status

Pre-Alpha. This page describes behavior that may change.

Ze is in early active development. It is not released and should not be used in production. APIs, configuration syntax, and plugin interfaces may change without notice. That said, anyone coming from ExaBGP who understands the risks may already find Ze useful for specific use cases, particularly route injection, BGP monitoring, and wire-level protocol tooling.

This page is the honest ledger. If a feature is listed here as working, it has tests behind it. If a feature is missing, it is missing.

What works

BGP protocol

Ze establishes BGP sessions, exchanges routes, and handles the full RFC 4271 FSM lifecycle. The wire layer encodes and decodes across every listed address family.

Area	Status
Session establishment (FSM)	Working. Tested against real peers and built-in test peers.
OPEN capability negotiation	Working. ASN4, ADD-PATH, PATHS-LIMIT, Extended Messages, Extended Next-Hop, Graceful Restart, Route Refresh, Role, Hostname, Software Version.
UPDATE encode/decode	Working. Every address family decodes. Most encode.
NOTIFICATION handling	Working. All standard codes including the RFC 9003 shutdown communication.
Keepalive and hold timer	Working.
TCP MD5 authentication	Working on Linux and FreeBSD. Not available on macOS (kernel limitation).
GTSM / TTL security (RFC 5082)	Working. Minimum-TTL enforced on the BGP socket (IP_MINTTL) on Linux.
Control-plane policing (CoPP)	Working. Rate-limits control-plane traffic, including TCP/179, on the INPUT chain.
UPDATE coalescing	Working. Consecutive IPv4 unicast UPDATEs with identical attributes are merged.

Address families

All families decode. Most encode. Run ze --plugins to see the current state on your build.

Family	Decode	Encode	Config routes
IPv4 / IPv6 unicast	Yes	Yes	Yes
IPv4 / IPv6 multicast	Yes	Yes	Yes
VPNv4 / VPNv6	Yes	Yes	Yes
EVPN	Yes	Yes	Yes
FlowSpec (IPv4, IPv6, VPN)	Yes	Yes	Yes
Labeled unicast	Yes	Yes	Yes
BGP-LS	Yes	No	No
VPLS	Yes	Yes	Yes
MVPN	Yes	No	No
Route Target Constraint	Yes	No	No
Mobile User Plane	Yes	Yes	Yes
SR-Policy (IPv4, IPv6)	Yes	Yes	Yes

Plugins

The binary reports 86 registered plugins. The plugin lifecycle (five-stage handshake, typed IPC, event dispatch) is usable for new plugins, with the caveat that the RPC names and payloads are not stable. Run ze --plugins for the current list.

Plugin	Status
bgp-rib (route storage, best-path, N-way multipath, multi-source protocol IDs)	Working
bgp-rs (route server, reactor-native forwarding with direct TCP write)	Working
bgp-rr (route reflector, RFC 4456)	Working
bgp-gr (RFC 4724 graceful restart)	Working
bgp-rpki (RTR v2 client, origin validation RFC 6811, ASPA path verification with reject/log-only/accept)	Working
bgp-adj-rib-in (raw hex replay)	Working
bgp-route-refresh (RFC 2918 and 7313)	Working
bgp-role (RFC 9234, OTC filtering)	Working
bgp-hostname, bgp-softver	Working
bgp-llnh (link-local next hop)	Working
bgp-persist (across restarts)	Working
bgp-watchdog (deferred announcement)	Working
bgp-healthcheck (service healthcheck)	Working
bgp-aigp (RFC 7311, AIGP attribute)	Working
bgp-bmp (RFC 7854, receiver, sender, Adj-RIB-Out, looking glass integration)	Working
bgp-filter-community (tag/strip), bgp-filter-community-match	Working
bgp-filter-prefix (per-prefix modify)	Working
bgp-filter-aspath (AS-path regex), bgp-filter-aspath-length	Working
bgp-filter-modify (set/inc/dec local-pref/MED/AIGP, community add/remove)	Working
bgp-filter-remove-private-as (private ASN stripping)	Working
bgp-redistribute (cross-protocol route advertising)	Working
bfd (RFC 5880/5881/5882/5883, echo, auth)	Working
bgp-filter-irr (IRR-based prefix filtering, AS-SET expansion, periodic refresh)	Working
bgp-nlri-srpolicy (SR-Policy NLRI SAFI 73, Tunnel Encap)	Working
All ten NLRI plugins	Working, decode and encode

Beyond BGP

Subsystem	Status
L2TP/PPP (RFC 2661, BNG)	Working. Both LNS (answering) and LAC (initiator) roles: originates tunnels and calls with the SCCRQ/SCCRP handshake and mutual CHAP-MD5, plus PPPoE-to-L2TP relay via a kernel channel bridge. Tunnel FSM, session FSM, LCP, CHAP/PAP/MS-CHAPv2 auth, IPCP/IPv6CP, kernel data plane via l2tp_ppp. RADIUS auth/acct, traffic shaping, CQM, session observer, Prometheus metrics, web UI. xl2tpd interop tested.
PPPoE (RFC 2516)	Working. Access concentrator, AC-Cookie, PADI rate limiting, shared PPP driver with L2TP.
Firewall (nftables + VPP backends)	Working. Stateful firewall rules, conntrack, expression lowering. VPP NAT44-ED (SNAT/DNAT/masquerade), ACL classify pipeline, SetMark, Limit.
Traffic control (tc and VPP backends)	Working. Per-interface queueing disciplines, HTB, TBF, FQ, netem.
VPP data plane	Working. Process lifecycle, DPDK NIC binding, FIB programming via GoVPP, stats telemetry, reload on crash or reconnect. MPLS label programming from labeled unicast. GRE/GRETAP/IPIP/VXLAN tunnels, SPAN port mirroring, WireGuard, Linux Control Plane pairs (shadow a VPP NIC into a Linux TAP), traffic policing by DSCP and multi-class classification steering, static-route programming, and host tuning (poll-sleep, appliance hugepage reservation).
Kernel MPLS FIB	Working. BGP labeled-unicast pushed into the Linux MPLS FIB via netlink lwtunnel, label/stack validation, show mpls forwarding. End-to-end and FRR interop on a live kernel still pending.
LDP (RFC 5036)	Working. Discovery, session FSM, label information base. Emits to mpls-fib. Live-kernel interop pending.
RSVP-TE (RFC 3209/2205)	Working. PATH/RESV signaling, ERO, bandwidth admission, soft-state refresh, make-before-break. Live-kernel interop pending.
SRv6 Prefix-SID (RFC 9252, RFC 8669)	Working. PREFIX_SID parse/transposition for VPN/EVPN, Linux SEG6 and VPP SR-steering programming (ingress PE).
OSPFv2 / OSPFv3 (RFC 2328 / 5340)	Working. Unified engine: areas/ABR, stub and NSSA (RFC 3101 Type 7 translation), SPF, E1/E2 AS-external redistribution with BGP, default-information originate, OSPFv3 Link-LSAs, per-interface key-chain auth (AuType 0/1/2/3). Loc-RIB to sysrib to fibkernel install at distance 110. Web /ospf, show ospf tree. Extension family across OSPFv2 and OSPFv3: Segment Routing, traffic engineering, TI-LFA and LFA fast reroute, graceful restart, BFD, LDP-IGP sync, virtual links, NBMA and point-to-multipoint, multi-instance, OSPFv3 multi-address-family, and OSPFv3 IPsec. FRR ospfd/ospf6d interop tested.
IS-IS (ISO/IEC 10589, RFC 1195)	Working. Native link-state IGP: L1/L2 levels, DIS/pseudo-node LANs, LSDB + SPF, ECMP, wide metrics, dual-stack IPv6 (RFC 5308), HMAC-MD5/SHA auth, bidirectional redistribution (TLV 135/236). FRR isisd interop tested.
Flow export	Working. sFlow v5, NetFlow v9 (RFC 3954), IPFIX (RFC 7011), tc/psample sampling, conntrack per-flow records, BGP next-hop enrichment.
Static routes	Working. ECMP, weighted load balancing, BFD failover, blackhole, reject.
Policy routing	Working. nftables-based PBR with fwmark, kernel ip rules, auto-managed tables.
MRT recording (RFC 6396)	Working. Daemon-side recording with three independent streams (updates, all messages, periodic TABLE_DUMP_V2 RIB snapshots). YANG config, per-peer and direction filtering, extended timestamps, add-path aware, on-demand CLI dump, async non-blocking writes.
MRT analysis	Working. Standalone ze-analyze tool with show, routes, inject, replay, convert, export, record, serve, statistics, filter commands. HTTP URL support. AS-path and community regex filtering.
Class of Service (802.1p QoS, named profiles, RADIUS dynamic CoS)	Working. VLAN QoS maps, named profiles via cos plugin, dynamic per-subscriber CoS via RADIUS Filter-Id/VSA, VPP qos-record/mark.
Connected route redistribution	Working. /32 and /128 from L2TP subscribers.
NTP client	Working. System clock synchronization, clock readiness gate.
Sysctl profiles	Working. Named profiles (dsr, router, hardened, multihomed, proxy) for interface units.
TACACS+ AAA (RFC 8907)	Working. SSH auth, priv-lvl mapping, accounting, local bcrypt fallback.
Host inventory	Working. Hardware inventory, SMART monitoring, tuning engine, observability stack.
IPsec/IKEv2	Working. Native IKE engine in Go, initiator and responder roles, XFRM dataplane, PSK / X.509 / EAP-MSCHAPv2 / EAP-TLS, NAT-T, DPD, real CREATE_CHILD_SA rekeying (child and IKE SA, make-before-break), MOBIKE. strongSwan 5.9.14 interop tested.
PKI certificate store	Working. X.509 certs, CA chains, health monitoring, Prometheus metrics.
DHCP server	Working. Multiple named ranges, PXE extensions, static mappings.
FlowSpec-to-firewall bridge	Working. BGP FlowSpec to nftables conversion.
Subscriber session model	Working. Unified session model for L2TP/PPPoE subscribers.

Security and DNS

Subsystem	Status
DDoS auto-mitigation	Working. Volumetric detection from live traffic stats with packet-rate and bandwidth (BPS) p99 baselines, attack characterization, incident confidence scoring, and direction-aware mitigation (local INPUT drop, transit FORWARD drop, or FlowSpec upstream) governed by an allow/deny traffic policy. show ddos incidents.
Behavioral anomaly detection	Working. Report-only per-source pattern-of-life detector (deviation and cohort-rarity scoring, incident correlation, freeze-learn) plus a shadow-first responder with surgical per-source firewall rate-limits, arming, timed auto-revert, blast-radius cap, and kill switch. show anomaly detect, show anomaly shape.
AS112 anycast DNS	Working. RFC 7534/7535 sink for misdirected reverse-DNS with watchdog-gated BGP origination of the covering prefixes. FRR and BIRD interop tested.
GeoDNS	Working. Authoritative per-source-IP DNS server on the shared DNS harness.
Encrypted and validated DNS	Working. DoT (RFC 7858) and DoH (RFC 8484) listeners for AS112 and GeoDNS; DNSSEC stub validation (off/permissive/strict) in the resolver.
RADIUS operator authentication	Working. RFC 2865 PAP admin backend in the AAA chain (SSH, web, MCP): reject stops the chain, unreachable falls through to local. Separate from the L2TP subscriber RADIUS path.
Traffic usage accounting	Working. Per-interface and per-subscriber usage tracking and reporting.

Infrastructure

Area	Status
YANG configuration and validation	Working. Unknown keys rejected with suggestions. Backend capability gate rejects unsupported features at commit.
Build-time feature gates	Working. Subsystems compile out via build tags (gNMI, MCP, REST/gRPC APIs, telemetry exporter, and ISIS/LDP/OSPF/RSVP-TE) for smaller images and less attack surface.
Web RBAC and operator auth	Working. Read-only web sessions are gated (403) from the admin console and config editor; web login runs through the AAA chain (RADIUS/TACACS admins, local fallback); config download and upload with commit-equivalent validation; French locale and a small-screen layout.
Interactive config editor	Working. Tab completion, rollback, live validation. Dynamic YANG module discovery. Deactivate/activate on containers and leaves.
Config reload (SIGHUP)	Working. Add, remove, or update peers without a restart.
SSH-based CLI	Working. Interactive and single-command modes. Per-user SSH public key authentication.
REST API	Working. Dedicated HTTP(S) server, /api/v1/execute, /api/v1/commands, Swagger UI.
gRPC API	Working. ze.api.v1.ZeService, server reflection, built-in TLS.
gNMI	Working. Capabilities, Get, Set, Subscribe ONCE and STREAM. Bearer token, optional TLS. Env-gated, default port 9339.
CLI default output format	Working. Configurable default (text/table/json/yaml/ndjson) via config or set cli format; explicit pipe wins.
CLI session transcript	Working. Records ze cli and ze config edit sessions to $XDG_DATA_HOME/ze/transcripts/.
Hierarchical logging	Working. Per-subsystem levels, runtime changes. Structured log query via slog ring buffer.
Named service listeners	Working. Web, SSH, MCP, LG, REST, gRPC, telemetry all support multiple named endpoints with port conflict detection.
Typed EventBus	Working. Component-owned typed payloads with registry-bound generic handles.
Component health registry	Working. /health endpoint, per-component status.
ExaBGP config migration	Working. Auto-detect and convert.
ExaBGP plugin bridge	Partial. The compatibility bridge exists, but not all ExaBGP behavior is equivalent.
Chaos testing (ze-chaos)	Working. Deterministic replay, property validation. MCP server, per-family convergence. 6 parameterized action types (v2).
MCP integration	Working. Task-augmented tools/call, Apps resources capability.
System reboot	Working. system reboot for gokrazy/Linux appliances.
Appliance management	Working. ze install appliance init/build/run/push/config-push, vendored go run builder and OTA updater, encrypted secrets, batch operations, disaster recovery export/import.
Local install	Working. ze install local (FHS prefix, systemd auto-detect, config scaffold), ze service install/uninstall, ze uninstall (--purge).
Self-update	Working. Platform-aware backend: normal Linux uses SHA-256 verified download, atomic replacement, fleet spread, maintenance windows, rollback; gokrazy reports gokrazy-ab and defers to A/B image updates.
System readiness (ze doctor)	Working. Platform-aware offline pre-start checks with stable diagnostic codes, ze explain remediation.
Tech-support bundle (ze support)	Working. 20 pure-Go modules, sanitized config, module/time scoping, JSON manifest.
Debug flags	Working. Granular debug with toggle semantics, per-module flag/direction/scope filtering, named profiles, show debug live state query. Stored in debug.zefs.
Config nop keyword	Working. nop replaces set + inactive: in set format.
ze format	Working. Offline pipe formatting for any command output (json, table, match, count, resolve).
Show enricher registry	Working. Plugins contribute data to show commands via show.MustRegister(). External plugins use callback protocol.
Env-key autocomplete	Working. Tab completion for env var keys in operational CLI and shell.
Audit trail	Working. Local JSON-lines log for config commit/discard, reload, failed auth across all surfaces. show audit.
Crash capture	Working. Automatic panic capture to syslog and crash files with build/runtime metadata and ring buffer context.
Config schema stamp	Working. Schema version stamp with downgrade recovery.
Graceful listener migration	Working. Hot reload of web, LG, REST, gRPC, MCP listeners.
Docker	Working. Static binary on scratch base (~89 MB), Compose support.
Zero-touch provisioning	Working. ze install remote with PXE/DHCP/TFTP/HTTP, installer initrd, and first-boot bootstrap mode.
ZeFS integrity	Working. Per-record CRC32c, check/repair CLI.
Remote credentials	Working. Per-service SSH credential storage in ZeFS.

Interface management

Feature	Status
Ethernet, veth, bridge, dummy, loopback	Working. Netlink backend on Linux.
WireGuard interfaces	Working. Config parsing, wgctrl backend, reconciliation, reload.
Tunnel interfaces (GRE, IPIP, SIT, IP6TNL)	Working. Full family support via netlink.
XFRM interfaces	Working. Route-based IPsec via netlink.
Per-interface rate tracking	Working. 1-second sampler, CLI, Prometheus, web.
DHCP client	Working. Config-driven, route/DNS/NTP discovery, route-priority metric.
IPv6 default routes (RA)	Working. Router Advertisement default route management.
VPP interface backend	Working. GoVPP-backed lifecycle, addressing, bridge, monitor.
Link-state route failover	Working. Metric-based failover on link down.
ze interface scan	Working. Netlink-based interface discovery from CLI.

Diagnostics

Feature	Status
Core diagnostic commands	Working. 11 commands replacing ss, dmesg, lsof, dig, nc, traceroute, mtr, ping, tcpdump, pprof.
monitor ping	Working. Continuous ICMP with live stats.
monitor traceroute	Working. mtr-style continuous trace with | log | origin and | log | resolve.
monitor system netlink	Working. Kernel route/link/address event stream.
show capture interface	Working. AF_PACKET live capture with BPF filters.
DNS cache management	Working. List, delete, flush, stats.
BGP/L2TP/BFD FSM history	Working. Global event ring and per-peer history.
Active probes	Working. Internal ICMP engine for ping and traceroute (no OS shell-out), route lookup, TCP check.
Netdata-compatible OS metrics	Working. CPU, memory, network, disk, conntrack, IPv6, softirqs, sockstat6.
Health summaries and metrics query	Working.

Test suite

Type	Count
Unit test functions	18,000+
Functional test files (.ci)	700+
Fuzz targets	121
Linters	28
Mutation testing	gomu integration for multi-package mutation testing

Tests run with the race detector enabled. Functional test runners support per-step trace output and unified parallel scheduling.

What does not work

Not implemented

Feature	Notes
Full BGP confederation (RFC 5065)	AS path segment parsing exists, but full confederation deployment behavior is not supported. IETF draft-ietf-idr-deprecate-as-set-confed-set deprecates the AS_CONFED_SET segment type.
Dynamic neighbors	Supported for the route server (bgp-rs dynamic peers). Regular BGP peers must be explicitly configured.
AIGP	Plugin exists as a capability and the attribute encodes/decodes. The metric is not consumed in best-path selection.
Flowspec redirect to VRF with 4-byte ASN	Extended community type 0x82 encoding is implemented but decoding is not yet complete.
Demand mode BFD	Not implemented. Rarely deployed.
Seamless BFD (RFC 7880)	Not implemented.
BMP Loc-RIB (RFC 9069)	Not yet wired. Best-path events exist but are not connected to BMP.
BMP Route Mirroring (sender)	Not implemented on the sender side.
External plugin filesystem discovery	External plugins must be configured. Built-in plugins auto-load by config roots, families, event types, and send types.
Multi-instance	One daemon per config file.

Known rough edges

Area	Issue
ExaBGP compatibility	17 of 37 compat tests fail. The gaps are in wire encoding for specific attribute combinations.
macOS TCP MD5	Returns "not supported" because the Darwin kernel lacks it.
Error messages	Some parse errors could point more precisely at the offending input.
Packaging	Docker build support and install commands exist. Binary releases and package-manager workflows are still pre-release.

API stability

Nothing is stable. The configuration syntax, the JSON event format, the plugin IPC protocol, the CLI command names and output format, and the Go package APIs can all change without notice. Do not import Ze as a library.

Should you use Ze today

If you are coming from ExaBGP and want to try the migration story, file issues: the feedback is genuinely useful. If you need a production BGP daemon, use BIRD, FRR, or OpenBGPd. The Why Ze page has a fuller discussion of the trade-offs.

If you do use Ze, pin to a commit (there are no releases), run make ze-verify before deploying any build, start with monitoring rather than route injection, keep ExaBGP as a fallback, and file issues for anything that bites you.

See also

• What is Ze.
• Architecture.
• Comparison against other BGP daemons.

Adapted from main/docs/guide/status.md and main/docs/features.md.