looking glass
Pre-Alpha. This page describes behavior that may change.
The Looking Glass is the public, read-only side of Ze. It runs as a separate HTTP server on its own port, with no authentication, designed for IXPs and operators who want to expose their peer state and route table to the world without giving anyone access to the rest of the daemon.
It serves both an HTMX web UI under /lg/ and a Birdwatcher-compatible JSON API under /api/looking-glass/, so you can either point a browser at it or feed it to Alice-LG.
environment {
looking-glass {
enabled true;
server main {
ip 0.0.0.0;
port 8443;
}
}
}
| Setting | Default | Description |
|---|---|---|
enabled |
false |
Enable the looking glass server. |
server <name> { ip } |
0.0.0.0 |
Listen address. Set to 127.0.0.1 for local-only. |
server <name> { port } |
8443 |
Listen port. Must differ from the web UI port. |
tls |
false |
Enable TLS. Requires blob storage (ze init). |
When the looking-glass block is absent, the server does not start and no resources are consumed. Environment overrides exist for ad-hoc starts: ze.looking-glass.listen=ip:port, ze.looking-glass.enabled=true, ze.looking-glass.tls=true.
The HTMX UI lives at http://<host>:<port>/lg/. It is a single-page tab layout with HTMX fragment swaps. Two navigation tabs plus Help cover the operator's needs.
| Tab | URL | What it shows |
|---|---|---|
| Peers | /lg/peers |
All peers with state, ASN names from Team Cymru, and route counts. Live SSE updates. |
| Search | /lg/search |
Unified search by prefix, AS path pattern, or community. |
/lg/lookup is a legacy redirect to /lg/search.
Per-peer routes are reachable at /lg/peer/{address}, route detail at /lg/route/detail.
| Page | URL | What it does |
|---|---|---|
| Peer download | /lg/peer/{address}/download |
Route download for a specific peer. |
| Events | /lg/events |
SSE event stream for live updates. |
| Help | /lg/help |
Help page. |
The graph at /lg/graph?prefix=X is rendered server-side as SVG, in pure Go, with no external dependencies. No GraphViz, no WASM, no JavaScript graph library. The layout is Sugiyama-inspired, left to right, with source ASes on the left and the origin on the right.
A few details worth knowing.
| Feature | What it does |
|---|---|
| Server-side SVG | One round trip, no client-side rendering. |
| AS prepending | Consecutive duplicate ASNs collapse to one node. |
| Multi-path | Multiple AS paths to the same prefix render as a branching DAG. |
| Node cap | Graphs are limited to 100 nodes. |
| ASN labels | Each node shows the AS number and the organization name when the decorator is available. |
The looking glass exposes a Birdwatcher-compatible JSON API at /api/looking-glass/. Field names are snake_case, not Ze's standard kebab-case, because the Birdwatcher convention is snake.
| Endpoint | Description |
|---|---|
GET /api/looking-glass/status |
Router ID, version, uptime. |
GET /api/looking-glass/protocols/bgp |
Peer list with state and route counts. |
GET /api/looking-glass/protocols/bmp |
BMP-monitored peers (when BMP receiver enabled). |
GET /api/looking-glass/protocols/short |
Short protocol summary. |
GET /api/looking-glass/routes/protocol/{name} |
Routes from a named peer. |
GET /api/looking-glass/routes/bmp/{name} |
Routes from a specific BMP-monitored peer. |
GET /api/looking-glass/routes/peer/{peer} |
Routes by peer address. |
GET /api/looking-glass/routes/table/{family} |
Best routes by address family. URL-encode the / in the family. |
GET /api/looking-glass/routes/filtered/{name} |
Filtered routes per peer. |
GET /api/looking-glass/routes/export/{name} |
Exported routes per peer. |
GET /api/looking-glass/routes/noexport/{name} |
Non-exported routes per peer. |
GET /api/looking-glass/routes/count/protocol/{name} |
Route count per protocol. |
GET /api/looking-glass/routes/prefix |
Prefix lookup (via ?prefix= query param). |
GET /api/looking-glass/routes/search?prefix=X |
Prefix lookup across all peers. |
Point Alice-LG at this API and you have a turn-key looking glass with no extra software in the path.
sources:
- name: "Ze Router"
type: birdwatcher
birdwatcher:
api: "http://ze-host:8443/api/looking-glass"When the BMP receiver is enabled, monitored routes from external routers appear in the looking glass under a separate "bmp" protocol namespace. These routes are visible through the /api/looking-glass/protocols/bmp and /api/looking-glass/routes/bmp/{name} endpoints but never enter best-path selection or the FIB.
BMP routes are kept separate from real BGP routes. ze bgp rib show excludes BMP-monitored routes; ze bmp rib show shows only BMP routes. The {name} parameter is the composite peer key in <router>:<peer-address> format.
The route lifecycle follows BMP protocol events: routes are injected from Route Monitoring messages, withdrawn on Peer Down, and fully cleared when a BMP session disconnects.
The looking glass is intended to be public. It is read-only and unauthenticated, and the implementation acts like it.
Input validation uses character allowlists and length limits on every query parameter. The server emits the usual restrictive headers (Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff). HTML is rendered through Go's html/template so it is auto-escaped. The SSE connection limit is 100 concurrent clients. There are no direct RIB or plugin imports: all data is fetched through the command dispatcher, the same one the CLI uses.
When TLS is enabled it uses TLS 1.2 minimum with the same certificate infrastructure as the web UI.
- BMP for BMP receiver and sender configuration.
- Web UI for the authenticated, read-write surface.
- REST API for the programmatic access path.
- Public Looking Glass blueprint for a complete deployment example.
Adapted from main/docs/guide/looking-glass.md.