comparison

Pre-Alpha. This page describes behavior that may change.

This page summarises how Ze lines up against the other open-source BGP daemons. The full feature matrix (over 100 rows across address families, protocol features, policy, security, monitoring, API, operations, and best-path selection) is in the in-tree comparison.md. The maintainer keeps it up to date and the rendered HTML version is built from the same markdown source. What follows is the wiki view: short, opinionated, and pointed at the questions an operator asks before picking a daemon.

The in-tree page carries this disclaimer and so does this one: every project listed below is under active development. Verify against the project's own documentation before making decisions. The numbers and "Yes / No / Partial" cells are accurate as of the date the in-tree page was last updated, not as of the day you are reading this.

The cast

Project	Language	License	Primary interface	First release
Ze	Go	AGPL-3.0	CLI (ze) over SSH	2026
BIRD 3	C	GPL-2.0+	CLI (birdc)	2024 (multithreaded)
BIRD 2	C	GPL-2.0+	CLI (birdc)	1998
FRR	C	GPL-2.0	CLI (vtysh)	2017
GoBGP	Go	Apache-2.0	gRPC	2014
OpenBGPd	C	ISC	CLI (bgpctl)	2004
ExaBGP	Python	BSD-3-Clause	CLI + API	2010
bio-rd	Go	Apache-2.0	gRPC	2018
rustbgpd	Rust	MIT	gRPC	2026
RustyBGP	Rust	Apache-2.0	gRPC	2019
freeRtr	Java	Free	CLI (telnet/SSH)	2012

Maturity, in plain English: BIRD 2/3, FRR, GoBGP, ExaBGP, OpenBGPd, and freeRtr are production. bio-rd and rustbgpd target IXPs and SDN controllers and are niche or pre-release. RustyBGP is experimental. Ze is pre-release.

Where Ze fits

Ze targets the same niche as ExaBGP: programmable BGP. It exists to be the daemon you reach for when you need external processes to react to BGP events, when you need to inject routes from a script, when you need a plugin SDK, or when you want BGP to be one event source on a bus that other things can subscribe to.

The architectural lever Ze pulls that no other daemon in the table pulls is the plugin model. Ze is a generic event bus and supervisor with BGP implemented as plugins on top. The plugin SDK is exposed both for in-tree Go plugins and for external processes in any language. The address-family list, the storage backends, the policy filters, RPKI, and the FIB integration are all plugins, which means they can be added, swapped, or replaced without modifying the engine.

The other lever is the YANG-modeled config. Every CLI prompt, every web UI form, every validation message, and every MCP tool is generated from the same YANG schemas. The atomic commit workflow (edit, diff, commit, rollback, commit confirmed with auto-rollback) is the kind of operator surface a JunOS user expects. No other open-source daemon ships that workflow.

What Ze has that the others do not

A short list, all from the in-tree comparison.

• Plugin SDK. No other open-source BGP daemon in the table has one.
• YANG-modeled config end to end. Plugins extend the YANG tree with their own schemas. FRR has partial YANG. The rest have none.
• Atomic commit workflow. Edit, diff, commit, rollback, commit confirmed.
• Five operator surfaces over one config tree. SSH CLI, web UI, Looking Glass, MCP, and REST + gRPC (both share one API engine).
• Schema discovery from the CLI. ze help --ai — all features of the CLI available via command line for AI.
• Built-in SSH server over TLS. Only the configuration is stored on disk; credentials live in blob storage.
• Built-in PeeringDB integration for prefix limits.
• Built-in Team Cymru ASN-name decoration in the CLI, web UI, and Looking Glass.
• Chaos testing framework as a first-class citizen with deterministic replay.
• MCP server for AI assistants. The structured-tools surface for ze_announce, ze_withdraw, ze_peers, and the auto-generated tools from the command registry.
• ze config migrate from ExaBGP with a bridge plugin for unconverted scripts.
• Update groups, automatic. Cross-peer UPDATE building and deduplication without explicit peer-group assignment.
• BFD with authentication and echo mode (RFC 5880/5881/5882/5883). Sub-second failure detection with BGP peer opt-in, keyed SHA1/MD5 auth, Prometheus metrics.
• BMP receiver and sender (RFC 7854, RFC 8671). Accepts feeds from routers and streams to collectors. Adj-RIB-Out support.
• Native IKEv2 in Go. No external IKE daemon. Full IKE_SA_INIT/AUTH/CREATE_CHILD_SA, EAP-MSCHAPv2, EAP-TLS, NAT-T, DPD, rekeying, MOBIKE, XFRM dataplane.
• Self-update with fleet rollout. SHA-256 verified download, atomic binary replacement, spread scheduling, maintenance windows, server-side pause, rollback.
• System readiness checks. ze doctor offline pre-start checks with stable diagnostic codes and ze explain remediation. Runtime health registry.
• 11 built-in diagnostic commands replacing ss, dmesg, lsof, dig, nc, traceroute, mtr, ping, tcpdump, pprof on gokrazy appliances. No external Linux tools needed.
• Zero-touch provisioning. ze install remote PXE-boots target machines with DHCP, TFTP, and HTTP image server, plus a busybox installer initrd and a first-boot bootstrap mode.
• gNMI server. Industry-standard gRPC Network Management Interface (Capabilities, Get, Set, Subscribe ONCE and STREAM) over the same YANG config tree.
• Flow export. sFlow v5, NetFlow v9 (RFC 3954), and IPFIX (RFC 7011) with tc/psample sampling, conntrack per-flow records, and BGP next-hop enrichment.
• MPLS with LDP and RSVP-TE. Kernel MPLS FIB for BGP labeled unicast, LDP (RFC 5036), and RSVP-TE (RFC 3209/2205) with bandwidth admission and make-before-break. SRv6 Prefix-SID (RFC 9252, RFC 8669) for VPN and EVPN.
• FlowSpec-to-firewall bridge. BGP FlowSpec rules converted to nftables entries.
• RPKI ASPA path verification with policy enforcement. reject/log-only/accept actions.
• L2TP/PPP BNG subsystem. Native L2TPv2 (RFC 2661) with PPP negotiation (LCP, CHAP/PAP/MS-CHAPv2, IPCP/IPv6CP), kernel data plane, subscriber route redistribution.
• VPP data plane integration. Process lifecycle, DPDK NIC binding, FIB programming via GoVPP, interface management, stats telemetry.
• Firewall and traffic control. nftables and VPP backends with commit-time capability checks. Global-options sysctl, masquerade port mapping.
• TACACS+ AAA (RFC 8907). SSH authentication with priv-lvl mapping, accounting, local bcrypt fallback.
• Built-in route filters. AS-path regex, community match, prefix filter, route attribute modifier, all as plugins.
• MRT recording and analysis (RFC 6396). Daemon-side recording with three streams (updates, all, periodic RIB), plus a standalone analysis tool with inject, replay, serve, filter, convert, and export commands.
• Mutation testing. gomu integration for multi-package mutation testing as a verification gate.
• Docker support. Static binary on scratch base (~89 MB). Compose included.
• IRR-based prefix filtering. Built-in IRR AS-SET expansion with periodic refresh, PeeringDB AS-SET discovery, and per-prefix modify actions. CLI commands for inspection and manual refresh.
• PATHS-LIMIT capability. Per-family path count limit for ADD-PATH (draft-abraitis-idr-addpath-paths-limit). Sender enforcement, RS fast-path suppression.
• Class of Service. 802.1p VLAN QoS maps with named profiles, dynamic per-subscriber CoS via RADIUS (Filter-Id, Cisco/Juniper/Nokia/Huawei VSAs), VPP qos-record/mark integration.
• SR-Policy NLRI. SAFI 73 with Tunnel Encapsulation attribute.

What Ze does not have

A short list, equally honest.

• No FIB integration in the engine. fib-kernel is a plugin and the FIB story is not on par with FRR or BIRD. If you need to program the kernel FIB at scale, FRR is the answer.
• No full confederation (RFC 5065). AS path segment parsing exists, but full confederation deployment behavior is not supported. The IETF draft draft-ietf-idr-deprecate-as-set-confed-set deprecates the AS_CONFED_SET segment type (not confederation itself).
• No production deployments. Pre-alpha, no releases.
• Best-path selection is missing AIGP. Multipath is configurable via bgp/multipath (maximum-paths, relax-as-path) and works for equal-cost paths.
• Memory and CPU overhead are estimated at 10 to 15 percent above C and Rust, based on code-path analysis rather than benchmarks at scale.

Quick "if you want X, use Y"

• A full routing stack with kernel FIB, OSPF, IS-IS, BFD, and a long production history: FRR.
• An IXP route server at the largest scale, with a powerful filter language: BIRD 3.
• An API-first BGP daemon with the broadest AFI/SAFI coverage: GoBGP.
• A security-focused, lean, OpenBSD-heritage daemon: OpenBGPd.
• A pure route injector and event bus to build automation around, in production today: ExaBGP.
• A full router OS with its own dataplane, BGP, OSPF, IS-IS, RIP, EIGRP, LDP, RSVP-TE: freeRtr.

See also

• In-tree comparison for the full feature matrix.
• What is Ze for the five-minute introduction.
• Why Ze for the long-form "when to use it, when not to".

Adapted from main/docs/comparison.md.