glossary

Pre-Alpha. This page describes behavior that may change.

Terms and acronyms that appear throughout the Ze documentation. Split into BGP terms, Ze-specific terms, and terms inherited from ExaBGP.

BGP terms

ADD-PATH. RFC 7911. Extension that lets a peer advertise multiple paths for the same prefix, instead of only the best one. Matters for route servers and for multi-path BGP.

Adj-RIB-In. The routes received from one peer, before policy and best-path. Ze exposes the raw bytes through the bgp-adj-rib-in plugin for forensic replay.

Adj-RIB-Out. The routes sent to one peer, after policy and best-path. Implementation-specific how it is stored.

AS path. The sequence of autonomous systems a route has traversed. AS_SEQUENCE (strictly ordered) and AS_SET (unordered, from aggregation) are both valid. Ze stores the parsed form under bgp-rib, but the wire layer never decodes it unless something actually asks.

Best path. The one route the router selects from the set of available paths to a prefix. Ze's best-path runs in the bgp-rib plugin when acting as a route server. In ExaBGP-style operation, there is no best-path selection: plugins decide what to forward.

BGP-LS. BGP Link State. RFC 7752. Carries IGP topology over BGP.

BFD. Bidirectional Forwarding Detection. RFC 5880/5881/5882/5883. Sub-second liveness detection. Ze implements BFD as a plugin with authentication, echo mode, and BGP peer opt-in. See BFD.

BMP. BGP Monitoring Protocol. RFC 7854. Ze implements BMP as both a receiver and sender, with Adj-RIB-Out support (RFC 8671). See BMP.

Capability. A feature advertised during OPEN that both peers must support for it to be used. ADD-PATH, 4-byte ASN, Graceful Restart, Route Refresh, and BGP Role are the common ones.

CLUSTER_LIST. RFC 4456 attribute used for route reflector loop detection. Ze's loop filter checks it on iBGP sessions.

Community. An opaque tag attached to a route. Standard communities are 32 bits, large communities (RFC 8092) are 96, extended communities are 64. Ze handles all three.

EVPN. Ethernet VPN. RFC 7432. L2VPN with a BGP control plane. Ze ships bgp-nlri-evpn for it.

DPD. Dead Peer Detection. IKEv2 mechanism (RFC 7296 Section 2.4) for detecting unresponsive peers via INFORMATIONAL exchange.

Flowspec. RFC 8955. BGP for distributing traffic filtering rules. Ze ships bgp-nlri-flowspec. Used for DDoS mitigation. The flowspec-firewall plugin converts FlowSpec rules into nftables entries.

FSM. Finite State Machine. The BGP FSM has six states: Idle, Connect, Active, OpenSent, OpenConfirm, Established.

Graceful Restart. RFC 4724. Lets a peer restart its BGP process without dropping forwarding state. Ze ships bgp-gr, which pairs with bgp-rib and (optionally) bgp-persist for the disk side.

Hold timer. The interval after which a session is torn down if no message has been received. Default 90 seconds, minimum 3.

iBGP. Internal BGP. Peers in the same AS. Ze uses the same peer configuration as eBGP, with matching local { as } and remote { as }.

LOCAL_PREF. Local preference. The first tie-breaker in best-path selection, for iBGP peers.

MED. Multi-Exit Discriminator. RFC 4271. Hints to a peer which path to prefer when multiple exits exist. Ze passes it through and uses it in the RIB plugin's best-path selection.

MRT. Multi-Threaded Routing Toolkit format. RFC 6396. Binary format for BGP route collection. Ze reads MRT through ze-analyse but does not produce MRT dumps.

NLRI. Network Layer Reachability Information. The prefix or identifier being advertised. Each address family has its own NLRI encoding.

NOTIFICATION. RFC 4271 section 4.5. The BGP message that ends a session. Ze logs every notification sent and received through the operational report bus.

Origin AS. The last ASN in an AS_PATH. The AS that introduced the prefix into BGP.

OTC. Only To Customer. RFC 9234 attribute. Stamped by the Role plugin on eligible egress updates to prevent leaks from provider to non-customer peers.

Peer. In Ze, a named configuration entry representing a BGP session. The name is an operator label, not the peer's IP.

Prefix limit. RFC 4486. Per-family maximum number of prefixes accepted from a peer. Mandatory in Ze: the daemon refuses to start without a prefix { maximum } for every configured family.

RIB. Routing Information Base. The in-memory table of routes. Ze's bgp-rib plugin is the main RIB implementation.

Route Refresh. RFC 2918. Capability that lets a peer request the other side to re-send its full table for a family. Ze ships bgp-route-refresh for both standard and Enhanced Route Refresh (RFC 7313).

Route server. A daemon that reflects routes between IXP members without modifying the next hop. Ze's bgp-rs plugin implements RFC 7947 route server behaviour.

AIGP. Accumulated IGP Metric. RFC 7311. Path attribute carrying the IGP cost from origin. Ze encodes, decodes, and exposes the metric but does not use it in best-path selection.

ASPA. Autonomous System Provider Authorization. Verifies AS_PATH hop authorization against provider-customer records distributed via RTR v2 (RFC 9582). Ze implements ASPA with configurable policy enforcement (reject/log-only/accept).

MOBIKE. IKEv2 Mobility and Multihoming Protocol. RFC 4555. Allows address updates for mobile/multihomed IPsec endpoints.

PXE. Preboot Execution Environment. Network booting standard. Ze's ze install serve uses PXE with DHCP options 43/60/66/67 for zero-touch provisioning.

RPKI. Resource Public Key Infrastructure. RFC 6480. Cryptographic validation of route origins. Ze ships bgp-rpki for the RTR client.

RTR. RPKI to Router protocol. RFC 6810 and RFC 8210. The protocol between a router and an RPKI cache.

UPDATE. The BGP message carrying route announcements and withdrawals. Ze parses UPDATE lazily into a WireUpdate.

Ze-specific terms

bgp-*. Plugin name prefix for BGP plugins. bgp-rib, bgp-gr, bgp-rpki, bgp-nlri-evpn, and so on.

Bus. The content-agnostic pub/sub backbone (internal/component/bus/). Topics are hierarchical, subscriptions match on prefixes, payloads are opaque. Not the hot path for BGP data: that goes through direct calls.

Commit confirmed. Commit with an auto-rollback timer. If you do not commit confirm before the timer expires, Ze reverts the change. Use it for remote changes that might lock you out.

Config archive. Every committed config is kept. rollback N jumps back N commits. show archive lists what is available.

ContextID. An identifier for a peer's negotiated encoding context: ASN4, ADD-PATH, Extended Message, Extended Next Hop, iBGP vs eBGP, ASN values. Two peers with the same ContextID can receive the same cached wire bytes unchanged.

DirectBridge. The in-process plugin transport. Internal plugins bypass the IPC layer entirely and call through a direct bridge.

EventDispatcher. The plugin-facing bridge. Delivers events to subscribed plugins, routes commands back.

fib-kernel. The plugin that programs the Linux FIB through netlink.

Hub. The TLS transport for plugin communication and fleet management. Named server blocks declare listeners; client blocks declare outbound connections.

In-process vs external plugin. In-process plugins are Go code compiled into the binary. External plugins are separate processes started by Ze. Same APIs; different transport.

ModAccumulator. The lazy data structure an egress filter writes into when it needs to modify an outgoing UPDATE. If nothing writes to it, no copy happens.

PluginManager. Owns plugin lifecycle: spawning, handshake, event dispatch, command routing.

Process. In Ze config, a process block under a peer binds a plugin to receive events from that peer.

Reactor. The BGP event loop and message cache. Holds the per-peer FSMs and the cached WireUpdates.

Register. Every plugin calls registry.Register() in its init(). This is how the plugin, its families, its commands, and its schema become visible to the rest of the binary.

Report bus. The cross-subsystem operator-visible issue bus. Producers push warnings and errors, ze show warnings and ze show errors read, the CLI login banner reads the BGP subset.

Subsystem. A logical grouping of code. BGP is a subsystem. Interface management is a subsystem. Subsystems plug into the supervisor, the bus, the config provider, and the plugin manager.

Supervisor. The engine. Wires the bus, the config provider, and the plugin manager together and starts subsystems in order.

Watchdog group. A named group that controls deferred route announcement. Healthcheck probes drive watchdog groups to announce or withdraw routes.

WireUpdate. A lazily-parsed BGP UPDATE. Holds a byte slice into the TCP read buffer plus a ContextID. Never decoded into intermediate structs on the receive path.

Ze. The project. Pronounced like the letter Z in French. Thomas is French.

XFRM. Linux kernel's IPsec transformation framework. Ze uses XFRM interfaces for route-based IPsec: traffic routed through an XFRM interface is encrypted, traffic arriving on it is decrypted.

ze-analyse. The standalone MRT analysis tool.

ze-chaos. The chaos testing orchestrator.

ze doctor. System readiness checker. Runs offline pre-start checks (config, TLS, interfaces, ports, disk space, DNS, clock) with stable diagnostic codes. See Health Checks.

ze-perf. The BGP propagation latency benchmark tool.

ze-test. The functional test driver.

ZeFS. Ze File System. The blob storage format used for credentials, config, and certificates. Supports per-record CRC32c integrity checks and in-place writes.

ExaBGP terms

Bridge plugin. ze exabgp plugin. Runs an existing ExaBGP process script with Ze as the BGP engine, translating between ExaBGP JSON and Ze JSON.

ze config migrate. Converts an ExaBGP configuration file to the current Ze syntax.

ExaBGP. The Python predecessor of Ze. github.com/Exa-Networks/exabgp. Same programmable BGP model, single-threaded, more mature, still in production everywhere.

See also

• Comparison for the per-feature matrix against other BGP daemons.
• Feature inventory for the list of what Ze can do today.
• Architecture for the mental model behind the Ze-specific terms.