show traffic feature

Ze command

Registry path

show traffic feature

Usage

show traffic feature [name <name>]

Mode

Read-only

Wire method

ze-show:traffic-feature

Backends

any backend

Task support

optional: the MCP call is synchronous, which is the default

Subcommands

none: this command takes no subcommand

Pipes, always

json, ndjson, table, text, yaml, raw, no-more, save

Pipes, when the answer has rows

match, count, first, last, display, fill

Pipes, while streaming

log

Pipes, local process only

save

Description

The signals are fan-out (distinct destinations), out/in
byte ratio (exfiltration), destination-port entropy, new-peer, rare-port/proto,
and coarse beaconing.
Without arguments, shows the top source entities. With 'name <address>',
filters to one source.

Arguments