Reference

CLI Reference

471 commands across 49 groups, generated straight from ze help command --json -- the same live command registry the binary itself uses, including the pipe operators available to each command. Full machine-readable list: data/cli-commands.json.

Pipes

Pipe operators

Each command row names the operators it accepts after |. Availability comes from the live command registry: operators may require row data, a streaming answer, or expansion by the operator's local process.

Operator reference 17

Operator	Class	Available	Description
`json`	Output and control	Always	JSON output
`ndjson`	Output and control	Always	One JSON object per line
`table`	Output and control	Always	Render as table
`text`	Output and control	Always	Space-aligned columns
`yaml`	Output and control	Always	YAML output
`raw`	Output and control	Always	Dispatcher JSON, unformatted
`no-more`	Output and control	Always	Disable paging
`log`	Streaming	While streaming	Append each update instead of replacing it, where the command keeps answering
`save`	Output and control	Always, Local process only	Write the answer to a file
`match`	Row data	Always, With rows	Keep the rows holding this text
`count`	Row data	Always, With rows	Count the rows
`first`	Row data	Always, With rows	Take first N rows
`last`	Row data	Always, With rows	Take last N rows
`display`	Row data	Always, With rows	Answer with these fields, in this order
`fill`	Row data	Always, With rows	Bring the remaining columns back, in the command's order or a named one
`resolve`	Row data	Always	Reverse DNS for IP addresses
`origin`	Row data	Always	ASN and network for IP addresses

clear l2tp 4

Command	Mode	Description	Pipes
`clear l2tp session all`	Daemon	Disconnect every L2TP session on this box. `clear l2tp session all`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear l2tp session id`	Daemon	Disconnect one subscriber session. `clear l2tp session id`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear l2tp tunnel all`	Daemon	Tear down every L2TP tunnel on this box. `clear l2tp tunnel all`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear l2tp tunnel id`	Daemon	Gracefully tear down one L2TP tunnel. `clear l2tp tunnel id`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

clear (other) 19

Command	Mode	Description	Pipes
`clear bgp healthcheck`	Daemon	Reset healthcheck probe to INIT `clear bgp healthcheck`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear bgp rib in`	Daemon	Remove all routes received from a peer. `clear bgp rib in` Task supportforbidden: the MCP server never answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear bgp rib out`	Daemon	Re-advertise all routes to a peer. `clear bgp rib out` Task supportforbidden: the MCP server never answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear debug`	Offline	Clear the default debug profile.	None
`clear dns cache`	Daemon	Flush all DNS cache entries and reset all DNS cache counters. `clear dns cache` Subcommands`record` `stats`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear dns cache record`	Daemon	Evict DNS cache entries for one record name, or one name and type when a type is provided. `clear dns cache record <name> [type <A\|AAAA\|MX\|NS\|TXT\|CNAME\|PTR>]` Arguments`name` string, required: yes, any value of this type: Record name to evict. The cache key, compared as an exact string. Alone, it evicts every type cached under the name and the answer counts the entries removed. `type` enum, required: no, one of `A` `AAAA` `MX` `NS` `TXT` `CNAME` `PTR`: Optional DNS record type to evict for the named record. Written after the type keyword, it evicts that one type and leaves the other types of the name in place. The answer reports found true or false.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear dns cache stats`	Daemon	Reset DNS cache hit, miss, eviction, and expiry counters without removing cached entries. `clear dns cache stats`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear firewall domain-group`	Daemon	Remove the addresses Ze cached for a domain group. `clear firewall domain-group <name>` Arguments`name` string, required: yes, any value of this type: Domain group name A group from the firewall configuration. The cache entries of that group's names are purged, and a name no group carries is an error.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear firewall irr as-set`	Daemon	Remove the cached IRR prefix-list for an AS-SET. `clear firewall irr as-set <as-set>` Arguments`as-set` string, required: yes, any value of this type: AS-SET name The RPSL set name the update command stored, for example AS-EXAMPLE. The entry under that exact name is purged.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear firewall irr asn`	Daemon	Remove the cached IRR prefix-list for an ASN. `clear firewall irr asn <asn>` Arguments`asn` string, required: yes, any value of this type: ASN number The AS number, 1 to 4294967294, in plain or dotted form. The entry purged is the one the update command stored under the decimal spelling.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear interface counters`	Daemon	Zero the Rx/Tx counters for every managed interface. `clear interface counters`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear interface name counters`	Daemon	Zero the Rx/Tx counters for one interface. `clear interface name <name> counters` Arguments`name` string, required: yes, any value of this type: Interface name The interface whose counters are reset. The answer names it as the scope cleared, where the form without a name reports all.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear isis adjacency`	Daemon	Tear down every IS-IS adjacency so neighbors re-form. `clear isis adjacency`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear isis counters`	Daemon	Reset IS-IS observational counters and the SPF log. `clear isis counters`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear ospf counters`	Daemon	Reset the OSPF SPF-run history. `clear ospf counters`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear ospf neighbor`	Daemon	Tear down every OSPF adjacency so neighbors re-form. `clear ospf neighbor`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear ospf process`	Daemon	Full OSPF reset: tear down every adjacency and re-run SPF. `clear ospf process`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear vpn ipsec sa`	Daemon	Tear down IKE Security Associations. `clear vpn ipsec sa`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`clear vrrp statistics`	Daemon	Reset every VRRP virtual router's counters to zero. `clear vrrp statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

create 10

Command	Mode	Description	Pipes
`create bgp peer`	Daemon	Add a peer to the running daemon. `create bgp peer <selector> <asn> [local-as <local-as>] [local-address <local-address>] [router-id <router-id>] [receive-hold-time <receive-hold-time>] [send-hold-time <send-hold-time>] [connect-retry <connect-retry>] [connect <true\|false>] [accept <true\|false>] [family <family>] [graceful-restart <graceful-restart>] [group-updates <true\|false>] [attach <attach>]` Arguments`selector` union, required: yes, any value of this type: Address of the peer to create The token typed after 'peer' is an IPv4 or IPv6 address and nothing else. A name, a glob or an AS pattern is refused, because a peer that does not exist yet matches none of them. An address that already names a peer is refused. `asn` union, required: yes, any value of this type: Remote AS of the peer, in any notation RFC 5396 names The value is 1 to 4294967295, in asplain or asdot notation. Ze stores the decimal form whichever notation you typed. AS 0 is refused, because RFC 7607 reserves it. `local-as` union, required: no, any value of this type: Local AS for this session, overriding the router's, in any notation RFC 5396 names The value is 1 to 4294967295, in asplain or asdot notation. Absent, the session uses the router's own AS. AS 0 is refused. `local-address` union, required: no, any value of this type: Local address to bind the session to The value is an IPv4 or IPv6 address of this router. Ze binds the TCP session to it. Absent, the kernel picks the source address. `router-id` string, required: no, any value of this type: BGP Identifier for this session, overriding the router's The value is a dotted quad and it MUST NOT be 0.0.0.0. Ze sends it as the BGP Identifier in the OPEN for this session. Absent, the session uses the router's own. `receive-hold-time` uint, required: no, any value of this type: Hold time in seconds (RFC 4271) The value is 0 to 65535 seconds and Ze puts it in the Hold Time field of its OPEN. The two peers then hold the lower of the two proposals. Absent, the value is 90. `send-hold-time` uint, required: no, any value of this type: Send hold time in seconds, 0 for automatic (RFC 9687) The value is 0 to 65535 seconds. A non-zero value MUST be at least 480 and more than the receive hold time, or the peer is refused. 0 derives it as the larger of 480 and twice the receive hold time. `connect-retry` uint, required: no, any value of this type: ConnectRetry interval in seconds The value is 0 to 65535 seconds and Ze reads it for a dynamic peer alone. A disconnected dynamic peer is removed after this delay when no connection comes back. A static peer reconnects on its own backoff, which this value does not change. Absent, the value is 120. `connect` enum, required: no, one of `true` `false`: Dial the peer, default true The value is true or false and nothing else. With false, the session comes up only when the peer opens the TCP connection and 'accept' lets it in. `accept` enum, required: no, one of `true` `false`: Accept a connection from the peer, default true The value is true or false and nothing else. With false, the session comes up only when 'connect' lets Ze dial the peer. `family` string, required: no, any value of this type: Address families to negotiate, comma separated Each name is an AFI/SAFI pair such as ipv4/unicast, and a name Ze does not know is refused. Ze negotiates each family in the OPEN. Absent, the session uses the configured default families. `graceful-restart` uint, required: no, any value of this type: Graceful restart time in seconds (RFC 4724) The value is 0 to 4095 seconds. It is the Restart Time Ze advertises in the graceful restart capability of its OPEN. Absent, the session advertises none. `group-updates` enum, required: no, one of `true` `false`: Group this peer's UPDATEs with other peers, default true The value is true or false and nothing else. Packing reduces the number of UPDATE messages from one per route to one per set of path attributes. Use false for a peer that requires one prefix per UPDATE. `attach` string, required: no, any value of this type: Plugin processes bound to this peer, comma separated Each name is a plugin process the configuration declares. Ze binds the peer to each one with the whole surface: the process receives every message from this peer and can send every type toward it. An empty name is refused.	15 operators · 1 column order Column order`peer, remote-as, message` Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface address`	Daemon	Add an IP address to an interface. `create interface address <name> <prefix>` Arguments`name` string, required: yes, any value of this type: Interface name The interface that receives the address. This form creates no interface, so the name must be present in the kernel before the command runs. `prefix` union, required: yes, any value of this type: Address in CIDR form An IPv4 or IPv6 address with its prefix length, for example 10.0.0.1/24. Ze passes the string to the netlink backend.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface bridge name`	Daemon	Create a Linux bridge for L2 forwarding. `create interface bridge name <name>` Arguments`name` string, required: yes, any value of this type: Interface name The name of the bridge to create. A name that holds an interface of another type is refused, and the error names both types. Backends`netlink` Subcommands`address` `unit`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface bridge name address`	Daemon	Add an IP address to the bridge. `create interface bridge name <name> address <prefix>` Arguments`name` string, required: yes, any value of this type: Interface name The bridge that receives the address. The dispatcher creates it first when it is absent. `prefix` union, required: yes, any value of this type: Address in CIDR form An IPv4 or IPv6 address with its prefix length, for example 10.0.0.1/32. Ze passes the string to the netlink backend. Backends`netlink`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface bridge name unit`	Daemon	Add a VLAN sub-interface to the bridge. `create interface bridge name <name> unit <vid>` Arguments`name` string, required: yes, any value of this type: Parent interface name The bridge the unit hangs off. The dispatcher creates it first when it is absent. `vid` uint, required: yes, any value of this type: VLAN ID The 802.1Q tag of the unit. The new device is named <name>.<vid>, and a tag outside 1 to 4094 is refused before the backend is called. Backends`netlink`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface dummy name`	Daemon	Create a dummy (loopback-style) interface. `create interface dummy name <name>` Arguments`name` string, required: yes, any value of this type: Interface name The name of the dummy to create. A name that holds an interface of another type is refused, and the error names both types. Backends`netlink` Subcommands`address` `unit`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface dummy name address`	Daemon	Add an IP address to the dummy. `create interface dummy name <name> address <prefix>` Arguments`name` string, required: yes, any value of this type: Interface name The dummy that receives the address. The dispatcher creates it first when it is absent. `prefix` union, required: yes, any value of this type: Address in CIDR form An IPv4 or IPv6 address with its prefix length, for example 10.0.0.1/32. Ze passes the string to the netlink backend. Backends`netlink`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface dummy name unit`	Daemon	Add a VLAN sub-interface to the dummy. `create interface dummy name <name> unit <vid>` Arguments`name` string, required: yes, any value of this type: Parent interface name The dummy the unit hangs off. The dispatcher creates it first when it is absent. `vid` uint, required: yes, any value of this type: VLAN ID The 802.1Q tag of the unit. The new device is named <name>.<vid>, and a tag outside 1 to 4094 is refused before the backend is called. Backends`netlink`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface unit`	Daemon	Add a VLAN sub-interface (802.1Q tagged). `create interface unit <name> <vid>` Arguments`name` string, required: yes, any value of this type: Parent interface name The parent interface. This form creates no interface, so the name must be present in the kernel before the command runs. `vid` uint, required: yes, any value of this type: VLAN ID The 802.1Q tag of the unit. The new device is named <name>.<vid>, and a tag outside 1 to 4094 is refused before the backend is called.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`create interface veth name`	Daemon	Create a veth pair (two linked virtual Ethernet interfaces). `create interface veth name <name> <peer>` Arguments`name` string, required: yes, any value of this type: Interface name The name of the first end of the pair. A pair already present under that name is reported, and nothing changes. `peer` string, required: yes, any value of this type: Peer interface name The name of the second end. Both ends appear in the kernel after the one command. Backends`netlink`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

debug 4

Command	Mode	Description	Pipes
`debug ip ospf inject opaque`	Daemon	Inject a crafted IPv4 opaque LSA into the local LSDB (RFC 5250). `debug ip ospf inject opaque scope <link\|area\|as> id <opaque-id> [type <type>] [hex <body> ...] [tlv <type> <value-hex> ...] [withdraw]` Subcommands`hex` `id` `scope` `tlv` `type` `withdraw`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`debug ipv6 ospf inject lsa`	Daemon	Inject a crafted OSPFv3 LSA into the local LSDB (RFC 5340). `debug ipv6 ospf inject lsa type <ls-type> id <link-state-id> [scope <link\|area\|as>] [hex <body> ...] [withdraw]` Subcommands`hex` `id` `scope` `type` `withdraw`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`debug ospf inject disable`	Daemon	Disable OSPF debug LSA injection. `debug ospf inject disable`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`debug ospf inject enable`	Daemon	Enable OSPF debug LSA injection (shared across both address families). `debug ospf inject enable`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

delete 6

Command	Mode	Description	Pipes
`delete bgp peer`	Daemon	Remove a peer from the running config. `delete bgp peer <selector>` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Ze tears down and deletes each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`delete debug module`	Offline	Disable debug for a subsystem, or remove one of its flags/scopes.	None
`delete debug profile name`	Offline	Delete a named debug profile.	None
`delete interface name`	Daemon	Delete an interface from the kernel. `delete interface name <name>` Arguments`name` string, required: yes, any value of this type: Interface name The interface to delete. The unit and address forms below keep this interface and remove one unit or one address of it. Subcommands`address` `unit`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`delete interface name address`	Daemon	Remove an IP address from an interface. `delete interface name <name> address <prefix>` Arguments`name` string, required: yes, any value of this type: Interface name The interface that holds the address. Its other addresses stay. `prefix` union, required: yes, any value of this type: Address in CIDR form An IPv4 or IPv6 address with its prefix length. Ze passes the string to the netlink backend, so it must match the string the add used.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`delete interface name unit`	Daemon	Remove a VLAN sub-interface. `delete interface name <name> unit <vid>` Arguments`name` string, required: yes, any value of this type: Parent interface name The parent interface. Ze joins it with the VLAN id into <name>.<vid> and deletes that device. `vid` uint, required: yes, any value of this type: VLAN ID The 802.1Q tag of the unit to remove. A tag outside 1 to 4094 is refused before the backend is called.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

doctor 1

Command	Mode	Description	Pipes
`doctor`	Offline	Check that this system is ready to run Ze.	None

explain 1

Command	Mode	Description	Pipes
`explain`	Offline	Explain one diagnostic code Ze printed.	None

generate 1

Command	Mode	Description	Pipes
`generate wireguard keypair`	Offline	Generate a WireGuard keypair with the system wg binary.	None

help 3

Command	Mode	Description	Pipes
`help`	Read-only	Show available commands at this level. `help`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`help ai`	Offline	Print the agent reference this binary builds from its own registries.	None
`help command`	Offline	List every command this binary carries with its summary.	None

monitor 8

Command	Mode	Description	Pipes
`monitor bgp`	Read-only	Live BGP peer dashboard that refreshes automatically. `monitor bgp` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`monitor event`	Read-only	Stream live events as they happen. `monitor event` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`monitor interface rate`	Read-only	Stream per-second traffic rates for your interfaces. `monitor interface rate` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`monitor ping`	Read-only	Continuous ping with live loss and RTT statistics. `monitor ping` Task supportrequired: the MCP server always answers with a task handle	17 operators · answer: tab · 1 address field Answer shape`tab` Address fields`target` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`monitor system netlink`	Read-only	Watch kernel networking changes in real time. `monitor system netlink` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`monitor traceroute`	Read-only	Live mtr-style traceroute that updates continuously. `monitor traceroute` Task supportrequired: the MCP server always answers with a task handle	17 operators · answer: tab · 1 address field Answer shape`tab` Address fields`addr` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`monitor traffic stat`	Read-only	Start streaming traffic monitor (per-second snapshots). `monitor traffic stat [name <name>]` Arguments`name` string, required: no, any value of this type: Interface name filter The name of one interface, matched exactly against the interface names in each snapshot. Every other interface is left out of the stream.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`monitor vpn ipsec`	Read-only	Watch IPsec SA events as they happen. `monitor vpn ipsec` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

plugin 10

Command	Mode	Description	Pipes
`plugin ack`	Read-only	Choose sync or async event delivery. `plugin ack`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin command complete`	Read-only	List the completion candidates for a partial plugin command. `plugin command complete <partial>` Arguments`partial` string, required: yes, any value of this type: Partial command text The text typed so far. The candidates match it on a case-insensitive prefix over the plugin command names.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin command help`	Read-only	Show one plugin command's summary, explanation, arguments, and source plugin. `plugin command help <name>` Arguments`name` string, required: yes, any value of this type: Plugin command name The full command name, as plugin command list prints it. A name no plugin registered fails with unknown plugin command.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin command list`	Read-only	List every command a plugin registered, with its summary. `plugin command list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin encoding`	Read-only	Choose json or text encoding for plugin events. `plugin encoding`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin format`	Read-only	Choose how BGP message bytes appear in events. `plugin format`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin help`	Read-only	List the subcommands the plugin verb accepts. `plugin help`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin session bye`	Read-only	Tell the daemon this session is disconnecting. `plugin session bye`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin session ping`	Read-only	Answer a health check with the daemon process id. `plugin session ping`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`plugin session ready`	Read-only	Signal that this plugin process finished its initialization. `plugin session ready`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

request bgp 19

request interface 5

Command	Mode	Description	Pipes
`request interface down`	Daemon	Shut down an interface. `request interface <name> down` Arguments`name` string, required: yes, any value of this type: Interface name The interface that up, down, mtu and mac act on. Each of those commands inherits it, and migrate names its own interfaces instead.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request interface mac`	Daemon	Set the MAC address on an interface. `request interface <name> mac <address>` Arguments`name` string, required: yes, any value of this type: Interface name The interface that up, down, mtu and mac act on. Each of those commands inherits it, and migrate names its own interfaces instead. `address` string, required: yes, any value of this type: MAC address, as xx:xx:xx:xx:xx:xx Six hexadecimal byte pairs separated by colons, in either case. The kernel device takes this address in place of the one it has.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request interface migrate`	Daemon	Move IP addresses between interfaces with minimal downtime. `request interface migrate from <source> to <destination> address <prefix> [create <dummy\|veth\|bridge>] [timeout <duration>]` Subcommands`address` `create` `from` `timeout` `to`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request interface mtu`	Daemon	Set the MTU on an interface. `request interface <name> mtu <bytes>` Arguments`name` string, required: yes, any value of this type: Interface name The interface that up, down, mtu and mac act on. Each of those commands inherits it, and migrate names its own interfaces instead. `bytes` uint, required: yes, any value of this type: MTU in bytes The largest frame payload the interface accepts. A value outside 68 to 65535 is refused before the backend is called.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request interface up`	Daemon	Bring an interface up. `request interface <name> up` Arguments`name` string, required: yes, any value of this type: Interface name The interface that up, down, mtu and mac act on. Each of those commands inherits it, and migrate names its own interfaces instead.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

request peer 9

Command	Mode	Description	Pipes
`request peer borr`	Daemon	Start an Enhanced Route Refresh cycle (RFC 7313). `request peer <selector> borr` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer clear soft`	Daemon	Soft-clear a peer without dropping the session. `request peer <selector> clear soft` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer eorr`	Daemon	Finish an Enhanced Route Refresh cycle (RFC 7313). `request peer <selector> eorr` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer flush`	Daemon	Wait until all queued updates for a peer are sent. `request peer <selector> flush` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer pause`	Daemon	Pause reading from a peer's TCP socket. `request peer <selector> pause` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer plugin session ready`	Daemon	Signal that per-peer plugin setup is complete. `request peer <selector> plugin session ready` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer refresh`	Daemon	Ask a peer to re-send all routes (RFC 2918). `request peer <selector> refresh` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer resume`	Daemon	Resume reading from a previously paused peer. `request peer <selector> resume` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request peer teardown`	Daemon	Tear down a peer session. `request peer <selector> teardown <cease-subcode>` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'pause' and 'resume' refuse a selector that matches more than one peer, and the other commands act on each peer it matches. `cease-subcode` uint, required: yes, any value of this type: BGP cease NOTIFICATION subcode The value is a whole number from 0 to 255, and a value outside that range is refused. Ze puts it in the Cease NOTIFICATION it sends before it closes the session.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

request (other) 19

Command	Mode	Description	Pipes
`request as112 healthcheck`	Daemon	Send one authoritative query and check the AS112 answer. `request as112 healthcheck [target <target>]` Arguments`target` string, required: no, any value of this type: Anycast service address to query. An IP address, queried on port 53. When it is absent the query goes to the on-box loopback of the configured address family: 127.0.0.1, or ::1 when address-family is ipv6-only.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request cache expire`	Daemon	Remove a cached message immediately. `request cache expire <id>` Arguments`id` string, required: yes, any value of this type: Cache entry ID, or a comma-separated list of IDs. One decimal cache entry ID, as show cache lists it, or several joined by commas. A comma-separated value runs the action once for each ID and reports a failure for each ID that is not in the cache. A value that is not a decimal number is refused as an invalid cache id.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request cache release`	Daemon	Ack without forwarding (cache consumer) or undo retain (API). `request cache release <id>` Arguments`id` string, required: yes, any value of this type: Cache entry ID, or a comma-separated list of IDs. One decimal cache entry ID, as show cache lists it, or several joined by commas. A comma-separated value runs the action once for each ID and reports a failure for each ID that is not in the cache. A value that is not a decimal number is refused as an invalid cache id.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request cache retain`	Daemon	Prevent eviction of a cached message. `request cache retain <id>` Arguments`id` string, required: yes, any value of this type: Cache entry ID, or a comma-separated list of IDs. One decimal cache entry ID, as show cache lists it, or several joined by commas. A comma-separated value runs the action once for each ID and reports a failure for each ID that is not in the cache. A value that is not a decimal number is refused as an invalid cache id.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request commit`	Daemon	Group route changes into named atomic commits. `request commit`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request config archive`	Daemon	Save a snapshot of the current running configuration. `request config archive`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request data backup`	Daemon	Write a backup of the whole store to a file on the daemon's host. `request data backup <path> [spare <spare>] [force]` Arguments`path` string, required: yes, any value of this type: Absolute artifact path Absolute path of the artifact. A relative path, a '..' element, a symlink, and every name the store owns in its folder are refused, each naming the rule it broke. `spare` uint, required: no, any value of this type: Spare capacity percent (0-100) Spare capacity in percent that each key and data slot carries. An artifact is normally copied whole, so the default is 0. `force` flag, required: no, any value of this type: Replace an existing file Replace an existing file at path. It never lifts a refusal of a name the store owns.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request data restore`	Daemon	Restore a config from a backup file on the daemon's host. `request data restore <path> [config] [name <name>] [client <client>]` Arguments`path` string, required: yes, any value of this type: Absolute artifact path Absolute path of the artifact, checked before it is read by the same rules as a backup path. `config` flag, required: no, any value of this type: Restore the config only Restore the artifact's config only. A full restore replaces the whole store and runs offline with ze data restore. `name` string, required: no, any value of this type: Config name inside the artifact The config to take from an artifact that holds several. Without it, the artifact's only config, or the config named like this device, is taken. `client` string, required: no, any value of this type: Managed client whose served config is restored The managed client whose served config (client-<name>.conf) the restore writes. The daemon MUST be a hub with a client entry of this name. Without it, the restore replaces this daemon's own config through the reload.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request halt`	Daemon	Dump goroutine stacks to stderr and terminate immediately. `request halt`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request l2tp outgoing-call remote called`	Daemon	Place an LNS-side outgoing call (RFC 2661 S10.4). `request l2tp outgoing-call remote <remote> called <called>` Arguments`remote` string, required: yes, any value of this type: Configured l2tp/remote dial-target name. The name of an l2tp/remote entry, which supplies the address and the shared secret Ze dials with. An unknown name, or an entry without outgoing-calls, is refused before any packet is sent. `called` string, required: yes, any value of this type: Called Number for the OCRQ. The number the remote LAC dials, as free text. Ze copies it into the Called Number AVP of the OCRQ without validation, so its form is what the LAC accepts.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request log level`	Daemon	Change a subsystem's log level without restarting. `request log level <logger> <disabled\|debug\|info\|warn\|err>` Arguments`logger` string, required: yes, any value of this type: Logger/subsystem name The name of a registered logger, as 'show log levels' lists it. A name no logger registered is refused. `target` enum, required: yes, one of `disabled` `debug` `info` `warn` `err`: Target log level The level the logger writes at from now on. The value is matched without regard to case, and 'error' and 'warning' are accepted as spellings of err and warn.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request mrt dump-rib`	Daemon	Write the current RIB to the MRT table dump file. `request mrt dump-rib`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request ospf graceful-restart`	Daemon	Trigger a planned OSPFv2 graceful restart (RFC 3623 section 2.1). `request ospf graceful-restart`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request quiesce`	Daemon	Block until every subsystem has drained pending async work, then reply. `request quiesce`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request reboot`	Daemon	Gracefully shutdown then reboot the system. `request reboot`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request reload`	Daemon	Reload the configuration without restarting. `request reload`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request shutdown`	Daemon	Gracefully shutdown: drain connections, close peers, exit. `request shutdown`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request subscribe`	Daemon	Start receiving events of one or more types. `request subscribe` Task supportrequired: the MCP server always answers with a task handle	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`request unsubscribe`	Daemon	Stop receiving events you previously subscribed to. `request unsubscribe`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

resolve 11

Command	Mode	Description	Pipes
`resolve cymru asn-name`	Read-only	Find out who owns an AS number. `resolve cymru asn-name <asn>` Arguments`asn` union, required: yes, any value of this type: AS number. The AS number in plain decimal or in asdot notation, which Ze parses to one 32-bit value before the query. A spelling that parses to no AS number is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve dns a`	Read-only	Look up IPv4 addresses (A records) for a hostname. `resolve dns a <hostname>` Arguments`hostname` string, required: yes, any value of this type: Hostname to look up. A DNS name of 1 to 253 characters, which the router's own resolver queries. The first word after the command is the name, and a call with no name is refused with a usage line.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve dns aaaa`	Read-only	Look up IPv6 addresses (AAAA records) for a hostname. `resolve dns aaaa <hostname>` Arguments`hostname` string, required: yes, any value of this type: Hostname to look up. A DNS name of 1 to 253 characters, which the router's own resolver queries. The first word after the command is the name, and a call with no name is refused with a usage line.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve dns ptr`	Read-only	Reverse-lookup an IP address to its hostname (PTR). `resolve dns ptr <ip-address>` Arguments`ip-address` string, required: yes, any value of this type: IP address to reverse-look-up. An IPv4 or IPv6 address in its usual text form. The resolver turns it into the reverse name itself, so pass the address and not the in-addr.arpa name.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve dns txt`	Read-only	Look up TXT records for a hostname. `resolve dns txt <hostname>` Arguments`hostname` string, required: yes, any value of this type: Hostname to look up. A DNS name of 1 to 253 characters, which the router's own resolver queries. The first word after the command is the name, and a call with no name is refused with a usage line.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve irr expand`	Read-only	Expand an AS-SET into its member AS numbers. `resolve irr expand`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve irr prefix`	Read-only	Get all prefixes announced by an AS-SET's members. `resolve irr prefix`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve peeringdb as-set`	Read-only	Find the IRR AS-SET registered for an ASN in PeeringDB. `resolve peeringdb as-set <asn>` Arguments`asn` union, required: yes, any value of this type: AS number. The AS number in plain decimal or in asdot notation, which Ze parses to one 32-bit value before the query. A spelling that parses to no AS number is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve peeringdb max-prefix`	Read-only	Get max-prefix limits for an ASN from PeeringDB. `resolve peeringdb max-prefix <asn>` Arguments`asn` union, required: yes, any value of this type: AS number. The AS number in plain decimal or in asdot notation, which Ze parses to one 32-bit value before the query. A spelling that parses to no AS number is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve ping`	Read-only	Ping from the router with optional source binding. `resolve ping <target> [source <source>] [count <count>] [size <size>] [do-not-fragment <honor-cache\|bypass-cache>]` Arguments`target` string, required: yes, any value of this type: Host or IP address to ping. The value follows the target keyword. A host name is resolved in either address family, and the family of the answer selects ICMPv4 or ICMPv6. `source` string, required: no, any value of this type: Source IP address to bind. The value is a local IPv4 or IPv6 address, with an optional %zone, that Ze binds the echo socket to. Absent, the kernel picks the source. `count` uint, required: no, any value of this type: Number of echo requests. Ze sends this many echo requests and waits 5 seconds for each reply. Absent, the value is 4. `size` uint, required: no, any value of this type: ICMP echo payload size in bytes. Ze fills the payload to exactly this many bytes, with its marker copied into the front. Absent, Ze sends the small default payload. `do-not-fragment` enum, required: no, one of `honor-cache` `bypass-cache`: Set the Don't Fragment bit; honor-cache obeys the cached path MTU, bypass-cache ignores it. The keyword takes one of two values. honor-cache sets the Don't Fragment bit and honors the kernel's cached path MTU: a probe larger than the cached value is refused at send time, and a router's Fragmentation Needed answer updates the cache. bypass-cache sets the bit and ignores the cached value, so the probe is put on the wire at its full size. Absent, the kernel fragments a probe larger than the path, which is the behavior of before the keyword existed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`resolve traceroute`	Read-only	Traceroute from the router with optional source binding. `resolve traceroute <target> [source <source>] [max-hops <max-hops>] [timeout <timeout>] [probes <probes>] [do-not-fragment <honor-cache\|bypass-cache>]` Arguments`target` string, required: yes, any value of this type: Host or IP address to trace to. The value follows the target keyword. A host name is resolved in the family of the source, or in either family when no source is given, and a name with no address in that family is refused. `source` string, required: no, any value of this type: Source IP address to bind, whose family also selects the family the target is resolved in. The value is a local IPv4 or IPv6 address, with an optional %zone, that Ze binds the probe socket to. Absent, the kernel picks the source. `max-hops` uint, required: no, any value of this type: Largest time-to-live to probe. The trace stops early when the target answers. Absent, the value is 30. `timeout` string, required: no, any value of this type: Per-probe timeout, 1s to 30s, in Go duration syntax. The value is the time Ze waits for one probe before it records a missing answer. Absent, the value is 3s. `probes` uint, required: no, any value of this type: Number of probes per hop. Each probe at one time-to-live reports its own round-trip time. Absent, the value is 3. `do-not-fragment` enum, required: no, one of `honor-cache` `bypass-cache`: Set the Don't Fragment bit; honor-cache obeys the cached path MTU, bypass-cache ignores it. The keyword takes one of two values. honor-cache sets the Don't Fragment bit and honors the kernel's cached path MTU: a probe larger than the cached value is refused at send time, and a router's Fragmentation Needed answer updates the cache. bypass-cache sets the bit and ignores the cached value, so the probe is put on the wire at its full size. Absent, the kernel fragments a probe larger than the path, which is the behavior of before the keyword existed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

send 9

Command	Mode	Description	Pipes
`send bgp blackhole`	Daemon	Originate a blackhole route on demand. `send bgp <selector> blackhole <prefix> [tag <key> <value>] [for <duration>]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `prefix` string, required: yes, any value of this type: Prefix to blackhole, in CIDR form The value is an IPv4 or IPv6 prefix with its length, such as 192.0.2.1/32. The address family of the route follows from the prefix. A value that is not a prefix is refused. Subcommands`for` `tag`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp cached`	Daemon	Send a cached UPDATE to the peers the selector matches. `send bgp <selector> cached <id>` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `id` string, required: yes, any value of this type: Cache entry ID, or a comma-separated list of IDs. One decimal cache entry ID, as show cache lists it, or several joined by commas. A comma-separated value runs the action once for each ID and reports a failure for each ID that is not in the cache. A value that is not a decimal number is refused as an invalid cache id.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp flowspec`	Daemon	Originate a FlowSpec rule on demand (RFC 8955). send bgp <selector> flowspec [destination-ipv4 <prefix> ...] [destination-ipv6 <prefix> ...] [destination-port <value> ...] [dscp <value> ...] [flow-label <value> ...] [fragment <value> ...] [icmp-code <value> ...] [icmp-type <value> ...] [next-header <value> ...] [packet-length <value> ...] [port <value> ...] [protocol <value> ...] [rd <value>] [source-ipv4 <prefix> ...] [source-ipv6 <prefix> ...] [source-port <value> ...] [tcp-flags <value> ...] [traffic-class <value> ...] (community <value>\|rate-limit <bytes-per-second>\|discard) [tag <key> <value>] [for <duration>] Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. Subcommands`action` `destination-ipv4` `destination-ipv6` `destination-port` `dscp` `flow-label` `for` `fragment` `icmp-code` `icmp-type` `next-header` `packet-length` `port` `protocol` `rd` `source-ipv4` `source-ipv6` `source-port` `tag` `tcp-flags` `traffic-class`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp raw`	Daemon	Send raw bytes into a peer's TCP stream (dangerous). `send bgp <selector> raw <hex\|b64> <data> [type <open\|update\|notification\|keepalive\|route-refresh>]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `encoding` enum, required: yes, one of `hex` `b64`: How the data below is encoded. The word is required and it is typed before the data. Ze decodes the data with it, and data the decoder refuses is an error. `data` string, required: yes, any value of this type: The bytes to send, in the encoding above. The value is one token, the octets in the encoding named before it. With a type keyword after it, the octets are the message body alone. Without one, they are the whole packet, marker and header included. `type` enum, required: no, one of `open` `update` `notification` `keepalive` `route-refresh`: The BGP message type ze writes a header for. The word is optional and any other word there is refused. With it, Ze writes the 16-byte marker and the length and type fields, and the data is the body. Absent, the data is sent as it is.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp unicast`	Daemon	Originate a unicast route on demand. `send bgp <selector> unicast <prefix> [next-hop <address>] [community <value> ...] [tag <key> <value>] [for <duration>]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `prefix` string, required: yes, any value of this type: Prefix to originate, in CIDR form The value is an IPv4 or IPv6 prefix with its length, such as 192.0.2.0/24. The address family of the route follows from the prefix. A value that is not a prefix is refused. Subcommands`community` `for` `next-hop` `tag`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp update`	Daemon	Send a pre-built BGP UPDATE to a peer. `send bgp <selector> update <text\|hex\|b64\|cursor>` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `encoding` enum, required: yes, one of `text` `hex` `b64` `cursor`: How the tokens after this word are read. The word is required and any other word there is refused before the handler runs. hex and b64 keep the structure of text with the octets in place of the words. cursor keeps the attributes of the last command per process and peer, so a later command names only what changed, and 'cursor done' clears them.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp withdraw all`	Daemon	Withdraw every on-demand announcement. `send bgp <selector> withdraw all` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp withdraw id`	Daemon	Withdraw one announcement by the id that show announcements reports. `send bgp <selector> withdraw id <id>` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `id` string, required: yes, any value of this type: Announcement id, as show announcements reports it The value is the whole number show announcements reports in its id column. A value that is not a number is refused, and an id that names no announcement of the selector answers 'not found'.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`send bgp withdraw tag`	Daemon	Withdraw the announcements carrying a tag. `send bgp <selector> withdraw tag <key> [value <value>]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, a comma-separated list of those, or * for every peer. The message goes to each session the selector matches. `key` string, required: yes, any value of this type: Tag key, or * for every tagged announcement The value is the key an announcement was made with, compared as text. Ze withdraws each announcement made to the selector that carries it. A key of * withdraws every tagged announcement made to the selector. `value` string, required: no, any value of this type: Tag value, or every value of the key when absent The value is the tag value an announcement was made with, compared as text. With it, Ze withdraws the announcements under the key that carry this value alone. Absent, or *, every value of the key is withdrawn.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

set 6

Command	Mode	Description	Pipes
`set debug active name`	Offline	Load a named debug profile and apply it to the running daemon.	None
`set debug module`	Offline	Enable debug output for one subsystem.	None
`set debug profile name`	Offline	Save the current debug state as a named profile.	None
`set debug timeout`	Offline	Set how long debug output stays enabled.	None
`set sysctl`	Daemon	Set a transient sysctl value `set sysctl <key> <value>`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`set system file-descriptors`	Daemon	Raise the file descriptor limit for the daemon process. `set system file-descriptors [limit <limit\|max>]` Arguments`limit` union, required: no, one of `max`: New limit or max for hard limit. The value is the new soft limit on open descriptors, a count from 1 up to the hard limit, or the word max. Ze sets it with setrlimit and reports the previous, the current and the hard limit. Zero, or a count above the hard limit, is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show bfd 4

Command	Mode	Description	Pipes
`show bfd profile`	Read-only	Show BFD timer profiles with effective values. `show bfd profile` Subcommands`name`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bfd profile name`	Read-only	Show one BFD profile by name. `show bfd profile name <name>` Arguments`name` string, required: yes, any value of this type: Profile name The name a bfd profile block declares in the configuration. The match is exact, and the values answered are the ones in effect after inheritance.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bfd session address`	Read-only	Show full detail for one BFD session. `show bfd session address <address>` Arguments`address` string, required: yes, any value of this type: Peer address An IPv4 or IPv6 address in its usual text form. A value that does not parse fails with bfd: invalid peer address before any lookup.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bfd sessions`	Read-only	List all active BFD sessions. `show bfd sessions`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show bgp 37

Command	Mode	Description	Pipes
`show bgp`	Read-only	BGP peers, sessions, RIB, and protocol tools. `show bgp` Subcommands`decode` `encode` `health` `irr` `peer` `reject-asn` `rib` `update-delay`	2 aliases · 17 operators · answer: tab · 1 address field · 2 column orders Answer shape`tab` Address fields`address` Column order`address, name, description, remote-as, peer-type, state, uptime, state-changed, last-error, routes-received, routes-accepted, routes-sent, updates-received, updates-sent, keepalives-received, keepalives-sent, eor-received, eor-sent, connections-dropped; router-id, local-as, uptime, peers-configured, peers-established, family, peers-in-family, peers` Aliases `peers` The peer rows, without the aggregate fields `display peers` `summary` The aggregate fields, without the peer rows `display router-id local-as uptime peers-configured peers-established` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp adj-rib-in`	Read-only	Show the routes held for each peer, with the wire bytes and validation state of each. `show bgp adj-rib-in`	14 operators · answer: map Answer shape`map` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display` While streaming`log` Local process only`save`
`show bgp adj-rib-in status`	Read-only	Show whether the Adj-RIB-In runs, its total route count, and the count for each peer. `show bgp adj-rib-in status`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp decode`	Read-only	Decode a hex-encoded BGP message into readable JSON. `show bgp decode`	None
`show bgp encode`	Read-only	Turn a route announcement into wire-format hex. `show bgp encode`	None
`show bgp health`	Read-only	Quick health check for all your BGP peers. `show bgp health`	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`peer` Column order`peer, state, as, uptime` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp healthcheck`	Read-only	Show healthcheck probe status `show bgp healthcheck`	14 operators · answer: map Answer shape`map` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display` While streaming`log` Local process only`save`
`show bgp irr`	Read-only	Show IRR filter status per ASN. `show bgp irr` Subcommands`check` `prefix`	15 operators · answer: tab · 2 column orders Answer shape`tab` Column order`asn, as-set, status, error, ipv4-count, ipv6-count, last-refresh, peers; server, last-refresh, next-refresh, entries` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp irr check`	Read-only	Check if a prefix is accepted by the IRR filter. `show bgp irr check <peer> <prefix>` Arguments`peer` string, required: yes, any value of this type: Peer address. The address of an IRR-filtered peer, spelled as the configuration spells it. The prefix is evaluated against the list of the ASN that peer is enrolled under. An address no enrolled ASN carries is refused. `prefix` string, required: yes, any value of this type: Prefix to check (CIDR). An IPv4 or IPv6 prefix in CIDR form, which Ze parses before the check. The answer echoes it and reports accepted true or false, with the entry that matched when one did.	9 operators · answer: doc · 1 column order Answer shape`doc` Column order`prefix, asn, accepted, matched-entry` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp irr prefix`	Read-only	Show IRR-resolved prefixes for a peer. `show bgp irr prefix <peer>` Arguments`peer` string, required: yes, any value of this type: Peer address. The address of an IRR-filtered peer, spelled as the configuration spells it. The plugin finds the ASN the peer is enrolled under and answers that ASN's prefix list. An address no enrolled ASN carries is refused.	14 operators · answer: map · 1 column order Answer shape`map` Column order`asn, as-set, prefixes` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display` While streaming`log` Local process only`save`
`show bgp peer capabilities`	Read-only	Show what capabilities were negotiated with a peer. `show bgp peer <selector> capabilities` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Every command under 'show bgp peer' reads the peers it matches, except 'list', which reads every peer.	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`peer` Column order`peer, state, negotiation-complete, negotiated` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp peer detail`	Read-only	Show full detail for one or more peers. `show bgp peer <selector> detail` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Every command under 'show bgp peer' reads the peers it matches, except 'list', which reads every peer.	17 operators · answer: tab · 2 address fields · 1 column order Answer shape`tab` Address fields`local-ip · next-hop-address` Column order`name, group, remote-as, local-as, peer-type, router-id, state, uptime, last-notification, local-ip, next-hop, next-hop-address, timer, capabilities` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp peer history`	Read-only	Show FSM state transitions for a peer over time. `show bgp peer <selector> history` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Every command under 'show bgp peer' reads the peers it matches, except 'list', which reads every peer.	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`timestamp, from, to, reason` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp peer list`	Read-only	List your peers, one line each. `show bgp peer list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, group, remote-as, state, uptime` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp peer rib`	Read-only	Show RIB data scoped to one peer. `show bgp peer <selector> rib [sent\|advertised\|received\|sent-received]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Every command under 'show bgp peer' reads the peers it matches, except 'list', which reads every peer. Subcommands`scope`	17 operators · answer: tab · 2 address fields · 1 column order Answer shape`tab` Address fields`peer · next-hop` Column order`peer, direction, family, prefix, next-hop, path-id, as-path, origin, local-pref, med, communities` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp peer statistics`	Read-only	Show UPDATE throughput for your peers. `show bgp peer <selector> statistics` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. Every command under 'show bgp peer' reads the peers it matches, except 'list', which reads every peer.	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`address` Column order`address, remote-as, state, uptime, updates-received, updates-sent, keepalives-received, keepalives-sent, eor-received, eor-sent, rate-updates-received, rate-updates-sent, rate-keepalives-received, rate-keepalives-sent` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp reject-asn`	Read-only	Show every reject-asn list. `show bgp reject-asn` Subcommands`known` `name`	2 aliases · 15 operators · answer: tab · 2 column orders Answer shape`tab` Column order`name, import-peers, export-peers, entries, patterns; asn, positions, network` Aliases `peers` The peer rows, without the aggregate fields `display peers` `summary` The aggregate fields, without the peer rows `display router-id local-as uptime peers-configured peers-established` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp reject-asn known transit-free`	Read-only	Print the curated transit-free ASNs as a config block. `show bgp reject-asn known transit-free`	2 aliases · 9 operators · answer: doc · 2 column orders Answer shape`doc` Column order`curated, sources, networks, block; asn, name, contested` Aliases `peers` The peer rows, without the aggregate fields `display peers` `summary` The aggregate fields, without the peer rows `display router-id local-as uptime peers-configured peers-established` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp reject-asn name`	Read-only	Show one reject-asn list. `show bgp reject-asn name <name>` Arguments`name` string, required: yes, any value of this type: Reject-ASN list name The name of one configured reject-asn list. A name no list carries is refused, and the answer names the missing list.	2 aliases · 9 operators · answer: doc · 2 column orders Answer shape`doc` Column order`name, import-peers, export-peers, entries, patterns; asn, positions, network` Aliases `peers` The peer rows, without the aggregate fields `display peers` `summary` The aggregate fields, without the peer rows `display router-id local-as uptime peers-configured peers-established` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rib`	Read-only	Query routes in the BGP RIB. `show bgp rib` Task supportrequired: the MCP server always answers with a task handle Subcommands`best` `protocol` `rpf` `status`	13 command pipes · 17 operators · answer: tab · 2 address fields · 1 column order Answer shape`tab` Address fields`peer · next-hop` Column order`peer, direction, family, prefix, next-hop, path-id, as-path, origin, local-pref, med, communities` Command pipes `advertisedcommunity <value>countfamily <value>first <value>graphhistogramlast <value>match <value>path <value>peer <value>prefix <value>received` Command pipe descriptions `advertised` Select advertised routes `community <value>` Filter by standard community `count` Count matching routes without serializing rows `family <value>` Filter by AFI/SAFI `first <value>` Take first N routes `graph` Render AS-path topology graph `histogram` Count routes by family and prefix length `last <value>` Take last N routes `match <value>` Cross-field structured match `path <value>` Filter by AS path `peer <value>` Filter by peer `prefix <value>` Filter by prefix `received` Select received routes Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rib best`	Read-only	Show the winning route for each prefix. `show bgp rib best` Subcommands`status`	12 command pipes · 17 operators · answer: tab · 2 address fields · 1 column order Answer shape`tab` Address fields`best-peer · next-hop` Column order`family, prefix, best-peer, multipath-peers, attributes` Command pipes `community <value>countfamily <value>first <value>graphhistogramlast <value>match <value>path <value>peer <value>prefix <value>reason` Command pipe descriptions `community <value>` Filter by standard community `count` Count matching best paths without serializing rows `family <value>` Filter by AFI/SAFI `first <value>` Take first N best paths `graph` Render AS-path topology graph `histogram` Count routes by family and prefix length `last <value>` Take last N best paths `match <value>` Cross-field structured match `path <value>` Filter by AS path `peer <value>` Filter by peer `prefix <value>` Filter by prefix `reason` Explain best-path selection Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rib best status`	Read-only	Check whether best-path computation is still running. `show bgp rib best status`	9 operators · answer: doc · 1 column order Answer shape`doc` Column order`running, peers-with-rib, total-routes` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rib commands`	Read-only	List RIB commands `show bgp rib commands`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp rib events`	Read-only	List RIB event types `show bgp rib events`	14 operators · answer: map Answer shape`map` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display` While streaming`log` Local process only`save`
`show bgp rib help`	Read-only	Show RIB subcommands `show bgp rib help`	14 operators · answer: map Answer shape`map` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display` While streaming`log` Local process only`save`
`show bgp rib protocol`	Read-only	Query the routes one protocol feeds into the RIB. `show bgp rib protocol <protocol>` Arguments`protocol` string, required: yes, any value of this type: Registered protocol name The name of a registered protocol. The bgp-rib plugin refuses a name the protocol registry does not hold and names the registered ones.	13 command pipes · 17 operators · answer: tab · 2 address fields · 1 column order Answer shape`tab` Address fields`peer · next-hop` Column order`peer, direction, family, prefix, next-hop, path-id, as-path, origin, local-pref, med, communities` Command pipes `advertisedcommunity <value>countfamily <value>first <value>graphhistogramlast <value>match <value>path <value>peer <value>prefix <value>received` Command pipe descriptions `advertised` Select advertised routes `community <value>` Filter by standard community `count` Count matching routes without serializing rows `family <value>` Filter by AFI/SAFI `first <value>` Take first N routes `graph` Render AS-path topology graph `histogram` Count routes by family and prefix length `last <value>` Take last N routes `match <value>` Cross-field structured match `path <value>` Filter by AS path `peer <value>` Filter by peer `prefix <value>` Filter by prefix `received` Select received routes Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rib rpf`	Read-only	Reverse-path forwarding lookup in the Loc-RIB. `show bgp rib rpf`	9 operators · answer: doc · 2 address fields · 1 column order Answer shape`doc` Address fields`source · next-hop` Column order`source, family, found, matched-prefix, next-hop, distance, metric` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rib status`	Read-only	Get a quick RIB overview without dumping routes. `show bgp rib status`	9 operators · answer: doc · 1 column order Answer shape`doc` Column order`running, peers, routes-in, routes-out, stale-routes, route-counts, gr-state` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rpki`	Read-only	Show RPKI validation counters with one row for each cache server `show bgp rpki`	1 alias · 17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`address` Column order`address, port, state, synced, version` Aliases `summary` The validation counters, without the cache server rows `display vrp-count validation-enabled sessions-total sessions-established sessions-synced aspa-enabled aspa-records` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rpki aspa`	Read-only	Show ASPA cache or lookup providers for a customer AS `show bgp rpki aspa`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`customer-asn, providers` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bgp rpki cache`	Read-only	Show RTR cache server sessions with protocol details `show bgp rpki cache`	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`address` Column order`address, port, preference, state, synced, version, session-id, serial, refresh-interval, retry-interval, expire-interval` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rpki roa`	Read-only	Show ROA table entries or lookup covering VRPs for a prefix `show bgp rpki roa`	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`prefix` Column order`prefix, max-length, asn` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rpki status`	Read-only	Show RPKI validation status and cache server overview `show bgp rpki status`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rpki summary`	Read-only	Show RPKI validation summary with session and ASPA counts `show bgp rpki summary`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp rs peers`	Read-only	Show peer states `show bgp rs peers`	17 operators · answer: tab · 1 address field · 1 column order Answer shape`tab` Address fields`address` Column order`address, remote, up` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill · resolve · origin` While streaming`log` Local process only`save`
`show bgp rs status`	Read-only	Show RS status `show bgp rs status`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show bgp update-delay`	Read-only	Show the startup convergence hold and what it waits for. `show bgp update-delay`	9 operators · answer: doc · 1 column order Answer shape`doc` Column order`configured, holding, released, reason, expected-peers, peers-held, peers-converged, max-delay-seconds, establish-wait-seconds` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`

show bmp 4

Command	Mode	Description	Pipes
`show bmp collectors`	Read-only	Show BMP collector connection status. `show bmp collectors`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bmp peers`	Read-only	Show BGP peers as seen through BMP monitoring. `show bmp peers`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bmp rib`	Read-only	Show routes received via BMP monitoring sessions. `show bmp rib`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show bmp sessions`	Read-only	Show active BMP receiver sessions. `show bmp sessions`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show config 7

Command	Mode	Description	Pipes
`show config cat`	Read-only	Print the full text of a stored configuration snapshot. `show config cat <id>` Arguments`id` string, required: yes, any value of this type: Stored configuration snapshot id. The value is a key that show config list prints. Ze reads that file from the configuration store and writes its bytes unchanged.	None
`show config diff`	Read-only	Compare two configuration versions side by side. `show config diff`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show config dump`	Read-only	Show the fully resolved configuration tree. `show config dump`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show config fmt`	Read-only	Pretty-print the configuration with consistent formatting. `show config fmt`	None
`show config graph`	Offline	Show how components and peers depend on each other, as JSON.	None
`show config history`	Read-only	List available configuration rollback points. `show config history`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`revision, timestamp, path, state` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show config list`	Read-only	List all configuration files stored in the database. `show config list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`source, path` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`

show ddos 4

Command	Mode	Description	Pipes
`show ddos flowspec`	Read-only	Show the upstream FlowSpec and RTBH DDoS mitigation status. `show ddos flowspec`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ddos incidents`	Read-only	Show the recent DDoS incident ring (newest first). `show ddos incidents`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ddos local`	Read-only	Show the on-host DDoS mitigation status. `show ddos local`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ddos status`	Read-only	Show the DDoS observation status. `show ddos status`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show dns 4

Command	Mode	Description	Pipes
`show dns cache list`	Read-only	List all non-expired DNS cache entries, sorted by shortest TTL first. `show dns cache list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show dns cache record`	Read-only	Show DNS cache entries for one record name. `show dns cache record <name>` Arguments`name` string, required: yes, any value of this type: Record name to inspect. The cache key, compared as an exact string. Each entry reported under it carries the name, the type, the records and the seconds of TTL left.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show dns cache stats`	Read-only	Show the DNS cache hit, miss, eviction, expiry, and hit-rate counters. `show dns cache stats`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show dns lookup`	Read-only	Look up a DNS name from the router. `show dns lookup <hostname> [type <A\|AAAA\|MX\|NS\|TXT\|CNAME\|PTR>]` Arguments`hostname` string, required: yes, any value of this type: Hostname to resolve. A DNS name of at most 253 characters. The first word that is not the type keyword is taken as the name, and a call with no name is refused. `type` enum, required: no, one of `A` `AAAA` `MX` `NS` `TXT` `CNAME` `PTR`: DNS record type. The record type to query, written after the type keyword. The default is A. Ze upper-cases the value, and a type outside this list is refused with the list of accepted ones.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show event 4

Command	Mode	Description	Pipes
`show event delivery`	Read-only	Show which peers feed which attached processes. `show event delivery`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show event list`	Read-only	List every event type you can subscribe to. `show event list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show event namespaces`	Read-only	List all event namespaces and how many events each has logged. `show event namespaces`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show event recent`	Read-only	Show recent events, newest first. `show event recent`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show firewall 5

Command	Mode	Description	Pipes
`show firewall domain-group`	Read-only	Show what each configured domain group's DNS names resolve to. `show firewall domain-group [name <name>]` Arguments`name` string, required: no, any value of this type: Group name; omit to list every group A group from the firewall configuration. A name no group carries is an error that lists the groups present.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show firewall group`	Read-only	Show members of a firewall address/port group. `show firewall group` Backends`nft`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show firewall irr`	Read-only	Show IRR filter status for all cached ASN/AS-SET entries. `show firewall irr` Subcommands`prefix`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show firewall irr prefix`	Read-only	Show IRR-resolved prefixes for a cached entry. `show firewall irr prefix <name>` Arguments`name` string, required: yes, any value of this type: ASN or AS-SET name The cache key, as the update command stored it: an ASN in the form AS64500, or an AS-SET name. A key with no cached data is an error.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show firewall ruleset`	Read-only	Show the live firewall ruleset with per-term counters. `show firewall ruleset <name>` Arguments`name` string, required: yes, any value of this type: Firewall table name The table name as the configuration spells it, without the ze prefix the backend adds. A name no applied table carries is an error that lists the tables applied. Backends`nft`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show host 10

Command	Mode	Description	Pipes
`show host`	Read-only	Hardware inventory for this box. `show host` Subcommands`all` `cpu` `dmi` `kernel` `memory` `nic` `platform` `storage` `thermal`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host all`	Read-only	Show the full hardware inventory in one shot. `show host all`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host cpu`	Read-only	Show what CPUs are in this box. `show host cpu`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host dmi`	Read-only	Show the box's identity from SMBIOS/DMI. `show host dmi`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host kernel`	Read-only	Show the running kernel version and boot parameters. `show host kernel`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host memory`	Read-only	Show installed memory and ECC health. `show host memory`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host nic`	Read-only	Show physical NICs installed in this box. `show host nic`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host platform`	Read-only	Show platform capabilities and constraints. `show host platform`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host storage`	Read-only	Show storage devices attached to this box. `show host storage`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show host thermal`	Read-only	Show temperature sensors and thermal throttle events. `show host thermal`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show interface 8

Command	Mode	Description	Pipes
`show interface`	Read-only	Show network interfaces on this box. `show interface` Subcommands`brief` `errors` `name` `rate` `scan` `type`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface brief`	Read-only	One-line summary per interface: name, state, IP, and MTU. `show interface brief`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface errors`	Read-only	Show interfaces that have errors or drops. `show interface errors`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface name counters`	Read-only	Show counters for one interface. `show interface name <name> counters` Arguments`name` string, required: yes, any value of this type: Interface name The interface whose statistics are read. The answer repeats this name beside the Rx and Tx values.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface name detail`	Read-only	Show full detail for one interface. `show interface name <name> detail` Arguments`name` string, required: yes, any value of this type: Interface name The interface whose record is shown. The backend looks it up by this name, and an unknown name answers the backend's error.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface rate`	Read-only	Show per-second traffic rates on your interfaces. `show interface rate`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface scan`	Read-only	Discover and classify all OS interfaces. `show interface scan`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show interface type`	Read-only	Show only interfaces of a given type. `show interface type <type>` Arguments`type` string, required: yes, any value of this type: Ze interface type to filter by The type name the backend reports for an interface, compared without regard to case. When no interface has it, the error lists the types present.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show isis 8

Command	Mode	Description	Pipes
`show isis database`	Read-only	Show the IS-IS link-state database. `show isis database` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis database detail`	Read-only	Show the IS-IS link-state database with TLV detail. `show isis database detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis hostname`	Read-only	Show the IS-IS dynamic-hostname mapping (RFC 5301). `show isis hostname`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis interface`	Read-only	Show IS-IS-enabled circuits. `show isis interface`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis neighbor`	Read-only	Show IS-IS adjacencies. `show isis neighbor`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis route`	Read-only	Show IS-IS-computed routes. `show isis route` Subcommands`ipv6`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis route ipv6`	Read-only	Show IS-IS-computed IPv6 routes (RFC 5308). `show isis route ipv6`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show isis spf-log`	Read-only	Show recent IS-IS SPF runs. `show isis spf-log`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show l2tp 18

Command	Mode	Description	Pipes
`show l2tp`	Read-only	L2TP tunnel, session, and subscriber state. `show l2tp` Subcommands`config` `cqm` `echo` `health` `listeners` `observer` `reliable` `session` `sessions` `statistics` `tunnel` `tunnels`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp config`	Read-only	Show the resolved L2TP configuration. `show l2tp config`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp cqm`	Read-only	Show subscriber line quality (CQM latency buckets). `show l2tp cqm`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp echo`	Read-only	Show LCP echo health for a subscriber session. `show l2tp echo`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp health`	Read-only	Find your worst L2TP sessions at a glance. `show l2tp health`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp listeners`	Read-only	Show which UDP sockets are listening for L2TP. `show l2tp listeners`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp observer`	Read-only	Show recent events for a session (debug aid). `show l2tp observer`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp pool`	Read-only	Show the IPv4 and IPv6 subscriber address pools and what each has allocated. `show l2tp pool`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp reliable`	Read-only	Show the reliable transport window for a tunnel. `show l2tp reliable`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp session history`	Read-only	Show state transitions for a session over time. `show l2tp session history`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp session id`	Read-only	Show full detail for one L2TP session. `show l2tp session id <id>` Arguments`id` string, required: yes, any value of this type: Local session ID. The decimal local session ID from the show l2tp session table. Zero is refused because RFC 2661 reserves it, and an unknown ID is refused with 'no session with local-sid'.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp session traffic`	Read-only	Show traffic counters for a subscriber's PPP interface. `show l2tp session traffic`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp sessions`	Read-only	List all active L2TP sessions. `show l2tp sessions`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp shaper`	Read-only	Show each shaped subscriber session with its download and upload rate. `show l2tp shaper`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp statistics`	Read-only	Show aggregate L2TP protocol counters. `show l2tp statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp tunnel history`	Read-only	Show state transitions for a tunnel over time. `show l2tp tunnel history`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp tunnel id`	Read-only	Show full detail for one L2TP tunnel. `show l2tp tunnel id <id>` Arguments`id` string, required: yes, any value of this type: Local tunnel ID. The decimal local tunnel ID from the show l2tp tunnel table. Zero is refused because RFC 2661 reserves it, and an unknown ID is refused with 'no tunnel with local-tid'.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show l2tp tunnels`	Read-only	List all active L2TP tunnels. `show l2tp tunnels`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show metrics 4

Command	Mode	Description	Pipes
`show metrics list`	Read-only	List all registered metric names (no values). `show metrics list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show metrics name`	Read-only	Show one Prometheus metric by name. `show metrics name <name> [label <key> <value> ...]` Arguments`name` string, required: yes, any value of this type: Prometheus metric name The value is the whole metric name, such as ze_bgp_connect_retry_counter, compared as text with the start of each sample line. A name that matches no sample answers an empty list. Subcommands`label`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show metrics pool`	Read-only	Show attribute pool memory usage and dedup efficiency. `show metrics pool`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show metrics values`	Read-only	Dump all metrics in Prometheus text format. `show metrics values`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show ospf 49

Command	Mode	Description	Pipes
`show ospf`	Read-only	Show the OSPFv2 process summary (RFC 2328). `show ospf` Subcommands`border-routers` `database` `graceful-restart` `instance` `interface` `ipv6` `ldp-sync` `neighbor` `route` `segment-routing` `spf` `te-database` `virtual-links`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf border-routers`	Read-only	Show routes to OSPF area-border and AS-boundary routers. `show ospf border-routers`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database`	Read-only	Show the OSPF link-state database. `show ospf database` Subcommands`asbr-summary` `external` `network` `nssa-external` `opaque-area` `opaque-as` `opaque-link` `router` `router-information` `summary`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database asbr-summary`	Read-only	Show only ASBR-Summary-LSAs (Type 4). `show ospf database asbr-summary`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database external`	Read-only	Show only AS-external-LSAs (Type 5). `show ospf database external`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database network`	Read-only	Show only Network-LSAs (Type 2). `show ospf database network`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database nssa-external`	Read-only	Show only NSSA-external-LSAs (Type 7, RFC 3101). `show ospf database nssa-external`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-area`	Read-only	Show only area-scope opaque-LSAs (Type 10, RFC 5250). `show ospf database opaque-area` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-area detail`	Read-only	Decode each area-scope opaque LSA body (RFC 5250). `show ospf database opaque-area detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-as`	Read-only	Show only AS-scope opaque-LSAs (Type 11, RFC 5250). `show ospf database opaque-as` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-as detail`	Read-only	Decode each AS-scope opaque LSA body (RFC 5250). `show ospf database opaque-as detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-link`	Read-only	Show only link-local opaque-LSAs (Type 9, RFC 5250). `show ospf database opaque-link` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database opaque-link detail`	Read-only	Decode each link-local opaque LSA body (RFC 5250). `show ospf database opaque-link detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database router`	Read-only	Show only Router-LSAs (Type 1). `show ospf database router`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database router-information`	Read-only	Show the Router Information LSAs (RFC 7770) for both address families. `show ospf database router-information`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf database summary`	Read-only	Show only Summary-LSAs (Type 3, inter-area network). `show ospf database summary`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf graceful-restart`	Read-only	Show OSPFv2 (IPv4) Graceful Restart state (RFC 3623). `show ospf graceful-restart`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf instance`	Read-only	Show the configured OSPFv2 instances (RFC 6549 Multi-Instance). `show ospf instance`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf interface`	Read-only	Show OSPF-enabled interfaces. `show ospf interface` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf interface detail`	Read-only	Show the full per-interface state (spec-ospf-ext-14). `show ospf interface detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6`	Read-only	Show the OSPFv3 (IPv6) address-family instances (RFC 5838). `show ospf ipv6` Subcommands`database` `graceful-restart` `instance` `interface` `neighbor` `segment-routing` `spf`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database`	Read-only	Show the OSPFv3 (IPv6) link-state database with each native scope-aware LSA decoded (RFC 5340). `show ospf ipv6 database` Subcommands`detail` `extended` `router` `router-information` `scope` `segment-routing`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database detail`	Read-only	Decode every OSPFv3 LSA body with its scope-aware header (RFC 5340 section A.4.2.1). `show ospf ipv6 database detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database extended`	Read-only	Show the extended OSPFv3 LSAs (RFC 8362). `show ospf ipv6 database extended`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database router detail`	Read-only	Decode each OSPFv3 Router-LSA body. `show ospf ipv6 database router detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database router-information`	Read-only	Show the OSPFv3 Router Information LSAs (RFC 7770). `show ospf ipv6 database router-information`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database scope area`	Read-only	Show only area-scope (S2/S1 = 01) LSAs. `show ospf ipv6 database scope area`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database scope as`	Read-only	Show only AS-scope (S2/S1 = 10) LSAs. `show ospf ipv6 database scope as`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database scope link`	Read-only	Show only link-local (S2/S1 = 00) LSAs, including the per-interface Link-LSA store. `show ospf ipv6 database scope link`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 database segment-routing`	Read-only	Summarise the OSPFv3 Segment Routing content (RFC 8666) carried in the RI and extended LSAs. `show ospf ipv6 database segment-routing`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 graceful-restart`	Read-only	Show OSPFv3 (IPv6) Graceful Restart state (RFC 5187). `show ospf ipv6 graceful-restart`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 instance`	Read-only	Enumerate the active OSPFv3 address-family instances (RFC 5838 section 2). `show ospf ipv6 instance`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 interface`	Read-only	Show OSPFv3 (IPv6-family) interfaces and their RFC 4552 IPsec status. `show ospf ipv6 interface` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 interface detail`	Read-only	Show the full per-interface OSPFv3 state (spec-ospf-ext-14). `show ospf ipv6 interface detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 neighbor`	Read-only	Show the OSPFv3 (IPv6) neighbors. `show ospf ipv6 neighbor` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 neighbor detail`	Read-only	Show the full per-neighbor OSPFv3 state (spec-ospf-ext-14). `show ospf ipv6 neighbor detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 segment-routing`	Read-only	Show OSPFv3 (IPv6) Segment Routing state (RFC 8666). `show ospf ipv6 segment-routing`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 spf`	Read-only	Show the OSPFv3 (IPv6) per-area SPF run history. `show ospf ipv6 spf` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ipv6 spf detail`	Read-only	Explain why each OSPFv3 route won (spec-ospf-ext-14), AF/Instance-ID tagged. `show ospf ipv6 spf detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf ldp-sync`	Read-only	Show OSPF LDP-IGP synchronization state (RFC 5443, RFC 6138). `show ospf ldp-sync`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf neighbor`	Read-only	Show OSPF neighbors. `show ospf neighbor` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf neighbor detail`	Read-only	Show the full per-neighbor state (spec-ospf-ext-14). `show ospf neighbor detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf route`	Read-only	Show OSPF-computed routes. `show ospf route` Subcommands`fast-reroute`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf route fast-reroute`	Read-only	Show OSPF fast-reroute (LFA / TI-LFA) backups (RFC 5286). `show ospf route fast-reroute`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf segment-routing`	Read-only	Show OSPFv2 (IPv4) Segment Routing state (RFC 8665). `show ospf segment-routing`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf spf`	Read-only	Show recent OSPF SPF runs. `show ospf spf` Subcommands`detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf spf detail`	Read-only	Explain why each route won the SPF calculation (spec-ospf-ext-14). `show ospf spf detail`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf te-database`	Read-only	Show the OSPF Traffic Engineering Database (RFC 3630 / RFC 5392). `show ospf te-database`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ospf virtual-links`	Read-only	Show OSPF virtual links (RFC 2328 section 15). `show ospf virtual-links`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show pki 6

Command	Mode	Description	Pipes
`show pki certificate name`	Read-only	Inspect a specific certificate in detail. `show pki certificate name <name>` Arguments`name` string, required: yes, any value of this type: Certificate name The name of a CA or device certificate in the store. An unknown name is refused, and the refusal lists the names the store holds. Subcommands`bundle` `fingerprint` `pem`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pki certificate name bundle pem`	Read-only	Export the certificate, its intermediates and its private key as one PEM stream. `show pki certificate name <name> bundle pem` Arguments`name` string, required: yes, any value of this type: Certificate name The name of a device certificate in the store. A CA name and a device certificate with no private key are each refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pki certificate name fingerprint`	Read-only	Show the hash of the certificate, to verify its identity against the one another system reports. `show pki certificate name <name> fingerprint [sha256\|sha384\|sha512]` Arguments`name` string, required: yes, any value of this type: Certificate name The name of a CA or device certificate in the store. The hash is taken over its DER bytes. An unknown name is refused, and the refusal lists the names the store holds. Subcommands`algorithm`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pki certificate name pem`	Read-only	Export the certificate, and any intermediate it carries, as PEM. `show pki certificate name <name> pem` Arguments`name` string, required: yes, any value of this type: Certificate name The name of a CA or device certificate in the store. An unknown name is refused, and the refusal lists the names the store holds.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pki certificates`	Read-only	List all loaded certificates with expiry dates. `show pki certificates`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pki local-ca pem`	Read-only	Export the root certificate of the local certificate authority as PEM. `show pki local-ca pem`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show policy 4

Command	Mode	Description	Pipes
`show policy chain peer`	Read-only	Show the import/export filter chain applied to a peer. `show policy chain peer <selector> [import\|export]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, or * for every peer. The chain of each peer it matches is shown. Subcommands`direction`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show policy list`	Read-only	List all available filter types and named instances. `show policy list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show policy routes`	Read-only	Show policy-based routing rules. `show policy routes`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show policy test peer`	Read-only	Test what your policy does to a specific UPDATE. `show policy test peer <selector> <import\|export> [filter <name>] update <hex> [source-asn4 <true\|false>]` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, or an AS pattern such as as65001. It MUST match exactly one peer: no match, and a match of several peers, are each refused. `direction` enum, required: yes, one of `import` `export`: Which half of the chain to test The word is required, and a call without it is refused. It picks which of the peer's two chains the UPDATE is fed through. Subcommands`filter` `source-asn4` `update`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show pppoe 5

Command	Mode	Description	Pipes
`show pppoe`	Read-only	PPPoE session and protocol state. `show pppoe` Subcommands`interfaces` `session` `sessions` `statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pppoe interfaces`	Read-only	Show which interfaces are accepting PPPoE sessions. `show pppoe interfaces`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pppoe session id`	Read-only	Show full detail for one PPPoE session. `show pppoe session id <id>` Arguments`id` string, required: yes, any value of this type: PPPoE session ID. The decimal sid column of the show pppoe session table. Zero is refused because RFC 2516 reserves it, and an unknown id is refused with 'no session with sid'.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pppoe sessions`	Read-only	List all active PPPoE sessions. `show pppoe sessions`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show pppoe statistics`	Read-only	Show PPPoE protocol message counters. `show pppoe statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show rsvp-te 5

Command	Mode	Description	Pipes
`show rsvp-te fast-reroute`	Read-only	Show RSVP-TE Fast Reroute (RFC 4090) protection state. `show rsvp-te fast-reroute`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rsvp-te interface`	Read-only	Show RSVP-TE bandwidth allocation per interface. `show rsvp-te interface`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rsvp-te lsp`	Read-only	Show RSVP-TE label-switched paths. `show rsvp-te lsp`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rsvp-te session`	Read-only	Show each signaling session with its LSP state, role, bandwidth and labels. `show rsvp-te session`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rsvp-te tunnel`	Read-only	Show configured RSVP-TE tunnels and their current state. `show rsvp-te tunnel`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show schema 5

Command	Mode	Description	Pipes
`show schema events`	Read-only	List all notification types defined in YANG API modules. `show schema events`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`method, module, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show schema handlers`	Read-only	Show which handler serves each YANG module. `show schema handlers`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`handler, module` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show schema list`	Read-only	List all YANG schemas loaded by the daemon. `show schema list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`module, namespace, wants-config, imports` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show schema methods`	Read-only	List all RPC methods defined in YANG API modules. `show schema methods`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`method, module, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show schema protocol`	Read-only	Show the wire protocol version and format details. `show schema protocol`	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`

show sysctl 5

Command	Mode	Description	Pipes
`show sysctl`	Read-only	Show all active sysctl keys with source and persistence `show sysctl`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show sysctl key`	Read-only	Show detail for one sysctl key `show sysctl key <key>`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show sysctl keys`	Read-only	List all known sysctl keys with descriptions `show sysctl keys`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show sysctl profile`	Read-only	Show detail for one sysctl profile `show sysctl profile <name>`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show sysctl profiles`	Read-only	List all registered sysctl profiles `show sysctl profiles`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show system 15

Command	Mode	Description	Pipes
`show system conntrack`	Read-only	Show the kernel connection tracking table. `show system conntrack` Backends`nft`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system cpu`	Read-only	Show CPU utilization context for the daemon. `show system cpu`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system date`	Read-only	Show the daemon's current wall-clock time and timezone. `show system date`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system file-descriptors`	Read-only	Show how many file descriptors the daemon has open. `show system file-descriptors [mode <summary\|detail>]` Arguments`mode` enum, required: no, one of `summary` `detail`: Display mode. The word is optional and the default is summary. Detail keeps the totals and appends the descriptor rows, so the output grows with the number of open files.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system goroutines`	Read-only	Dump goroutine stacks for debugging hangs or deadlocks. `show system goroutines [mode <summary\|blocked\|full>]` Arguments`mode` enum, required: no, one of `summary` `blocked` `full`: Display mode. The word is optional and the default is summary. The blocked list carries each waiting goroutine with its id, its state and its stack, after the same totals. A full dump is one text block of up to 16 MB, so keep it for a hang.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system kernel-log`	Read-only	Show kernel log messages (dmesg-style). `show system kernel-log [level <emerg\|alert\|crit\|err\|warning\|notice\|info\|debug>] [count <count>]` Arguments`level` enum, required: no, one of `emerg` `alert` `crit` `err` `warning` `notice` `info` `debug`: Filter by syslog level. The word is the highest syslog level to show, and every more severe level is included with it. A digit from 0 to 7 is accepted in its place. Absent, or not a known level, nothing is filtered. `count` uint, required: no, any value of this type: Maximum number of messages. The value is from 1 to 10000 and the default is 50. Ze reads the whole ring buffer, applies the level filter, then keeps the newest count messages. A value outside the range is ignored and the default applies.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system memory`	Read-only	Show how much memory the daemon is using, from the OS's view. `show system memory`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system ntp`	Read-only	NTP clock synchronization status. `show system ntp` Subcommands`peers`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system ntp peers`	Read-only	Show NTP peers with offset, RTT, stratum, and reachability. `show system ntp peers`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system platform`	Read-only	Show what kind of platform the daemon is running on. `show system platform`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system profile`	Read-only	Capture a runtime profile for performance analysis. `show system profile [type <cpu\|heap\|goroutine\|allocs>] [duration <duration>]` Arguments`type` enum, required: no, one of `cpu` `heap` `goroutine` `allocs`: Profile type. The word is optional and the default is heap. Only cpu runs for a time and reads duration. The three others return at once. The response carries the pprof bytes as base64 in data, with format pprof-base64. `duration` string, required: no, any value of this type: Profile duration. The value is a Go duration with a unit, from 1s to 60s, and the default is 10s. Only a cpu profile reads it. A second cpu profile is refused while one runs.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system sockets`	Read-only	Show open TCP and UDP sockets on this box. `show system sockets [protocol <tcp\|udp>] [state <state>] [port <port>]` Arguments`protocol` enum, required: no, one of `tcp` `udp`: Filter by protocol. The word is optional. Absent, the list carries both protocols. Ze reads /proc/net/tcp and /proc/net/tcp6 for tcp, and the udp pair for udp. `state` string, required: no, any value of this type: Filter by socket state. The value is a kernel state name such as established, listen or time_wait, in any letter case. Only sockets in that state are listed. A UDP socket has no state to match. `port` uint, required: no, any value of this type: Filter by port number. The value is a port number from 1 to 65535. A socket is listed when its local port or its remote port equals it. A value outside that range is ignored and the list is not filtered.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system subsystem list`	Read-only	List every registered subsystem and whether it is running. `show system subsystem list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system update`	Read-only	Check if a firmware update is available. `show system update` Subcommands`history`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show system update history`	Read-only	Show recent firmware update activity. `show system update history`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show traffic 4

Command	Mode	Description	Pipes
`show traffic control`	Read-only	Show traffic control (QoS) configuration per interface. `show traffic control`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show traffic feature`	Read-only	Show neutral per-source traffic feature signals. `show traffic feature [name <name>]` Arguments`name` string, required: no, any value of this type: Source address filter A source IP address, compared as text against each entry's address. Only the entries with that exact address are listed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show traffic stat`	Read-only	Show aggregated traffic snapshot (interface rates, top talkers, top ports, severity). `show traffic stat [name <name>]` Arguments`name` string, required: no, any value of this type: Interface name filter The name of one interface, matched exactly against the interface names in the snapshot. A name in no row leaves the answer empty.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show traffic usage`	Read-only	Show per-interface traffic byte counters captured by eBPF TCX. `show traffic usage [name <name>]` Arguments`name` string, required: no, any value of this type: Interface name (used with 'name <interface>') The kernel interface name, as configured under traffic usage. An interface the plugin does not monitor fails with interface not monitored.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show vpn 6

Command	Mode	Description	Pipes
`show vpn ipsec dataplane drift`	Read-only	Compare what the IKE engine believes against what the kernel holds. `show vpn ipsec dataplane drift`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpn ipsec dataplane policy`	Read-only	Show the Security Policy Database the kernel holds. `show vpn ipsec dataplane policy`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpn ipsec dataplane sa`	Read-only	Show the Security Association Database the kernel holds. `show vpn ipsec dataplane sa [spi <spi>]` Arguments`spi` uint, required: no, any value of this type: Show all SAs with this SPI. The value is decimal. Ze keeps only the SAs whose SPI equals it, and the inbound SA and the outbound SA of one tunnel carry different SPIs, so one value names one direction. The value 0 is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpn ipsec peer name`	Read-only	Show full detail for one IPsec peer. `show vpn ipsec peer name <name>` Arguments`name` string, required: yes, any value of this type: Configured IPsec peer name. The value is the key of a site-to-site peer entry, at most 255 characters. Ze returns every IKE SA that peer holds, and answers 'peer not found' when none is up.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpn ipsec sa`	Read-only	Show all IKE and Child Security Associations. `show vpn ipsec sa`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpn ipsec status`	Read-only	Quick IPsec health check. `show vpn ipsec status`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show vpp 4

Command	Mode	Description	Pipes
`show vpp runtime`	Read-only	Show VPP graph node processing statistics. `show vpp runtime`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpp trace clear`	Read-only	Discard the captured VPP trace buffer. `show vpp trace clear`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpp trace show`	Read-only	Retrieve packets captured since the last trace start. `show vpp trace show`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vpp trace start`	Read-only	Start capturing packets in the VPP dataplane. `show vpp trace start`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show vrrp 4

Command	Mode	Description	Pipes
`show vrrp`	Read-only	Show every VRRP virtual router. `show vrrp` Subcommands`interface` `statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vrrp interface`	Read-only	Show the VRRP virtual routers hosted on one interface. `show vrrp interface name <interface>` Subcommands`name`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vrrp interface name`	Read-only	Show the VRRP virtual routers on one parent interface. `show vrrp interface name [value <value>]` Arguments`value` string, required: no, any value of this type: Parent interface name The name of the parent interface whose virtual routers the answer lists. The word after the name keyword is the value, and a bare word with no keyword is accepted from a programmatic sender.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show vrrp statistics`	Read-only	Show per-virtual-router counters. `show vrrp statistics`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

show (other) 70

Command	Mode	Description	Pipes
`show aaa accounting`	Read-only	Show AAA accounting counters and any dropped records. `show aaa accounting`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show announcements`	Read-only	List active on-demand announcements. `show announcements [tag <tag>] [selector <selector>] [family <family>]` Arguments`tag` string, required: no, any value of this type: Show only announcements carrying this tag key The value is a tag key, compared as text with the key each announcement was made with. Absent, announcements of every key are listed. `selector` string, required: no, any value of this type: Show only announcements whose peer selector matches this pattern The value is compared as text with the selector the announcement was made with, so it MUST be spelled the way that announcement spelled it. Absent, announcements to every selector are listed. `family` string, required: no, any value of this type: Show only announcements of this address family The value is an address family as the family column reports it, such as ipv4/unicast. Absent, announcements of every family are listed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show anomaly detect`	Read-only	Show the recent behavioral anomaly incidents. `show anomaly detect`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show anomaly observe`	Read-only	Show the behavioral anomaly incident lifecycle, newest first. `show anomaly observe`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show anomaly shape`	Read-only	Show the shadow-first anomaly responder status. `show anomaly shape`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show arp`	Read-only	Show the IPv4 ARP table (shortcut for 'show neighbor ipv4'). `show arp`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show as112`	Read-only	AS112 node status. `show as112`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show audit`	Read-only	Show who did what and when on this box. `show audit [action <action>] [actor <actor>] [surface <surface>] [since <since>] [until <until>] [count <count>]` Arguments`action` string, required: no, any value of this type: Filter by action type The value is an action name as the action column reports it, such as config-commit or login, compared as text. Absent, entries of every action are shown. `actor` string, required: no, any value of this type: Filter by actor name The value is the name of the user or process that acted, compared as text with the actor column. Absent, entries of every actor are shown. `surface` string, required: no, any value of this type: Filter by surface name The value is the surface the action came through: cli, web or api, compared as text. Absent, entries of every surface are shown. `since` string, required: no, any value of this type: Start time (RFC3339) The value is an RFC 3339 timestamp such as 2026-09-15T08:00:00Z, and any other form is refused. Entries recorded before it are left out. `until` string, required: no, any value of this type: End time (RFC3339) The value is an RFC 3339 timestamp such as 2026-09-15T18:00:00Z, and any other form is refused. Entries recorded after it are left out. `count` uint, required: no, any value of this type: Maximum number of entries The value is a whole number of 1 or more. The query stops after that many matching entries, oldest first. Absent, every matching entry is shown.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show cache`	Read-only	List the cached BGP UPDATE message IDs. `show cache`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show capture`	Read-only	Show captured control-plane messages. `show capture [protocol <l2tp\|bgp>] [tunnel-id <tunnel-id>] [count <count>] [peer <peer>]` Arguments`protocol` enum, required: no, one of `l2tp` `bgp`: Protocol filter. Restricts the answer to one protocol key. Absent, the answer carries an l2tp key and a bgp key, each holding its messages or 'capture not enabled'. `tunnel-id` string, required: no, any value of this type: L2TP tunnel ID filter. Keeps only the L2TP messages of the tunnel with this local tunnel ID. The BGP messages are not affected. `count` uint, required: no, any value of this type: Maximum number of messages. At most this many messages are returned for each protocol. Absent or 0, every buffered message is returned. `peer` string, required: no, any value of this type: Peer address filter. Keeps only the messages exchanged with this peer address, for L2TP and BGP alike. Subcommands`interface` `raw`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show capture interface`	Read-only	Capture live packets on an interface (like tcpdump). `show capture interface [iface <iface>] [count <count>] [duration <duration>] [snap-len <snap-len>] [format <pcap\|text>] [protocol <protocol>]` Arguments`iface` string, required: no, any value of this type: Interface name. The interface name as the configuration spells it. Ze resolves it to the kernel device before it opens the socket. One capture at a time runs per interface, and a second call on the same name is refused. `count` uint, required: no, any value of this type: Packet count. The capture ends when this many packets have been read or when the duration has elapsed, whichever comes first. The default is 100. `duration` string, required: no, any value of this type: Capture duration. The time the socket stays open, from 1s to 60s. The default is 10s. The capture ends earlier when the packet count is reached. `snap-len` uint, required: no, any value of this type: Snap length in bytes. The number of bytes kept from the start of each packet. The default is 65535, which keeps whole packets. The value is written into the pcap file header. `format` enum, required: no, one of `pcap` `text`: Output format. The default is pcap. Both forms carry a packets count with the data. `protocol` string, required: no, any value of this type: Protocol filter. A pcap-filter word such as tcp or udp. Ze joins it to every other word after the interface name and compiles the whole expression to a BPF program on the socket.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show capture raw`	Read-only	Control raw byte capture for protocol debugging. `show capture raw [action <start\|stop\|dump>] [protocol <l2tp\|bgp>] [format <pcap\|json>] [count <count>]` Arguments`action` enum, required: no, one of `start` `stop` `dump`: Capture action. The verb the command performs. It is required, and a call without one is refused with the usage line. `protocol` enum, required: no, one of `l2tp` `bgp`: Protocol to capture. Narrows the action to one protocol. Absent, the action applies to every protocol with a raw capture, and the answer carries one key for each. `format` enum, required: no, one of `pcap` `json`: Output format. Read by dump alone. The default is json. With pcap the answer carries a <protocol>-pcap key holding the base64 file and a <protocol>-packets count. `count` uint, required: no, any value of this type: Maximum number of messages. Read by dump alone. At most this many messages are returned for each protocol. Absent or 0, every captured message is returned.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show class-of-service`	Read-only	Show each class-of-service profile with its ingress and egress marking maps. `show class-of-service`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show command complete`	Read-only	Get tab-completion candidates for a partial command. `show command complete`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show command help`	Read-only	Show usage and arguments for a specific command. `show command help`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show command list`	Read-only	List every command the daemon knows about. `show command list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show crashes`	Read-only	View saved crash reports, and whether kernel capture is armed. `show crashes [name <name>]` Arguments`name` string, required: no, any value of this type: Crash report name (used with 'name <filename>'). The file name of one stored report, as the listing prints it. Ze reads that file from the crash directory and prints it. A name holding a slash or '..' is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show data cat`	Read-only	Print the value of a storage key. `show data cat <key>` Arguments`key` string, required: yes, any value of this type: Storage key to print The key of one entry, as show data list prints it. The bytes stored under it are written out unchanged, and a key the store does not hold is an error.	None
`show data list`	Read-only	List the keys in the selected store. `show data list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`key` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show data registered`	Read-only	List the key patterns registered by all subsystems. `show data registered`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`pattern, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show debug`	Read-only	Show live debug state from the running daemon. `show debug`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show debug profile`	Offline	Show stored debug profiles, one by name, or one filtered to a module subtree.	None
`show doctor`	Read-only	Check if this box is ready to run Ze. `show doctor`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ecmp-groups`	Read-only	Show each prefix the system RIB holds equal-cost paths for, whether or not Ze programs them. `show ecmp-groups`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show env get`	Read-only	Show one environment variable in detail. `show env get <name>` Arguments`name` string, required: yes, any value of this type: Environment variable name The variable's full name as Ze registered it, matched exactly. A name Ze never declared is refused, even when the process inherited it.	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`key, type, default, current, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show env list`	Read-only	List all Ze environment variables with their current values. `show env list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`key, type, default, current, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show env registered`	Read-only	List every registered environment variable with metadata. `show env registered`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`key, type, default, current, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show errors`	Read-only	Show recent errors across all subsystems, newest first. `show errors`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show fib kernel`	Read-only	Show the routes this backend programmed into the Linux forwarding table. `show fib kernel`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show fib p4`	Read-only	Show the routes this backend programmed into the P4 forwarding pipeline. `show fib p4`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show fib vpp`	Read-only	Show the routes this backend programmed into the VPP forwarding table. `show fib vpp`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show flow export`	Read-only	Show flow export (NetFlow/IPFIX) collector status. `show flow export [name <name>]` Arguments`name` string, required: no, any value of this type: Collector name (used with 'name <name>'). The value is the key of a configured collector. Ze returns that one collector with its protocol counters and errors, and answers 'collector not found' for any other value.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show flow recent`	Read-only	Show recent conntrack flow records from the bounded recent-flow ring. `show flow recent [dst <dst>]` Arguments`dst` string, required: no, any value of this type: Destination prefix or address to filter by (used with 'dst <prefix>'). The value is an IPv4 or IPv6 prefix in CIDR form, or a bare address, which Ze reads as a /32 or a /128. Ze keeps only the ring records whose destination is inside that prefix.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show geodns`	Read-only	Show the GeoDNS server status. `show geodns`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show gnmi`	Read-only	Show whether the gNMI server is running and how it is configured. `show gnmi`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show health`	Read-only	Show the health of every component and the overall status of this box. `show health`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ldp binding`	Read-only	Show LDP FEC-to-label bindings. `show ldp binding`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ldp neighbor`	Read-only	Show LDP neighbors and their session state. `show ldp neighbor`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show log levels`	Read-only	Show what log level each subsystem is using. `show log levels`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show log recent`	Read-only	Show recent log entries from the in-memory ring. `show log recent [level <disabled\|debug\|info\|warn\|err>] [component <component>] [count <count>]` Arguments`level` enum, required: no, one of `disabled` `debug` `info` `warn` `err`: Filter by log level Keeps the entries whose level equals this value, and no other level. Without it every level is shown. `component` string, required: no, any value of this type: Filter by component name Keeps the entries whose component name equals this value exactly. Without it every component is shown. `count` uint, required: no, any value of this type: Maximum number of entries Stops the answer after this many entries, newest first. It MUST be 1 or more, and without it every buffered entry is shown.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show mpls forwarding`	Read-only	Show MPLS forwarding entries installed in the kernel. `show mpls forwarding [limit <limit>]` Arguments`limit` uint, required: no, any value of this type: Maximum number of entries. The value is a positive integer. Ze returns at most that many entries and sets truncated to true when the kernel holds more. Absent, the value is 100000.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show mtu`	Read-only	Measure the path MTU and size the IPsec tunnels from it. `show mtu [host <host>] [search <exhaustive>] [view <detail>]` Arguments`host` union, required: no, any value of this type: Measure one address instead of the IPsec peers. The value follows the host keyword and is one IPv4 or IPv6 address. Ze measures the path MTU to that address alone and skips the peers and the reference address. A name is refused: the run sends probes to the address as typed. `search` enum, required: no, one of `exhaustive`: exhaustive: a slower run that probes every size and discards the cached and reported path MTU. The bare word exhaustive makes the run slower and its figure comes from probing every size on the wire: the path MTU the kernel remembered and the value a router reported are both discarded, so a stale or poisoned cache value cannot reach the answer. `view` enum, required: no, one of `detail`: detail: report every probe sent and every reply received. The bare word detail adds, per target, the size of every probe sent and the answer each one received, so an operator can follow how the value was found.	9 operators · answer: doc Answer shape`doc` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`show neighbor`	Read-only	Show the ARP and neighbor discovery table. `show neighbor [family <ipv4\|ipv6\|any\|all>]` Arguments`family` enum, required: no, one of `ipv4` `ipv6` `any` `all`: Address family filter Selects the address family the answer carries. The default when it is absent is both families.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show nexthop-table`	Read-only	Show each next hop the resolver tracks and the direct next hop it resolves to. `show nexthop-table`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show ping`	Read-only	Ping a target from the router itself. `show ping [dest <dest>] [count <count>] [size <size>] [timeout <timeout>] [do-not-fragment <honor-cache\|bypass-cache>]` Arguments`dest` string, required: no, any value of this type: Target host or IP address. The value is the first bare word of the command. A host name is resolved in either address family, and the family of the answer selects ICMPv4 or ICMPv6. `count` uint, required: no, any value of this type: Number of ping packets. The value is the number of echo requests Ze sends, 1 to 100, paced 10 milliseconds apart. Absent, the value is 5. `size` uint, required: no, any value of this type: ICMP echo payload size in bytes (1-65507). Omit for the engine default. Ze fills the payload to exactly this many bytes, with its marker copied into the front so a capture still identifies the sender. `timeout` string, required: no, any value of this type: Timeout duration. The value is the time Ze waits for each reply, in Go duration syntax, 1s to 30s. Absent, the value is 5s. `do-not-fragment` enum, required: no, one of `honor-cache` `bypass-cache`: Set the Don't Fragment bit; honor-cache obeys the cached path MTU, bypass-cache ignores it. The keyword takes one of two values. honor-cache sets the Don't Fragment bit and honors the kernel's cached path MTU: a probe larger than the cached value is refused at send time, and a router's Fragmentation Needed answer updates the cache. bypass-cache sets the bit and ignores the cached value, so the probe is put on the wire at its full size. Absent, the kernel fragments a probe larger than the path, which is the behavior of before the keyword existed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show plugin declarations`	Read-only	Show what each plugin declares about its command surface. `show plugin declarations` Subcommands`config`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, kind, state, commands, pipes, reason` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show plugin declarations config`	Read-only	Read the plugin blocks of a config file as well. `show plugin declarations config <path>` Arguments`path` string, required: yes, any value of this type: Path of the config file whose plugin blocks are read One filesystem path, or - for a config arriving on stdin. A path that names no readable file is refused before the read, and a second path after it is refused.	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, kind, state, commands, pipes, reason` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show plugin list`	Read-only	List the plugins compiled into this binary. `show plugin list`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, description, outcome, families, rfcs, capabilities, reason` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show probe-round`	Read-only	Run a parallel traceroute probe round to a target. `show probe-round [dest <dest>] [probes <probes>] [max-hops <max-hops>] [timeout <timeout>]` Arguments`dest` string, required: no, any value of this type: Target host or IP address. The value is the first bare word of the command. A host name is resolved in either address family, and the family of the answer selects ICMPv4 or ICMPv6. `probes` uint, required: no, any value of this type: Number of probes per hop. The value is accepted in the range 1 to 10 and then not read: a probe round sends one probe at each time-to-live. `max-hops` uint, required: no, any value of this type: Maximum number of hops. The value is the largest time-to-live Ze probes, 1 to 64. Absent, or set to 30, the round probes 16 hops. `timeout` string, required: no, any value of this type: Timeout duration. The value is accepted in Go duration syntax, 1s to 30s, and then not read: a probe round waits one second for every answer.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show reload-status`	Read-only	Show how many config reloads the daemon has processed. `show reload-status`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show resolve rir`	Read-only	Show which Regional Internet Registry holds an AS number. `show resolve rir <asn>` Arguments`asn` union, required: yes, any value of this type: AS number to look up. The AS number in plain decimal or in asdot notation, which Ze parses to one 32-bit value before it searches the delegation table.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rib`	Read-only	Show each route the system RIB holds, with its family, next hop, protocol and equal-cost paths. `show rib`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show route`	Read-only	Show the kernel routing table. `show route [prefix <prefix>] [limit <limit>]` Arguments`prefix` string, required: no, any value of this type: CIDR prefix filter A prefix in CIDR form, or the word default. Only routes for that prefix are listed, and every route is listed when it is absent. `limit` uint, required: no, any value of this type: Maximum number of routes The largest number of routes the answer carries, given after the word limit. The default is 100000, and the answer says when it was truncated. Subcommands`lookup`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show route lookup`	Read-only	Look up which route the kernel would use for a given IP. `show route lookup <ip>` Arguments`ip` string, required: yes, any value of this type: Destination IP address to look up One IPv4 or IPv6 address without a prefix length. The kernel answers with the route it selects for a packet to that address.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rr peers`	Read-only	Show route reflector client peers. `show rr peers`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show rr status`	Read-only	Show whether the route reflector is active. `show rr status`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show runtime memory`	Read-only	Show the Go runtime allocator memory stats. `show runtime memory`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show static`	Read-only	Show static routes defined in the configuration. `show static`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show status`	Read-only	Show process status, uptime, and resource usage. `show status`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show storage smart`	Read-only	Show disk health via SMART data. `show storage smart`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show subscriber`	Read-only	Show a summary of all subscriber sessions. `show subscriber` Subcommands`id`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show subscriber id detail`	Read-only	Show everything about one subscriber session. `show subscriber id <id> detail` Arguments`id` string, required: yes, any value of this type: Subscriber session ID. The id column of the show subscriber table. An L2TP session is named l2tp-<tunnel-id>-<session-id> and a PPPoE session pppoe-<ifindex>-<session-id>. An unknown id is refused with 'session not found'.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show tcp-check`	Read-only	Test TCP connectivity to a remote host and port. `show tcp-check <host> <port> [source <source>] [timeout <timeout>]` Arguments`host` string, required: yes, any value of this type: Target host. An IP address or a DNS name of at most 253 characters, which the dialer resolves. The answer echoes it in the host key. `port` uint, required: yes, any value of this type: Target port. The TCP port to connect to, from 1 to 65535. Ze joins it to the host and dials that one endpoint. `source` string, required: no, any value of this type: Source IP address. A local IP address the connection binds to before it dials. An address the host does not hold makes the dial fail. Absent, the kernel picks the source. `timeout` string, required: no, any value of this type: Connection timeout. How long the dial waits before it reports timeout, from 1s to 30s. The default is 5s.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show traceroute`	Read-only	Trace the network path from this router to a target. `show traceroute [dest <dest>] [max-hops <max-hops>] [timeout <timeout>] [probes <probes>] [do-not-fragment <honor-cache\|bypass-cache>]` Arguments`dest` string, required: no, any value of this type: Target host or IP address. The value is the first bare word of the command. A host name is resolved in either address family, and the family of the answer selects ICMPv4 or ICMPv6. `max-hops` uint, required: no, any value of this type: Maximum number of hops. The value is the largest time-to-live Ze probes, 1 to 64. The trace stops early when the target answers. Absent, the value is 30. `timeout` string, required: no, any value of this type: Timeout duration. The value is the time Ze waits for one probe, in Go duration syntax, 1s to 30s. Absent, the value is 3s. `probes` uint, required: no, any value of this type: Number of probes per hop. The value is the number of probes Ze sends at each time-to-live, 1 to 10, and each probe reports its own round-trip time. Absent, the value is 3. `do-not-fragment` enum, required: no, one of `honor-cache` `bypass-cache`: Set the Don't Fragment bit; honor-cache obeys the cached path MTU, bypass-cache ignores it. The keyword takes one of two values. honor-cache sets the Don't Fragment bit and honors the kernel's cached path MTU: a probe larger than the cached value is refused at send time, and a router's Fragmentation Needed answer updates the cache. bypass-cache sets the bit and ignores the cached value, so the probe is put on the wire at its full size. Absent, the kernel fragments a probe larger than the path, which is the behavior of before the keyword existed.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show uptime`	Read-only	Show how long the daemon has been running. `show uptime`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show version`	Read-only	Show the running Ze version and build date. `show version`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show warnings`	Read-only	Show active warnings across all subsystems. `show warnings`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show yang completion`	Read-only	Show YANG paths available for tab completion. `show yang completion`	15 operators · answer: tab Answer shape`tab` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`
`show yang doc`	Read-only	Generate command reference docs from YANG schemas. `show yang doc`	None
`show yang tree`	Read-only	Print the YANG tree for a module in a readable hierarchy. `show yang tree`	15 operators · answer: tab · 1 column order Answer shape`tab` Column order`name, kind, source, description` Always`json · ndjson · table · text · yaml · raw · no-more · save · match · count · first · last · display · fill` While streaming`log` Local process only`save`

skills 1

Command	Mode	Description	Pipes
`skills`	Offline	List the agent skills this binary carries, or fetch one by name.	None

support 1

Command	Mode	Description	Pipes
`support`	Offline	Collect logs, config, state and diagnostics into one archive.	None

system 8

Command	Mode	Description	Pipes
`system command complete`	Read-only	List the completion candidates for a partial command. `system command complete <partial>` Arguments`partial` string, required: yes, any value of this type: Partial command text The text typed so far. The candidates match it on a case-insensitive prefix, and a prefix that matches nothing answers an empty list.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system command help`	Read-only	Show the detailed help for one command. `system command help <name>` Arguments`name` string, required: yes, any value of this type: Command name The full command name, as command list prints it. A name in neither registry fails with unknown command.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system command list`	Read-only	List every command the daemon knows. `system command list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system dispatch`	Read-only	Dispatch a text command through the command dispatcher. `system dispatch`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system help`	Read-only	List the subcommands the system verb accepts. `system help`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system subsystem list`	Read-only	List the subsystems registered in the daemon. `system subsystem list`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system version api`	Read-only	Show the IPC protocol version. `system version api`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`system version software`	Read-only	Show the ze software version. `system version software`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

update 16

Command	Mode	Description	Pipes
`update bgp config`	Daemon	Write the running peer set to the configuration file. `update bgp config`	9 operators · answer: doc · 1 column order Answer shape`doc` Column order`added, removed, config, message` Always`json · ndjson · table · text · yaml · raw · no-more · save` While streaming`log` Local process only`save`
`update bgp irr all`	Daemon	Refresh all IRR prefix-lists immediately. `update bgp irr all`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update bgp irr as-set`	Daemon	Refresh IRR prefix-list for a specific AS-SET. `update bgp irr as-set <as-set>` Arguments`as-set` string, required: yes, any value of this type: AS-SET name. The AS-SET name as the peer configuration spells it, compared as an exact string. Every enrolled ASN that resolves through this AS-SET is refreshed, and a name no enrolled ASN uses is refused.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update bgp irr asn`	Daemon	Refresh IRR prefix-list for a specific ASN. `update bgp irr asn <asn>` Arguments`asn` string, required: yes, any value of this type: ASN number. The AS number as a plain decimal from 0 to 4294967295. An ASN with no IRR-filtered peer is refused, and a refresh the IRR server fails is reported with the server's error.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update bgp peer prefix`	Daemon	Refresh max-prefix limits from PeeringDB. `update bgp peer <selector> prefix` Arguments`selector` string, required: yes, any value of this type: Peer selector The value is an IP address, a peer name, an AS pattern such as as65001, a glob, or * for every peer. 'prefix' refreshes the maximums of each peer it matches.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update firewall domain-group`	Daemon	Resolve a domain group's DNS names now and program its set. `update firewall domain-group <name>` Arguments`name` string, required: yes, any value of this type: Domain group name A group from the firewall configuration. Every name in that group is resolved, and a name no group carries is an error that lists the groups present.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update firewall irr all`	Daemon	Refresh all cached IRR prefix-lists. `update firewall irr all`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update firewall irr as-set`	Daemon	Fetch or refresh IRR prefix-list for an AS-SET. `update firewall irr as-set <as-set>` Arguments`as-set` string, required: yes, any value of this type: AS-SET name The RPSL set name, for example AS-EXAMPLE or RIPE::AS-EXAMPLE. Letters, digits, hyphen, underscore, colon and period are accepted, and the name is the cache key.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update firewall irr asn`	Daemon	Fetch or refresh IRR prefix-list for an ASN. `update firewall irr asn <asn>` Arguments`asn` string, required: yes, any value of this type: ASN number The AS number, 1 to 4294967294, in plain or dotted form. The cache key is the decimal spelling with an AS prefix, so 1.10 and 65546 name one entry.	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update resolve rir`	Daemon	Refresh the RIR delegation table from the five registry delegation files. `update resolve rir`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update serve`	Offline	Serve this binary and its version manifest for update checks.	None
`update system firmware apply`	Daemon	Full upgrade: download, verify, stage, and restart. `update system firmware apply`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update system firmware check`	Daemon	Check for a new firmware version right now. `update system firmware check`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update system firmware download`	Daemon	Download the latest firmware image right now. `update system firmware download`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update system firmware restart`	Daemon	Reboot into the already-staged firmware. `update system firmware restart`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`
`update system firmware rollback`	Daemon	Roll back to the previous firmware and restart. `update system firmware rollback`	15 operators Always`json · ndjson · table · text · yaml · raw · no-more · save` With rows`match · count · first · last · display · fill` While streaming`log` Local process only`save`

validate 1

Command	Mode	Description	Pipes
`validate config`	Offline	Check a config for errors without applying it.	None