status

Pre-Alpha. This page describes behavior that may change.

Ze is in early active development. It is not released and should not be used in production. APIs, configuration syntax, and plugin interfaces may change without notice. That said, anyone coming from ExaBGP who understands the risks may already find Ze useful for specific use cases, particularly route injection, BGP monitoring, and wire-level protocol tooling.

This page is the honest ledger. If a feature is listed here as working, it has tests behind it. If a feature is missing, it is missing.

What works

BGP protocol

Ze establishes BGP sessions, exchanges routes, and handles the full RFC 4271 FSM lifecycle. The wire layer encodes and decodes across every listed address family.

Area	Status
Session establishment (FSM)	Working. Tested against real peers and built-in test peers.
OPEN capability negotiation	Working. ASN4, ADD-PATH, Extended Messages, Extended Next-Hop, Graceful Restart, Route Refresh, Role, Hostname, Software Version.
UPDATE encode/decode	Working. Every address family decodes. Most encode.
NOTIFICATION handling	Working. All standard codes including the RFC 9003 shutdown communication.
Keepalive and hold timer	Working.
TCP MD5 authentication	Working on Linux and FreeBSD. Not available on macOS (kernel limitation).
UPDATE coalescing	Working. Consecutive IPv4 unicast UPDATEs with identical attributes are merged.

Address families

All families decode. Most encode. Run ze --plugins to see the current state on your build.

Family	Decode	Encode	Config routes
IPv4 / IPv6 unicast	Yes	Yes	Yes
IPv4 / IPv6 multicast	Yes	Yes	Yes
VPNv4 / VPNv6	Yes	Yes	Yes
EVPN	Yes	Yes	Yes
FlowSpec (IPv4, IPv6, VPN)	Yes	Yes	Yes
Labeled unicast	Yes	Yes	Yes
BGP-LS	Yes	No	No
VPLS	Yes	Yes	Yes
MVPN	Yes	No	No
Route Target Constraint	Yes	No	No
Mobile User Plane	Yes	Yes	Yes

Plugins

Over 40 plugins ship in-tree. The plugin lifecycle (five-stage handshake, typed IPC, event dispatch) is usable for new plugins, with the caveat that the RPC names and payloads are not stable.

Plugin	Status
bgp-rib (route storage, best-path, N-way multipath, multi-source protocol IDs)	Working
bgp-rs (route server, reactor-native forwarding with direct TCP write)	Working
bgp-rr (route reflector, RFC 4456)	Working
bgp-gr (RFC 4724 graceful restart)	Working
bgp-rpki (RTR client, origin validation, fail-open)	Working
bgp-adj-rib-in (raw hex replay)	Working
bgp-route-refresh (RFC 2918 and 7313)	Working
bgp-role (RFC 9234, OTC filtering)	Working
bgp-hostname, bgp-softver	Working
bgp-llnh (link-local next hop)	Working
bgp-persist (across restarts)	Working
bgp-watchdog (deferred announcement)	Working
bgp-healthcheck (service healthcheck)	Working
bgp-aigp (RFC 7311, AIGP attribute)	Working
bgp-bmp (RFC 7854, receiver, sender, Adj-RIB-Out, looking glass integration)	Working
bgp-filter-community (tag/strip)	Working
bgp-filter-prefix (per-prefix modify)	Working
bgp-filter-aspath (AS-path regex)	Working
bgp-route-modify (attribute modifier)	Working
bgp-redistribute (cross-protocol route advertising)	Working
bfd (RFC 5880/5881/5882/5883, echo, auth)	Working
All nine NLRI plugins	Working, decode and encode

Beyond BGP

Subsystem	Status
L2TP/PPP (RFC 2661, BNG)	Working. Tunnel FSM, session FSM, LCP, CHAP/PAP/MS-CHAPv2 auth, IPCP/IPv6CP, kernel data plane via l2tp_ppp. RADIUS auth/acct, traffic shaping, CQM, session observer, Prometheus metrics, web UI.
PPPoE (RFC 2516)	Working. Access concentrator, AC-Cookie, PADI rate limiting, shared PPP driver with L2TP.
Firewall (nftables + VPP backends)	Working. Stateful firewall rules, conntrack, expression lowering. VPP NAT44-ED (SNAT/DNAT/masquerade), ACL classify pipeline, SetMark, Limit.
Traffic control (tc and VPP backends)	Working. Per-interface queueing disciplines, HTB, TBF, FQ, netem.
VPP data plane	Working. Process lifecycle, DPDK NIC binding, FIB programming via GoVPP, stats telemetry. MPLS label programming from labeled unicast.
Static routes	Working. ECMP, weighted load balancing, BFD failover, blackhole, reject.
Policy routing	Working. nftables-based PBR with fwmark, kernel ip rules, auto-managed tables.
Connected route redistribution	Working. /32 and /128 from L2TP subscribers.
NTP client	Working. System clock synchronization, clock readiness gate.
Sysctl profiles	Working. Named profiles (dsr, router, hardened, multihomed, proxy) for interface units.
TACACS+ AAA (RFC 8907)	Working. SSH auth, priv-lvl mapping, accounting, local bcrypt fallback.
Host inventory	Working. Hardware inventory, SMART monitoring, tuning engine, observability stack.
IPsec/IKEv2	Working. Native IKE engine in Go, XFRM dataplane, EAP-MSCHAPv2/TLS, NAT-T, DPD, rekeying, MOBIKE. strongSwan interop tested.
PKI certificate store	Working. X.509 certs, CA chains, health monitoring, Prometheus metrics.
DHCP server	Working. Multiple named ranges, PXE extensions, static mappings.
FlowSpec-to-firewall bridge	Working. BGP FlowSpec to nftables conversion.
Subscriber session model	Working. Unified session model for L2TP/PPPoE subscribers.

Infrastructure

Area	Status
YANG configuration and validation	Working. Unknown keys rejected with suggestions. Backend capability gate rejects unsupported features at commit.
Interactive config editor	Working. Tab completion, rollback, live validation. Dynamic YANG module discovery. Deactivate/activate on containers and leaves.
Config reload (SIGHUP)	Working. Add, remove, or update peers without a restart.
SSH-based CLI	Working. Interactive and single-command modes. Per-user SSH public key authentication.
REST API	Working. Dedicated HTTP(S) server, /api/v1/execute, /api/v1/commands, Swagger UI.
gRPC API	Working. ze.api.v1.ZeService, server reflection, built-in TLS.
Hierarchical logging	Working. Per-subsystem levels, runtime changes. Structured log query via slog ring buffer.
Named service listeners	Working. Web, SSH, MCP, LG, REST, gRPC, telemetry all support multiple named endpoints with port conflict detection.
Typed EventBus	Working. Component-owned typed payloads with registry-bound generic handles.
Component health registry	Working. /health endpoint, per-component status.
ExaBGP config migration	Working. Auto-detect and convert.
ExaBGP plugin bridge	Partial. 20 of 37 compatibility tests pass.
Chaos testing (ze-chaos)	Working. Deterministic replay, property validation. MCP server, per-family convergence. 6 parameterized action types (v2).
MCP integration	Working. Task-augmented tools/call, Apps resources capability.
System reboot	Working. system reboot for gokrazy/Linux appliances.
Appliance management	Working. ze appliance init/build/run/push/config-push, encrypted secrets, batch operations, disaster recovery export/import.
Self-update	Working. SHA-256 verified download, atomic binary replacement, fleet spread scheduling, maintenance windows, rollback.
System readiness (ze doctor)	Working. Offline pre-start checks with stable diagnostic codes, ze explain remediation.
Crash capture	Working. Automatic panic capture to syslog and crash files with ring buffer context.
Config schema stamp	Working. Schema version stamp with downgrade recovery.
Graceful listener migration	Working. Hot reload of web, LG, REST, gRPC, MCP listeners.
Docker	Working. Static binary on scratch base (~89 MB), Compose support.
Zero-touch provisioning	Working. ze install serve with PXE/DHCP/TFTP/HTTP.
ZeFS integrity	Working. Per-record CRC32c, check/repair CLI.
Remote credentials	Working. Per-service SSH credential storage in ZeFS.

Interface management

Feature	Status
Ethernet, veth, bridge, dummy, loopback	Working. Netlink backend on Linux.
WireGuard interfaces	Working. Config parsing, wgctrl backend, reconciliation, reload.
Tunnel interfaces (GRE, IPIP, SIT, IP6TNL)	Working. Full family support via netlink.
XFRM interfaces	Working. Route-based IPsec via netlink.
Per-interface rate tracking	Working. 1-second sampler, CLI, Prometheus, web.
DHCP client	Working. Config-driven, route/DNS/NTP discovery, route-priority metric.
IPv6 default routes (RA)	Working. Router Advertisement default route management.
VPP interface backend	Working. GoVPP-backed lifecycle, addressing, bridge, monitor.
Link-state route failover	Working. Metric-based failover on link down.
ze interface scan	Working. Netlink-based interface discovery from CLI.

Diagnostics

Feature	Status
Core diagnostic commands	Working. 11 commands replacing ss, dmesg, lsof, dig, nc, traceroute, mtr, ping, tcpdump, pprof.
monitor ping	Working. Continuous ICMP with live stats.
monitor traceroute	Working. mtr-style continuous trace with | log | origin and | log | resolve.
monitor system netlink	Working. Kernel route/link/address event stream.
show capture interface	Working. AF_PACKET live capture with BPF filters.
DNS cache management	Working. List, delete, flush, stats.
BGP/L2TP/BFD FSM history	Working. Global event ring and per-peer history.
Active probes	Working. Ping, traceroute, route lookup, TCP check.
Netdata-compatible OS metrics	Working. CPU, memory, network, disk, conntrack, IPv6, softirqs, sockstat6.
Health summaries and metrics query	Working.

Test suite

Type	Count
Unit test functions	18,000+
Functional test files (.ci)	700+
Fuzz targets	121
Linters	28

Tests run with the race detector enabled.

What does not work

Not implemented

Feature	Notes
MRT dump (RFC 6396)	Not implemented for writing. Reading works for analysis via ze-analyse.
Confederation (RFC 5065)	Not implemented. IETF draft-ietf-idr-deprecate-as-set-confed-set deprecates the AS_CONFED_SET segment type.
ASPA verification	Not implemented. RPKI origin validation only.
Dynamic neighbors	Every peer must be explicitly configured.
Private AS removal	Not implemented.
AIGP	Plugin exists as a capability. The metric is not consumed in best-path selection.
Flowspec redirect to VRF with 4-byte ASN	Extended community type 0x82 encoding is implemented but decoding is not yet complete.
Demand mode BFD	Not implemented. Rarely deployed.
Seamless BFD (RFC 7880)	Not implemented.
BMP Loc-RIB (RFC 9069)	Not yet wired. Best-path events exist but are not connected to BMP.
BMP Route Mirroring (sender)	Not implemented on the sender side.
Auto plugin discovery	Plugins must be declared in the config.
Multi-instance	One daemon per config file.

Known rough edges

Area	Issue
ExaBGP compatibility	17 of 37 compat tests fail. The gaps are in wire encoding for specific attribute combinations.
TTL security	Parsed from config but not wired to the socket options.
macOS TCP MD5	Returns "not supported" because the Darwin kernel lacks it.
Error messages	Some parse errors could point more precisely at the offending input.
Packaging	No Docker image, no binary releases, no OS packages. Build from source.

API stability

Nothing is stable. The configuration syntax, the JSON event format, the plugin IPC protocol, the CLI command names and output format, and the Go package APIs can all change without notice. Do not import Ze as a library.

Should you use Ze today

If you are coming from ExaBGP and want to try the migration story, file issues: the feedback is genuinely useful. If you need a production BGP daemon, use BIRD, FRR, or OpenBGPd. The Why Ze page has a fuller discussion of the trade-offs.

If you do use Ze, pin to a commit (there are no releases), run make ze-verify before deploying any build, start with monitoring rather than route injection, keep ExaBGP as a fallback, and file issues for anything that bites you.

See also

• What is Ze.
• Architecture.
• Comparison against other BGP daemons.

Adapted from main/docs/guide/status.md and main/docs/features.md.