comparison

Pre-Alpha. This page describes behavior that may change.

This page summarises how Ze lines up against the other open-source BGP daemons. The full feature matrix (over 100 rows across address families, protocol features, policy, security, monitoring, API, operations, and best-path selection) is in the in-tree comparison.md. The maintainer keeps it up to date and the rendered HTML version is built from the same markdown source. What follows is the wiki view: short, opinionated, and pointed at the questions an operator asks before picking a daemon.

The in-tree page carries this disclaimer and so does this one: every project listed below is under active development. Verify against the project's own documentation before making decisions. The numbers and "Yes / No / Partial" cells are accurate as of the date the in-tree page was last updated, not as of the day you are reading this.

The cast

Project	Language	License	Primary interface	First release
Ze	Go	AGPL-3.0	CLI (ze) over SSH	2026
BIRD 3	C	GPL-2.0+	CLI (birdc)	2024 (multithreaded)
BIRD 2	C	GPL-2.0+	CLI (birdc)	1998
FRR	C	GPL-2.0	CLI (vtysh)	2017
GoBGP	Go	Apache-2.0	gRPC	2014
OpenBGPd	C	ISC	CLI (bgpctl)	2004
ExaBGP	Python	BSD-3-Clause	CLI + API	2010
bio-rd	Go	Apache-2.0	gRPC	2018
rustbgpd	Rust	MIT	gRPC	2026
RustyBGP	Rust	Apache-2.0	gRPC	2019
freeRtr	Java	Free	CLI (telnet/SSH)	2012

Maturity, in plain English: BIRD 2/3, FRR, GoBGP, ExaBGP, OpenBGPd, and freeRtr are production. bio-rd and rustbgpd target IXPs and SDN controllers and are niche or pre-release. RustyBGP is experimental. Ze is pre-release.

Where Ze fits

Ze targets the same niche as ExaBGP: programmable BGP. It exists to be the daemon you reach for when you need external processes to react to BGP events, when you need to inject routes from a script, when you need a plugin SDK, or when you want BGP to be one event source on a bus that other things can subscribe to.

The architectural lever Ze pulls that no other daemon in the table pulls is the plugin model. Ze is a generic event bus and supervisor with BGP implemented as plugins on top. The plugin SDK is exposed both for in-tree Go plugins and for external processes in any language. The address-family list, the storage backends, the policy filters, RPKI, and the FIB integration are all plugins, which means they can be added, swapped, or replaced without modifying the engine.

The other lever is the YANG-modeled config. Every CLI prompt, every web UI form, every validation message, and every MCP tool is generated from the same YANG schemas. The atomic commit workflow (edit, diff, commit, rollback, commit confirmed with auto-rollback) is the kind of operator surface a JunOS user expects. No other open-source daemon ships that workflow.

What Ze has that the others do not

A short list, all from the in-tree comparison.

• Plugin SDK. No other open-source BGP daemon in the table has one.
• YANG-modeled config end to end. Plugins extend the YANG tree with their own schemas. FRR has partial YANG. The rest have none.
• Atomic commit workflow. Edit, diff, commit, rollback, commit confirmed.
• Five operator surfaces over one config tree. SSH CLI, web UI, Looking Glass, MCP, and REST + gRPC (both share one API engine).
• Schema discovery from the CLI. ze help --ai — all features of the CLI available via command line for AI.
• Built-in SSH server over TLS. Only the configuration is stored on disk; credentials live in blob storage.
• Built-in PeeringDB integration for prefix limits.
• Built-in Team Cymru ASN-name decoration in the CLI, web UI, and Looking Glass.
• Chaos testing framework as a first-class citizen with deterministic replay.
• MCP server for AI assistants. The structured-tools surface for ze_announce, ze_withdraw, ze_peers, and the auto-generated tools from the command registry.
• ze config migrate from ExaBGP with a bridge plugin for unconverted scripts.
• Update groups, automatic. Cross-peer UPDATE building and deduplication without explicit peer-group assignment.
• BFD with authentication and echo mode (RFC 5880/5881/5882/5883). Sub-second failure detection with BGP peer opt-in, keyed SHA1/MD5 auth, Prometheus metrics.
• BMP receiver and sender (RFC 7854, RFC 8671). Accepts feeds from routers and streams to collectors. Adj-RIB-Out support.
• Native IKEv2 in Go. No external IKE daemon. Full IKE_SA_INIT/AUTH/CREATE_CHILD_SA, EAP-MSCHAPv2, EAP-TLS, NAT-T, DPD, rekeying, MOBIKE, XFRM dataplane.
• Self-update with fleet rollout. SHA-256 verified download, atomic binary replacement, spread scheduling, maintenance windows, server-side pause, rollback.
• System readiness checks. ze doctor offline pre-start checks with stable diagnostic codes and ze explain remediation. Runtime health registry.
• 11 built-in diagnostic commands replacing ss, dmesg, lsof, dig, nc, traceroute, mtr, ping, tcpdump, pprof on gokrazy appliances. No external Linux tools needed.
• Zero-touch provisioning. ze install serve PXE-boots target machines with DHCP, TFTP, and HTTP image server.
• FlowSpec-to-firewall bridge. BGP FlowSpec rules converted to nftables entries.
• RPKI ASPA path verification with policy enforcement. reject/log-only/accept actions.
• L2TP/PPP BNG subsystem. Native L2TPv2 (RFC 2661) with PPP negotiation (LCP, CHAP/PAP/MS-CHAPv2, IPCP/IPv6CP), kernel data plane, subscriber route redistribution.
• VPP data plane integration. Process lifecycle, DPDK NIC binding, FIB programming via GoVPP, interface management, stats telemetry.
• Firewall and traffic control. nftables and VPP backends with commit-time capability checks. Global-options sysctl, masquerade port mapping.
• TACACS+ AAA (RFC 8907). SSH authentication with priv-lvl mapping, accounting, local bcrypt fallback.
• Built-in route filters. AS-path regex, community match, prefix filter, route attribute modifier, all as plugins.
• Docker support. Static binary on scratch base (~89 MB). Compose included.

What Ze does not have

A short list, equally honest.

• No FIB integration in the engine. fib-kernel is a plugin and the FIB story is not on par with FRR or BIRD. If you need to program the kernel FIB at scale, FRR is the answer.
• No MRT dump for writing (RFC 6396). Reading works via ze-analyse. Most other daemons can write MRT.
• No confederation (RFC 5065). Not implemented. The IETF draft draft-ietf-idr-deprecate-as-set-confed-set deprecates the AS_CONFED_SET segment type (not confederation itself).
• No production deployments. Pre-alpha, no releases.
• Best-path selection is missing AIGP. Multipath is configurable via bgp/multipath (maximum-paths, relax-as-path) and works for equal-cost paths.
• Memory and CPU overhead are estimated at 10 to 15 percent above C and Rust, based on code-path analysis rather than benchmarks at scale.

Quick "if you want X, use Y"

• A full routing stack with kernel FIB, OSPF, IS-IS, BFD, and a long production history: FRR.
• An IXP route server at the largest scale, with a powerful filter language: BIRD 3.
• An API-first BGP daemon with the broadest AFI/SAFI coverage: GoBGP.
• A security-focused, lean, OpenBSD-heritage daemon: OpenBGPd.
• A pure route injector and event bus to build automation around, in production today: ExaBGP.
• A full router OS with its own dataplane, BGP, OSPF, IS-IS, RIP, EIGRP, LDP, RSVP-TE: freeRtr.

See also

• In-tree comparison for the full feature matrix.
• What is Ze for the five-minute introduction.
• Why Ze for the long-form "when to use it, when not to".

Adapted from main/docs/comparison.md.