the detail of 'show bgp peer detail'. - `show bgp peer rib` (read-only; wire ze-bgp:peer-rib; pipes; args selector): Show RIB data scoped to one peer. Syntax: `show bgp peer rib [scope|filters|terminal]`. - `show bgp peer statistics` (read-only; wire ze-bgp:peer-statistics; pipes; args selector): Show UPDATE throughput for your peers. - `show bgp rib` (read-only; wire ze-rib-api:routes; pipes): Query routes in the BGP RIB. Look at received or advertised routes with flexible filters: peer, family, prefix, AS path regex, community, match expression. Pipe... - `show bgp rib best` (read-only; wire ze-rib-api:best; pipes): Show the winning route for each prefix. Same filters as 'show bgp rib'. Use '| reason' to see why each path was selected (local-pref, AS path length, MED, etc.). - `show bgp rib best status` (read-only; wire ze-rib-api:best-status; pipes): Check whether best-path computation is still running. Reports idle, pending, or running, plus the last run duration. - `show bgp rib rpf` (read-only; wire ze-rib-api:rpf; pipes): Reverse-path forwarding lookup in the Loc-RIB. Performs a longest-prefix-match and returns the best-path entry. Use this to verify RPF checks would pass for a given... - `show bgp rib status` (read-only; wire ze-rib-api:status; pipes): Get a quick RIB overview without dumping routes. Shows total peers, received/accepted/advertised route counts, and per-family breakdowns. Use this to confirm convergence... - `show bgp summary` (read-only; wire ze-bgp:summary; pipes): Show a one-line-per-peer BGP summary. Lists every peer with state, ASN, prefixes received, and uptime. Optionally scope by address family: ipv4, ipv6, or l2vpn. - `show bmp collectors` (read-only; wire ze-show:bmp-collectors; pipes): Show BMP collector connection status. Lists configured collectors with connection state, sent message counts, and error statistics. Check here if your collector is not... - `show bmp peers` (read-only; wire ze-show:bmp-peers; pipes): Show BGP peers as seen through BMP monitoring. Lists peers reported via BMP with their state and route statistics. - `show bmp rib` (read-only; wire ze-show:bmp-rib; pipes): Show routes received via BMP monitoring sessions. Returns the BMP RIB content. Use this to verify what your collector is seeing from remote peers. - `show bmp sessions` (read-only; wire ze-show:bmp-sessions; pipes): Show active BMP receiver sessions. Lists each session with connection state and message counters. Check here to confirm your BMP collector is receiving data. - `show cache` (read-only; wire ze-bgp:cache-list; pipes): List cached BGP UPDATE message IDs with their retain and consumer state. - `show capture` (read-only; wire ze-show:capture; pipes; args count, peer, protocol, tunnel-id): Show captured control-plane messages. Returns protocol messages you previously enabled capture for. Without a protocol keyword, shows all protocols. Filters: tunnel-id... - `show capture interface` (read-only; wire ze-show:capture-interface; pipes; args count, duration, format, iface, protocol, snap-len): Capture live packets on an interface (like tcpdump). Uses AF_PACKET for zero-copy capture. Filter by protocol and port. Limit with count or duration. Output as pcap (for... - `show capture raw` (read-only; wire ze-show:capture-raw; pipes; args action, count, format, protocol): Control raw byte capture for protocol debugging. Actions: start (begin capturing), stop (halt), dump (retrieve). Protocols: l2tp, bgp. Output formats: pcap (for... - `show command complete` (read-only; wire ze-bgp:command-complete; pipes): Get tab-completion candidates for a partial command. Returns possible completions for the given input. Used internally by the CLI editor, but also callable for scripting. - `show command help` (read-only; wire ze-bgp:command-help; pipes): Show usage and arguments for a specific command. Gives you the full description, expected arguments, and usage pattern for one command. - `show command list` (read-only; wire ze-bgp:command-list; pipes): List every command the daemon knows about. Returns dispatch key and description for each. Useful for scripting or discovering commands not shown in the top-level help. - `show config cat` (read-only; wire ze-show:config-cat; pipes): Print the full text of a stored configuration snapshot. - `show config diff` (read-only; wire ze-show:config-diff; pipes): Compare two configuration versions side by side. Shows what was added, removed, or changed. Commonly used with rollback revisions to review what changed before you roll... - `show config dump` (read-only; wire ze-show:config-dump; pipes): Show the fully resolved configuration tree. Parses the config and outputs it after includes, defaults, and group inheritance have been applied. What you see here is... - `show config fmt` (read-only; wire ze-show:config-fmt; pipes): Pretty-print the configuration with consistent formatting. Normalizes indentation and ordering. Output goes to stdout (read-only). To rewrite the file in place, use 'ze... - `show config graph` (offline): Show how components and peers depend on each other (DOT graph format). - `show config history` (read-only; wire ze-show:config-history; pipes): List available configuration rollback points. Shows revisions with timestamps and commit metadata. Pair with 'show config diff' to review changes before rolling back. - `show config ls` (read-only; wire ze-show:config-ls; pipes): List all configuration files stored in the database. Shows archived snapshots and the active config. - `show crashes` (read-only; wire ze-show:crashes; pipes; args name): View saved crash reports from panics. Without arguments, lists available crash files. Use 'latest' to see the newest crash or 'name ' to print one specific report. Send... - `show data cat` (read-only; wire ze-show:data-cat; pipes): Print the raw content of a blob store entry. - `show data ls` (read-only; wire ze-show:data-ls; pipes): List everything stored in the ZeFS blob store. Shows all keys and their sizes. Use 'show data cat ' to see the content of a specific entry. - `show data registered` (read-only; wire ze-show:data-registered; pipes): List the key patterns registered by all subsystems. Shows you what types of data ZeFS knows about. - `show ddos flowspec` (read-only; wire ze-show:ddos-flowspec; pipes): Show the upstream FlowSpec/RTBH DDoS mitigation status: whether a rule is currently announced, the target vector it covers, and whether the leak-probe is running. - `show ddos incidents` (read-only; wire ze-show:ddos-incidents; pipes): Show the recent DDoS incident ring (newest first): per incident the target vector (prefix/proto/port), attack family, top source addresses, peak pps/bps, start/end time... - `show ddos local` (read-only; wire ze-show:ddos-local; pipes): Show the on-host DDoS mitigation status: whether an nft drop rule is currently installed and the target vector (prefix / proto / port) it covers. - `show ddos status` (read-only; wire ze-show:ddos-status; pipes): Show DDoS observation status: whether the incident store is running, the number of currently active attacks, and the number of incidents retained in the ring. - `show debug` (read-only; wire ze-debug:debug-state; pipes): Show live debug state from the running daemon. Lists every registered subsystem with its current log level and any active flag or scope filters. Unlike 'debug show'... - `show debug profile` (offline): Show stored debug profiles (list, 'name ' for one, add 'module ' to filter). - `show dns cache list` (read-only; wire ze-show:dns-cache-list; pipes): List all non-expired DNS cache entries, sorted by shortest TTL first. - `show dns cache record` (read-only; wire ze-show:dns-cache-record; pipes; args name): Show DNS cache entries for one record name. - `show dns cache stats` (read-only; wire ze-show:dns-cache-stats; pipes): Show DNS cache hit, miss, eviction, expiry, and hit-rate counters without changing cache contents. - `show dns lookup` (read-only; wire ze-show:dns-lookup; pipes; args hostname, type): Look up a DNS name from the router. Resolves using the daemon's DNS resolver (falls back to the system resolver if no DNS component is configured). Default type is A... - `show doctor` (read-only; wire ze-show:doctor; pipes): Check if this box is ready to run Ze. Verifies runtime dependencies: required files, sockets, ports, and kernel modules. Each check reports pass or fail with a reason... - `show env get` (read-only; wire ze-show:env-get; pipes): Show one environment variable in detail. Returns the variable name, current value, default, and what it controls. - `show env list` (read-only; wire ze-show:env-list; pipes): List all Ze environment variables with their current values. Shows which env vars are set and their defaults. - `show env registered` (read-only; wire ze-show:env-registered; pipes): List every registered environment variable with metadata. Includes type, default, description, and whether it is currently set. - `show errors` (read-only; wire ze-show:errors; pipes): Show recent errors across all subsystems, newest first. This is the first place to look when something goes wrong. Filter with source to narrow to one subsystem, count... - `show event list` (read-only; wire ze-bgp:event-list; pipes): List every event type you can subscribe to. Shows event name, category, and payload structure. Use this to discover what events are available before subscribing. - `show event namespaces` (read-only; wire ze-show:event-namespaces; pipes): List all event namespaces and how many events each has logged. Tells you which subsystems are generating events and how active they are. - `show event recent` (read-only; wire ze-show:event-recent; pipes): Show recent events, newest first. Each event includes timestamp, namespace, and type. Filter with namespace to focus on one area, count to limit output. Useful for... - `show firewall group` (read-only; wire ze-show:firewall-group; pipes): Show members of a firewall address/port group. Without arguments, lists all known groups. With a name, shows the set elements. Reads from the last applied config, not... - `show firewall irr` (read-only; wire ze-show:firewall-irr-status; pipes): Show IRR filter status for all cached ASN/AS-SET entries. Lists each cached entry with prefix counts, last refresh time, and error status. Use this to confirm that IRR... - `show firewall irr prefix` (read-only; wire ze-show:firewall-irr-prefix; pipes; args name): Show IRR-resolved prefixes for a cached entry. - `show firewall ruleset` (read-only; wire ze-show:firewall-ruleset; pipes): Show the live firewall ruleset with per-term counters. - `show flow export` (read-only; wire ze-show:flow-export; pipes; args name): Show flow export (NetFlow/IPFIX) collector status. Without arguments, lists all configured collectors. With 'name ', shows details for that collector including protocol... - `show flow recent` (read-only; wire ze-show:flow-recent; pipes; args dst): Show recent conntrack flow records from the bounded recent-flow ring. Without arguments, returns every ring record (oldest to newest, up to the configured... - `show geodns` (read-only; wire ze-show:geodns; pipes): GeoDNS server status: enabled, bind addresses/port, client-IP source mode, zones, nameserver/host-set/source counts, and the current SOA serial. - `show gnmi` (read-only; wire ze-show:gnmi; pipes): Show whether the gNMI server is running and how it is configured. Returns listen address, TLS details, authentication mode, and the number of active streaming... - `show health` (read-only; wire ze-show:health; pipes): Is this box healthy? One command to find out. Returns per-component health (bgp, fib, iface, plugins, l2tp, etc.) plus an overall status. Each component reports healthy... - `show host all` (read-only; wire ze-show:host-all; pipes): Show the full hardware inventory in one shot. Returns every section (cpu, nic, dmi, memory, thermal, storage, kernel, platform) as a single JSON response. Ideal for... - `show host cpu` (read-only; wire ze-show:host-cpu; pipes): Show what CPUs are in this box. Returns vendor, model, core/thread topology, hybrid layout, scaling driver, current/min/max frequencies, and throttle counts. - `show host dmi` (read-only; wire ze-show:host-dmi; pipes): Show the box's identity from SMBIOS/DMI. Returns system vendor, board name, BIOS version, and chassis type. Useful for inventory or confirming which hardware model you... - `show host kernel` (read-only; wire ze-show:host-kernel; pipes): Show the running kernel version and boot parameters. Returns kernel release, command line, CPU microcode revision, boot time, and security-relevant CPU flags (spectre... - `show host memory` (read-only; wire ze-show:host-memory; pipes): Show installed memory and ECC health. Returns DIMM sizes and, when the edac driver is present, correctable and uncorrectable error counters. Non-zero ECC counts mean you... - `show host nic` (read-only; wire ze-show:host-nic; pipes): Show physical NICs installed in this box. Returns driver, PCI vendor/device IDs, link speed, queue counts, and firmware version. Virtual interfaces are excluded. Use... - `show host platform` (read-only; wire ze-show:host-platform; pipes): Show platform capabilities and constraints. Reports read-only root, privilege level, systemd presence, gokrazy update socket, reboot-allowed flag, persistent-storage... - `show host storage` (read-only; wire ze-show:host-storage; pipes): Show storage devices attached to this box. Returns size, model, transport type (nvme, sata, mmc, virtio), rotational flag, and NVMe firmware version where applicable. - `show host thermal` (read-only; wire ze-show:host-thermal; pipes): Show temperature sensors and thermal throttle events. Returns hwmon sensor readings and per-CPU throttle counters. Non-zero throttle counts mean the box has been running... - `show interface` (read-only; wire ze-show:interface; pipes): Show network interfaces on this box. Without arguments, returns all interfaces with full detail. Subcommands: brief, type , errors, rate [ ], name detail, name counters. - `show interface brief` (read-only; wire ze-show:interface-brief; pipes): One-line summary per interface: name, state, IP, and MTU. Quick way to see what is up and what addresses are assigned. - `show interface errors` (read-only; wire ze-show:interface-errors; pipes): Show interfaces that have errors or drops. Filters to only interfaces with non-zero Rx/Tx error or drop counters. Quick way to find troubled links. - `show interface name counters` (read-only; wire ze-show:interface-counters; pipes; args name): Show counters for one interface. - `show interface name detail` (read-only; wire ze-show:interface-detail; pipes; args name): Show full detail for one interface. - `show interface rate` (read-only; wire ze-show:interface-rate; pipes): Show per-second traffic rates on your interfaces. Returns rx/tx bytes and packets per second. Pass an interface name to narrow the output. Requires the rate tracker. For... - `show interface scan` (read-only; wire ze-show:interface-scan; pipes): Discover and classify all OS interfaces. Returns name, Ze type (ethernet, bridge, vxlan, etc.), and MAC for each interface found. Pipe to table, yaml, or json for... - `show interface type` (read-only; wire ze-show:interface-type; pipes): Show only interfaces of a given type. - `show isis database` (read-only; wire ze-show:isis-database; pipes): Show the IS-IS link-state database. Lists each LSP with its LSP ID, sequence number, remaining lifetime, checksum, and overload bit, across Level-1 and Level-2. - `show isis database detail` (read-only; wire ze-show:isis-database-detail; pipes): Show the IS-IS link-state database with TLV detail. Expands each LSP into its decoded TLVs (type, length, value) so you can read exactly what each node advertises. - `show isis hostname` (read-only; wire ze-show:isis-hostname; pipes): Show the IS-IS dynamic-hostname mapping (RFC 5301). Maps each System ID to the hostname it advertises in TLV 137. - `show isis interface` (read-only; wire ze-show:isis-interface; pipes): Show IS-IS-enabled circuits. Returns level, circuit type, metric, hello interval, hold multiplier, passive flag, DIS state, and the count of Up adjacencies per circuit. - `show isis neighbor` (read-only; wire ze-show:isis-neighbor; pipes): Show IS-IS adjacencies. Returns the neighbor System ID, interface, level, adjacency state, and hold time for each IS-IS neighbor. - `show isis route` (read-only; wire ze-show:isis-route; pipes): Show IS-IS-computed routes. Lists each prefix the SPF installed with its metric, level, up/down bit, and next-hops (address and outgoing interface). - `show isis route ipv6` (read-only; wire ze-show:isis-route-ipv6; pipes): Show IS-IS-computed IPv6 routes (RFC 5308). Lists each IPv6 prefix the SPF installed with its metric, level, and next-hops (link-local address and outgoing interface). - `show isis spf-log` (read-only; wire ze-show:isis-spf-log; pipes): Show recent IS-IS SPF runs. Returns the most recent SPF runs with their timestamp, level, trigger, duration, and node count. - `show l2tp` (read-only; wire ze-l2tp-api:summary; pipes): L2TP tunnel, session, and subscriber state. Without a subcommand, shows a summary of tunnels and sessions. - `show l2tp config` (read-only; wire ze-l2tp-api:config; pipes): Show the resolved L2TP configuration. Returns the effective config after defaults and overrides. Confirms what the daemon is actually using. - `show l2tp cqm` (read-only; wire ze-l2tp-api:cqm; pipes): Show subscriber line quality (CQM latency buckets). Pass a login name for one subscriber or 'summary' for an overview. Helps diagnose poor subscriber experience. - `show l2tp echo` (read-only; wire ze-l2tp-api:echo; pipes): Show LCP echo health for a subscriber session. Returns echo request/reply counters and round-trip times. Rising loss or high RTT indicates a degraded line. - `show l2tp health` (read-only; wire ze-show:l2tp-health; pipes): Find your worst L2TP sessions at a glance. Sorts sessions by echo loss ratio (worst first). Shows subscriber login, session state, echo count, average RTT, and CQM... - `show l2tp listeners` (read-only; wire ze-l2tp-api:listeners; pipes): Show which UDP sockets are listening for L2TP. Lists each bound address, port, and the number of tunnels on it. - `show l2tp observer` (read-only; wire ze-l2tp-api:observer; pipes): Show recent events for a session (debug aid). Returns the event ring buffer for one session ID or 'all'. Useful for understanding why a session failed to establish. - `show l2tp reliable` (read-only; wire ze-l2tp-api:reliable; pipes): Show the reliable transport window for a tunnel. Returns send/receive sequence numbers, window size, and retransmit queue depth. Check here when tunnel control messages... - `show l2tp session history` (read-only; wire ze-l2tp-api:session-history; pipes): Show state transitions for a session over time. Timestamped FSM entries for session establishment. Use this when a subscriber's session fails to come up. - `show l2tp session id` (read-only; wire ze-l2tp-api:session; pipes; args id): Show full detail for one L2TP session. Pass the local session ID. Returns PPP state, assigned addresses, negotiated LCP/NCP options, and traffic counters. - `show l2tp session traffic` (read-only; wire ze-l2tp-api:session-traffic; pipes): Show traffic counters for a subscriber's PPP interface. Returns byte and packet counts, error counters, and current rates. Compare with CQM data to get the full picture... - `show l2tp sessions` (read-only; wire ze-l2tp-api:sessions; pipes): List all active L2TP sessions. One line per session: local/remote ID, parent tunnel, subscriber login, and uptime. - `show l2tp statistics` (read-only; wire ze-l2tp-api:statistics; pipes): Show aggregate L2TP protocol counters. Tunnels and sessions established, control messages sent/received, retransmits, and errors. Your first stop for L2TP health. - `show l2tp tunnel history` (read-only; wire ze-l2tp-api:tunnel-history; pipes): Show state transitions for a tunnel over time. Timestamped FSM entries showing how the tunnel reached its current state. Use this to diagnose tunnel establishment... - `show l2tp tunnel id` (read-only; wire ze-l2tp-api:tunnel; pipes; args id): Show full detail for one L2TP tunnel. Pass the local tunnel ID. Returns control channel state, peer endpoint, hello interval, and all assigned sessions. - `show l2tp tunnels` (read-only; wire ze-l2tp-api:tunnels; pipes): List all active L2TP tunnels. One line per tunnel: local/remote ID, peer address, session count, and uptime. - `show ldp binding` (read-only; wire ze-show:ldp-binding; pipes): Show LDP FEC-to-label bindings. Lists local and remote label bindings for each FEC (prefix). Use this to verify label distribution is working. - `show ldp neighbor` (read-only; wire ze-show:ldp-neighbor; pipes): Show LDP neighbors and their session state. Returns peer address, transport address, session state, and hold time for each LDP neighbor. - `show log levels` (read-only; wire ze-bgp:log-levels; pipes): Show what log level each subsystem is using. Lists every registered logger with its current level. Use 'request log level' to change a level at runtime without... - `show log recent` (read-only; wire ze-bgp:log-recent; pipes; args component, count, level): Show recent log entries from the in-memory ring. Filters (all optional): level , component , count . Newest entries first. Useful when you cannot access the log file... - `show metrics list` (read-only; wire ze-bgp:metrics-list; pipes): List all registered metric names (no values). Useful for discovering what metrics exist before querying them. - `show metrics name` (read-only; wire ze-show:metrics-query; pipes): Show one Prometheus metric by name. Syntax: `show metrics name [label=value`. - `show metrics pool` (read-only; wire ze-bgp:pool-stats; pipes): Show attribute pool memory usage and dedup efficiency. Returns allocated entries, reference counts, and deduplication hit rates per attribute type. Watch the dedup rate... - `show metrics values` (read-only; wire ze-bgp:metrics-values; pipes): Dump all metrics in Prometheus text format. Outputs every registered metric with labels and values. Suitable for feeding into Prometheus, Grafana, or curl-based... - `show mpls forwarding` (read-only; wire ze-show:mpls-forwarding; pipes; args limit): Show MPLS forwarding entries installed in the kernel. Each entry shows the incoming label, swap/push/pop operation, and outgoing next-hop. Pass 'limit N' to cap large... - `show neighbor` (read-only; wire ze-show:neighbor; pipes; args family): Show the ARP and neighbor discovery table. Lists IPv4 ARP and IPv6 ND entries with MAC addresses and states. Pass ipv4 or ipv6 to filter by address family; no argument... - `show ospf` (read-only; wire ze-show:ospf; pipes): OSPFv2 process summary: router-id, areas, ABR/ASBR status, and stub-router (max-metric) state (RFC 2328). - `show ospf border-routers` (read-only; wire ze-show:ospf-border-routers; pipes): Show routes to OSPF area-border and AS-boundary routers. Lists each reachable ABR/ASBR with its router-id, cost, next-hops, and area. - `show ospf database` (read-only; wire ze-show:ospf-database; pipes): Show the OSPF link-state database. Lists each LSA with its LS Type, Link State ID, Advertising Router, sequence number, age, and checksum. - `show ospf database asbr-summary` (read-only; wire ze-show:ospf-database-asbr-summary; pipes): Show only ASBR-Summary-LSAs (Type 4). - `show ospf database external` (read-only; wire ze-show:ospf-database-external; pipes): Show only AS-external-LSAs (Type 5). - `show ospf database network` (read-only; wire ze-show:ospf-database-network; pipes): Show only Network-LSAs (Type 2). - `show ospf database nssa-external` (read-only; wire ze-show:ospf-database-nssa-external; pipes): Show only NSSA-external-LSAs (Type 7, RFC 3101). - `show ospf database opaque-area` (read-only; wire ze-show:ospf-database-opaque-area; pipes): Show only area-scope opaque-LSAs (Type 10, RFC 5250). - `show ospf database opaque-area detail` (read-only; wire ze-show:ospf-database-opaque-area-detail; pipes): Decode each area-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14... - `show ospf database opaque-as` (read-only; wire ze-show:ospf-database-opaque-as; pipes): Show only AS-scope opaque-LSAs (Type 11, RFC 5250). - `show ospf database opaque-as detail` (read-only; wire ze-show:ospf-database-opaque-as-detail; pipes): Decode each AS-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC... - `show ospf database opaque-link` (read-only; wire ze-show:ospf-database-opaque-link; pipes): Show only link-local opaque-LSAs (Type 9, RFC 5250). - `show ospf database opaque-link detail` (read-only; wire ze-show:ospf-database-opaque-link-detail; pipes): Decode each link-local opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14... - `show ospf database router` (read-only; wire ze-show:ospf-database-router; pipes): Show only Router-LSAs (Type 1). - `show ospf database router-information` (read-only; wire ze-show:ospf-database-router-information; pipes): Show the Router Information LSAs (RFC 7770) for both address families -- OSPFv2 opaque type 4 and OSPFv3 function code 12 -- decoded into the advertised informational... - `show ospf database summary` (read-only; wire ze-show:ospf-database-summary; pipes): Show only Summary-LSAs (Type 3, inter-area network). - `show ospf graceful-restart` (read-only; wire ze-show:ospf-graceful-restart; pipes): Show OSPFv2 (IPv4) Graceful Restart state (RFC 3623): the restarter state (in-restart or not, grace end, reason) and the per-neighbor helper sessions (which neighbors... - `show ospf instance` (read-only; wire ze-show:ospf-instance; pipes): Show the configured OSPFv2 instances (RFC 6549 Multi-Instance). Lists each Instance ID with its router-id and the size of its isolated area, interface, neighbor, and... - `show ospf interface` (read-only; wire ze-show:ospf-interface; pipes): Show OSPF-enabled interfaces. Returns area, network-type, cost, ISM state, DR/BDR, hello/dead intervals, priority, and passive flag per interface. - `show ospf interface detail` (read-only; wire ze-show:ospf-interface-detail; pipes): Show full per-interface state (spec-ospf-ext-14): ISM, DR/BDR election detail, all three timers, and the opaque-capable neighbour count. - `show ospf ipv6` (read-only; wire ze-show:ospf-ipv6; pipes): Show the OSPFv3 (IPv6) address-family instances (RFC 5838). Lists each configured address family (ipv6-unicast, ipv6-multicast, ipv4-unicast, ipv4-multicast) with its... - `show ospf ipv6 database` (read-only; wire ze-show:ospfv3-database; pipes): Show the OSPFv3 (IPv6) link-state database with each native scope-aware LSA decoded (RFC 5340). Base types decode into named fields; unknown function codes fall back to... - `show ospf ipv6 database detail` (read-only; wire ze-show:ospfv3-database-detail; pipes): Decode every OSPFv3 LSA body with its scope-aware header (RFC 5340 section A.4.2.1). - `show ospf ipv6 database extended` (read-only; wire ze-show:ospfv3-database-extended; pipes): Show the RFC 8362 extended OSPFv3 LSAs (E-Router / E-Network / E-Inter-Area / E-AS-External / E-Link / E-Intra-Area-Prefix) decoded into named TLVs. - `show ospf ipv6 database router detail` (read-only; wire ze-show:ospfv3-database-router-detail; pipes): Decode each OSPFv3 Router-LSA body. - `show ospf ipv6 database router-information` (read-only; wire ze-show:ospfv3-database-router-information; pipes): Show the OSPFv3 Router Information LSAs (RFC 7770, function code 12) decoded into capability bits and TLVs. - `show ospf ipv6 database scope area` (read-only; wire ze-show:ospfv3-database-scope-area; pipes): Show only area-scope (S2/S1 = 01) LSAs. - `show ospf ipv6 database scope as` (read-only; wire ze-show:ospfv3-database-scope-as; pipes): Show only AS-scope (S2/S1 = 10) LSAs. - `show ospf ipv6 database scope link` (read-only; wire ze-show:ospfv3-database-scope-link; pipes): Show only link-local (S2/S1 = 00) LSAs, including the per-interface Link-LSA store. - `show ospf ipv6 database segment-routing` (read-only; wire ze-show:ospfv3-database-segment-routing; pipes): Summarise the OSPFv3 Segment Routing content (RFC 8666) carried in the RI and extended LSAs. - `show ospf ipv6 graceful-restart` (read-only; wire ze-show:ospf-ipv6-graceful-restart; pipes): Show OSPFv3 (IPv6) Graceful Restart state (RFC 5187): the restarter state (in-restart or not, grace end, reason) and the per-neighbor helper sessions (which neighbors... - `show ospf ipv6 instance` (read-only; wire ze-show:ospfv3-instance; pipes): Enumerate the active OSPFv3 address-family instances (RFC 5838 section 2): each with its address family, Instance ID, area count, and neighbor count. - `show ospf ipv6 interface` (read-only; wire ze-show:ospf-ipv6-interface; pipes): Show OSPFv3 (IPv6-family) interfaces and their RFC 4552 IPsec status. Returns per interface whether IPsec is configured, the protocol (ah/esp) and SPI, and whether the... - `show ospf ipv6 interface detail` (read-only; wire ze-show:ospfv3-interface-detail; pipes): Show full per-interface OSPFv3 state (spec-ospf-ext-14): ISM, DR/BDR by Router ID, timers, the local Interface ID and Instance ID. - `show ospf ipv6 neighbor` (read-only; wire ze-show:ospfv3-neighbor; pipes): Show OSPFv3 (IPv6) neighbors: the link-local address as identity, adjacency state, DR/BDR by Router ID, and dead time. - `show ospf ipv6 neighbor detail` (read-only; wire ze-show:ospfv3-neighbor-detail; pipes): Show full per-neighbor OSPFv3 state (spec-ospf-ext-14): the advertised Interface ID, DD sequence, decoded Options (R/V6/E/N/AF), list sizes, last NSM event, and timers. - `show ospf ipv6 segment-routing` (read-only; wire ze-show:ospf-ipv6-segment-routing; pipes): Show OSPFv3 (IPv6) Segment Routing state (RFC 8666): the configured SRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node Prefix-SIDs, and the... - `show ospf ipv6 spf` (read-only; wire ze-show:ospfv3-spf; pipes): Show the OSPFv3 (IPv6) per-area SPF run history. - `show ospf ipv6 spf detail` (read-only; wire ze-show:ospfv3-spf-detail; pipes): Explain why each OSPFv3 route won (spec-ospf-ext-14), AF/Instance-ID tagged; read-only. - `show ospf ldp-sync` (read-only; wire ze-show:ospf-ldp-sync; pipes): Show OSPF LDP-IGP synchronization state (RFC 5443, RFC 6138). Lists each ldp-sync interface with its state (not-synchronized / hold-down / synchronized), remaining... - `show ospf neighbor` (read-only; wire ze-show:ospf-neighbor; pipes): Show OSPF neighbors. Returns each neighbor's router-id, interface, adjacency state, DR/BDR, priority, dead time, and address. - `show ospf neighbor detail` (read-only; wire ze-show:ospf-neighbor-detail; pipes): Show full per-neighbor state (spec-ospf-ext-14): DD sequence, decoded Options (incl. the RFC 5250 O-bit), request/summary list sizes, last NSM event, and timers. - `show ospf route` (read-only; wire ze-show:ospf-route; pipes): Show OSPF-computed routes. Lists each prefix with its path type (intra/inter/external-1/2), cost, next-hops, and area. - `show ospf route fast-reroute` (read-only; wire ze-show:ospf-route-fast-reroute; pipes): Show OSPF fast-reroute (LFA / TI-LFA) backups (RFC 5286). Lists each prefix's primary next-hops with their pre-computed loop-free backup, protection class... - `show ospf segment-routing` (read-only; wire ze-show:ospf-segment-routing; pipes): Show OSPFv2 (IPv4) Segment Routing state (RFC 8665): the configured SRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node Prefix-SIDs, and the... - `show ospf spf` (read-only; wire ze-show:ospf-spf; pipes): Show recent OSPF SPF runs. Returns the most recent per-area SPF runs with their timestamp, duration, node count, and pending state. - `show ospf spf detail` (read-only; wire ze-show:ospf-spf-detail; pipes): Explain why each route won (spec-ospf-ext-14): the candidate paths considered per prefix, the winning cost, and the RFC 2328 section 16.4 path-preference tie-break... - `show ospf te-database` (read-only; wire ze-show:ospf-te-database; pipes): Show the OSPF Traffic Engineering Database (RFC 3630 / RFC 5392): router addresses plus TE links with their Link ID, local/remote address, link type, TE metric... - `show ospf virtual-links` (read-only; wire ze-show:ospf-virtual-links; pipes): Show OSPF virtual links (RFC 2328 section 15). Lists each configured virtual link with its transit area, remote router-id, adjacency state, computed cost, and transit... - `show ping` (read-only; wire ze-show:ping; pipes; args count, dest, size, timeout): Ping a target from the router itself. Sends ICMP echo requests to (IP or hostname). Default count is 5. Timeout uses Go duration syntax (e.g. 3s, 500ms). Confirms... - `show pki certificate name` (read-only; wire ze-show:pki-certificate; pipes; args name): Inspect a specific certificate in detail. Syntax: `show pki certificate name [pem | bundle pem | fingerprint`. - `show pki certificates` (read-only; wire ze-show:pki-certificates; pipes): List all loaded certificates with expiry dates. Shows name, type (CA or device), subject, issuer, expiry, and validity status. Check here to find certificates... - `show policy chain peer` (read-only; wire ze-show:policy-chain; pipes): Show the import/export filter chain applied to a peer. Syntax: `show policy chain peer [import|export]`. - `show policy list` (read-only; wire ze-show:policy-list; pipes): List all available filter types and named instances. Shows each filter type and its implementing plugin. Check here when building a new policy chain to see what filters... - `show policy routes` (read-only; wire ze-show:policy-routes; pipes): Show policy-based routing rules. Lists PBR rules with match criteria and routing actions. - `show policy test peer` (read-only; wire ze-show:policy-test; pipes): Test what your policy does to a specific UPDATE. Feed a hex-encoded BGP UPDATE through a peer's filter chain and see the accept/reject result plus attribute... Syntax: `show policy test peer import|export [filter ]`. - `show pppoe` (read-only; wire ze-pppoe-api:summary; pipes): PPPoE session and protocol state. Without a subcommand, shows a summary of active sessions. - `show pppoe interfaces` (read-only; wire ze-pppoe-api:interfaces; pipes): Show which interfaces are accepting PPPoE sessions. Lists each PPPoE-enabled interface with its service name, session limit, and how many sessions are currently active. - `show pppoe session id` (read-only; wire ze-pppoe-api:session; pipes; args id): Show full detail for one PPPoE session. Pass the session ID. Returns discovery tags, LCP/NCP state, assigned addresses, and traffic counters. - `show pppoe sessions` (read-only; wire ze-pppoe-api:sessions; pipes): List all active PPPoE sessions. One line per session: session ID, MAC, subscriber login, uptime, and assigned addresses. - `show pppoe statistics` (read-only; wire ze-pppoe-api:statistics; pipes): Show PPPoE protocol message counters. Returns PADI, PADO, PADR, PADS, PADT counts, active sessions, and errors. A rising PADI count with flat PADS means sessions are not... - `show probe-round` (read-only; wire ze-show:probe-round; pipes; args dest, max-hops, probes, timeout): Run a parallel traceroute probe round to a target. Sends all probes concurrently for faster results than sequential traceroute. Returns per-hop RTT and IP. Use probes... - `show reload-status` (read-only; wire ze-show:reload-status; pipes): Show how many config reloads the daemon has processed. Returns a generation counter, the outcome of the most recent reload (applied or failed), and when it finished. The... - `show route` (read-only; wire ze-show:route; pipes; args limit, prefix): Show the kernel routing table. Lists installed routes with next-hop, interface, protocol, and metric. Pass a CIDR prefix or 'default' to filter, or a route limit to cap... - `show route lookup` (read-only; wire ze-show:route-lookup; pipes): Look up which route the kernel would use for a given IP. Performs a longest-prefix-match and returns the matching route with gateway, interface, protocol, and metric. - `show rr peers` (read-only; wire ze-show:rr-peers; pipes): Show route reflector client peers. Lists each RR client with session state and reflected route counts. - `show rr status` (read-only; wire ze-show:rr-status; pipes): Show whether the route reflector is active. Returns cluster ID, running state, and summary statistics (reflected routes, client count). - `show rsvp-te fast-reroute` (read-only; wire ze-show:rsvp-te-fast-reroute; pipes): Show RSVP-TE Fast Reroute (RFC 4090) protection state. Returns each configured facility-backup bypass LSP and each protected LSP with its armed bypass, mode, and whether... - `show rsvp-te interface` (read-only; wire ze-show:rsvp-te-interface; pipes): Show RSVP-TE bandwidth allocation per interface. Returns reserved, available, and maximum bandwidth for each TE-enabled interface. - `show rsvp-te lsp` (read-only; wire ze-show:rsvp-te-lsp; pipes): Show RSVP-TE label-switched paths. Returns state, role (ingress/transit/egress), reserved bandwidth, and in/out labels for each LSP. - `show rsvp-te tunnel` (read-only; wire ze-show:rsvp-te-tunnel; pipes): Show configured RSVP-TE tunnels and their current state. Returns tunnel name, endpoints, signaling state, and active LSP. - `show runtime memory` (read-only; wire ze-show:system-memory; pipes): Show the Go runtime allocator memory stats. Returns allocated bytes, heap in-use, total allocations, GC cycles, and last GC pause duration. Compare over time to spot... - `show schema events` (read-only; wire ze-show:schema-events; pipes): List all notification types defined in YANG API modules. Shows which events a plugin can subscribe to. - `show schema handlers` (read-only; wire ze-show:schema-handlers; pipes): Show which handler serves each YANG module. Maps module names to their implementing Go handler. - `show schema list` (read-only; wire ze-show:schema-list; pipes): List all YANG schemas loaded by the daemon. Shows module name, namespace, and revision for each schema. - `show schema methods` (read-only; wire ze-show:schema-methods; pipes): List all RPC methods defined in YANG API modules. Useful for plugin developers to discover available operations. - `show schema protocol` (read-only; wire ze-show:schema-protocol; pipes): Show the wire protocol version and format details. Useful for checking compatibility between Ze versions. - `show static` (read-only; wire ze-show:static; pipes): Show static routes defined in the configuration. Lists each static route with its prefix, next-hop, and interface. - `show status` (read-only; wire ze-system:daemon-status; pipes): Show process status, uptime, and resource usage. - `show storage smart` (read-only; wire ze-show:storage-smart; pipes): Show disk health via SMART data. Returns health status, temperature, power-on hours, and self-test schedule for each block device. Replace drives that report failing... - `show subscriber` (read-only; wire ze-subscriber-api:summary; pipes): Show a summary of all subscriber sessions. Counts by access type (PPPoE, L2TP, IPoE) with totals. Quick way to see how many subscribers are online. - `show subscriber id detail` (read-only; wire ze-subscriber-api:detail; pipes; args id): Show everything about one subscriber session. Pass the session ID. Returns access type, assigned addresses, authentication state, uptime, and traffic counters. - `show system conntrack` (read-only; wire ze-show:system-conntrack; pipes): Show the kernel connection tracking table. Returns conntrack entry count, table size, timeouts, and loaded modules. Requires the nft backend. Check this when you suspect... - `show system cpu` (read-only; wire ze-show:system-cpu; pipes): Show CPU utilization context for the daemon. Returns goroutine count, logical CPU count, and GOMAXPROCS setting. Useful when the box feels sluggish and you want to see... - `show system date` (read-only; wire ze-show:system-date; pipes): Show the daemon's current wall-clock time and timezone. Useful for correlating log timestamps when the box is in a different timezone than you are. - `show system file-descriptors` (read-only; wire ze-show:system-file-descriptors; pipes; args mode): Show how many file descriptors the daemon has open. Summary mode: totals by type (socket, pipe, file). Detail mode: every fd with its path and type. Linux only (reads... - `show system goroutines` (read-only; wire ze-show:system-goroutines; pipes; args mode): Dump goroutine stacks for debugging hangs or deadlocks. Modes: summary (groups by state), blocked (only lock/channel waiters), full (all stacks). Default: summary. Share... - `show system kernel-log` (read-only; wire ze-show:system-kernel-log; pipes; args count, level): Show kernel log messages (dmesg-style). Reads from /dev/kmsg. Filter by syslog level (emerg through debug) and limit with count. Without count, you get everything... - `show system memory` (read-only; wire ze-show:system-memory-map; pipes): Show how much memory the daemon is using, from the OS's view. Returns VmRSS, VmSize, VmSwap, and thread count from /proc/self/status (Linux only). This is what the... - `show system ntp` (read-only; wire ze-show:system-ntp; pipes): NTP clock synchronization status - `show system ntp peers` (read-only; wire ze-show:system-ntp-peers; pipes): Show NTP peers with offset, RTT, stratum, and reachability. Tells you whether your clock is synced and how far off each NTP server thinks you are. - `show system platform` (read-only; wire ze-show:system-platform; pipes): Show what kind of platform the daemon is running on. Reports whether this is gokrazy, systemd, container, plain-linux, or darwin, along with platform-specific... - `show system profile` (read-only; wire ze-show:system-profile; pipes; args duration, type): Capture a runtime profile for performance analysis. Types: cpu (requires duration, e.g. 30s), heap, goroutine, allocs (instant snapshots). Output is pprof format you can... - `show system sockets` (read-only; wire ze-show:system-sockets; pipes; args port, protocol, state): Show open TCP and UDP sockets on this box. Filters: [tcp|udp] [state ] [port ], all optional and combinable. States use kernel names (ESTABLISHED, LISTEN, TIME_WAIT)... - `show system subsystem list` (read-only; wire ze-show:system-subsystem-list; pipes): List every registered subsystem and whether it is running. Shows you which components (bgp, dns, web, l2tp, etc.) are active, stopped, or failed. - `show system update` (read-only; wire ze-show:system-update; pipes): Check if a firmware update is available. Shows the running version, latest available version, and when the last check ran. Use 'update system firmware check' to trigger... - `show system update history` (read-only; wire ze-show:system-update-history; pipes): Show recent firmware update activity. Lists the last 20 update events: checks, downloads, installs, and rollbacks with timestamps and outcomes. - `show tcp-check` (read-only; wire ze-show:tcp-check; pipes; args host, port, source, timeout): Test TCP connectivity to a remote host and port. Tries to open a TCP connection and reports success or failure with the connection time. Use 'source ' to bind a specific... - `show traceroute` (read-only; wire ze-show:traceroute; pipes; args dest, max-hops, probes, timeout): Trace the network path from this router to a target. Shows each hop with its IP and round-trip time. Dest can be an IP or hostname. Defaults: 30 max hops, 3 probes per... - `show traffic control` (read-only; wire ze-show:traffic; pipes): Show traffic control (QoS) configuration per interface. Without arguments, lists every interface with its qdisc type and class/filter counts. With an interface name... - `show traffic feature` (read-only; wire ze-show:traffic-feature; pipes; args name): Show neutral per-source traffic feature signals: fan-out (distinct destinations), out/in byte ratio (exfiltration), destination-port entropy, new-peer, rare-port/proto... - `show traffic stat` (read-only; wire ze-show:traffic-stat; pipes; args name): Show aggregated traffic snapshot (interface rates, top talkers, top ports, severity). Without arguments, shows all interfaces. With 'name ', filters to one interface. - `show traffic usage` (read-only; wire ze-show:traffic-usage; pipes; args name): Show per-interface traffic byte counters captured by eBPF TCX. Per destination/source port and protocol counters are always present; per-IP top-talker counters appear... - `show uptime` (read-only; wire ze-show:uptime; pipes): Show how long the daemon has been running. Returns the start time and elapsed uptime. Handy after a maintenance window to confirm the process restarted. - `show version` (read-only; wire ze-show:version; pipes): Show the running Ze version and build date. You can verify which release is deployed on this box. - `show vpn ipsec dataplane drift` (read-only; wire ze-show:vpn-ipsec-dataplane-drift; pipes): Compare what the IKE engine believes against what the kernel holds. Reports each Child SA the engine counts as installed whose SPI the kernel SAD does not hold. The... - `show vpn ipsec dataplane policy` (read-only; wire ze-show:vpn-ipsec-dataplane-policy; pipes): Show the Security Policy Database the kernel holds. Lists each policy with its selector prefixes and ports, direction, priority, upper-layer protocol, if_id, tunnel... - `show vpn ipsec dataplane sa` (read-only; wire ze-show:vpn-ipsec-dataplane-sa; pipes; args spi): Show the Security Association Database the kernel holds. Lists each installed ESP SA with its SPI, addresses, mode, algorithms, replay window, byte and packet counters... - `show vpn ipsec peer name` (read-only; wire ze-show:vpn-ipsec-peer; pipes; args name): Show full detail for one IPsec peer. Returns IKE SA state, all child SAs with traffic selectors, and byte counts. - `show vpn ipsec sa` (read-only; wire ze-show:vpn-ipsec-sa; pipes): Show all IKE and Child Security Associations. Lists every SA with peer, negotiated algorithms, byte counts, rekey timers, and uptime. Includes SPIs, NAT detection, and... - `show vpn ipsec status` (read-only; wire ze-show:vpn-ipsec-status; pipes): Quick IPsec health check. Reports whether the IKE engine is running, how many peers are configured, and how many IKE SAs are Established. - `show vpp runtime` (read-only; wire ze-show:vpp-runtime; pipes): Show VPP graph node processing statistics. Returns per-node packet counts, vectors, clocks, and suspends. Helps you find which node is the bottleneck. Requires the VPP... - `show vpp trace clear` (read-only; wire ze-show:vpp-trace-clear; pipes): Discard the captured VPP trace buffer. Clears all packets so you can start a fresh trace. Requires the VPP backend. - `show vpp trace show` (read-only; wire ze-show:vpp-trace-show; pipes): Retrieve packets captured since the last trace start. Shows per-packet VPP graph node traversal. Requires the VPP backend. - `show vpp trace start` (read-only; wire ze-show:vpp-trace-start; pipes): Start capturing packets in the VPP dataplane. Default input node is dpdk-input, default count is 100 (max 10000). After starting, use 'show vpp trace show' to retrieve... - `show vrrp` (read-only; wire ze-show:vrrp; pipes): Show every VRRP virtual router: its group name, VRID, address family, state (initialize, backup, master), configured and effective priority, virtual addresses, and the... - `show vrrp interface name` (read-only; wire ze-show:vrrp-interface; pipes; args value): Show the VRRP virtual routers on one parent interface. Pass the interface name: show vrrp interface name . - `show vrrp statistics` (read-only; wire ze-show:vrrp-statistics; pipes): Show per-virtual-router counters: advertisements sent and received, priority-zero advertisements, gratuitous ARP and unsolicited neighbor advertisement bursts... - `show warnings` (read-only; wire ze-show:warnings; pipes): Show active warnings across all subsystems. Displays any conditions that need your attention (degraded peers, resource limits approaching, etc.). Use 'source ' to filter... - `show yang completion` (read-only; wire ze-show:yang-completion; pipes): Show YANG paths available for tab completion. Lists every valid completion point in the command tree. - `show yang doc` (read-only; wire ze-show:yang-doc; pipes): Generate command reference docs from YANG schemas. Produces structured documentation with descriptions, arguments, and usage patterns for every registered command. - `show yang tree` (read-only; wire ze-show:yang-tree; pipes): Print the YANG tree for a module in a readable hierarchy. Shows node types, data types, and config-vs-state annotations. Similar to 'pyang -f tree'. Useful for... ### `skills` commands (1) - `skills` (offline): List or retrieve agent skill definitions matching this Ze version. Use 'get ' to fetch a specific skill. ### `support` commands (1) - `support` (offline): Bundle logs, config, state, and diagnostics into one archive file. Send the result to support when reporting an issue. ### `system` commands (8) - `system command complete` (read-only; wire ze-system:command-complete; pipes): Complete command/args - `system command help` (read-only; wire ze-system:command-help; pipes): Show command details - `system command list` (read-only; wire ze-system:command-list; pipes): List all commands - `system dispatch` (read-only; wire ze-system:dispatch; pipes): Dispatch a text command - `system help` (read-only; wire ze-system:help; pipes): Show available commands - `system subsystem list` (read-only; wire ze-system:subsystem-list; pipes): List available subsystems - `system version api` (read-only; wire ze-system:version-api; pipes): Show IPC protocol version - `system version software` (read-only; wire ze-system:version-software; pipes): Show ze version ### `update` commands (13) - `update bgp irr all` (daemon; wire ze-update:irr-all; pipes): Refresh all IRR prefix-lists immediately. Re-queries the IRR server for every enrolled ASN and atomically swaps prefix-lists on success. Failed refreshes preserve the... - `update bgp irr as-set` (daemon; wire ze-update:irr-as-set; pipes; args as-set): Refresh IRR prefix-list for a specific AS-SET. - `update bgp irr asn` (daemon; wire ze-update:irr-asn; pipes; args asn): Refresh IRR prefix-list for a specific ASN. - `update bgp peer prefix` (daemon; wire ze-update:bgp-peer-prefix; pipes; args selector): Refresh max-prefix limits from PeeringDB. - `update firewall irr all` (daemon; wire ze-update:firewall-irr-all; pipes): Refresh all cached IRR prefix-lists. Re-queries the IRR server for every cached ASN/AS-SET entry and updates the zefs cache on success. Failed refreshes preserve the... - `update firewall irr as-set` (daemon; wire ze-update:firewall-irr-as-set; pipes; args as-set): Fetch or refresh IRR prefix-list for an AS-SET. - `update firewall irr asn` (daemon; wire ze-update:firewall-irr-asn; pipes; args asn): Fetch or refresh IRR prefix-list for an ASN. - `update serve` (offline): Run a local update server for firmware checks - `update system firmware apply` (daemon; wire ze-update:system-firmware-apply; pipes): Full upgrade: download, verify, stage, and restart. Runs the complete update cycle in one command. Only available on platforms where Ze owns the update lifecycle (e.g... - `update system firmware check` (daemon; wire ze-update:system-firmware-check; pipes): Check for a new firmware version right now. Bypasses the scheduled interval timer and contacts the update server immediately. Compare the result with 'show system... - `update system firmware download` (daemon; wire ze-update:system-firmware-download; pipes): Download the latest firmware image right now. Bypasses the maintenance window and spread timers. The image is staged but not applied. Use 'update system firmware apply'... - `update system firmware restart` (daemon; wire ze-update:system-firmware-restart; pipes): Reboot into the already-staged firmware. No download happens. Use this after 'update system firmware download' when you are ready to activate the new version. - `update system firmware rollback` (daemon; wire ze-update:system-firmware-rollback; pipes): Roll back to the previous firmware and restart. Reverts to the prior image. Only available on platforms with A/B partitioning (e.g. gokrazy). Use this if the new version... ### `validate` commands (1) - `validate config` (offline): Check your config for errors without applying anything. Reports syntax and semantic issues. ### `withdraw` commands (1) - `withdraw` (daemon; wire ze-bgp:withdraw; pipes): Withdraw on-demand announcements. Syntax: `withdraw tag | withdraw tag * | withdraw id | withdraw all`. ## Vendor command equivalents Curated vendor command equivalents joined with the live Ze command catalog generated from ze help command --json. Ze paths are exact join keys; vendor commands are migration hints with provenance and confidence. Updated: 2026-07-04. Vendors: Junos MX (object-rooted), IOS XR (family-rooted-for-routing), SR OS (instance-rooted), VyOS (family-rooted-for-routing). - BGP: BGP session summary. Ze: `show bgp summary`. Junos MX: `show bgp summary` (operational, verified). IOS XR: `show bgp summary` (operational, verified); `show bgp ipv4 unicast summary` (operational, verified). SR OS: `show router bgp summary` (operational, verified). VyOS: `show bgp ipv4 summary` (operational, verified); `show ip bgp summary` (operational, legacy). - BGP: BGP peer list. Ze: `show bgp peer list`. - BGP: Detailed BGP peer state. Ze: `show bgp peer detail`. - BGP: Negotiated BGP capabilities for a peer. Ze: `show bgp peer capabilities`. - BGP: Routes received from one BGP peer. Ze: `show bgp peer rib`. Junos MX: `show route receive-protocol bgp` (operational, verified). - BGP: Routes advertised to one BGP peer. Ze: `show bgp peer rib`. Junos MX: `show route advertising-protocol bgp` (operational, verified). - BGP: Best BGP routes. Ze: `show bgp rib best`. Junos MX: `show route protocol bgp` (operational, verified). IOS XR: `show bgp ipv4 unicast` (operational, verified). - BGP: BGP route for a prefix. Ze: `show bgp rib best`. Junos MX: `show route protocol bgp` (operational, verified). IOS XR: `show bgp ipv4 unicast` (operational, verified). VyOS: `show ip bgp` (operational, legacy). - BGP: Refresh BGP routes without a hard reset. Ze: `request peer refresh`. Junos MX: `clear bgp neighbor soft-inbound` (operational, verified). IOS XR: `clear bgp ipv4 unicast soft in` (operational, verified). VyOS: `reset bgp soft in` (operational, verified). - BGP: Hard reset one BGP peer. Ze: `request peer teardown`. Junos MX: `clear bgp neighbor` (operational, verified). IOS XR: `clear bgp ipv4 unicast` (operational, verified). VyOS: `reset bgp` (operational, verified). - BGP: Pause or resume a BGP peer without deleting configuration. Ze: `request peer pause`, `request peer resume`. - BGP: Stream live BGP events or updates. Ze: `monitor bgp`. - BGP: BMP collector, peer, and session visibility. Ze: `show bmp sessions`, `show bmp peers`, `show bmp collectors`, `show bmp rib`. - BGP: RPKI cache and validation session state. Ze: `show bgp irr`, `show bgp irr check`, `show bgp irr prefix`. - Routing: Routing table. Ze: `show route`. Junos MX: `show route` (operational, verified). VyOS: `show ip route` (operational, verified). - Routing: Route lookup for a prefix or address. Ze: `show route lookup`. Junos MX: `show route` (operational, verified). VyOS: `show ip route` (operational, verified). - Routing: Static route configuration or state. Ze: `show static`. - Interfaces: Interface list and brief status. Ze: `show interface brief`. VyOS: `show interfaces` (operational, verified). - Interfaces: Detailed interface state. Ze: `show interface name detail`. VyOS: `show interfaces` (operational, verified). - Interfaces: Interface counters and error counters. Ze: `show interface name counters`, `show interface errors`. - Interfaces: Clear interface counters. Ze: `clear interface counters`, `clear interface name counters`. VyOS: `clear interfaces ethernet counters` (operational, verified). - Neighbors: ARP and neighbor cache. Ze: `show arp`, `show neighbor`. VyOS: `show arp` (operational, verified). - Firewall: Firewall ruleset and counters. Ze: `show firewall ruleset`. - Firewall: Firewall address, network, and port groups. Ze: `show firewall group`. - Firewall: Policy-based routing rules. Ze: `show policy routes`. - VPN and access: IPsec security associations. Ze: `show vpn ipsec sa`, `show vpn ipsec status`. - VPN and access: L2TP tunnel and session state. Ze: `show l2tp tunnels`, `show l2tp sessions`, `clear l2tp tunnel id`, `clear l2tp session id`. - VPN and access: PPPoE subscriber sessions. Ze: `show pppoe sessions`, `show pppoe statistics`. - Routing protocols: OSPF overview. Ze: `show ospf`, `show ospf ipv6`. - Routing protocols: OSPF neighbor state. Ze: `show ospf neighbor`, `show ospf ipv6 neighbor`. - Routing protocols: OSPF link-state database. Ze: `show ospf database`, `show ospf ipv6 database`. - Routing protocols: Clear OSPF process, counters, or neighbor state. Ze: `clear ospf process`, `clear ospf counters`, `clear ospf neighbor`. - Routing protocols: IS-IS neighbors, database, routes, and interfaces. Ze: `show isis neighbor`, `show isis database`, `show isis route`, `show isis interface`. - Routing protocols: MPLS, LDP, and RSVP-TE state. Ze: `show ldp neighbor`, `show ldp binding`, `show mpls forwarding`, `show rsvp-te lsp`, `show rsvp-te tunnel`. - Routing protocols: BFD session state. Ze: `show bfd sessions`, `show bfd session address`. - System: Software version and uptime. Ze: `show version`, `show uptime`. VyOS: `show system uptime` (operational, verified). - System: CPU, memory, platform, and host health. Ze: `show system cpu`, `show system memory`, `show system platform`, `show health`, `show doctor`. VyOS: `show hardware cpu` (operational, verified); `show system memory` (operational, verified). - System: System time and NTP state. Ze: `show system date`, `show system ntp`, `show system ntp peers`. VyOS: `show date` (operational, verified); `show ntp` (operational, verified). - Operations: Logs, warnings, and errors. Ze: `show log recent`, `show warnings`, `show errors`. VyOS: `show log` (operational, verified). - Operations: Metrics inventory and values. Ze: `show metrics list`, `show metrics values`, `show metrics name`. - Diagnostics: Ping and traceroute diagnostics. Ze: `show ping`, `show traceroute`, `resolve ping`, `resolve traceroute`. SR OS: `ping` (operational, verified). VyOS: `ping` (operational, verified); `traceroute` (operational, verified). - Diagnostics: DNS lookup and cache inspection. Ze: `show dns cache list`, `show dns cache record`, `show dns cache stats`, `show dns lookup`, `resolve dns a`, `resolve dns aaaa`, `resolve dns ptr`. VyOS: `show dns` (operational, verified). - Configuration: Show running, candidate, and diffed configuration. Ze: `show config dump`, `show config diff`, `show config history`, `show config fmt`. VyOS: `show configuration` (operational, verified); `compare` (configuration, verified). - Configuration: Validate and commit configuration. Ze: `validate config`, `request commit`. VyOS: `commit` (configuration, verified). - Lifecycle: Reload, reboot, halt, or shut down. Ze: `request reload`, `request reboot`, `request halt`, `request shutdown`. VyOS: `reboot` (operational, verified); `poweroff` (operational, verified). - Security: Certificate inventory. Ze: `show pki certificates`, `show pki certificate name`. - Security: Generate a WireGuard keypair. Ze: `generate wireguard keypair`. - Vendor-only gaps: LLDP neighbor discovery. Ze: . - Vendor-only gaps: NAT translations and pools. Ze: . ## Dependency rationale Direct Go modules are grouped by why Ze needs them. This is generated from go.mod plus curated rationale, not copied from package names alone. ### Terminal UI & SSH (8) - `charm.land/bubbletea/v2`: The Elm-style TUI framework driving Ze's interactive CLI: config editor, dashboard, monitor, ping and traceroute views, run per SSH session. - `charm.land/bubbles/v2`: Pre-built TUI widgets (text input, viewport) for the CLI's interactive screens. - `charm.land/lipgloss/v2`: Styling and layout for the CLI's colors, borders, and widths. - `charm.land/wish/v2`: SSH server middleware that wires each incoming session to run the CLI's Bubbletea program. - `charm.land/ssh`: SSH session and public-key types that the wish server and the CLI's key-based auth build on. - `github.com/charmbracelet/colorprofile`: Forces a deterministic color profile in render tests, so CLI screenshot/layout tests don't depend on the terminal running them. - `github.com/muesli/reflow`: ANSI-aware text width calculation, so the CLI's prompt and status bar line up correctly despite embedded color codes. - `github.com/creack/pty`: Opens a pseudo-terminal in a Linux integration test that exercises serial console handling. ### Networking & Protocols (6) - `github.com/miekg/dns`: DNS message parsing and serving underneath Ze's DNS server engine, the AS112 blackhole plugin, and GeoDNS. It's the library underpinning CoreDNS. - `github.com/insomniacslk/dhcp`: DHCPv4/DHCPv6 client used for interface lease handling and the installer's disk-provisioning DHCP client. - `github.com/beevik/ntp`: NTP client queries used by the ntp plugin. - `golang.zx2c4.com/wireguard/wgctrl`: Creates and configures WireGuard interfaces and peers from the interface netlink backend. - `github.com/mdlayher/packet`: Raw AF_PACKET sockets behind the `diag capture` CLI command. - `github.com/packetcap/go-pcap`: Only its filter subpackage: parses tcpdump/BPF-style filter expressions for `diag capture`. Packet capture itself goes through mdlayher/packet instead. ### Linux Kernel Interfaces (6) - `github.com/vishvananda/netlink`: The main library for configuring the Linux network stack: links, addresses, routes, neighbors, bridges, VLANs, tunnels, IPsec, QoS. Used across interfaces, traffic, FIB, OSPF, ISIS, and MPLS. - `github.com/vishvananda/netns`: Linux network-namespace handles, used alongside netlink for namespace-scoped route watching. - `github.com/google/nftables`: Programs the kernel's nftables firewall (tables, chains, rules, sets) over netlink. - `github.com/mdlayher/netlink`: Low-level generic netlink sockets, used to flush conntrack flow entries for flow export. - `github.com/mdlayher/genetlink`: Generic netlink family dialing, used to attach to the kernel's psample subsystem for sampled flow export. - `github.com/cilium/ebpf`: Assembles and attaches eBPF programs in pure Go, no clang or libbpf needed, to count traffic for the trafficusage plugin. ### Routing & Dataplane (2) - `github.com/gaissmai/bart`: Balanced Adaptive Radix Trie: the longest-prefix-match structure underneath Ze's RIB store. - `go.fd.io/govpp`: Binary-API client for FD.io VPP, used by the optional VPP dataplane backends for interfaces, firewall, traffic, FIB, and IKE. ### Config, RPC & Telemetry (5) - `github.com/openconfig/goyang`: Parses and validates the YANG module definitions behind Ze's config schema, CLI completion, and validation engine. - `github.com/openconfig/gnmi`: Generated gNMI protobuf/gRPC types that Ze's gNMI server implements for Get/Set/Subscribe/Capabilities. - `google.golang.org/grpc`: Backs Ze's gRPC servers: gNMI and Ze's own management API. - `google.golang.org/protobuf`: Runtime support for the generated protobuf message types behind Ze's gRPC API. - `google.golang.org/grpc/cmd/protoc-gen-go-grpc`: Build-time only: the protoc plugin used to regenerate the gRPC API's Go bindings from ze.proto. ### Observability (3) - `github.com/prometheus/client_golang`: Ze's internal metrics backend: counters, gauges, and histograms against a private registry. - `github.com/prometheus/procfs`: Parses Linux /proc for the telemetry collector: CPU, memory, network device and socket stats, conntrack, softnet. - `github.com/sirupsen/logrus`: Only to satisfy GoVPP's logging interface, bridged into Ze's own slog logger via a hook. Not used as Ze's own logger. ### Standard Library Extensions (golang.org/x) (6) - `golang.org/x/crypto`: SSH protocol primitives and certificate signing for the SSH server, plus password hashing. - `golang.org/x/mod`: Parses and rewrites go.mod files when the appliance build prepares an isolated instance of the tree, so an image is never built from the tracked working copy. - `golang.org/x/net`: Raw ICMP packet connections for the traceroute plugin, and hostname normalization for MCP's auth. - `golang.org/x/sys`: Low-level Linux syscalls: disk sync and reboot in the installer, used throughout the Linux-specific components. - `golang.org/x/term`: Reads passwords without echo and detects an interactive terminal during CLI login. - `golang.org/x/tools`: Build-time only: goimports, pinned via a tools.go tracking file, never compiled into Ze's binaries. ### Testing & Build Tooling (4) - `github.com/stretchr/testify`: Assertion and require helpers used across the Go unit test suite. - `github.com/gokrazy/tools`: Drives gokrazy appliance image builds from Ze's appliance build tooling. - `github.com/gokrazy/updater`: Referenced only in a regression test against Ze's own vendored update-push logic, written locally after a bug was found upstream. Not used in production. - `github.com/sivchari/gomu`: Mutation-testing tool, run via the Makefile to advisory-score how well the test suite actually exercises the code. Not a build or CI gate. ## Complete documentation index - [Ze Architecture](https://ze-software.net/docs/architecture/index.md): A one-page guide to how Ze is structured. For the full design document with rationale, wire format details, and performance analysis, see DESIGN.md. For the canonical architecture reference, see... (web: https://ze-software.net/docs/architecture/) - [Configuration Syntax Changes](https://ze-software.net/docs/architecture/config/deprecated-options/index.md): Ze has not shipped a stable configuration release yet. There is no public deprecation lifecycle for old config versions, and Ze does not promise a numbered generation ladder for config syntax. (web: https://ze-software.net/docs/architecture/config/deprecated-options/) - [Interoperability Testing](https://ze-software.net/docs/architecture/testing/interop/index.md): Ze validates protocol correctness against production BGP daemons in two complementary ways: live session interop tests (Docker containers running real daemons) and byte-level wire format validation against ExaBGP (Ze's... (web: https://ze-software.net/docs/architecture/testing/interop/) - [Ze Features](https://ze-software.net/docs/features/index.md): Ze is an open-source configuration and protocol engine written in Go. The network operating system built on it runs on any Linux or as a gokrazy appliance. (web: https://ze-software.net/docs/features/) - [AI-First Design](https://ze-software.net/docs/features/ai-first/index.md): Ze is built around a single command and discovery surface. Commands, configuration nodes, RPCs, events, and plugin metadata are registered once, then exposed through MCP and the operator interfaces that need them. AI... (web: https://ze-software.net/docs/features/ai-first/) - [API Commands](https://ze-software.net/docs/features/api-commands/index.md): Commands sent through `ze cli`, `ze cli -c`, `ze show`, or process stdin. (web: https://ze-software.net/docs/features/api-commands/) - [BGP Protocol](https://ze-software.net/docs/features/bgp-protocol/index.md): When several BGP candidates tie under multipath selection, Ze carries the winner and its equal-cost sibling next hops into the shared Loc-RIB. The system RIB then emits one ECMP group to the active FIB backend... (web: https://ze-software.net/docs/features/bgp-protocol/) - [RFC Implementation Status](https://ze-software.net/docs/features/rfc-status/index.md): This page is Ze's public standards status page. It lists RFCs that Ze implements, partially implements, has deferred, or has explicitly decided not to implement. It is a product support view rather than a formal IETF... (web: https://ze-software.net/docs/features/rfc-status/) - [CLI Commands](https://ze-software.net/docs/features/cli-commands/index.md): Ping and traceroute: `show ping` and `show traceroute` run one-shot ICMP checks from the router itself using ze's internal engine -- no daemon required, they work as local handlers. `monitor ping` and `monitor... (web: https://ze-software.net/docs/features/cli-commands/) - [Configuration](https://ze-software.net/docs/features/configuration/index.md): This page walks through BGP peer configuration specifically, since it is the most-configured surface. For every other subsystem's config syntax (interfaces, firewall, L2TP, DHCP, and the rest of Ze's 38 plugin groups)... (web: https://ze-software.net/docs/features/configuration/) - [DNS Resolver](https://ze-software.net/docs/features/dns-resolver/index.md): Built-in DNS resolver component providing cached DNS queries to all Ze components. Uses `github.com/miekg/dns` (the library CoreDNS is built on). (web: https://ze-software.net/docs/features/dns-resolver/) - [ExaBGP Compatibility](https://ze-software.net/docs/features/exabgp-compatibility/index.md): Automatic detection and migration of ExaBGP configuration files (web: https://ze-software.net/docs/features/exabgp-compatibility/) - [Fleet Management](https://ze-software.net/docs/features/fleet-management/index.md): Ze supports centralized configuration for multi-node deployments. A central hub serves configuration to remote ze instances over TLS. (web: https://ze-software.net/docs/features/fleet-management/) - [Output Formatting](https://ze-software.net/docs/features/formatting/index.md): Every command's output goes through the same pipe pipeline, whether you're poking around interactively or scripting against ze. One operator set, three ways to use it: set a persistent default, pipe it inline, or apply... (web: https://ze-software.net/docs/features/formatting/) - [Interface Management](https://ze-software.net/docs/features/interfaces/index.md): Ze manages Linux network interfaces via pure netlink (no iproute2 shell-outs). JunOS-style two-layer model: physical interfaces with named logical units. (web: https://ze-software.net/docs/features/interfaces/) - [Interoperability Testing](https://ze-software.net/docs/features/interoperability-testing/index.md): Ze ships a Docker-based interoperability test suite that verifies protocol correctness against real third-party BGP implementations. Tests are not mocks -- they launch actual daemon instances in containers and exchange... (web: https://ze-software.net/docs/features/interoperability-testing/) - [Self-Documenting System](https://ze-software.net/docs/features/introspection/index.md): Ze is self-documenting: every plugin, environment variable, RPC, event type, and CLI command is registered at startup and discoverable at runtime. Nothing exists unregistered -- the system enforces this with... (web: https://ze-software.net/docs/features/introspection/) - [Looking Glass](https://ze-software.net/docs/features/looking-glass/index.md): Ze includes a built-in looking glass that exposes BGP session state and route information via both an HTMX web UI and a birdwatcher-compatible REST API. The looking glass runs as a separate HTTP server on its own port... (web: https://ze-software.net/docs/features/looking-glass/) - [MCP Integration](https://ze-software.net/docs/features/mcp-integration/index.md): Ze includes an MCP (Model Context Protocol) server that makes the BGP daemon AI-ready. Any AI assistant (Claude, GPT, or custom agents) can connect via MCP and fully control Ze -- the same operations available through... (web: https://ze-software.net/docs/features/mcp-integration/) - [Web Interface](https://ze-software.net/docs/features/web-interface/index.md): Ze includes an HTTPS web interface for configuration viewing, editing, and runtime command execution through a browser. (web: https://ze-software.net/docs/features/web-interface/) - [Behavioural Anomaly Detection](https://ze-software.net/docs/guide/anomaly/index.md): Ze includes a report-only behavioural anomaly detector. It builds a per-source behavioural baseline, scores how far each source deviates from its own history and from its peers, and correlates weak signals into a single... (web: https://ze-software.net/docs/guide/anomaly/) - [AS112](https://ze-software.net/docs/guide/as112/index.md): Ze's `as112` plugin runs an AS112 anycast DNS node: an authoritative sink for misdirected RFC 1918 and link-local reverse-DNS queries (RFC 7534), plus the EMPTY.AS112.ARPA DNAME-redirection sink (RFC 7535). It answers... (web: https://ze-software.net/docs/guide/as112/) - [Authentication](https://ze-software.net/docs/guide/authentication/index.md): Ze supports multiple SSH login users defined in the daemon's configuration, in addition to the bootstrap super-admin written to `database.zefs` by `ze init`. This guide covers adding YANG-configured users, hashing their... (web: https://ze-software.net/docs/guide/authentication/) - [Authorization](https://ze-software.net/docs/guide/authorization/index.md): Ze uses profile-based command authorization (RBAC) to control which commands each user can execute. Profiles are defined in the daemon configuration alongside user accounts. Each user is assigned one or more profiles... (web: https://ze-software.net/docs/guide/authorization/) - [Audit Trail](https://ze-software.net/docs/guide/audit/index.md): Ze keeps a local structured audit log for operator actions that change state or fail authentication. The log is append-only from the user's point of view: there is a query command, but no command to delete or truncate... (web: https://ze-software.net/docs/guide/audit/) - [Benchmarking](https://ze-software.net/docs/guide/benchmarking/index.md): Ze includes `ze-perf`, a standalone tool for measuring BGP route propagation latency through a device under test (DUT). It works with any BGP implementation, including Ze. (web: https://ze-software.net/docs/guide/benchmarking/) - [BFD: Bidirectional Forwarding Detection](https://ze-software.net/docs/guide/bfd/index.md): Status: the plugin is live, the production transport is hardened (GTSM, IP_TTL=255 outbound, SO_BINDTODEVICE for single-hop and multi-VRF, RFC 5880 ยง6.8.7 TX jitter), the BGP peer opt-in is wired through the reactor... (web: https://ze-software.net/docs/guide/bfd/) - [BMP (BGP Monitoring Protocol)](https://ze-software.net/docs/guide/bmp/index.md): Ze implements RFC 7854 BMP in both directions: as a receiver (accepting feeds from routers) and as a sender (streaming state to collectors). (web: https://ze-software.net/docs/guide/bmp/) - [Command Reference](https://ze-software.net/docs/guide/command-reference/index.md): Ze commands fall into two categories: shell commands that run locally and runtime commands sent to the running daemon via SSH. (web: https://ze-software.net/docs/guide/command-reference/) - [Configuration Editor](https://ze-software.net/docs/guide/config-editor/index.md): Ze includes an interactive configuration editor with YANG-driven tab completion, rollback history, and live validation. (web: https://ze-software.net/docs/guide/config-editor/) - [DDoS Detection and Auto-Mitigation](https://ze-software.net/docs/guide/ddos-mitigation/index.md): Ze can automatically detect volumetric DDoS attacks on its interfaces, mitigate them locally or upstream, and report incidents to the Flowtriq cloud. (web: https://ze-software.net/docs/guide/ddos-mitigation/) - [FlowSpec protected router](https://ze-software.net/docs/guide/flowspec-protected-router/index.md): Use this when a Ze router receives BGP FlowSpec rules and should turn them into nftables filters, while also protecting its own BGP control plane from connection floods. (web: https://ze-software.net/docs/guide/flowspec-protected-router/) - [FlowSpec route reflector](https://ze-software.net/docs/guide/flowspec-route-reflector/index.md): Use this when you want one Ze node to receive FlowSpec routes from mitigation systems or edge routers and reflect them to iBGP clients. (web: https://ze-software.net/docs/guide/flowspec-route-reflector/) - [Firewall](https://ze-software.net/docs/guide/firewall/index.md): Ze manages nftables packet filter and NAT rules from a single `firewall { }` YANG section. The abstract data model describes matches (from) and actions (then); the nft backend lowers them to nftables kernel expressions. (web: https://ze-software.net/docs/guide/firewall/) - [Flow Export](https://ze-software.net/docs/guide/flow-export/index.md): Ze exports interface counters and per-flow records to external collectors over UDP. The `flowexport` component is a registered component: it loads only when a `flow-export { }` section is present in the config. Counter... (web: https://ze-software.net/docs/guide/flow-export/) - [IS-IS](https://ze-software.net/docs/guide/isis/index.md): Ze implements IS-IS (Intermediate System to Intermediate System, ISO/IEC 10589 as updated by RFC 1195 / RFC 5305 / RFC 5308 / ...) as a native link-state interior gateway protocol that runs directly over Layer 2. This... (web: https://ze-software.net/docs/guide/isis/) - [Native IKEv2 and IPsec](https://ze-software.net/docs/guide/ipsec/index.md): Ze implements native IKEv2 in Go for route-based IPsec VPN tunnels. It does not require strongSwan, libreswan, or another external IKE daemon. The IKE engine, cryptographic primitives, wire codec, and XFRM dataplane... (web: https://ze-software.net/docs/guide/ipsec/) - [Filter BGP Imports with IRR](https://ze-software.net/docs/guide/irr-filtering/index.md): Ze can build a BGP import prefix-list from an ASN or IRR AS-SET. The `bgp-filter-irr` plugin resolves the AS-SET through an IRR whois server, keeps the resulting IPv4 and IPv6 prefixes in ZeFS, and rejects received... (web: https://ze-software.net/docs/guide/irr-filtering/) - [L2TPv2 LNS subsystem](https://ze-software.net/docs/guide/l2tp/index.md): Ze includes a native L2TPv2 (RFC 2661) LNS/LAC implementation used as a BNG (Broadband Network Gateway) component: it terminates L2TP tunnels over UDP, runs PPP negotiation (LCP, authentication, IPCP/IPv6CP), assigns... (web: https://ze-software.net/docs/guide/l2tp/) - [OSPF](https://ze-software.net/docs/guide/ospf/index.md): Ze includes an experimental native OSPF engine under the `ospf` config root. The same engine drives OSPFv2 for IPv4 and OSPFv3 for the `address-family ipv6` subsection: interface and neighbor state, LSDB flooding, SPF... (web: https://ze-software.net/docs/guide/ospf/) - [Monitoring](https://ze-software.net/docs/guide/monitoring/index.md): Ze provides real-time BGP event monitoring and a live peer dashboard through the CLI. Commands follow verb-first syntax: `monitor `. (web: https://ze-software.net/docs/guide/monitoring/) - [MRT Analysis](https://ze-software.net/docs/guide/mrt-analysis/index.md): Ze includes `ze-analyze`, a standalone tool for analysing real-world BGP data from public route collectors (RIPE RIS, RouteViews). It processes MRT dump files to extract statistics that inform ze's internal buffer... (web: https://ze-software.net/docs/guide/mrt-analysis/) - [Policy Routing](https://ze-software.net/docs/guide/policy-routing/index.md): Ze supports policy-based routing (PBR) to steer traffic through alternate routing tables or next-hops based on L3/L4 match criteria. This is used for content filtering (Surfprotect), split tunneling, and traffic... (web: https://ze-software.net/docs/guide/policy-routing/) - [Plugins](https://ze-software.net/docs/guide/plugins/index.md): Ze uses a plugin architecture for all features beyond core BGP session management. Plugins handle RIB storage, route reflection, graceful restart, RPKI validation, NLRI encoding, and more. (web: https://ze-software.net/docs/guide/plugins/) - [PPPoE Access Concentrator](https://ze-software.net/docs/guide/pppoe/index.md): Ze implements an RFC 2516 PPPoE access concentrator for direct-attach subscriber access. PPPoE is the alternative to L2TP: subscribers connect over Ethernet to the BNG without an intermediate LAC/LNS tunnel. (web: https://ze-software.net/docs/guide/pppoe/) - [Production Diagnostics Guide](https://ze-software.net/docs/guide/production-diagnostics/index.md): Symptom-based troubleshooting using Ze's built-in diagnostic commands. `ze doctor`, health checks, warning/error reports, support bundles, crash capture, and runtime probes are part of the product, so operators can... (web: https://ze-software.net/docs/guide/production-diagnostics/) - [Health Checks and System Readiness](https://ze-software.net/docs/guide/health-checks/index.md): Ze provides two complementary systems for monitoring operational health: offline doctor checks (pre-start readiness) and runtime health monitoring (continuous anomaly detection during operation). (web: https://ze-software.net/docs/guide/health-checks/) - [Quick Start](https://ze-software.net/docs/guide/quickstart/index.md): Get Ze running with two BGP peers in under 5 minutes. (web: https://ze-software.net/docs/guide/quickstart/) - [RADIUS admin AAA](https://ze-software.net/docs/guide/radius/index.md): Ze authenticates operator logins (SSH, web, MCP) against RADIUS servers (RFC 2865) when the `system.authentication.radius` block is present. Local bcrypt users keep working as the fallback so an unreachable server... (web: https://ze-software.net/docs/guide/radius/) - [Route Injection](https://ze-software.net/docs/guide/route-injection/index.md): Ze supports injecting routes at runtime through text, hex, or base64 encoded UPDATE commands. Routes can be sent from the CLI, from external plugins, or from process scripts. (web: https://ze-software.net/docs/guide/route-injection/) - [RPKI Origin Validation](https://ze-software.net/docs/guide/rpki/index.md): Ze validates received BGP routes against RPKI ROA data. Invalid routes are rejected before entering the RIB. The feature connects to RTR cache servers (RFC 8210), downloads Validated ROA Payloads (VRPs), and applies the... (web: https://ze-software.net/docs/guide/rpki/) - [Static Routes](https://ze-software.net/docs/guide/static-routes/index.md): Ze supports static routes with ECMP, weighted load balancing, BFD-tracked failover, blackhole, and reject. Routes are programmed directly to the kernel via netlink (or VPP when available). Routes are grouped under named... (web: https://ze-software.net/docs/guide/static-routes/) - [Public looking glass](https://ze-software.net/docs/guide/looking-glass-howto/index.md): Use this when you want a read-only HTTP looking glass for BGP peers, route lookup, prefix search, and AS-path graphs. (web: https://ze-software.net/docs/guide/looking-glass-howto/) - [TACACS+ AAA](https://ze-software.net/docs/guide/tacacs/index.md): Ze authenticates SSH logins against TACACS+ servers (RFC 8907) when the `system.authentication.tacacs` block is present. Local bcrypt users keep working as the fallback so an unreachable server cannot lock you out of... (web: https://ze-software.net/docs/guide/tacacs/) - [Operator access with SSH and RBAC](https://ze-software.net/docs/guide/operator-access-rbac/index.md): Use this when the box already has Ze installed and `database.zefs` created, and you want real operator accounts instead of a single bootstrap admin. (web: https://ze-software.net/docs/guide/operator-access-rbac/) - [Traffic Usage](https://ze-software.net/docs/guide/traffic-usage/index.md): Ze accounts per-(port, protocol) and, optionally, per-IP byte totals on operator-selected interfaces using eBPF programs attached via TCX. The counters are exported as Prometheus metrics and viewed with `show traffic... (web: https://ze-software.net/docs/guide/traffic-usage/) - [Terminal Demonstrations](https://ze-software.net/docs/guide/terminal-demonstrations/index.md): These recordings run real Ze commands against isolated local fixtures. The checked-in VHS tapes define every keystroke, pause, and terminal size, so a release can regenerate the videos when Ze changes. The recordings... (web: https://ze-software.net/docs/guide/terminal-demonstrations/) - [VRRP](https://ze-software.net/docs/guide/vrrp/index.md): VRRP gives a LAN a gateway address that survives the loss of the router holding it. Two or more routers share a virtual IP; one is Active (Master) and answers for it, the others wait. If the Active router dies, a Backup... (web: https://ze-software.net/docs/guide/vrrp/) - [VPP Data Plane](https://ze-software.net/docs/guide/vpp/index.md): Status: the VPP component manages the VPP process lifecycle (startup, crash recovery, DPDK NIC binding, GoVPP connection), the `fib-vpp` plugin programs routes from ze's system RIB directly into VPP's FIB via the GoVPP... (web: https://ze-software.net/docs/guide/vpp/) - [VM Appliance](https://ze-software.net/docs/guide/appliance/index.md): Build a bootable VM image with Ze baked in using gokrazy. The default target is x86_64. The legacy Make workflow uses `GOKRAZY_ARCH=arm64` for native Apple Silicon QEMU images; the structured `ze appliance build`... (web: https://ze-software.net/docs/guide/appliance/) - [Installation](https://ze-software.net/docs/guide/ze-install/index.md): Ze provides commands for local installation, remote PXE provisioning, and appliance ISO installer media. (web: https://ze-software.net/docs/guide/ze-install/) - [Build and install Ze on Ubuntu](https://ze-software.net/docs/guide/ubuntu-build-install/index.md): This page starts from a blank Ubuntu server and leaves you with an installed `ze` binary, a `database.zefs`, an SSH listener, a systemd service, and one place to add Ze features. (web: https://ze-software.net/docs/guide/ubuntu-build-install/) - [Performance Comparison](https://ze-software.net/docs/performance/index.md): Ze-perf establishes two BGP sessions with a device under test (DUT): a sender and a receiver. The sender injects routes and records when each was sent. The receiver parses incoming UPDATEs and records when each prefix... (web: https://ze-software.net/docs/performance/) - [VPP Deployment Reference](https://ze-software.net/docs/research/vpp-deployment-reference/index.md): Source: 83 blog articles from ipng.ch (Pim van Pelt / IPng Networks, AS8298 / AS50869), VyOS VPP integration, and GoVPP documentation. (web: https://ze-software.net/docs/research/vpp-deployment-reference/) - [Command Ownership and Plugin Structure](https://ze-software.net/docs/architecture/command-ownership/index.md): Every feature in Ze passes two folder tests: (web: https://ze-software.net/docs/architecture/command-ownership/) - [Route Selection](https://ze-software.net/docs/architecture/route-selection/index.md): Every route received by ze goes through two phases before it can become the best path for a prefix. Phase 1 determines whether the route is valid and eligible. Phase 2 determines which eligible route wins. A route that... (web: https://ze-software.net/docs/architecture/route-selection/) - [Ze System Architecture](https://ze-software.net/docs/architecture/system-architecture/index.md): Status: Superseded / legacy design note (kept for background only) Last Updated: 2026-01-30 Purpose: Describes Ze's hub/orchestrator mode with separate plugin processes (web: https://ze-software.net/docs/architecture/system-architecture/) - [.ci Test File Format](https://ze-software.net/docs/architecture/testing/ci-format/index.md): The `.ci` format is used by Ze's test runner to define functional tests. It supports embedded files (Tmpfs), test options, expectations, and commands. (web: https://ze-software.net/docs/architecture/testing/ci-format/) - [Documentation Testing](https://ze-software.net/docs/contributing/documentation-testing/index.md): Ze ships several tools that validate documentation against the live code. They live in `scripts/` and are exposed as `make ze-*` targets. The full documentation check is still explicit, while `make ze-verify` runs a... (web: https://ze-software.net/docs/contributing/documentation-testing/) - [RFC Implementation Guide for Ze](https://ze-software.net/docs/contributing/rfc-implementation-guide/index.md): This guide provides a step-by-step checklist for implementing an RFC in Ze. Use it alongside `planning.md` to ensure complete implementations. (web: https://ze-software.net/docs/contributing/rfc-implementation-guide/) - [Testing Guide](https://ze-software.net/docs/contributing/testing/index.md): This guide covers how to run tests, what the different test types are, and how to interpret their output. For the full technical reference (`.ci` format spec, `.et` directives, fuzz target list), see... (web: https://ze-software.net/docs/contributing/testing/) - [SRv6 (Segment Routing over IPv6)](https://ze-software.net/docs/features/srv6/index.md): Ze receives BGP routes carrying SRv6 Prefix-SID attributes (RFC 8669, RFC 9252), extracts SRv6 SIDs, validates them, and programs encapsulation into the FIB. Operates as an ingress PE: consumes received SRv6 SIDs but... (web: https://ze-software.net/docs/features/srv6/) - [Glossary](https://ze-software.net/docs/glossary/index.md): Terms used in Ze documentation and operator output. (web: https://ze-software.net/docs/glossary/) - [ADD-PATH and PATHS-LIMIT](https://ze-software.net/docs/guide/add-path/index.md): ADD-PATH (RFC 7911) allows multiple paths per prefix by including a Path Identifier with each NLRI. Route servers use it to forward all available paths rather than one best path. (web: https://ze-software.net/docs/guide/add-path/) - [REST and gRPC API](https://ze-software.net/docs/guide/api/index.md): Ze exposes a programmatic API over REST (HTTP/JSON) and gRPC. Both transports share one engine -- they produce identical command output and support the same commands. (web: https://ze-software.net/docs/guide/api/) - [BGP Peering](https://ze-software.net/docs/guide/bgp-peering/index.md): Use this guide after the quick start when a peer needs groups, multiple address families, capabilities, prefix limits, or an explicit relationship role. (web: https://ze-software.net/docs/guide/bgp-peering/) - [BGP Policy](https://ze-software.net/docs/guide/bgp-policy/index.md): Ze applies ordered import and export filter chains to BGP updates. Define named policy objects once, attach them globally, to a group, or to one peer, then verify both accepted routes and the routes sent onward. (web: https://ze-software.net/docs/guide/bgp-policy/) - [BGP Resilience](https://ze-software.net/docs/guide/bgp-resilience/index.md): BGP resilience is a set of separate mechanisms. Route Refresh reapplies policy without dropping the session. Graceful Restart retains forwarding during a restart. RIB persistence retains outbound state. Route reflection... (web: https://ze-software.net/docs/guide/bgp-resilience/) - [BGP Role (RFC 9234)](https://ze-software.net/docs/guide/bgp-role/index.md): BGP Role enables route leak prevention by declaring the relationship between peers. When configured, ze adds the Only To Customer (OTC) path attribute to enforce proper route propagation based on the business... (web: https://ze-software.net/docs/guide/bgp-role/) - [Chaos Testing](https://ze-software.net/docs/guide/chaos-testing/index.md): Ze includes a chaos testing mode that injects faults during operation to verify the daemon handles failures correctly. This is useful for validating configuration changes, testing plugin resilience, and finding edge... (web: https://ze-software.net/docs/guide/chaos-testing/) - [CLI Reference](https://ze-software.net/docs/guide/cli/index.md): Ze provides an interactive CLI and single-command execution for runtime queries and control. All CLI access goes through the daemon's SSH server. (web: https://ze-software.net/docs/guide/cli/) - [Config Archive](https://ze-software.net/docs/guide/config-archive/index.md): Ze archives configuration files to local or remote destinations. Archives can be triggered manually from the CLI, automatically on every editor commit, or on a schedule. (web: https://ze-software.net/docs/guide/config-archive/) - [Configuration](https://ze-software.net/docs/guide/configuration/index.md): Ze uses a JUNOS-like hierarchical configuration format. (web: https://ze-software.net/docs/guide/configuration/) - [ZeBGP Debugging Tools](https://ze-software.net/docs/guide/debugging-tools/index.md): This document describes the debugging tools available in ZeBGP for troubleshooting config parsing, BGP message encoding, and session issues. (web: https://ze-software.net/docs/guide/debugging-tools/) - [Developer Setup](https://ze-software.net/docs/guide/developer-setup/index.md): Set up a Ze development environment with all build, lint, and test dependencies. (web: https://ze-software.net/docs/guide/developer-setup/) - [Environment Variables](https://ze-software.net/docs/guide/environment-variables/index.md): Ze reads environment variables for daemon-wide settings and BGP protocol tuning. Config-backed keys have matching paths under `environment { }`. Bootstrap, safety, and test keys can be environment-only. (web: https://ze-software.net/docs/guide/environment-variables/) - [Fleet Configuration](https://ze-software.net/docs/guide/fleet-config/index.md): Ze supports centralized configuration management for multi-node deployments. A central hub serves configuration to remote ze instances over TLS. (web: https://ze-software.net/docs/guide/fleet-config/) - [gNMI Guide](https://ze-software.net/docs/guide/gnmi/index.md): Ze includes a gNMI (gRPC Network Management Interface) server that exposes YANG-modeled configuration over the industry-standard gNMI protocol. This allows management by tools like gnmic, Ansible, and network... (web: https://ze-software.net/docs/guide/gnmi/) - [Graceful Restart](https://ze-software.net/docs/guide/graceful-restart/index.md): Graceful Restart (RFC 4724) preserves forwarding state across BGP session restarts. When a peer goes down and comes back, routes are held during the restart window instead of being immediately withdrawn, preventing... (web: https://ze-software.net/docs/guide/graceful-restart/) - [Healthcheck](https://ze-software.net/docs/guide/healthcheck/index.md): Ze's healthcheck plugin monitors service availability by running shell commands and controls BGP route announcement/withdrawal via watchdog groups. It is the successor to ExaBGP's healthcheck program. (web: https://ze-software.net/docs/guide/healthcheck/) - [Lifecycle, Rollback, and Recovery](https://ze-software.net/docs/guide/lifecycle/index.md): Use this guide for routine daemon control and configuration recovery. Ze separates configuration reload, process restart, and host reboot because they have different routing consequences. (web: https://ze-software.net/docs/guide/lifecycle/) - [Logging](https://ze-software.net/docs/guide/logging/index.md): Ze uses hierarchical, structured logging with runtime-configurable levels per subsystem. (web: https://ze-software.net/docs/guide/logging/) - [Looking Glass](https://ze-software.net/docs/guide/looking-glass/index.md): Ze includes a built-in looking glass that provides public, read-only access to BGP session state and route information. It runs as a separate HTTP server from the authenticated web UI. (web: https://ze-software.net/docs/guide/looking-glass/) - [Chaos MCP Server](https://ze-software.net/docs/guide/mcp/chaos/index.md): ze-chaos includes an MCP (Model Context Protocol) server that lets AI assistants query chaos test state, detect problems, and control the chaos scheduler. (web: https://ze-software.net/docs/guide/mcp/chaos/) - [MCP Elicitation](https://ze-software.net/docs/guide/mcp/elicitation/index.md): Ze can ask an MCP client for a value it needs but was not given. Under protocol revision `2026-07-28` it does so through Multi Round-Trip Requests (MRTR): the server does not send the client a request, it returns one. (web: https://ze-software.net/docs/guide/mcp/elicitation/) - [MCP Integration](https://ze-software.net/docs/guide/mcp/overview/index.md): Ze includes an MCP (Model Context Protocol) server that lets AI assistants control BGP operations. The server runs inside the daemon and wraps the same command dispatcher used by the CLI and web interface. (web: https://ze-software.net/docs/guide/mcp/overview/) - [MCP Remote Access](https://ze-software.net/docs/guide/mcp/remote-access/index.md): Ze's MCP server defaults to loopback binding (`127.0.0.1`). Two patterns make it reachable from other machines: (web: https://ze-software.net/docs/guide/mcp/remote-access/) - [MPLS](https://ze-software.net/docs/guide/mpls/index.md): Ze can act as a Linux MPLS label-switching router (LSR). BGP labeled-unicast routes (RFC 8277) received from peers are programmed into the kernel MPLS FIB as label-push entries, so Ze forwards labeled traffic without... (web: https://ze-software.net/docs/guide/mpls/) - [Operations](https://ze-software.net/docs/guide/operations/index.md): Running Ze in production: SSH access, signals, health checks, environment variables, and troubleshooting. (web: https://ze-software.net/docs/guide/operations/) - [Route Filters](https://ze-software.net/docs/guide/redistribution/index.md): Route filters let plugins act as route filters on import (ingress) and export (egress). Filters are configured per peer, group, or globally using named references in a `filter {}` config block. Named filter types are... (web: https://ze-software.net/docs/guide/redistribution/) - [RSVP-TE](https://ze-software.net/docs/guide/rsvp-te/index.md): RSVP-TE (RFC 3209, on top of RFC 2205 RSVP) signals explicitly-routed MPLS LSP tunnels with bandwidth reservation. It runs directly over IP as protocol 46 and requires `CAP_NET_RAW`. (web: https://ze-software.net/docs/guide/rsvp-te/) - [Self-Update Guide](https://ze-software.net/docs/guide/self-update/index.md): Ze can automatically download, verify, and install firmware updates on non-gokrazy deployments. This guide covers server setup, client configuration, manual operations, and fleet deployment. (web: https://ze-software.net/docs/guide/self-update/) - [Traffic Control](https://ze-software.net/docs/guide/traffic-control/index.md): Ze programs per-interface queueing disciplines, classes, and filters from a single `traffic { control { } }` YANG section. The same config is consumed by two backends; the operator chooses one via the `backend` leaf. (web: https://ze-software.net/docs/guide/traffic-control/) - [Web Interface](https://ze-software.net/docs/guide/web-interface/index.md): Ze provides an HTTPS web interface for browsing configuration, editing values, and running commands through a browser. The web UI uses the same YANG schemas, user database, and command grammar as the SSH CLI. (web: https://ze-software.net/docs/guide/web-interface/) - [Project History](https://ze-software.net/docs/history/index.md): Ze grew from the operational lessons of ExaBGP. ExaBGP made BGP programmable by treating routes and protocol events as input and output for ordinary processes. That model proved that a routing tool did not need to... (web: https://ze-software.net/docs/history/) - [Plugin Development](https://ze-software.net/docs/plugin-development/index.md): Ze plugins receive events, add configuration and commands, validate or apply configuration changes, implement address families and capabilities, and call the shared command dispatcher. External and in-process plugins... (web: https://ze-software.net/docs/plugin-development/) - [Adding Commands](https://ze-software.net/docs/plugin-development/commands/index.md): Plugins can expose commands for runtime interaction via the ze API. (web: https://ze-software.net/docs/plugin-development/commands/) - [Plugin Handlers](https://ze-software.net/docs/plugin-development/handlers/index.md): Handlers process engine-initiated callbacks during startup and at runtime. They are registered on the `sdk.Plugin` before calling `Run()`. (web: https://ze-software.net/docs/plugin-development/handlers/) - [Plugin Metrics](https://ze-software.net/docs/plugin-development/metrics/index.md): Plugins that have observable runtime state register their own Prometheus metrics via the existing `ConfigureMetrics` callback in the `Registration` struct. (web: https://ze-software.net/docs/plugin-development/metrics/) - [Plugin Protocol](https://ze-software.net/docs/plugin-development/protocol/index.md): Ze plugins communicate with the engine via newline-framed YANG RPCs over a single bidirectional connection. Internal plugins use `net.Pipe()` for startup; external plugins connect back via TLS. (web: https://ze-software.net/docs/plugin-development/protocol/) - [YANG Schema Authoring](https://ze-software.net/docs/plugin-development/schema/index.md): Plugins declare their configuration schema using YANG (RFC 7950). This guide covers the basics for plugin authors. (web: https://ze-software.net/docs/plugin-development/schema/) - [Testing Your Plugin](https://ze-software.net/docs/plugin-development/testing/index.md): This guide covers testing strategies for ze plugins using the SDK (`pkg/plugin/sdk`). (web: https://ze-software.net/docs/plugin-development/testing/) - [Why Ze / Why Not Ze](https://ze-software.net/docs/why-ze/index.md): An honest assessment of when Ze is the right tool and when it is not. (web: https://ze-software.net/docs/why-ze/) - [Usage](https://ze-software.net/usage/index.md): Use these pages when you want Ze to play a concrete role in a network. (web: https://ze-software.net/usage/) - [AS112 anycast DNS inside a network](https://ze-software.net/usage/as112/index.md): Run Ze as the AS112 sink for RFC 1918 and link-local reverse DNS, then learn the four AS112 covering prefixes from Ze over BGP. (web: https://ze-software.net/usage/as112/) - [ExaBGP Migration](https://ze-software.net/usage/exabgp-migration/index.md): Ze provides tools for converting ExaBGP configurations and running existing ExaBGP plugins with ze as the BGP engine. (web: https://ze-software.net/usage/exabgp-migration/) - [BGP performance testing with Ze](https://ze-software.net/usage/bgp-performance/index.md): A route-server performance test is simple in outline: create a route source, connect it to a device under test, watch a monitor peer, and publish how many routes arrived and how long convergence took. (web: https://ze-software.net/usage/bgp-performance/) - [Route Server at an IXP](https://ze-software.net/usage/route-server/index.md): Use Ze as an RFC 7947 route server when each member should maintain one eBGP session and receive eligible routes from the other members without next-hop rewriting. (web: https://ze-software.net/usage/route-server/) - [Transit Edge with RPKI](https://ze-software.net/usage/transit-edge-rpki/index.md): This deployment shape uses Ze at an Internet edge with two transit sessions, origin validation, explicit import policy, and local preference for deterministic failover. (web: https://ze-software.net/usage/transit-edge-rpki/) - [FlowSpec Injection](https://ze-software.net/usage/flowspec-injection/index.md): Use Ze to inject or relay BGP FlowSpec rules when an automation system must distribute traffic filters to routers. Keep the route source, policy, and withdrawal path explicit because a stale FlowSpec rule can affect... (web: https://ze-software.net/usage/flowspec-injection/) - [Chaos-Tested BGP Peering](https://ze-software.net/usage/chaos-tested-peering/index.md): Use `ze-chaos` before deployment to prove that a peer configuration converges, survives selected faults, and produces a reproducible failure record when it does not. (web: https://ze-software.net/usage/chaos-tested-peering/) - [AS-Path Topology](https://ze-software.net/usage/as-path-topology/index.md): Use the built-in Looking Glass to turn the AS paths for a prefix into a topology view. The graph is an operational aid for comparing what different peers advertise, not a complete map of the Internet. (web: https://ze-software.net/usage/as-path-topology/) ## Page map Every link points to the page Markdown mirror first. The web URL is the human-rendered version of the same page. ## Start ### First steps - [Quickstart](https://ze-software.net/docs/guide/quickstart/index.md): Two BGP peers in under five minutes (web: https://ze-software.net/docs/guide/quickstart/) - [Install Ze](https://ze-software.net/docs/guide/ze-install/index.md): Run Ze on Linux or as a bootable appliance (web: https://ze-software.net/docs/guide/ze-install/) - [Ubuntu build](https://ze-software.net/docs/guide/ubuntu-build-install/index.md): Compile Ze, install it, create zefs, and start SSH (web: https://ze-software.net/docs/guide/ubuntu-build-install/) - [Configuration](https://ze-software.net/docs/features/configuration/index.md): The YANG-modelled configuration Ze uses everywhere (web: https://ze-software.net/docs/features/configuration/) - [CLI basics](https://ze-software.net/docs/features/cli-commands/index.md): Diff, commit, history, and operator commands (web: https://ze-software.net/docs/features/cli-commands/) ### Before you run - [Project status](https://ze-software.net/roadmap/index.md): What works today and what may still change (web: https://ze-software.net/roadmap/) - [FAQ](https://ze-software.net/faq/index.md): Common questions before trying Ze (web: https://ze-software.net/faq/) - [Plugin catalogue](https://ze-software.net/docs/features/plugins/index.md): Find runtime plugins by purpose, config, or dependency (web: https://ze-software.net/docs/features/plugins/) ## Evaluate ### Capabilities - [Features](https://ze-software.net/features/index.md): 51 features, color-coded by category (web: https://ze-software.net/features/) - [Compare](https://ze-software.net/compare/index.md): Compare Ze with BIRD, FRR, VyOS, and more (web: https://ze-software.net/compare/) - [Performance](https://ze-software.net/performance/index.md): Measured BGP benchmarks and reports (web: https://ze-software.net/performance/) - [Terminal demos](https://ze-software.net/docs/guide/terminal-demonstrations/index.md): Reproducible recordings of Ze workflows (web: https://ze-software.net/docs/guide/terminal-demonstrations/) ### Trust - [Code Quality](https://ze-software.net/quality/index.md): Tests, QEMU, fuzzing, and mutation checks (web: https://ze-software.net/quality/) - [Testing Health](https://ze-software.net/quality/health/index.md): Measured test state and how it moves over time (web: https://ze-software.net/quality/health/) - [RFC compliance gate](https://ze-software.net/quality/rfc-compliance/index.md): RFC requirements, tests, gaps, and public claims checked by AI (web: https://ze-software.net/quality/rfc-compliance/) - [Dependencies](https://ze-software.net/dependencies/index.md): 40 direct packages, generated from go.mod (web: https://ze-software.net/dependencies/) - [Security](https://ze-software.net/security/index.md): Security policy and vulnerability reporting (web: https://ze-software.net/security/) ## Docs ### Hub and core - [Documentation](https://ze-software.net/docs/index.md): All docs, organised by what you want to do (web: https://ze-software.net/docs/) - [Configuration](https://ze-software.net/docs/features/configuration/index.md): One YANG model for the whole system (web: https://ze-software.net/docs/features/configuration/) - [CLI commands](https://ze-software.net/docs/features/cli-commands/index.md): SSH CLI with diff, commit, and history (web: https://ze-software.net/docs/features/cli-commands/) - [Architecture](https://ze-software.net/docs/architecture/index.md): How the pieces fit together (web: https://ze-software.net/docs/architecture/) - [Plugin development](https://ze-software.net/docs/plugin-development/index.md): Build in-process and external Ze plugins (web: https://ze-software.net/docs/plugin-development/) ### Operate - [Production Diagnostics](https://ze-software.net/docs/guide/production-diagnostics/index.md): Start from symptoms and debug safely (web: https://ze-software.net/docs/guide/production-diagnostics/) - [Monitoring](https://ze-software.net/docs/guide/monitoring/index.md): Metrics, health, and operational visibility (web: https://ze-software.net/docs/guide/monitoring/) - [VPP dataplane](https://ze-software.net/docs/guide/vpp/index.md): FIB, traffic, and firewall through VPP (web: https://ze-software.net/docs/guide/vpp/) - [Looking glass](https://ze-software.net/docs/guide/looking-glass-howto/index.md): Publish read-only BGP visibility (web: https://ze-software.net/docs/guide/looking-glass-howto/) - [BGP Peering](https://ze-software.net/docs/guide/bgp-peering/index.md): Groups, families, capabilities, limits, and checks (web: https://ze-software.net/docs/guide/bgp-peering/) - [BGP Policy](https://ze-software.net/docs/guide/bgp-policy/index.md): Import, export, validation, and redistribution (web: https://ze-software.net/docs/guide/bgp-policy/) - [BGP Resilience](https://ze-software.net/docs/guide/bgp-resilience/index.md): Refresh, restart, persistence, and reflection (web: https://ze-software.net/docs/guide/bgp-resilience/) - [Lifecycle and Rollback](https://ze-software.net/docs/guide/lifecycle/index.md): Start, reload, update, recover, and verify (web: https://ze-software.net/docs/guide/lifecycle/) ### Access and mitigation - [SSH and RBAC](https://ze-software.net/docs/guide/operator-access-rbac/index.md): Local users, profiles, and operator access (web: https://ze-software.net/docs/guide/operator-access-rbac/) - [RADIUS Login](https://ze-software.net/docs/guide/radius/index.md): Operator authentication with safe local fallback (web: https://ze-software.net/docs/guide/radius/) - [FlowSpec Route Reflector](https://ze-software.net/docs/guide/flowspec-route-reflector/index.md): Reflect FlowSpec routes to clients (web: https://ze-software.net/docs/guide/flowspec-route-reflector/) - [FlowSpec Protection](https://ze-software.net/docs/guide/flowspec-protected-router/index.md): Turn FlowSpec into nftables and protect BGP (web: https://ze-software.net/docs/guide/flowspec-protected-router/) - [DDoS Mitigation](https://ze-software.net/docs/guide/ddos-mitigation/index.md): Detect floods and respond locally or upstream (web: https://ze-software.net/docs/guide/ddos-mitigation/) - [Anomaly Detection](https://ze-software.net/docs/guide/anomaly/index.md): Behavioural baselines with shadow-first response (web: https://ze-software.net/docs/guide/anomaly/) - [Native IPsec](https://ze-software.net/docs/guide/ipsec/index.md): IKEv2 initiator and responder tunnels (web: https://ze-software.net/docs/guide/ipsec/) ### Automate and extend - [REST and gRPC](https://ze-software.net/docs/guide/api/index.md): Commands, config sessions, authentication, and streaming (web: https://ze-software.net/docs/guide/api/) - [gNMI](https://ze-software.net/docs/guide/gnmi/index.md): YANG Get, Set, Subscribe, TLS, and metrics (web: https://ze-software.net/docs/guide/gnmi/) - [Web Interface](https://ze-software.net/docs/guide/web-interface/index.md): Configuration workbench, commands, and live state (web: https://ze-software.net/docs/guide/web-interface/) - [Fleet Management](https://ze-software.net/docs/guide/fleet-config/index.md): Managed config, TLS hub, caching, and reconnect (web: https://ze-software.net/docs/guide/fleet-config/) ## Examples ### Deployment examples - [Usage examples](https://ze-software.net/usage/index.md): Complete examples for real network roles (web: https://ze-software.net/usage/) - [AS112 anycast DNS](https://ze-software.net/usage/as112/index.md): AS112 DNS with real router peers (web: https://ze-software.net/usage/as112/) - [ExaBGP migration](https://ze-software.net/usage/exabgp-migration/index.md): Migrate process scripts to Ze (web: https://ze-software.net/usage/exabgp-migration/) - [BGP performance tests](https://ze-software.net/usage/bgp-performance/index.md): Route-server performance tests driven by Ze (web: https://ze-software.net/usage/bgp-performance/) - [IXP route server](https://ze-software.net/usage/route-server/index.md): Member policy, RPKI validation, and replay (web: https://ze-software.net/usage/route-server/) - [Transit edge with RPKI](https://ze-software.net/usage/transit-edge-rpki/index.md): Dual-transit policy and tested failover (web: https://ze-software.net/usage/transit-edge-rpki/) - [FlowSpec injection](https://ze-software.net/usage/flowspec-injection/index.md): Authorised, atomic, reversible mitigation routes (web: https://ze-software.net/usage/flowspec-injection/) ### Runnable labs - [Testing labs](https://ze-software.net/labs/index.md): Interop labs you can run against real daemons (web: https://ze-software.net/labs/) - [BGP interop](https://ze-software.net/labs/bgp-interop/index.md): FRR, BIRD, and GoBGP sessions (web: https://ze-software.net/labs/bgp-interop/) - [L2TP access](https://ze-software.net/labs/l2tp-interop/index.md): Ze LNS against real xl2tpd (web: https://ze-software.net/labs/l2tp-interop/) - [PPPoE access](https://ze-software.net/labs/pppoe-interop/index.md): Ze against real accel-ppp (web: https://ze-software.net/labs/pppoe-interop/) - [IPsec / IKEv2](https://ze-software.net/labs/ipsec-interop/index.md): Ze IKE initiator against strongSwan (web: https://ze-software.net/labs/ipsec-interop/) ### Systems - [VPP dataplane](https://ze-software.net/labs/vpp-dataplane/index.md): FIB, traffic, and firewall in real VPP (web: https://ze-software.net/labs/vpp-dataplane/) - [Appliance installer](https://ze-software.net/labs/appliance-install/index.md): HTTP/PXE, ISO, Ventoy, and tested boot paths (web: https://ze-software.net/labs/appliance-install/) - [Looking Glass graph](https://ze-software.net/labs/looking-glass-graph/index.md): UK topology with real external ASNs (web: https://ze-software.net/labs/looking-glass-graph/) - [VLAN QoS](https://ze-software.net/labs/vlan-qos/index.md): 802.1p PCP tagging verified on the wire (web: https://ze-software.net/labs/vlan-qos/) - [Chaos-tested peering](https://ze-software.net/usage/chaos-tested-peering/index.md): Deterministic faults, properties, replay, and shrink (web: https://ze-software.net/usage/chaos-tested-peering/) - [AS-path topology](https://ze-software.net/usage/as-path-topology/index.md): Investigate path visibility in the Looking Glass (web: https://ze-software.net/usage/as-path-topology/) ## Reference ### Generated references - [CLI Reference](https://ze-software.net/cli/index.md): 390 commands, generated from the live binary (web: https://ze-software.net/cli/) - [Configuration Reference](https://ze-software.net/config-reference/index.md): 36 sections, indexed from live YANG (web: https://ze-software.net/config-reference/) - [Command equivalents](https://ze-software.net/command-equivalents/index.md): Search Ze commands across Junos MX, IOS XR, SR OS, and VyOS (web: https://ze-software.net/command-equivalents/) - [RFC status](https://ze-software.net/docs/features/rfc-status/index.md): Implemented RFCs, partial support, and known gaps (web: https://ze-software.net/docs/features/rfc-status/) ### Written references - [Glossary](https://ze-software.net/docs/glossary/index.md): Routing, policy, configuration, and test terms (web: https://ze-software.net/docs/glossary/) - [Deprecated options](https://ze-software.net/docs/architecture/config/deprecated-options/index.md): Removed configuration syntax and replacements (web: https://ze-software.net/docs/architecture/config/deprecated-options/) - [Project history](https://ze-software.net/docs/history/index.md): How ExaBGP's programmable model grew into Ze (web: https://ze-software.net/docs/history/) - [Contributor testing](https://ze-software.net/docs/contributing/testing/index.md): How to choose and run the right test layer (web: https://ze-software.net/docs/contributing/testing/) ## Project ### Progress - [Roadmap](https://ze-software.net/roadmap/index.md): What works today and what remains before the first release (web: https://ze-software.net/roadmap/) - [Milestones](https://ze-software.net/milestones/index.md): Landmark features, oldest to newest (web: https://ze-software.net/milestones/) - [Changes](https://ze-software.net/changes/index.md): 35 weekly updates, newest first (web: https://ze-software.net/changes/) - [Activity](https://ze-software.net/activity/index.md): A year of commits, at a glance (web: https://ze-software.net/activity/) ### Community - [Blog](https://ze-software.net/blog/index.md): Project notes and release stories (web: https://ze-software.net/blog/) - [Talks](https://ze-software.net/talks/index.md): Talk slides and conference material (web: https://ze-software.net/talks/) - [Contribute](https://ze-software.net/contribute/index.md): How to send code, reports, and interop results (web: https://ze-software.net/contribute/) ## More - [Discord](https://discord.gg/T8s7CjPDne): community and support - [GitHub](https://github.com/ze-software/ze): canonical repository, issues, wiki