show commands

Pre-Alpha. This page describes behavior that may change.

This is the day-2 operator's quick reference for the ze show family. The full command list is in reference/command-reference.md. What follows is the ten you will type the most.

ze show is the read-only path. It cannot mutate state, which makes it the right thing to put in monitoring scripts and dashboards. The same commands work inside the interactive shell after ze cli, just without the ze prefix.

The most-used

ze show peer list                 # Brief peer list with state
ze show bgp summary               # The BGP summary table
ze show peer <name> detail        # Everything about one peer
ze show peer <name> capabilities  # Negotiated capabilities for one peer
ze show rib routes received <peer> [family]
ze show rib routes sent <peer> [family]
ze show interface brief           # One-line-per-interface summary
ze show interface rate            # Per-interface rate tracking
ze show uptime                    # Daemon start time and running duration
ze show rpki status               # RTR sessions and VRP counts
ze show health                    # Component health registry
ze show warnings                  # Active operational warnings
ze show errors                    # Recent error events
ze show version                   # Version, build, plugin list

peer list

Brief table for "is anything down right now".

$ ze show peer list
NAME       REMOTE          AS       STATE
upstream   10.0.0.1        65001    ESTABLISHED
ixp        192.0.2.42      65010    ESTABLISHED
backup     10.0.0.2        65001    CONNECT

bgp summary

The same shape network operators have been reading for thirty years.

$ ze show bgp summary
NEIGHBOR        AS       UP        STATE          PFXRCVD
10.0.0.1     65001    2h13m     ESTABLISHED      947213
192.0.2.42   65010    18d4h     ESTABLISHED       12047
10.0.0.2     65001    -         CONNECT               -

uptime

ze show uptime reports when the daemon started and how long it has been running. Two fields: start-time (RFC 3339) and uptime (duration string). Useful after a graceful restart or reload to confirm the process came up when you expected.

For per-peer uptime, use peer list or bgp summary, which both show the per-session uptime in their tables.

peer detail

Everything Ze knows about one session, including capability negotiation, families, prefix counters, and timer state. Use it the moment a peer behaves oddly.

rib routes received and rib routes sent

The Adj-RIB-In and Adj-RIB-Out, filterable by peer and family. Pipe through | match for a regex filter, | count for a row count, or | json for structured output.

ze show rib routes received upstream ipv4/unicast | count
ze show rib routes received upstream | match 192.0.2 | no-more

interface brief

ze show interface brief is the one-liner-per-interface view: name, state, MTU, and the first address. Drop brief to get the full interface dump (every address, counters, kernel attributes). Add a name to focus on one interface. Add counters after the name to get just the RX/TX statistics block for that interface. The long form returns structured JSON; pipe through | table or | json as needed.

ze show interface brief             # all interfaces, compact
ze show interface eth0              # one interface, full detail
ze show interface eth0 counters     # one interface, counters only

Connectivity tests: resolve ping, resolve traceroute

ze resolve ping and ze resolve traceroute use an internal ICMP engine (no OS shell-out) and are available inside the shell and over the API without needing a separate shell account on the router.

ze resolve ping 10.0.0.1
ze resolve ping --source 192.0.2.1 --count 5 --size 1500 10.0.0.1
ze resolve traceroute 10.0.0.1
ze resolve traceroute --source 192.0.2.1 10.0.0.1

Flag	Subcommand	Purpose
--source <addr>	both	Bind to a specific local address.
--count <N>	ping	Number of probes.
--size <bytes>	ping	Payload size.

ping has a 15-second wall-clock timeout, traceroute has 30 seconds. Both use the internal ICMP engine (no OS shell-out) with context-based cancellation so they cannot stall the dispatcher. Tab-completion walks YANG and suggests the known interfaces for the source address.

rib rpf

Reverse Path Forwarding lookup on the sharded Loc-RIB. Returns the best-path entry for the longest matching prefix. Useful for external multicast daemons (PIM-SM) that need to resolve upstream next-hops.

ze show rib rpf ipv4/unicast 10.0.1.5

rpki status, warnings, errors

rpki status shows your RTR session count, the cache server, and the VRP totals. warnings and errors query the operational report bus that the BGP reactor and the rest of the subsystems publish to. Warnings are state-based (something is wrong right now). Errors are events (something happened, with a timestamp). Both return JSON by default.

ze show warnings | json
ze show errors  | json

The login banner reads from the same bus and surfaces the active warnings when you connect.

Diagnostics

Production debugging commands, all available from the CLI shell.

ze show health                    # Component health (bgp, fib, firewall, iface, ...)
ze show tcp-check <ip> <port>     # TCP connectivity probe
ze show traceroute <target>       # ICMP path trace
ze show capture interface <iface> tcp port 179 count 10 format text
ze show dns lookup <name> type A  # DNS resolution
ze show dns cache stats           # Cache hit/miss statistics
ze show system sockets tcp        # Socket state (replaces ss)
ze show system kernel-log level warning count 50
ze show system goroutines summary # Goroutine distribution
ze show system file-descriptors summary
ze show system profile cpu duration 10s
ze show crashes                   # Panic crash reports

See Production Diagnostics for the full symptom-based guide.

Routing and forwarding

ze show nexthop-table             # Resolved next-hops with recursion depth
ze show ecmp-groups               # ECMP nexthop groups (max 128 members)
ze show mpls forwarding           # Kernel AF_MPLS label table (push/swap/pop)
ze show policy test <policy> ...  # Dry-run a policy against routes, no apply

Subsystem status

ze show flow-export [<collector>] # sFlow/NetFlow/IPFIX exporter stats
ze show storage smart             # Per-device SMART health and self-tests
ze show gnmi                      # gNMI server status and subscriptions
ze show audit                     # Local audit log (action/actor/surface/time filters)
ze show pki certificates          # Certificate store
ze show pki certificate <name> pem        # Export a certificate as PEM
ze show pki certificate <name> bundle pem # Export the full chain as PEM
ze show pki certificate <name> fingerprint

Live monitoring

monitor ping <target>             # Continuous ICMP with live stats
monitor traceroute <target>       # mtr-style continuous traceroute
monitor system netlink all        # Kernel route/link/address changes
monitor interface rate            # Live interface rate tracking

monitor traceroute supports pipe enrichment: | log | origin annotates hops with ASN names, | log | resolve adds reverse DNS.

Pipes

The shell understands a small set of pipe operators borrowed from network OS shells.

Pipe	Effect
| json	Render the structured response as JSON.
| table	Render as a table.
| match <regex>	Drop rows that do not match.
| count	Just the row count.
| no-more	Disable paging for long output.
| log	Scrollback output for streaming commands.
| first N	Keep only the first N items. Server-side early termination when supported.
| last N	Keep only the last N items (trailing window).
| origin	Annotate IPs with ASN names (Team Cymru).
| resolve	Annotate IPs with reverse DNS hostnames.

See also

• Monitoring for live event streams and the auto-refreshing dashboard.
• Production Diagnostics for symptom-based troubleshooting.
• Health Checks for the health registry and report bus.
• Command reference for every command and every flag.
• CLI reference for the interactive shell, history, and tab completion.

Adapted from main/docs/guide/command-reference.md and main/docs/features/cli-commands.md.