comparison

Pre-Alpha. This page describes behavior that may change.

This page summarises how Ze lines up against the other open-source BGP daemons. The full feature matrix (over 100 rows across address families, protocol features, policy, security, monitoring, API, operations, and best-path selection) is in the in-tree comparison.md. The maintainer keeps it up to date and the rendered HTML version is built from the same markdown source. What follows is the wiki view: short, opinionated, and pointed at the questions an operator asks before picking a daemon.

The in-tree page carries this disclaimer and so does this one: every project listed below is under active development. Verify against the project's own documentation before making decisions. The numbers and "Yes / No / Partial" cells are accurate as of the date the in-tree page was last updated, not as of the day you are reading this.

The cast

Project	Language	License	Primary interface	First release
Ze	Go	AGPL-3.0	CLI (ze) over SSH	2026
BIRD 3	C	GPL-2.0+	CLI (birdc)	2024 (multithreaded)
BIRD 2	C	GPL-2.0+	CLI (birdc)	1998
FRR	C	GPL-2.0	CLI (vtysh)	2017
GoBGP	Go	Apache-2.0	gRPC	2014
OpenBGPd	C	ISC	CLI (bgpctl)	2004
ExaBGP	Python	BSD-3-Clause	CLI + API	2010
bio-rd	Go	Apache-2.0	gRPC	2018
rustbgpd	Rust	MIT	gRPC	2026
RustyBGP	Rust	Apache-2.0	gRPC	2019
freeRtr	Java	Free	CLI (telnet/SSH)	2012

Maturity, in plain English: BIRD 2/3, FRR, GoBGP, ExaBGP, OpenBGPd, and freeRtr are production. bio-rd and rustbgpd target IXPs and SDN controllers and are niche or pre-release. RustyBGP is experimental. Ze is pre-release.

Where Ze fits

Ze targets the same niche as ExaBGP: programmable BGP. It exists to be the daemon you reach for when you need external processes to react to BGP events, when you need to inject routes from a script, when you need a plugin SDK, or when you want BGP to be one event source on a bus that other things can subscribe to.

The architectural lever Ze pulls that no other daemon in the table pulls is the plugin model. Ze is a generic event bus and supervisor with BGP implemented as plugins on top. The plugin SDK is exposed both for in-tree Go plugins and for external processes in any language. The address-family list, the storage backends, the policy filters, RPKI, and the FIB integration are all plugins, which means they can be added, swapped, or replaced without modifying the engine.

The other lever is the YANG-modeled config. Every CLI prompt, every web UI form, every validation message, and every MCP tool is generated from the same YANG schemas. The atomic commit workflow (edit, diff, commit, rollback, commit confirmed with auto-rollback) is the kind of operator surface a JunOS user expects. No other open-source daemon ships that workflow.

What Ze has that the others do not

A short list, all from the in-tree comparison.

• Plugin SDK. No other open-source BGP daemon in the table has one.
• YANG-modeled config end to end. Plugins extend the YANG tree with their own schemas. FRR has partial YANG. The rest have none.
• Atomic commit workflow. Edit, diff, commit, rollback, commit confirmed.
• Five operator surfaces over one config tree. SSH CLI, web UI, Looking Glass, MCP, and REST + gRPC (both share one API engine).
• Interactive TUI launcher. Running ze with no arguments opens a hierarchical, filterable command menu; a single 7-role semantic color system (structure, identity, value, caution, danger, muted, context) spans the CLI, help, editor, dashboard, and monitors.
• Schema discovery from the CLI. ze help --ai makes all features of the CLI available via command line for AI.
• Built-in SSH server over TLS. Only the configuration is stored on disk; credentials live in blob storage.
• Built-in PeeringDB integration for prefix limits.
• Built-in Team Cymru ASN-name decoration in the CLI, web UI, and Looking Glass.
• Chaos testing framework as a first-class citizen with deterministic replay.
• MCP server for AI assistants. The structured-tools surface for ze_announce, ze_withdraw, ze_peers, and the auto-generated tools from the command registry.
• ze config migrate from ExaBGP with a bridge plugin for unconverted scripts.
• Update groups, automatic. Cross-peer UPDATE building and deduplication without explicit peer-group assignment.
• BFD with authentication and echo mode (RFC 5880/5881/5882/5883). Sub-second failure detection with BGP peer opt-in, keyed SHA1/MD5 auth, Prometheus metrics.
• BMP receiver and sender (RFC 7854, RFC 8671, RFC 9069). Accepts feeds from routers and streams to collectors, with Adj-RIB-Out and Loc-RIB (Peer Type 3) monitoring.
• Native IKEv2 in Go. No external IKE daemon. Initiator and responder roles, full IKE_SA_INIT/AUTH/CREATE_CHILD_SA with real make-before-break rekeying, EAP-MSCHAPv2, EAP-TLS, NAT-T, DPD, MOBIKE, XFRM dataplane. strongSwan interop.
• Self-update with fleet rollout. SHA-256 verified download, atomic binary replacement, spread scheduling, maintenance windows, server-side pause, rollback.
• System readiness checks. ze doctor offline pre-start checks with stable diagnostic codes and ze explain remediation. Runtime health registry.
• 11 built-in diagnostic commands replacing ss, dmesg, lsof, dig, nc, traceroute, mtr, ping, tcpdump, pprof on gokrazy appliances. No external Linux tools needed.
• Zero-touch provisioning. ze install remote PXE-boots target machines with DHCP, TFTP, and HTTP image server, plus a pure-Go installer initrd (a single PID-1 binary, no busybox shell) and a first-boot bootstrap mode.
• gNMI server. Industry-standard gRPC Network Management Interface (Capabilities, Get, Set, Subscribe ONCE and STREAM) over the same YANG config tree.
• Flow export. sFlow v5, NetFlow v9 (RFC 3954), and IPFIX (RFC 7011) with tc/psample sampling, conntrack per-flow records, and BGP next-hop enrichment.
• MPLS with LDP and RSVP-TE. Kernel MPLS FIB for BGP labeled unicast, LDP (RFC 5036), and RSVP-TE (RFC 3209/2205) with bandwidth admission, make-before-break, and RFC 4090 facility-backup fast reroute. SRv6 Prefix-SID (RFC 9252, RFC 8669) for VPN and EVPN.
• Native OSPFv2 / OSPFv3 and IS-IS IGPs. One OSPF engine for IPv4 (RFC 2328) and IPv6 (RFC 5340) with areas, ABR, stub and NSSA (RFC 3101), bidirectional BGP redistribution, and a full extension family (Segment Routing, TE, TI-LFA and LFA fast reroute, graceful restart, BFD, LDP-IGP sync, virtual links, NBMA and point-to-multipoint, multi-instance, OSPFv3 multi-AF, and OSPFv3 IPsec); native IS-IS (ISO/IEC 10589, RFC 1195) with L1/L2 levels, wide metrics, dual-stack IPv6 (RFC 5308), and HMAC-SHA authentication. No external IGP daemon.
• VRRP first-hop redundancy (RFC 9568 / 3768). A shared gateway address that survives router loss, IPv4 and IPv6, with a per-group virtual-MAC macvlan so failover is transparent at L2. VRRPv2 opt-in for legacy peers. keepalived interop. No other daemon in the table ships a first-hop redundancy protocol.
• FlowSpec-to-firewall bridge. BGP FlowSpec rules converted to nftables entries.
• RPKI ASPA path verification with policy enforcement. reject/log-only/accept actions.
• L2TP/PPP BNG subsystem. Native L2TPv2 (RFC 2661) in both LNS (answering) and LAC (initiator) roles, with PPP negotiation (LCP, CHAP/PAP/MS-CHAPv2, IPCP/IPv6CP), kernel data plane, PPPoE-to-L2TP relay, and subscriber route redistribution. xl2tpd interop.
• VPP data plane integration. Process lifecycle, DPDK NIC binding, FIB programming via GoVPP, interface management, stats telemetry, GRE/GRETAP/IPIP/VXLAN tunnels, SPAN mirroring, WireGuard, Linux Control Plane pairs, and DSCP policing.
• Firewall and traffic control. nftables and VPP backends with commit-time capability checks. Global-options sysctl, masquerade port mapping.
• TACACS+ AAA (RFC 8907). SSH authentication with priv-lvl mapping, accounting, local bcrypt fallback.
• Built-in route filters. AS-path regex, community match, prefix filter, route attribute modifier, all as plugins.
• MRT recording and analysis (RFC 6396). Daemon-side recording with three streams (updates, all, periodic RIB), plus a standalone analysis tool with inject, replay, serve, filter, convert, and export commands.
• Mutation testing. gomu integration for multi-package mutation testing as a verification gate.
• Docker support. Static binary on scratch base (~89 MB). Compose included.
• IRR-based prefix filtering. Built-in IRR AS-SET expansion with periodic refresh, PeeringDB AS-SET discovery, and per-prefix modify actions. CLI commands for inspection and manual refresh.
• PATHS-LIMIT capability. Per-family path count limit for ADD-PATH (draft-abraitis-idr-addpath-paths-limit). Sender enforcement, RS fast-path suppression.
• Class of Service. 802.1p VLAN QoS maps with named profiles, dynamic per-subscriber CoS via RADIUS (Filter-Id, Cisco/Juniper/Nokia/Huawei VSAs), VPP qos-record/mark integration.
• SR-Policy NLRI. SAFI 73 with Tunnel Encapsulation attribute.
• Automatic DDoS detection and mitigation. Volumetric detection from live traffic stats (packet-rate and bandwidth baselines), attack characterization, and direction-aware mitigation via local firewall drops or upstream FlowSpec, governed by an allow/deny policy.
• Behavioral anomaly detection. A report-only per-source pattern-of-life detector plus a shadow-first responder with surgical, auto-reverting firewall rate-limits.
• Control-plane protection. GTSM / TTL-security (RFC 5082) enforced on the socket and CoPP policing of control-plane traffic including TCP/179.
• AS112 anycast DNS and GeoDNS. An RFC 7534/7535 reverse-DNS sink with watchdog-gated BGP origination, plus an authoritative per-source-IP GeoDNS server, both with optional DoT (RFC 7858) and DoH (RFC 8484). DNSSEC stub validation in the resolver.
• RADIUS operator authentication. RFC 2865 PAP admin auth in the AAA chain (SSH, web, MCP), alongside TACACS+.
• Web RBAC. Read-only operator sessions gated from config edits, with web login through the AAA chain.
• Build-time feature gates. Subsystems (gNMI, MCP, REST/gRPC, telemetry, ISIS/LDP/OSPF/RSVP-TE, VRRP) compile out via build tags for smaller images and less attack surface.

What Ze does not have

A short list, equally honest.

• No FIB integration in the engine. fib-kernel is a plugin and the FIB story is not on par with FRR or BIRD. If you need to program the kernel FIB at scale, FRR is the answer.
• No full confederation (RFC 5065). AS path segment parsing exists, but full confederation deployment behavior is not supported. The IETF draft draft-ietf-idr-deprecate-as-set-confed-set deprecates the AS_CONFED_SET segment type (not confederation itself).
• No production deployments. Pre-alpha, no releases.
• Best-path selection is missing AIGP. Multipath is configurable via bgp/multipath (maximum-paths, relax-as-path) and works for equal-cost paths.
• Memory and CPU overhead are estimated at 10 to 15 percent above C and Rust, based on code-path analysis rather than benchmarks at scale.

Quick "if you want X, use Y"

• A full routing stack with mature kernel-FIB programming at scale and a long production history: FRR. (Ze now ships native OSPF, IS-IS, and BFD, so the IGP gap has narrowed; FRR's remaining edge is production maturity and FIB scale.)
• An IXP route server at the largest scale, with a powerful filter language: BIRD 3.
• An API-first BGP daemon with the broadest AFI/SAFI coverage: GoBGP.
• A security-focused, lean, OpenBSD-heritage daemon: OpenBGPd.
• A pure route injector and event bus to build automation around, in production today: ExaBGP.
• A full router OS with its own dataplane, BGP, OSPF, IS-IS, RIP, EIGRP, LDP, RSVP-TE: freeRtr.

See also

• In-tree comparison for the full feature matrix.
• What is Ze for the five-minute introduction.
• Why Ze for the long-form "when to use it, when not to".

Adapted from main/docs/comparison.md.