show vpn ipsec dataplane drift

Ze command

Registry path

show vpn ipsec dataplane drift

Usage

show vpn ipsec dataplane drift

Mode

Read-only

Wire method

ze-show:vpn-ipsec-dataplane-drift

Backends

any backend

Task support

optional: the MCP call is synchronous, which is the default

Subcommands

none: this command takes no subcommand

Pipes, always

json, ndjson, table, text, yaml, raw, no-more, save

Pipes, when the answer has rows

match, count, first, last, display, fill

Pipes, while streaming

log

Pipes, local process only

save

Description

Reports each Child SA the engine counts as
installed whose SPI the kernel SAD does not hold. The command exits non-zero
when it finds drift, so a script CAN test it. A rekey window holds two SPIs and
is not drift.

Arguments

No command-specific arguments listed.