feature inventory

Pre-Alpha. This page describes behavior that may change.

The full inventory of what Ze does. Not the narrative ("why this exists") or the comparison ("how it stacks up"), just the list. Use this page when you need to check whether a specific feature is present and whether it is built into the engine or provided by a plugin.

The in-tree docs/features.md is the canonical source. When this page and that one disagree, the in-tree page wins.

BGP protocol

See BGP peers for the configuration surface and the comparison page for the per-feature breakdown against other daemons.

Area	Detail
Address families	21, covering IPv4/IPv6 unicast, multicast, labelled unicast, VPN, FlowSpec, EVPN, VPLS, BGP-LS, MVPN, RTC, and MUP. IPv4/IPv6 unicast and multicast are built into the engine; everything else ships as an nlri plugin.
Capabilities	Multiprotocol, 4-byte ASN, Route Refresh, Enhanced Route Refresh, ADD-PATH, Extended Messages, Extended Next Hop, Graceful Restart, Long-Lived GR, BGP Role, Hostname, Software Version, Link-Local Next Hop.
Path attributes	ORIGIN, AS_PATH, NEXT_HOP, MED, LOCAL_PREF, ATOMIC_AGGREGATE, AGGREGATOR, COMMUNITY, ORIGINATOR_ID, CLUSTER_LIST, MP_REACH_NLRI, MP_UNREACH_NLRI, EXTENDED_COMMUNITY, LARGE_COMMUNITY, PREFIX_SID.
Route loop detection	AS loop (RFC 4271 section 9), ORIGINATOR_ID (RFC 4456), CLUSTER_LIST (RFC 4456). All three run before prefix-limit counting and silently treat the route as withdrawn.
UPDATE coalescing	Consecutive IPv4 unicast UPDATEs with identical attributes are merged into a single UPDATE message.

Configuration

Feature	Detail
YANG-modelled	Every field, every CLI prompt, every web UI form comes from the same YANG schemas.
Atomic commit	Edit, diff, commit, rollback, commit confirmed with auto-rollback.
Per-user drafts	Each user gets an independent editor session; drafts survive disconnection.
Hot reload	No daemon restart required for config changes. Session resets only when the underlying change demands it.
Prefix limits (RFC 4486)	Mandatory per-family per-peer maximum. Refuses to start without one.
Update groups	Automatic cross-peer UPDATE building deduplication, based on encoding context.
Session resilience	TCP_NODELAY, DSCP CS6, graceful close, Send Hold Timer (RFC 9687), congestion extension for hold timer, bounded overflow pool with GR-aware teardown.
Deactivate/activate	Mark any node (container or leaf) inactive. Kept in the config file, skipped at apply time.

Interface management

iface plugin. Netlink on Linux, stdlib fallback elsewhere.

Interface type	MAC required	Notes
ethernet	Yes	Physical ethernet interface.
veth	Yes	Virtual ethernet pair.
bridge	Yes	Bridge interface.
dummy	No	Virtual dummy interface.
loopback	No	Container, no key.

Static addressing, DHCP client (with route/DNS/NTP discovery), interface monitoring, make-before-break migration with ze interface migrate, route-priority for configurable DHCP route metric, and IPv6 default route management from Router Advertisements.

Additional interface types:

Interface type	Notes
tunnel (gre, gretap, ipip, sit, ip6gre, ip6gretap, ip6tnl)	Full tunnel family support via netlink.
wireguard	WireGuard encrypted tunnels with peer reconciliation on reload.

VPP interface backend is also available (interface { backend vpp; }) for GoVPP-backed lifecycle, addressing, bridge, and monitoring.

Operator surfaces

Surface	Transport	Auth
CLI	SSH, port 2222 by default.	User database with bcrypt passwords, SSH public keys (ed25519, RSA, ECDSA), ED25519 host key.
Web UI	HTTPS, port 3443 by default. Workbench V2 (experimental).	Same user database. Session cookies for browsers, Basic Auth for API clients.
Looking Glass	HTTP or HTTPS on its own configurable port (separate from the web UI).	None. Read-only by design.
MCP	HTTP on 127.0.0.1, port must be specified.	Optional bearer token. Task-augmented tools/call, Apps resources.
REST API	Dedicated HTTP(S) server on port 8081 by default, /api/v1/execute, /api/v1/commands, typed config sessions, Swagger UI.	Bearer per-user or single token.
gRPC API	Dedicated server on port 50051 by default, ze.api.v1.ZeService + ze.api.v1.ZeConfigService, server reflection, built-in TLS.	Bearer metadata (same tokens as REST).

Plugins

The list of built-in plugins, grouped by category. Full reference in plugins.

Category	Plugins
Storage	bgp-rib (N-way multipath best-path, multi-source protocol IDs), bgp-adj-rib-in, bgp-persist.
Policy	bgp-rs, bgp-rr (RFC 4456), bgp-watchdog, bgp-healthcheck, bgp-filter-community, bgp-filter-prefix, bgp-filter-aspath, bgp-route-modify, bgp-redistribute, loop, bgp-role, policy-routes.
Resilience	bgp-gr, bgp-route-refresh.
Validation	bgp-rpki, bgp-rpki-decorator.
Capabilities	bgp-aigp, bgp-hostname, bgp-llnh, bgp-softver.
Protocol	bfd (RFC 5880, auth, echo mode), bgp-bmp (RFC 7854, Adj-RIB-Out, looking glass integration).
Address families	bgp-nlri-vpn, bgp-nlri-evpn, bgp-nlri-flowspec, bgp-nlri-ls, bgp-nlri-labeled, bgp-nlri-vpls, bgp-nlri-mvpn, bgp-nlri-rtc, bgp-nlri-mup.
Subsystems	l2tp (RFC 2661, PPP, BNG, RADIUS, shaping, CQM, web UI), pppoe (RFC 2516, AC), firewall (nftables + VPP), traffic-control (tc/VPP), ntp, sysctl, tacacs (RFC 8907), static-routes.
Infrastructure	iface, fib-kernel, fib-vpp (GoVPP, MPLS), fib-p4, iface-dhcp, iface-vpp, sysrib (unified Loc-RIB), host (inventory, SMART, tuning), vpp.

BFD

Bidirectional Forwarding Detection (RFC 5880/5881/5882/5883). Sub-second failure detection.

Feature	Detail
Single-hop (RFC 5881)	GTSM TTL=255, SO_BINDTODEVICE, per-session timers.
Multi-hop (RFC 5883)	UDP 4784, min-TTL gate, loopback peering.
Authentication (RFC 5880 S6.7)	Keyed MD5, meticulous keyed MD5, keyed SHA1, meticulous keyed SHA1.
Echo mode (RFC 5880 S6.4)	Single-hop only, async slow-down.
BGP peer opt-in	bfd { } inside bgp peer connection. RFC 9384 Cease subcode 10 on BFD Down.
Named profiles	Bundles of timer and feature parameters, shared across sessions.
Standalone sessions	Pinned sessions for gateway or tunnel monitoring.
Prometheus metrics	ze_bfd_sessions, ze_bfd_transitions_total, ze_bfd_detection_expired_total, ze_bfd_tx_packets_total, ze_bfd_rx_packets_total.

BMP

BGP Monitoring Protocol (RFC 7854) in both directions.

Feature	Detail
Receiver	Accepts BMP feeds from routers. Parses all 7 message types. Configurable listener endpoints.
Sender	Streams to collectors. Peer Up/Down, Route Monitoring (pre-policy and post-policy), Statistics, Initiation, Termination.
Adj-RIB-Out (RFC 8671)	Sender wraps sent UPDATEs as post-policy Route Monitoring with O+L flags.
Looking glass integration	BMP-monitored routes visible in dedicated LG endpoints under "bmp" protocol namespace.
CLI	ze show bmp sessions, ze show bmp peers, ze show bmp collectors, ze show bmp rib.

L2TP/PPP

Native L2TPv2 (RFC 2661) BNG subsystem.

Feature	Detail
Tunnel FSM	SCCRQ/SCCRP/SCCCN handshake, CHAP-MD5 tunnel auth, tie-breaker resolution.
Session FSM	ICRQ/ICRP/ICCN, OCRQ/OCRP, CDN/WEN/SLI.
PPP	LCP, PAP, CHAP-MD5, MS-CHAPv2, IPCP, IPv6CP. Periodic re-auth.
Kernel data plane	l2tp_ppp via netlink.
RADIUS	Authentication and accounting. CoA/DM listener. Configurable source address.
Traffic shaping	TBF/HTB qdisc on pppN interfaces, per-session rates via RADIUS or config.
CQM	Firebrick-style per-session event ring and 24h sample buckets.
Session observer	Event namespace, CQM sampler.
Prometheus metrics	L2TP session, CQM, and RADIUS counters.
Web management UI	Sessions, CQM chart, event timeline, disconnect.
Redistribute	Subscriber /32 and /128 routes into BGP via bgp-redistribute.
CLI	show l2tp tunnels/sessions/statistics, l2tp tunnel/session teardown.

PPPoE

RFC 2516 PPPoE access concentrator (alternative to L2TP for direct-attach subscribers).

Feature	Detail
Discovery	PADI/PADO/PADR/PADS/PADT with AC-Cookie, service-name filtering.
PPP driver	Shared with L2TP: LCP, auth, IPCP/IPv6CP, pool, shaper.
Security	HMAC-SHA256 AC-Cookie, PADI rate limiting, MAC binding.
Concurrent	Runs alongside L2TP on the same daemon.

Static routes

Feature	Detail
ECMP	Multiple next-hops as multipath routes.
Weighted	Per-next-hop weight for traffic distribution.
BFD failover	BFD-tracked next-hops with automatic reprogramming.
Blackhole/reject	Discard or ICMP unreachable.
Redistribute	Importable as protocol "static" in BGP redistribute.

Policy routing

Feature	Detail
Match criteria	Source/dest address, port, protocol, TCP flags, set references.
Actions	Accept, drop, table (user-populated), next-hop (auto-managed), tcp-mss.
Interface binding	Per-interface or wildcard (l2tp*) policy application.
Implementation	nftables fwmark + kernel ip rules.

Firewall and traffic control

Feature	Detail
Firewall (nft)	Stateful packet filtering with nftables backend. Expression lowering, conntrack. Named sets with timeout.
Firewall (VPP)	VPP ACL classify pipeline. NAT44-ED (SNAT, DNAT, masquerade). SetMark, Limit actions.
Traffic control	Per-interface queueing disciplines. HTB, TBF, FQ, netem (tc backend). Policers (VPP backend). Original-qdisc snapshot/restore.
Backend gate	Commit-time rejection of unsupported features via ze:backend YANG extension.
CLI	show firewall, show traffic-control, clear verb.

VPP data plane

Feature	Detail
Process lifecycle	Startup, crash recovery (exponential backoff), DPDK NIC binding, GoVPP connection.
FIB programming	fib-vpp installs best routes via GoVPP binary API. Replays RIB on reconnect. MPLS label programming from labeled unicast.
Interface backend	GoVPP-backed lifecycle, addressing, bridge, monitor via interface { backend vpp; }.
Telemetry	Per-interface rx/tx counters, per-node clocks, system vector rates via stats segment.
External mode	vpp.external true for systemd-managed or container VPP.

Authentication

Feature	Detail
Local users	Multi-user YANG login, bcrypt passwords, ED25519 host key. ze passwd command.
SSH public keys	Per-user multi-key support. ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp{256,384,521}.
TACACS+ (RFC 8907)	PAP authentication, priv-lvl mapping to local authz profiles, accounting. Local bcrypt fallback.
AAA chain	Pluggable backend registry (VFS-shaped). TACACS+ priority 100, local bcrypt priority 200.
Junos format	$9$ encrypted passwords supported in config.

System

Feature	Detail
NTP client	System clock synchronization with clock readiness gate for interfaces.
Sysctl profiles	Named profiles (dsr, router, hardened, multihomed, proxy) for interface units. Three-layer precedence.
Host inventory	Hardware inventory library, show host CLI surface. SMART health monitoring. Hardware tuning engine.
Static DNS	System nameserver config, resolver unification.
System reboot	system reboot for gokrazy/Linux appliances.
Gokrazy appliance	TLS cert caching, management proxy, zefs bootstrap, kmsg logging, DHCP-auto discovery. Appliance builder with init, build, push, config-push, export/import.

Observability

Feature	Where
Prometheus metrics	telemetry { prometheus { ... } }. Peer state, message counters, prefix counters, forward-pool utilisation, connection timing histograms, plugin health. Basic auth support.
Host metrics	ze_host_* namespace: memory, CPU, ECC, NIC speed/carrier, thermal, storage.
OS metrics	Netdata-compatible collectors: CPU, memory, network, disk, conntrack, IPv6, softirqs, sockstat6.
Structured logging	JSON output, hierarchical per-subsystem levels, runtime-configurable. Slog ring buffer query.
Live event stream	ze cli monitor event, pipeable to `
Live peer dashboard	ze cli monitor bgp. Auto-refreshing two seconds, sortable.
Operational report bus	ze show warnings, ze show errors. Cross-subsystem state and event surface, login banner reads the same source.
Diagnostics	Runtime diagnostics commands, FSM history rings, capture rings (BGP, L2TP), VPP trace, pcap export, active probes (ping, route lookup).
Component health	/health endpoint, per-component status registry.
MRT analysis	Standalone ze-analyse tool. Downloads from RIPE RIS and RouteViews, runs density, attribute, and community analyses.
Benchmarking	ze-perf cross-implementation latency benchmark. OpenBGPd added as 8th DUT.

Chaos testing

Feature	Detail
In-daemon chaos	--chaos-seed and --chaos-rate flags inject faults at runtime. Deterministic with a fixed seed.
Orchestrator	ze-chaos runs mock peers, validates protocol properties, and records runs to NDJSON.
Dashboard	Live HTMX web dashboard with peer table, property badges, and interactive controls.
Event logs	Record, replay, and shrink failing runs.
Properties	Convergence deadline, route consistency, no duplicate routes, hold timer enforcement, message ordering. Per-family convergence.
MCP server	MCP integration for AI-driven chaos testing. Watchdog consumer.

Developer surfaces

Feature	Detail
Self-describing	ze help --ai, ze schema list, ze env list, ze --plugins.
Plugin SDK	Go SDK for in-tree plugins, line-protocol SDK for external plugins in any language.
ExaBGP migration	ze config migrate converts configs, ze exabgp plugin runs existing scripts unchanged.
ze bgp decode / ze bgp encode	Offline BGP message codec.
Fuzz testing	Every external-input parser has a fuzz harness.
Interop testing	32 Docker-based scenarios against FRR, BIRD, and GoBGP.

Testing surface

Kind	Count or scope
Unit tests	Several thousand test functions.
Functional tests	Hundreds. Config parsing, wire encoding, plugin behaviour.
Fuzz harnesses	Every external-input parser.
Chaos scenarios	Configurable, deterministic, with event-log replay and shrinking.
Interop suite	Docker scenarios against FRR, BIRD, GoBGP.

See also

• Comparison for how these features line up against other BGP daemons.
• What is Ze for the narrative view.
• Status for what actually works today.
• In-tree features for the authoritative list.

Adapted from main/docs/features.md.