feature inventory

Pre-Alpha. This page describes behavior that may change.

The full inventory of what Ze does. Not the narrative ("why this exists") or the comparison ("how it stacks up"), just the list. Use this page when you need to check whether a specific feature is present and whether it is built into the engine or provided by a plugin.

The in-tree docs/features.md is the canonical source. When this page and that one disagree, the in-tree page wins.

BGP protocol

See BGP peers for the configuration surface and the comparison page for the per-feature breakdown against other daemons.

Area	Detail
Address families	21, covering IPv4/IPv6 unicast, multicast, labelled unicast, VPN, FlowSpec, EVPN, VPLS, BGP-LS, MVPN, RTC, and MUP. IPv4/IPv6 unicast and multicast are built into the engine; everything else ships as an nlri plugin.
Capabilities	Multiprotocol, 4-byte ASN, Route Refresh, Enhanced Route Refresh, ADD-PATH, Extended Messages, Extended Next Hop, Graceful Restart, Long-Lived GR, BGP Role, Hostname, Software Version, Link-Local Next Hop.
Path attributes	ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, AGGREGATOR, COMMUNITY, ORIGINATOR_ID, CLUSTER_LIST, MP_REACH_NLRI, MP_UNREACH_NLRI, EXTENDED_COMMUNITY, LARGE_COMMUNITY, PREFIX_SID.
Route loop detection	AS loop (RFC 4271 section 9), ORIGINATOR_ID (RFC 4456), CLUSTER_LIST (RFC 4456). All three run before prefix-limit counting and silently treat the route as withdrawn.

Configuration

Feature	Detail
YANG-modelled	Every field, every CLI prompt, every web UI form comes from the same YANG schemas.
Atomic commit	Edit, diff, commit, rollback, commit confirmed with auto-rollback.
Per-user drafts	Each user gets an independent editor session; drafts survive disconnection.
Hot reload	No daemon restart required for config changes. Session resets only when the underlying change demands it.
Prefix limits (RFC 4486)	Mandatory per-family per-peer maximum. Refuses to start without one.
Update groups	Automatic cross-peer UPDATE building deduplication, based on encoding context.
Session resilience	TCP_NODELAY, DSCP CS6, graceful close, Send Hold Timer (RFC 9687), congestion extension for hold timer, bounded overflow pool with GR-aware teardown.

Interface management

iface plugin. Netlink on Linux, stdlib fallback elsewhere.

Interface type	MAC required	Notes
ethernet	Yes	Physical ethernet interface.
veth	Yes	Virtual ethernet pair.
bridge	Yes	Bridge interface.
dummy	No	Virtual dummy interface.
loopback	No	Container, no key.

Static addressing, DHCP client (with route/DNS/NTP discovery), interface monitoring, make-before-break migration with ze interface migrate, route-priority for configurable DHCP route metric, and IPv6 default route management from Router Advertisements.

Additional interface types added since the initial release:

Interface type	Notes
tunnel (gre, gretap, ipip, sit, ip6gre, ip6gretap, ip6tnl)	Full tunnel family support via netlink.
wireguard	WireGuard encrypted tunnels with peer reconciliation on reload.

VPP interface backend is also available (interface { backend vpp; }) for GoVPP-backed lifecycle, addressing, bridge, and monitoring.

Operator surfaces

Surface	Transport	Auth
CLI	SSH, port 2222 by default.	User database with bcrypt passwords, ED25519 host key.
Web UI	HTTPS, port 3443 by default.	Same user database. Session cookies for browsers, Basic Auth for API clients.
Looking Glass	HTTP or HTTPS on its own configurable port (separate from the web UI).	None. Read-only by design.
MCP	HTTP on 127.0.0.1, port must be specified.	Optional bearer token.
REST API	Dedicated HTTP(S) server on port 8081 by default, /api/v1/execute, /api/v1/commands, typed config sessions, Swagger UI.	Bearer per-user or single token.
gRPC API	Dedicated server on port 50051 by default, ze.api.v1.ZeService + ze.api.v1.ZeConfigService, server reflection, built-in TLS.	Bearer metadata (same tokens as REST).

Plugins

The list of built-in plugins, grouped by category. Full reference in plugins.

Category	Plugins
Storage	bgp-rib (N-way multipath best-path), bgp-adj-rib-in, bgp-persist.
Policy	bgp-rs, bgp-rr (RFC 4456), bgp-watchdog, bgp-healthcheck, bgp-filter-community, bgp-filter-prefix, bgp-filter-aspath, bgp-route-modify, bgp-redistribute, loop, bgp-role.
Resilience	bgp-gr, bgp-route-refresh.
Validation	bgp-rpki, bgp-rpki-decorator.
Capabilities	bgp-aigp, bgp-hostname, bgp-llnh, bgp-softver.
Protocol	bfd (RFC 5880, auth, echo mode), bgp-bmp (RFC 7854, Adj-RIB-Out).
Address families	bgp-nlri-vpn, bgp-nlri-evpn, bgp-nlri-flowspec, bgp-nlri-ls, bgp-nlri-labeled, bgp-nlri-vpls, bgp-nlri-mvpn, bgp-nlri-rtc, bgp-nlri-mup.
Subsystems	l2tp (RFC 2661, PPP, BNG), firewall (nftables), traffic-control (tc/VPP), ntp, sysctl, tacacs (RFC 8907).
Infrastructure	iface, fib-kernel, fib-vpp (GoVPP), fib-p4, iface-dhcp, iface-vpp, sysrib (unified Loc-RIB), host, vpp.

BFD

Bidirectional Forwarding Detection (RFC 5880/5881/5882/5883). Sub-second failure detection.

Feature	Detail
Single-hop (RFC 5881)	GTSM TTL=255, SO_BINDTODEVICE, per-session timers.
Multi-hop (RFC 5883)	UDP 4784, min-TTL gate, loopback peering.
Authentication (RFC 5880 S6.7)	Keyed MD5, meticulous keyed MD5, keyed SHA1, meticulous keyed SHA1.
Echo mode (RFC 5880 S6.4)	Single-hop only, async slow-down.
BGP peer opt-in	bfd { } inside bgp peer connection. RFC 9384 Cease subcode 10 on BFD Down.
Named profiles	Bundles of timer and feature parameters, shared across sessions.
Standalone sessions	Pinned sessions for gateway or tunnel monitoring.
Prometheus metrics	ze_bfd_sessions, ze_bfd_transitions_total, ze_bfd_detection_expired_total, ze_bfd_tx_packets_total, ze_bfd_rx_packets_total.

BMP

BGP Monitoring Protocol (RFC 7854) in both directions.

Feature	Detail
Receiver	Accepts BMP feeds from routers. Parses all 7 message types. Configurable listener endpoints.
Sender	Streams to collectors. Peer Up/Down, Route Monitoring (pre-policy and post-policy), Statistics, Initiation, Termination.
Adj-RIB-Out (RFC 8671)	Sender wraps sent UPDATEs as post-policy Route Monitoring with O+L flags.
CLI	ze bmp sessions, ze bmp peers, ze bmp collectors.

L2TP/PPP

Native L2TPv2 (RFC 2661) BNG subsystem.

Feature	Detail
Tunnel FSM	SCCRQ/SCCRP/SCCCN handshake, CHAP-MD5 tunnel auth, tie-breaker resolution.
Session FSM	ICRQ/ICRP/ICCN, OCRQ/OCRP, CDN/WEN/SLI.
PPP	LCP, PAP, CHAP-MD5, MS-CHAPv2, IPCP, IPv6CP. Periodic re-auth.
Kernel data plane	l2tp_ppp via netlink.
Redistribute	Subscriber /32 and /128 routes into BGP via bgp-redistribute.
CLI	show l2tp tunnels/sessions/statistics, l2tp tunnel/session teardown.

Firewall and traffic control

Feature	Detail
Firewall	Stateful packet filtering with nftables backend. Expression lowering, conntrack.
Traffic control	Per-interface queueing disciplines. HTB, TBF, FQ, netem (tc backend). Policers (VPP backend).
Backend gate	Commit-time rejection of unsupported features via ze:backend YANG extension.
CLI	show firewall, show traffic-control, clear verb.

VPP data plane

Feature	Detail
Process lifecycle	Startup, crash recovery (exponential backoff), DPDK NIC binding, GoVPP connection.
FIB programming	fib-vpp installs best routes via GoVPP binary API. Replays RIB on reconnect.
Interface backend	GoVPP-backed lifecycle, addressing, bridge, monitor via interface { backend vpp; }.
Telemetry	Per-interface rx/tx counters, per-node clocks, system vector rates via stats segment.
External mode	vpp.external true for systemd-managed or container VPP.

Authentication

Feature	Detail
Local users	Multi-user YANG login, bcrypt passwords, ED25519 host key. ze passwd command.
TACACS+ (RFC 8907)	PAP authentication, priv-lvl mapping to local authz profiles, accounting. Local bcrypt fallback.
AAA chain	Pluggable backend registry (VFS-shaped). TACACS+ priority 100, local bcrypt priority 200.
Junos format	$9$ encrypted passwords supported in config.

System

Feature	Detail
NTP client	System clock synchronization with clock readiness gate for interfaces.
Sysctl profiles	Named profiles (dsr, router, hardened, multihomed, proxy) for interface units. Three-layer precedence.
Host inventory	Hardware inventory library, show host CLI surface.
System reboot	system reboot for gokrazy/Linux appliances.
Gokrazy appliance	TLS cert caching, management proxy, zefs bootstrap, kmsg logging, DHCP-auto discovery.

Observability

Feature	Where
Prometheus metrics	telemetry { prometheus { ... } }. Peer state, message counters, prefix counters, forward-pool utilisation, connection timing histograms, plugin health.
Structured logging	JSON output, hierarchical per-subsystem levels, runtime-configurable.
Live event stream	ze cli monitor event, pipeable to `
Live peer dashboard	ze cli monitor bgp. Auto-refreshing two seconds, sortable.
Operational report bus	ze show warnings, ze show errors. Cross-subsystem state and event surface, login banner reads the same source.
MRT analysis	Standalone ze-analyse tool. Downloads from RIPE RIS and RouteViews, runs density, attribute, and community analyses.
Benchmarking	ze-perf cross-implementation latency benchmark.

Chaos testing

Feature	Detail
In-daemon chaos	--chaos-seed and --chaos-rate flags inject faults at runtime. Deterministic with a fixed seed.
Orchestrator	ze-chaos runs mock peers, validates protocol properties, and records runs to NDJSON.
Dashboard	Live HTMX web dashboard with peer table, property badges, and interactive controls.
Event logs	Record, replay, and shrink failing runs.
Properties	Convergence deadline, route consistency, no duplicate routes, hold timer enforcement, message ordering.

Developer surfaces

Feature	Detail
Self-describing	ze help --ai, ze schema list, ze env list, ze --plugins.
Plugin SDK	Go SDK for in-tree plugins, line-protocol SDK for external plugins in any language.
ExaBGP migration	ze config migrate converts configs, ze exabgp plugin runs existing scripts unchanged.
ze bgp decode / ze bgp encode	Offline BGP message codec.
Fuzz testing	Every external-input parser has a fuzz harness.
Interop testing	32 Docker-based scenarios against FRR, BIRD, and GoBGP.

Testing surface

Kind	Count or scope
Unit tests	Several thousand test functions.
Functional tests	Hundreds. Config parsing, wire encoding, plugin behaviour.
Fuzz harnesses	Every external-input parser.
Chaos scenarios	Configurable, deterministic, with event-log replay and shrinking.
Interop suite	Docker scenarios against FRR, BIRD, GoBGP.

See also

• Comparison for how these features line up against other BGP daemons.
• What is Ze for the narrative view.
• Status for what actually works today.
• In-tree features for the authoritative list.

Adapted from main/docs/features.md.