-
Notifications
You must be signed in to change notification settings - Fork 2
command catalog
Pre-Alpha. This page is auto-generated from
ze help command --json.
- cache (1)
- clear (10)
- command (3)
- commit (1)
- config (1)
- crashes (2)
- daemon (5)
- debug (3)
- del (1)
- doctor (1)
- event (1)
- explain (1)
- fakel2tp (2)
- fakeredist (3)
- generate (1)
- help (2)
- host (2)
- interface (13)
- log (3)
- metrics (3)
- monitor (7)
- peer (15)
- ping (1)
- plugin (10)
- request (2)
- resolve (11)
- set (3)
- show (152)
- skills (1)
- subscribe (1)
- summary (1)
- support (1)
- system (8)
- unsubscribe (1)
- update (6)
- validate (1)
| Command | Mode | Description |
|---|---|---|
cache |
read-only | Manage cached BGP UPDATE messages. |
Manage cached BGP UPDATE messages. Actions: list (show cached entries), retain (hold a message), release (free a retained message), expire (force eviction), forward (send a cached message to peers). Grammar: cache [args].
Mode: read-only | Wire: ze-bgp:cache
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
clear bgp rib in |
daemon | Remove all routes received from a peer. |
clear bgp rib out |
daemon | Re-advertise all routes to a peer. |
clear dns cache |
daemon | Clear the DNS cache. |
clear interface |
daemon | Reset interface traffic counters. |
clear interface counters |
daemon | Zero the Rx/Tx counters for one interface or all. |
clear l2tp session teardown |
daemon | Disconnect one subscriber session. |
clear l2tp session teardown-all |
daemon | Disconnect every L2TP session on this box. |
clear l2tp tunnel teardown |
daemon | Gracefully tear down one L2TP tunnel. |
clear l2tp tunnel teardown-all |
daemon | Tear down every L2TP tunnel on this box. |
clear vpn ipsec sa |
daemon | Tear down IKE Security Associations. |
Remove all routes received from a peer. Wipes the Adj-RIB-In for matched peers. They will need to re-advertise everything (or you can send a route-refresh). Selector: IP, name, AS pattern, glob, or *.
Mode: daemon | Wire: ze-rib-api:clear-in
Task support: forbidden
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Re-advertise all routes to a peer. Triggers a full Adj-RIB-Out replay to the selected peers. Useful after a policy change to push updated attributes without tearing down the session. Selector: IP, name, AS pattern, glob, or *.
Mode: daemon | Wire: ze-rib-api:clear-out
Task support: forbidden
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Clear the DNS cache. With no argument, flushes everything. Use 'record ' to evict one entry, or 'stats' to see hit/miss rates without flushing.
Mode: daemon | Wire: ze-clear:dns-cache
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Reset interface traffic counters. Zeroes Rx/Tx byte and packet counters. Without a name, clears every managed interface. Some backends store a baseline instead of resetting the kernel counters directly.
Mode: daemon | Wire: ze-clear:interface-counters
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: counters
Zero the Rx/Tx counters for one interface or all. Usage: clear interface counters [].
Mode: daemon | Wire: ze-clear:interface-counters
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Disconnect one subscriber session. Sends a CDN to gracefully close the session. Pass the local session ID.
Mode: daemon | Wire: ze-l2tp-api:session-teardown
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Disconnect every L2TP session on this box. Sends CDN for all sessions across all tunnels. Tunnels themselves stay up. Use with care.
Mode: daemon | Wire: ze-l2tp-api:session-teardown-all
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Gracefully tear down one L2TP tunnel. Sends a StopCCN to the peer. All sessions on this tunnel will be disconnected. Pass the local tunnel ID.
Mode: daemon | Wire: ze-l2tp-api:tunnel-teardown
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Tear down every L2TP tunnel on this box. Sends StopCCN for all tunnels. Every subscriber session will be disconnected. Use with care during maintenance.
Mode: daemon | Wire: ze-l2tp-api:tunnel-teardown-all
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Tear down IKE Security Associations. Without arguments, terminates all SAs. Use 'peer ' to clear just one peer. The tunnel will renegotiate automatically if the config is still active.
Mode: daemon | Wire: ze-clear:vpn-ipsec-sa
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
command complete |
read-only | Get tab-completion candidates for a partial command. |
command help |
read-only | Show usage and arguments for a specific command. |
command list |
read-only | List every command the daemon knows about. |
Get tab-completion candidates for a partial command. Returns possible completions for the given input. Used internally by the CLI editor, but also callable for scripting.
Mode: read-only | Wire: ze-bgp:command-complete
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show usage and arguments for a specific command. Gives you the full description, expected arguments, and usage pattern for one command.
Mode: read-only | Wire: ze-bgp:command-help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List every command the daemon knows about. Returns dispatch key and description for each. Useful for scripting or discovering commands not shown in the top-level help.
Mode: read-only | Wire: ze-bgp:command-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
commit |
daemon | Group route changes into named atomic commits. |
Group route changes into named atomic commits. Actions: start (begin a commit), end (finalize), eor (signal end of RIB), rollback (undo), show (inspect), withdraw (remove all routes in a commit), list (show all commits). Grammar: commit [args].
Mode: daemon | Wire: ze-bgp:commit
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
config archive |
daemon | Save a snapshot of the current running configuration. |
Save a snapshot of the current running configuration. Captures the config into the store for later rollback or comparison. Optional name labels the snapshot; defaults to a timestamp.
Mode: daemon | Wire: ze-config-archive:trigger
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
crashes |
offline | View saved crash reports from panics (offline) |
crashes show |
offline | Show a crash report. Use 'latest' for the most recent, or pass a filename. Contains the goroutine stack trace at the time of panic. |
| Command | Mode | Description |
|---|---|---|
daemon quit |
daemon | Dump goroutine stacks and shutdown |
daemon reboot |
daemon | Gracefully shutdown then reboot the system |
daemon reload |
daemon | Reload the configuration |
daemon shutdown |
daemon | Gracefully shutdown the daemon |
daemon status |
read-only | Show daemon status |
Mode: daemon | Wire: ze-system:daemon-quit
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-system:daemon-reboot
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-system:daemon-reload
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-system:daemon-shutdown
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:daemon-status
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
debug disable |
offline | Turn off a debug flag and remove it from ZeFS. |
debug enable |
offline | Turn on a debug flag. Persisted in ZeFS so it survives restarts. |
debug show |
offline | List all debug flags currently enabled. |
| Command | Mode | Description |
|---|---|---|
del bgp peer |
daemon | Remove a peer from the running config. |
Remove a peer from the running config. Tears down the TCP session and deletes the peer from the running configuration. Does not modify the config file on disk. Use 'set bgp peer save' afterward if you want the removal to survive a restart.
Mode: daemon | Wire: ze-del:bgp-peer
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
doctor |
offline | Verify kernel features, file descriptor limits, sockets, and required dependencies. Run this before first start or after platform changes. |
| Command | Mode | Description |
|---|---|---|
event list |
read-only | List every event type you can subscribe to. |
List every event type you can subscribe to. Shows event name, category, and payload structure. Use this to discover what events are available before subscribing.
Mode: read-only | Wire: ze-bgp:event-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
explain |
offline | Print the meaning, likely cause, and recommended fix for a Ze diagnostic code. Pass the code you saw in a log or error message. |
| Command | Mode | Description |
|---|---|---|
fakel2tp emit |
daemon | Emit one synthetic L2TP route-change batch |
fakel2tp help |
daemon | Print the fakel2tp command surface |
Mode: daemon | Wire: ze-fakel2tp-api:fakel2tp-emit
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-fakel2tp-api:fakel2tp-help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
fakeredist emit |
daemon | Emit one synthetic route-change batch |
fakeredist emit-burst |
daemon | Emit N synthetic batches sequentially |
fakeredist help |
daemon | Print the fakeredist command surface |
Mode: daemon | Wire: ze-fakeredist-api:fakeredist-emit
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-fakeredist-api:fakeredist-emit-burst
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: daemon | Wire: ze-fakeredist-api:fakeredist-help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
generate wireguard keypair |
offline | Generate a WireGuard keypair. Prints private and public keys to stdout for use in your config. |
| Command | Mode | Description |
|---|---|---|
help |
read-only | Show available commands at this level. |
help command |
offline | List every command with its description. Use a filter to narrow the list. |
Show available commands at this level. Lists every registered command verb with a brief description.
Mode: read-only | Wire: ze-bgp:help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
host |
offline | Show hardware inventory for this box (offline) |
host show |
offline | Show hardware details by section (cpu, nic, dmi, memory, thermal, storage, kernel). JSON by default, --text for human-readable. |
| Command | Mode | Description |
|---|---|---|
interface addr-add |
daemon | Add an IP address to an interface. |
interface addr-del |
daemon | Remove an IP address from an interface. |
interface create-bridge |
daemon | Create a Linux bridge for L2 forwarding. |
interface create-dummy |
daemon | Create a dummy (loopback-style) interface. |
interface create-veth |
daemon | Create a veth pair (two linked virtual Ethernet interfaces). |
interface delete |
daemon | Delete an interface from the kernel. |
interface down |
daemon | Shut down an interface. |
interface mac |
daemon | Set the MAC address on an interface. |
interface migrate |
daemon | Move IP addresses between interfaces with minimal downtime. |
interface mtu |
daemon | Set the MTU on an interface. |
interface unit-add |
daemon | Add a VLAN sub-interface (802.1Q tagged). |
interface unit-del |
daemon | Remove a VLAN sub-interface. |
interface up |
daemon | Bring an interface up. |
Add an IP address to an interface. Usage: interface addr-add . Use CIDR notation (e.g. 10.0.0.1/24). Multiple addresses on one interface are fine.
Mode: daemon | Wire: ze-iface:interface-addr-add
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Remove an IP address from an interface. Usage: interface addr-del . The prefix must match an assigned address exactly (including mask length).
Mode: daemon | Wire: ze-iface:interface-addr-del
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Create a Linux bridge for L2 forwarding. Usage: interface create-bridge . Add ports to it with standard bridge configuration.
Mode: daemon | Wire: ze-iface:interface-create-bridge
Requires backend: netlink
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Create a dummy (loopback-style) interface. Usage: interface create-dummy . Good for hosting service IPs that are not tied to a physical link.
Mode: daemon | Wire: ze-iface:interface-create-dummy
Requires backend: netlink
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Create a veth pair (two linked virtual Ethernet interfaces). Usage: interface create-veth . Commonly used for connecting namespaces or testing.
Mode: daemon | Wire: ze-iface:interface-create-veth
Requires backend: netlink
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Delete an interface from the kernel. Usage: interface delete . The interface and all its addresses are removed immediately.
Mode: daemon | Wire: ze-iface:interface-delete
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Shut down an interface. Usage: interface down . All traffic stops immediately.
Mode: daemon | Wire: ze-iface:interface-down
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Set the MAC address on an interface. Usage: interface mac aa:bb:cc:dd:ee:ff. Some backends require the interface to be down first.
Mode: daemon | Wire: ze-iface:interface-mac
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Move IP addresses between interfaces with minimal downtime. Adds addresses to the target before removing them from the source (make-before-break). Useful during NIC replacements or interface consolidation.
Mode: daemon | Wire: ze-iface:interface-migrate
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Set the MTU on an interface. Usage: interface mtu . Range: 68 to 65535. Standard Ethernet is 1500; jumbo frames typically 9000.
Mode: daemon | Wire: ze-iface:interface-mtu
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Add a VLAN sub-interface (802.1Q tagged). Usage: interface unit-add . Creates a new sub-interface on the parent with the given VLAN tag.
Mode: daemon | Wire: ze-iface:interface-unit-add
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Remove a VLAN sub-interface. Usage: interface unit-del .
Mode: daemon | Wire: ze-iface:interface-unit-del
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Bring an interface up. Usage: interface up . Traffic starts flowing once the link is also physically up.
Mode: daemon | Wire: ze-iface:interface-up
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
log levels |
daemon | Show what log level each subsystem is using. |
log recent |
daemon | Show recent log entries from the in-memory ring. |
log set |
daemon | Change a subsystem's log level without restarting. |
Show what log level each subsystem is using. Lists every registered logger with its current level. Use 'log set' to change a level at runtime without restarting.
Mode: daemon | Wire: ze-bgp:log-levels
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show recent log entries from the in-memory ring. Filters (all optional): level , component , count . Newest entries first. Useful when you cannot access the log file directly.
Mode: daemon | Wire: ze-bgp:log-recent
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
component |
string | ||
count |
uint | ||
level |
enum | debug, disabled, err, info, warn |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Change a subsystem's log level without restarting. Usage: log set . Takes effect immediately. Set to debug when troubleshooting, then back to info when you are done.
Mode: daemon | Wire: ze-bgp:log-set
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
level |
enum | debug, disabled, err, info, warn | |
logger |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
metrics list |
read-only | List all registered metric names (no values). |
metrics pool |
read-only | Show attribute pool memory usage and dedup efficiency. |
metrics values |
read-only | Dump all metrics in Prometheus text format. |
List all registered metric names (no values). Useful for discovering what metrics exist before querying them.
Mode: read-only | Wire: ze-bgp:metrics-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show attribute pool memory usage and dedup efficiency. Returns allocated entries, reference counts, and deduplication hit rates per attribute type. Watch the dedup rate to gauge how much memory pooling is saving you.
Mode: read-only | Wire: ze-bgp:pool-stats
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Dump all metrics in Prometheus text format. Outputs every registered metric with labels and values. Suitable for feeding into Prometheus, Grafana, or curl-based monitoring.
Mode: read-only | Wire: ze-bgp:metrics-values
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
monitor bgp |
read-only | Live BGP peer dashboard that refreshes automatically. |
monitor event |
read-only | Stream live events as they happen. |
monitor interface rate |
read-only | Stream per-second traffic rates for your interfaces. |
monitor ping |
read-only | Continuous ping with live loss and RTT statistics. |
monitor system netlink |
read-only | Watch kernel networking changes in real time. |
monitor traceroute |
read-only | Live mtr-style traceroute that updates continuously. |
monitor vpn ipsec |
read-only | Watch IPsec SA events as they happen. |
Live BGP peer dashboard that refreshes automatically. Shows all peers with state, uptime, and prefix counts. State changes highlight as they happen. Ctrl-C to stop.
Mode: read-only | Wire: ze-bgp:monitor
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Stream live events as they happen. Shows a real-time feed of internal events. Filter with include or exclude to focus on what matters. Patterns match event type names.
Mode: read-only | Wire: ze-event:monitor
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Stream per-second traffic rates for your interfaces. Shows rx/tx bytes and packets per second, updating every second. Optionally pass an interface name to watch just one link.
Mode: read-only | Wire: ze-monitor:interface-rate
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Continuous ping with live loss and RTT statistics. Pings until you stop it. Adjust interval and timeout as needed. Shows running min/avg/max RTT and packet loss.
Mode: read-only | Wire: ze-monitor:ping
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Watch kernel networking changes in real time. Streams netlink events: route adds/deletes, link state changes, address assignments. Filter with route, link, address, or all.
Mode: read-only | Wire: ze-monitor:system-netlink
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Live mtr-style traceroute that updates continuously. Shows each hop with running RTT statistics. Keeps probing so you can watch path changes and latency shifts over time.
Mode: read-only | Wire: ze-monitor:traceroute
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Watch IPsec SA events as they happen. Streams sa-up, sa-down, child-up, child-down, and child-rekey events. Useful for debugging tunnel flaps or rekey issues.
Mode: read-only | Wire: ze-monitor:vpn-ipsec
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
peer borr |
read-only | Start an Enhanced Route Refresh cycle (RFC 7313). |
peer capabilities |
read-only | Show what capabilities were negotiated with a peer. |
peer clear soft |
read-only | Soft-clear a peer without dropping the session. |
peer detail |
read-only | Show full detail for one or more peers. |
peer eorr |
read-only | Finish an Enhanced Route Refresh cycle (RFC 7313). |
peer flush |
read-only | Wait until all queued updates for a peer are sent. |
peer list |
read-only | List your peers, one line each. |
peer pause |
read-only | Pause reading from a peer's TCP socket. |
peer plugin session ready |
read-only | Signal that per-peer plugin setup is complete. |
peer raw |
read-only | Send raw bytes into a peer's TCP stream (dangerous). |
peer refresh |
read-only | Ask a peer to re-send all routes (RFC 2918). |
peer resume |
read-only | Resume reading from a previously paused peer. |
peer statistics |
read-only | Show UPDATE throughput and message counters. |
peer teardown |
read-only | Tear down a peer session. |
peer update |
read-only | Send a pre-built BGP UPDATE to a peer. |
Start an Enhanced Route Refresh cycle (RFC 7313). Tells the peer to mark existing routes as stale. After re-sending, send EORR to purge anything not refreshed.
Mode: read-only | Wire: ze-bgp:peer-borr
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show what capabilities were negotiated with a peer. Compares the OPEN you sent vs the OPEN you received.
Mode: read-only | Wire: ze-bgp:peer-capabilities
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Soft-clear a peer without dropping the session. Sends ROUTE-REFRESH for every negotiated AFI/SAFI, causing the peer to re-send all routes. No session bounce, no traffic impact. Selector: IP, name, AS pattern, glob, or *.
Mode: read-only | Wire: ze-bgp:peer-clear-soft
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one or more peers. Returns config, state, timers, message counters, and notification history. Selector: IP, name, AS pattern (as65001), glob, or *.
Mode: read-only | Wire: ze-bgp:peer-detail
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Finish an Enhanced Route Refresh cycle (RFC 7313). The peer purges any routes not re-advertised since the matching BORR. Only send this after the peer has finished re-advertising.
Mode: read-only | Wire: ze-bgp:peer-eorr
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Wait until all queued updates for a peer are sent. Blocks until the forward pool drains. Use this before teardown or maintenance to ensure nothing is left unsent.
Mode: read-only | Wire: ze-bgp:peer-flush
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List your peers, one line each. Shows name, address, ASN, state, and uptime. Quick overview without the detail of 'peer detail'.
Mode: read-only | Wire: ze-bgp:peer-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Pause reading from a peer's TCP socket. Stops processing incoming messages until you 'peer resume'. Useful for debugging or applying backpressure. The peer's hold timer may fire if you pause too long.
Mode: read-only | Wire: ze-bgp:peer-pause
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Signal that per-peer plugin setup is complete. Call this after your plugin finishes per-peer initialization so Ze knows you are ready to process events for this peer.
Mode: read-only | Wire: ze-plugin:session-peer-ready
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Send raw bytes into a peer's TCP stream (dangerous). Injects arbitrary bytes with no BGP framing or validation. Intended for conformance testing and fuzzing only. Will likely break the session if used carelessly.
Mode: read-only | Wire: ze-bgp:peer-raw
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Ask a peer to re-send all routes (RFC 2918). Sends a ROUTE-REFRESH message for the specified AFI/SAFI. The peer will re-advertise its entire Adj-RIB-Out. Selector: IP, name, AS pattern, glob, or *.
Mode: read-only | Wire: ze-bgp:peer-refresh
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Resume reading from a previously paused peer. Picks up message processing where you left off.
Mode: read-only | Wire: ze-bgp:peer-resume
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show UPDATE throughput and message counters. Returns message counts, prefix counts, and per-second rates.
Mode: read-only | Wire: ze-bgp:peer-statistics
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Tear down a peer session. Sends a CEASE notification with an optional shutdown message (RFC 8203) so the remote side knows why you disconnected. Selector: IP, name, AS pattern, glob, or *. The session will not come back until you bring it up again.
Mode: read-only | Wire: ze-bgp:peer-teardown
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Send a pre-built BGP UPDATE to a peer. Payload can be text (human-readable route syntax), hex, or base64. Use 'show bgp encode' to build the payload, then send it here.
Mode: read-only | Wire: ze-bgp:peer-update
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
ping |
offline | Ping a target using the OS ping command. Use --count N and --interface IF to control the test. |
| Command | Mode | Description |
|---|---|---|
plugin ack |
read-only | Choose sync or async event delivery. |
plugin command complete |
read-only | Complete command/args |
plugin command help |
read-only | Show command details |
plugin command list |
read-only | List plugin commands |
plugin encoding |
read-only | Choose json or text encoding for plugin events. |
plugin format |
read-only | Choose how BGP message bytes appear in events. |
plugin help |
read-only | List plugin subcommands |
plugin session bye |
read-only | Disconnect |
plugin session ping |
read-only | Health check (returns PID) |
plugin session ready |
read-only | Signal plugin init complete |
Choose sync or async event delivery. sync: Ze waits for your plugin to acknowledge each event before sending the next one. Safer but slower. async: events fire without waiting, giving higher throughput at the cost of backpressure control.
Mode: read-only | Wire: ze-bgp:plugin-ack
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:command-complete
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:command-help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:command-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Choose json or text encoding for plugin events. Controls how events are serialized in this session. JSON is structured and parseable; text is more compact.
Mode: read-only | Wire: ze-bgp:plugin-encoding
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Choose how BGP message bytes appear in events. hex and base64 are compact wire representations. parsed decodes attributes into structured fields. full includes both wire bytes and parsed content.
Mode: read-only | Wire: ze-bgp:plugin-format
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:session-bye
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:session-ping
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-plugin:session-ready
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
request bgp rib inject |
daemon | Inject a synthetic route into the Adj-RIB-In. |
request bgp rib withdraw |
daemon | Withdraw a route from the Adj-RIB-In. |
Inject a synthetic route into the Adj-RIB-In. Behaves as if the route was received from a peer. Use this for testing policy filters or simulating route announcements.
Mode: daemon | Wire: ze-rib-api:inject
Task support: forbidden
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Withdraw a route from the Adj-RIB-In. Removes a previously injected or received route from a peer's Adj-RIB-In, triggering best-path recomputation.
Mode: daemon | Wire: ze-rib-api:withdraw
Task support: forbidden
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
resolve cymru asn-name |
read-only | Find out who owns an AS number. |
resolve dns a |
read-only | Look up IPv4 addresses (A records) for a hostname. |
resolve dns aaaa |
read-only | Look up IPv6 addresses (AAAA records) for a hostname. |
resolve dns ptr |
read-only | Reverse-lookup an IP address to its hostname (PTR). |
resolve dns txt |
read-only | Look up TXT records for a hostname. |
resolve irr expand |
read-only | Expand an AS-SET into its member AS numbers. |
resolve irr prefix |
read-only | Get all prefixes announced by an AS-SET's members. |
resolve peeringdb as-set |
read-only | Find the IRR AS-SET registered for an ASN in PeeringDB. |
resolve peeringdb max-prefix |
read-only | Get max-prefix limits for an ASN from PeeringDB. |
resolve ping |
read-only | Ping from the router with optional source binding. |
resolve traceroute |
read-only | Traceroute from the router with optional source binding. |
Find out who owns an AS number. Queries Team Cymru DNS to return the organization name for the ASN. Usage: resolve cymru asn-name .
Mode: read-only | Wire: ze-resolve:cymru-asn-name
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Look up IPv4 addresses (A records) for a hostname. Usage: resolve dns a .
Mode: read-only | Wire: ze-resolve:dns-a
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Look up IPv6 addresses (AAAA records) for a hostname. Usage: resolve dns aaaa .
Mode: read-only | Wire: ze-resolve:dns-aaaa
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Reverse-lookup an IP address to its hostname (PTR). Usage: resolve dns ptr .
Mode: read-only | Wire: ze-resolve:dns-ptr
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Look up TXT records for a hostname. Usage: resolve dns txt . Returns all TXT strings.
Mode: read-only | Wire: ze-resolve:dns-txt
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Expand an AS-SET into its member AS numbers. Recursively resolves nested AS-SET objects via WHOIS into a flat list. Useful for building prefix filters from IRR data.
Mode: read-only | Wire: ze-resolve:irr-expand
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Get all prefixes announced by an AS-SET's members. Expands the AS-SET, then returns every route/route6 object for each member ASN. Use this to build or verify prefix filters.
Mode: read-only | Wire: ze-resolve:irr-prefix
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Find the IRR AS-SET registered for an ASN in PeeringDB. Usage: resolve peeringdb as-set . Feed the result into 'resolve irr expand' to get the full member list.
Mode: read-only | Wire: ze-resolve:peeringdb-as-set
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Get max-prefix limits for an ASN from PeeringDB. Returns IPv4 and IPv6 prefix limits. Use 'update bgp peer prefix' to apply them automatically. Usage: resolve peeringdb max-prefix .
Mode: read-only | Wire: ze-resolve:peeringdb-max-prefix
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Ping from the router with optional source binding. Usage: resolve ping [source ] [count ] [size ].
Mode: read-only | Wire: ze-resolve:ping
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Traceroute from the router with optional source binding. Usage: resolve traceroute [source ].
Mode: read-only | Wire: ze-resolve:traceroute
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
set bgp peer save |
daemon | Persist peer configuration to the config file. |
set bgp peer with |
daemon | Change a running peer's parameters on the fly. |
set system file-descriptors |
daemon | Raise the file descriptor limit for the daemon process. |
Persist peer configuration to the config file. Writes the current runtime peer config for matched peers back to disk so changes survive a restart. Selector: IP, name, AS pattern, glob, or *.
Mode: daemon | Wire: ze-set:bgp-peer-save
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Change a running peer's parameters on the fly. Modifies ASN, local-as, timers, and other settings without tearing down the session where possible. Usage: set bgp peer with .
Mode: daemon | Wire: ze-set:bgp-peer-with
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Raise the file descriptor limit for the daemon process. Pass a number or 'max' to go to the hard limit. Takes effect immediately. Check current limits with 'show system file-descriptors'.
Mode: daemon | Wire: ze-set:system-file-descriptors
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
limit |
union | max |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
show aaa accounting |
read-only | Show AAA accounting counters and any dropped records. |
show audit |
read-only | Show who did what and when on this box. |
show bfd profile |
read-only | Show BFD timer profiles with effective values. |
show bfd session |
read-only | Show full detail for one BFD session. |
show bfd sessions |
read-only | List all active BFD sessions. |
show bgp decode |
read-only | Decode a hex-encoded BGP message into readable JSON. |
show bgp encode |
read-only | Turn a route announcement into wire-format hex. |
show bgp peer |
read-only | Show detailed state for one or more BGP peers. |
show bgp peer-history |
read-only | Show why a peer has been bouncing. |
show bgp rib |
read-only | Query routes in the BGP RIB. |
show bgp rib best |
read-only | Show the winning route for each prefix. |
show bgp rib best status |
read-only | Check whether best-path computation is still running. |
show bgp rib rpf |
read-only | Reverse-path forwarding lookup in the Loc-RIB. |
show bgp rib status |
read-only | Get a quick RIB overview without dumping routes. |
show bgp-health |
read-only | Quick health check for all your BGP peers. |
show bmp collectors |
read-only | Show BMP collector connection status. |
show bmp peers |
read-only | Show BGP peers as seen through BMP monitoring. |
show bmp rib |
read-only | Show routes received via BMP monitoring sessions. |
show bmp sessions |
read-only | Show active BMP receiver sessions. |
show capture |
read-only | Show captured control-plane messages. |
show capture interface |
read-only | Capture live packets on an interface (like tcpdump). |
show capture raw |
read-only | Control raw byte capture for protocol debugging. |
show config cat |
read-only | Print the full text of a stored configuration snapshot. |
show config diff |
read-only | Compare two configuration versions side by side. |
show config dump |
read-only | Show the fully resolved configuration tree. |
show config fmt |
read-only | Pretty-print the configuration with consistent formatting. |
show config graph |
offline | Show how components and peers depend on each other (DOT graph format). |
show config history |
read-only | List available configuration rollback points. |
show config ls |
read-only | List all configuration files stored in the database. |
show crashes |
read-only | View saved crash reports from panics. |
show data cat |
read-only | Print the raw content of a blob store entry. |
show data ls |
read-only | List everything stored in the ZeFS blob store. |
show data registered |
read-only | List the key patterns registered by all subsystems. |
show dns cache |
read-only | Inspect the DNS cache. |
show dns lookup |
read-only | Look up a DNS name from the router. |
show doctor |
read-only | Check if this box is ready to run Ze. |
show env get |
read-only | Show one environment variable in detail. |
show env list |
read-only | List all Ze environment variables with their current values. |
show env registered |
read-only | List every registered environment variable with metadata. |
show errors |
read-only | Show recent errors across all subsystems, newest first. |
show event namespaces |
read-only | List all event namespaces and how many events each has logged. |
show event recent |
read-only | Show recent events, newest first. |
show firewall group |
read-only | Show members of a firewall address/port group. |
show firewall ruleset |
read-only | Show firewall rules in a named table with hit counters. |
show flow-export |
read-only | Show flow export (NetFlow/IPFIX) collector status. |
show gnmi |
read-only | Show whether the gNMI server is running and how it is configured. |
show health |
read-only | Is this box healthy? One command to find out. |
show host all |
read-only | Show the full hardware inventory in one shot. |
show host cpu |
read-only | Show what CPUs are in this box. |
show host dmi |
read-only | Show the box's identity from SMBIOS/DMI. |
show host kernel |
read-only | Show the running kernel version and boot parameters. |
show host memory |
read-only | Show installed memory and ECC health. |
show host nic |
read-only | Show physical NICs installed in this box. |
show host platform |
read-only | Show platform capabilities and constraints. |
show host storage |
read-only | Show storage devices attached to this box. |
show host thermal |
read-only | Show temperature sensors and thermal throttle events. |
show interface |
read-only | Show network interfaces on this box. |
show interface brief |
read-only | One-line summary per interface: name, state, IP, and MTU. |
show interface errors |
read-only | Show interfaces that have errors or drops. |
show interface rate |
read-only | Show per-second traffic rates on your interfaces. |
show interface scan |
read-only | Discover and classify all OS interfaces. |
show interface type |
read-only | Show only interfaces of a given type. |
show ip arp |
read-only | Show the ARP and neighbor discovery table. |
show ip route |
read-only | Show the kernel routing table. |
show ip route lookup |
read-only | Look up which route the kernel would use for a given IP. |
show kernel-routes |
read-only | Show kernel routes (shortcut for 'show ip route'). |
show l2tp |
read-only | L2TP tunnel, session, and subscriber state. |
show l2tp config |
read-only | Show the resolved L2TP configuration. |
show l2tp cqm |
read-only | Show subscriber line quality (CQM latency buckets). |
show l2tp echo |
read-only | Show LCP echo health for a subscriber session. |
show l2tp listeners |
read-only | Show which UDP sockets are listening for L2TP. |
show l2tp observer |
read-only | Show recent events for a session (debug aid). |
show l2tp reliable |
read-only | Show the reliable transport window for a tunnel. |
show l2tp session |
read-only | Show full detail for one L2TP session. |
show l2tp session-history |
read-only | Show state transitions for a session over time. |
show l2tp session-traffic |
read-only | Show traffic counters for a subscriber's PPP interface. |
show l2tp sessions |
read-only | List all active L2TP sessions. |
show l2tp statistics |
read-only | Show aggregate L2TP protocol counters. |
show l2tp tunnel |
read-only | Show full detail for one L2TP tunnel. |
show l2tp tunnel-history |
read-only | Show state transitions for a tunnel over time. |
show l2tp tunnels |
read-only | List all active L2TP tunnels. |
show l2tp-health |
read-only | Find your worst L2TP sessions at a glance. |
show ldp binding |
read-only | Show LDP FEC-to-label bindings. |
show ldp neighbor |
read-only | Show LDP neighbors and their session state. |
show metrics-query |
read-only | Query a specific Prometheus metric by name. |
show mpls forwarding |
read-only | Show MPLS forwarding entries installed in the kernel. |
show neighbors |
read-only | Show the ARP/ND neighbor table (shortcut for 'show ip arp'). |
show peer capabilities |
read-only | Show what capabilities were negotiated with a peer. |
show peer detail |
read-only | Show full detail for one or more peers. |
show peer history |
read-only | Show FSM state transitions for a peer over time. |
show peer list |
read-only | List your peers, one line each. |
show peer statistics |
read-only | Show UPDATE throughput for your peers. |
show ping |
read-only | Ping a target from the router itself. |
show pki certificate |
read-only | Inspect a specific certificate in detail. |
show pki certificates |
read-only | List all loaded certificates with expiry dates. |
show policy chain peer |
read-only | Show the import/export filter chain applied to a peer. |
show policy list |
read-only | List all available filter types and named instances. |
show policy test peer |
read-only | Test what your policy does to a specific UPDATE. |
show policy-routes |
read-only | Show policy-based routing rules. |
show pppoe |
read-only | PPPoE session and protocol state. |
show pppoe interfaces |
read-only | Show which interfaces are accepting PPPoE sessions. |
show pppoe session |
read-only | Show full detail for one PPPoE session. |
show pppoe sessions |
read-only | List all active PPPoE sessions. |
show pppoe statistics |
read-only | Show PPPoE protocol message counters. |
show probe-round |
read-only | Run a parallel traceroute probe round to a target. |
show rr peers |
read-only | Show route reflector client peers. |
show rr status |
read-only | Show whether the route reflector is active. |
show rsvp-te interface |
read-only | Show RSVP-TE bandwidth allocation per interface. |
show rsvp-te lsp |
read-only | Show RSVP-TE label-switched paths. |
show rsvp-te tunnel |
read-only | Show configured RSVP-TE tunnels and their current state. |
show schema events |
read-only | List all notification types defined in YANG API modules. |
show schema handlers |
read-only | Show which handler serves each YANG module. |
show schema list |
read-only | List all YANG schemas loaded by the daemon. |
show schema methods |
read-only | List all RPC methods defined in YANG API modules. |
show schema protocol |
read-only | Show the wire protocol version and format details. |
show static |
read-only | Show static routes defined in the configuration. |
show storage smart |
read-only | Show disk health via SMART data. |
show subscriber |
read-only | Show a summary of all subscriber sessions. |
show subscriber detail |
read-only | Show everything about one subscriber session. |
show summary |
read-only | Show a one-line-per-peer BGP summary. |
show system conntrack |
read-only | Show the kernel connection tracking table. |
show system cpu |
read-only | Show CPU utilization context for the daemon. |
show system date |
read-only | Show the daemon's current wall-clock time and timezone. |
show system file-descriptors |
read-only | Show how many file descriptors the daemon has open. |
show system goroutines |
read-only | Dump goroutine stacks for debugging hangs or deadlocks. |
show system kernel-log |
read-only | Show kernel log messages (dmesg-style). |
show system memory |
read-only | Show how much memory the daemon is using. |
show system memory-map |
read-only | Show the process memory footprint from the kernel's view. |
show system ntp |
read-only | NTP clock synchronization status |
show system ntp peers |
read-only | Show NTP peers with offset, RTT, stratum, and reachability. |
show system platform |
read-only | Show what kind of platform the daemon is running on. |
show system profile |
read-only | Capture a runtime profile for performance analysis. |
show system sockets |
read-only | Show open TCP and UDP sockets on this box. |
show system subsystem list |
read-only | List every registered subsystem and whether it is running. |
show system update |
read-only | Check if a firmware update is available. |
show system update history |
read-only | Show recent firmware update activity. |
show tcp-check |
read-only | Test TCP connectivity to a remote host and port. |
show traceroute |
read-only | Trace the network path from this router to a target. |
show traffic |
read-only | Show traffic control (QoS) configuration per interface. |
show uptime |
read-only | Show how long the daemon has been running. |
show version |
read-only | Show the running Ze version and build date. |
show vpn ipsec peer |
read-only | Show full detail for one IPsec peer. |
show vpn ipsec sa |
read-only | Show all IKE and Child Security Associations. |
show vpn ipsec status |
read-only | Quick IPsec health check. |
show vpp runtime |
read-only | Show VPP graph node processing statistics. |
show vpp trace clear |
read-only | Discard the captured VPP trace buffer. |
show vpp trace show |
read-only | Retrieve packets captured since the last trace start. |
show vpp trace start |
read-only | Start capturing packets in the VPP dataplane. |
show warnings |
read-only | Show active warnings across all subsystems. |
show yang completion |
read-only | Show YANG paths available for tab completion. |
show yang doc |
read-only | Generate command reference docs from YANG schemas. |
show yang tree |
read-only | Print the YANG tree for a module in a readable hierarchy. |
Show AAA accounting counters and any dropped records. Tells you whether TACACS+ accounting is working or if records are being lost due to server unreachability.
Mode: read-only | Wire: ze-show:aaa-accounting
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show who did what and when on this box. Returns audit log entries with timestamps, actors, and actions. Filters (all optional, combinable): action , actor , surface (cli, web, api), since/until , count . Actions include config-commit, login, peer-teardown, and more.
Mode: read-only | Wire: ze-show:audit
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
action |
string | ||
actor |
string | ||
count |
uint | ||
since |
string | ||
surface |
string | ||
until |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show BFD timer profiles with effective values. Returns min-tx, min-rx, and detect-multiplier after inheritance. Pass a profile name, or omit it to see all profiles.
Mode: read-only | Wire: ze-bfd-api:show-profile
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one BFD session. Pass the peer address. Returns local/remote discriminators, negotiated timers, detection time, and packet counters.
Mode: read-only | Wire: ze-bfd-api:show-session
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all active BFD sessions. One line per session: peer address, state, negotiated tx/rx intervals, and detect multiplier.
Mode: read-only | Wire: ze-bfd-api:show-sessions
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Decode a hex-encoded BGP message into readable JSON. Paste a hex BGP UPDATE and get back parsed attributes, NLRI, and withdrawn prefixes. Handy for reading pcap captures or debugging wire issues. Also available in the web UI under tools.
Mode: read-only | Wire: ze-show:bgp-decode
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Turn a route announcement into wire-format hex. Takes a route in API syntax and returns the BGP UPDATE as a hex string. Useful for building test payloads, feeding to ze-test, or verifying that your announcement encodes correctly.
Mode: read-only | Wire: ze-show:bgp-encode
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show detailed state for one or more BGP peers. Returns IP, ASN, state, uptime, capabilities, message counters, policy, and notification history. Use a peer selector: IP address, name, AS pattern (as65001), glob (10.0.*), or * for all.
Mode: read-only | Wire: ze-show:bgp-peer
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show why a peer has been bouncing. Returns timestamped FSM state transitions with reasons (hold timer expired, notification received, etc.). Accepts a peer selector (IP or name). The go-to command when diagnosing flapping.
Mode: read-only | Wire: ze-bgp:peer-history
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Query routes in the BGP RIB. Look at received or advertised routes with flexible filters: peer, family, prefix, AS path regex, community, match expression. Pipe operators: | count, | prefix-summary, | graph. This is the main route inspection command.
Mode: read-only | Wire: ze-rib-api:routes
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Command-specific:
-
advertised-- Select advertised routes -
community<value>-- Filter by standard community -
count-- Count matching routes without serializing rows -
family<value>-- Filter by AFI/SAFI -
first<value>-- Take first N routes -
graph-- Render AS-path topology graph -
last<value>-- Take last N routes -
match<value>-- Cross-field structured match -
path<value>-- Filter by AS path -
peer<value>-- Filter by peer -
prefix<value>-- Filter by prefix -
prefix-summary-- Summarize by family and prefix length -
received-- Select received routes
Subcommands: best, rpf, status
Show the winning route for each prefix. Same filters as 'show bgp rib'. Use '| reason' to see why each path was selected (local-pref, AS path length, MED, etc.).
Mode: read-only | Wire: ze-rib-api:best
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Command-specific:
-
community<value>-- Filter by standard community -
count-- Count matching best paths without serializing rows -
family<value>-- Filter by AFI/SAFI -
first<value>-- Take first N best paths -
graph-- Render AS-path topology graph -
last<value>-- Take last N best paths -
match<value>-- Cross-field structured match -
path<value>-- Filter by AS path -
peer<value>-- Filter by peer -
prefix<value>-- Filter by prefix -
prefix-summary-- Summarize by family and prefix length -
reason-- Explain best-path selection
Subcommands: status
Check whether best-path computation is still running. Reports idle, pending, or running, plus the last run duration.
Mode: read-only | Wire: ze-rib-api:best-status
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Reverse-path forwarding lookup in the Loc-RIB. Performs a longest-prefix-match and returns the best-path entry. Use this to verify RPF checks would pass for a given source.
Mode: read-only | Wire: ze-rib-api:rpf
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Command-specific:
-
advertised-- Select advertised routes -
community<value>-- Filter by standard community -
count-- Count matching routes without serializing rows -
family<value>-- Filter by AFI/SAFI -
first<value>-- Take first N routes -
graph-- Render AS-path topology graph -
last<value>-- Take last N routes -
match<value>-- Cross-field structured match -
path<value>-- Filter by AS path -
peer<value>-- Filter by peer -
prefix<value>-- Filter by prefix -
prefix-summary-- Summarize by family and prefix length -
received-- Select received routes
Get a quick RIB overview without dumping routes. Shows total peers, received/accepted/advertised route counts, and per-family breakdowns. Use this to confirm convergence after a peer comes up.
Mode: read-only | Wire: ze-rib-api:status
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Quick health check for all your BGP peers. Lists every peer with address, state, ASN, and uptime. Reports how many are not Established. Much faster than 'show bgp peer *' when you just need a status overview.
Mode: read-only | Wire: ze-show:bgp-health
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show BMP collector connection status. Lists configured collectors with connection state, sent message counts, and error statistics. Check here if your collector is not receiving data.
Mode: read-only | Wire: ze-show:bmp-collectors
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show BGP peers as seen through BMP monitoring. Lists peers reported via BMP with their state and route statistics.
Mode: read-only | Wire: ze-show:bmp-peers
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show routes received via BMP monitoring sessions. Returns the BMP RIB content. Use this to verify what your collector is seeing from remote peers.
Mode: read-only | Wire: ze-show:bmp-rib
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show active BMP receiver sessions. Lists each session with connection state and message counters. Check here to confirm your BMP collector is receiving data.
Mode: read-only | Wire: ze-show:bmp-sessions
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show captured control-plane messages. Returns protocol messages you previously enabled capture for. Without a protocol keyword, shows all protocols. Filters: tunnel-id (L2TP), peer (remote address), count (limit entries). Use this to debug session establishment issues.
Mode: read-only | Wire: ze-show:capture
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
count |
uint | ||
peer |
string | ||
protocol |
enum | bgp, l2tp | |
tunnel-id |
uint |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: interface, raw
Capture live packets on an interface (like tcpdump). Uses AF_PACKET for zero-copy capture. Filter by protocol and port. Limit with count or duration. Output as pcap (for Wireshark) or text. Snap-len controls how many bytes per packet are captured.
Mode: read-only | Wire: ze-show:capture-interface
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
count |
uint | ||
duration |
string | ||
format |
enum | pcap, text | |
iface |
string | ||
protocol |
string | ||
snap-len |
uint |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Control raw byte capture for protocol debugging. Actions: start (begin capturing), stop (halt), dump (retrieve). Protocols: l2tp, bgp. Output formats: pcap (for Wireshark), json. Limit with count .
Mode: read-only | Wire: ze-show:capture-raw
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
action |
enum | dump, start, stop | |
count |
uint | ||
format |
enum | json, pcap | |
protocol |
enum | bgp, l2tp |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Print the full text of a stored configuration snapshot. Usage: show config cat . Outputs the config as-is.
Mode: read-only | Wire: ze-show:config-cat
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Compare two configuration versions side by side. Shows what was added, removed, or changed. Commonly used with rollback revisions to review what changed before you roll back.
Mode: read-only | Wire: ze-show:config-diff
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the fully resolved configuration tree. Parses the config and outputs it after includes, defaults, and group inheritance have been applied. What you see here is exactly what the daemon is using.
Mode: read-only | Wire: ze-show:config-dump
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Pretty-print the configuration with consistent formatting. Normalizes indentation and ordering. Output goes to stdout (read-only). To rewrite the file in place, use 'ze config fmt -w' from the CLI.
Mode: read-only | Wire: ze-show:config-fmt
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List available configuration rollback points. Shows revisions with timestamps and commit metadata. Pair with 'show config diff' to review changes before rolling back.
Mode: read-only | Wire: ze-show:config-history
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all configuration files stored in the database. Shows archived snapshots and the active config.
Mode: read-only | Wire: ze-show:config-ls
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
View saved crash reports from panics. Without arguments, lists available crash files. Use 'latest' or a specific filename to see the goroutine stack trace from that crash. Send the output to support when reporting a crash.
Mode: read-only | Wire: ze-show:crashes
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
name |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Print the raw content of a blob store entry. Usage: show data cat . Outputs the value for the given key, like 'cat' for ZeFS.
Mode: read-only | Wire: ze-show:data-cat
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List everything stored in the ZeFS blob store. Shows all keys and their sizes. Use 'show data cat ' to see the content of a specific entry.
Mode: read-only | Wire: ze-show:data-ls
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List the key patterns registered by all subsystems. Shows you what types of data ZeFS knows about.
Mode: read-only | Wire: ze-show:data-registered
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Inspect the DNS cache. 'stats' shows hit/miss/eviction counters. 'list' shows all cached entries. 'record ' shows one specific entry. Requires the DNS component to be active.
Mode: read-only | Wire: ze-show:dns-cache
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
action |
enum | list, record, stats | |
name |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Look up a DNS name from the router. Resolves using the daemon's DNS resolver (falls back to the system resolver if no DNS component is configured). Default type is A. Returns records, TTL, and query time. Supports A, AAAA, MX, NS, TXT, CNAME, and PTR.
Mode: read-only | Wire: ze-show:dns-lookup
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
hostname |
string | ||
type |
enum | A, AAAA, CNAME, MX, NS, PTR, TXT |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Check if this box is ready to run Ze. Verifies runtime dependencies: required files, sockets, ports, and kernel modules. Each check reports pass or fail with a reason. Run this before first start or after changing the platform setup.
Mode: read-only | Wire: ze-show:doctor
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show one environment variable in detail. Returns the variable name, current value, default, and what it controls. Usage: show env get .
Mode: read-only | Wire: ze-show:env-get
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all Ze environment variables with their current values. Shows which env vars are set and their defaults.
Mode: read-only | Wire: ze-show:env-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List every registered environment variable with metadata. Includes type, default, description, and whether it is currently set.
Mode: read-only | Wire: ze-show:env-registered
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show recent errors across all subsystems, newest first. This is the first place to look when something goes wrong. Filter with source to narrow to one subsystem, count to limit output.
Mode: read-only | Wire: ze-show:errors
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all event namespaces and how many events each has logged. Tells you which subsystems are generating events and how active they are.
Mode: read-only | Wire: ze-show:event-namespaces
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show recent events, newest first. Each event includes timestamp, namespace, and type. Filter with namespace to focus on one area, count to limit output. Useful for reconstructing what happened before an incident.
Mode: read-only | Wire: ze-show:event-recent
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show members of a firewall address/port group. Without arguments, lists all known groups. With a name, shows the set elements. Reads from the last applied config, not the kernel.
Mode: read-only | Wire: ze-show:firewall-group
Requires backend: nft
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show firewall rules in a named table with hit counters. Returns each rule with packet and byte counters. Usage: show firewall ruleset . Check counters to verify rules are matching.
Mode: read-only | Wire: ze-show:firewall-ruleset
Requires backend: nft
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show flow export (NetFlow/IPFIX) collector status. Without arguments, lists all configured collectors. With a name, shows details for that collector including protocol stats and errors. Returns not-configured when no exporter is active.
Mode: read-only | Wire: ze-show:flow-export
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show whether the gNMI server is running and how it is configured. Returns listen address, TLS details, authentication mode, and the number of active streaming subscribers.
Mode: read-only | Wire: ze-show:gnmi
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Is this box healthy? One command to find out. Returns per-component health (bgp, fib, iface, plugins, l2tp, etc.) plus an overall status. Each component reports healthy, degraded, or unhealthy with a reason. Start here when troubleshooting.
Mode: read-only | Wire: ze-show:health
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the full hardware inventory in one shot. Returns every section (cpu, nic, dmi, memory, thermal, storage, kernel, platform) as a single JSON response. Ideal for support bundles or automated inventory collection.
Mode: read-only | Wire: ze-show:host-all
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show what CPUs are in this box. Returns vendor, model, core/thread topology, hybrid layout, scaling driver, current/min/max frequencies, and throttle counts.
Mode: read-only | Wire: ze-show:host-cpu
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the box's identity from SMBIOS/DMI. Returns system vendor, board name, BIOS version, and chassis type. Useful for inventory or confirming which hardware model you are on.
Mode: read-only | Wire: ze-show:host-dmi
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the running kernel version and boot parameters. Returns kernel release, command line, CPU microcode revision, boot time, and security-relevant CPU flags (spectre mitigations, etc.).
Mode: read-only | Wire: ze-show:host-kernel
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show installed memory and ECC health. Returns DIMM sizes and, when the edac driver is present, correctable and uncorrectable error counters. Non-zero ECC counts mean you should plan a DIMM replacement.
Mode: read-only | Wire: ze-show:host-memory
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show physical NICs installed in this box. Returns driver, PCI vendor/device IDs, link speed, queue counts, and firmware version. Virtual interfaces are excluded. Use this to confirm NIC firmware before an upgrade.
Mode: read-only | Wire: ze-show:host-nic
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show platform capabilities and constraints. Reports read-only root, privilege level, systemd presence, gokrazy update socket, reboot-allowed flag, persistent-storage writability, and fd limits. Helps you understand what operations are possible on this particular deployment.
Mode: read-only | Wire: ze-show:host-platform
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show storage devices attached to this box. Returns size, model, transport type (nvme, sata, mmc, virtio), rotational flag, and NVMe firmware version where applicable.
Mode: read-only | Wire: ze-show:host-storage
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show temperature sensors and thermal throttle events. Returns hwmon sensor readings and per-CPU throttle counters. Non-zero throttle counts mean the box has been running hot enough to slow down.
Mode: read-only | Wire: ze-show:host-thermal
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show network interfaces on this box. Without arguments, returns all interfaces with full detail. Subcommands: brief, type , errors, rate, detail , counters .
Mode: read-only | Wire: ze-show:interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: brief, errors, rate, scan, type
One-line summary per interface: name, state, IP, and MTU. Quick way to see what is up and what addresses are assigned.
Mode: read-only | Wire: ze-show:interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show interfaces that have errors or drops. Filters to only interfaces with non-zero Rx/Tx error or drop counters. Quick way to find troubled links.
Mode: read-only | Wire: ze-show:interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show per-second traffic rates on your interfaces. Returns rx/tx bytes and packets per second. Pass an interface name to narrow the output. Requires the rate tracker. For continuous monitoring, use 'monitor interface rate' instead.
Mode: read-only | Wire: ze-show:interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Discover and classify all OS interfaces. Returns name, Ze type (ethernet, bridge, vxlan, etc.), and MAC for each interface found. Pipe to table, yaml, or json for different views. Useful during initial setup to see what the box has.
Mode: read-only | Wire: ze-show:interface-scan
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show only interfaces of a given type. Usage: show interface type . Types include ethernet, bridge, vxlan, wireguard, tunnel, bond, and more. If you pick an invalid type, the error lists all valid ones.
Mode: read-only | Wire: ze-show:interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the ARP and neighbor discovery table. Lists IPv4 ARP and IPv6 ND entries with MAC addresses and states. Filter with --family ipv4 or ipv6. Same data as 'show neighbors', just a different path.
Mode: read-only | Wire: ze-show:ip-arp
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
family |
enum | all, any, ipv4, ipv6 |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the kernel routing table. Lists installed routes with next-hop, interface, protocol, and metric. Pass a CIDR prefix or 'default' to filter. Same data as 'show kernel-routes'.
Mode: read-only | Wire: ze-show:ip-route
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
limit |
uint | ||
prefix |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: lookup
Look up which route the kernel would use for a given IP. Performs a longest-prefix-match and returns the matching route with gateway, interface, protocol, and metric. Usage: show ip route lookup .
Mode: read-only | Wire: ze-show:route-lookup
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show kernel routes (shortcut for 'show ip route'). Pass a CIDR prefix, 'default', or --limit N to narrow output.
Mode: read-only | Wire: ze-show:kernel-routes
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
L2TP tunnel, session, and subscriber state. Without a subcommand, shows a summary of tunnels and sessions.
Mode: read-only | Wire: ze-l2tp-api:summary
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: config, cqm, echo, listeners, observer, reliable, session, session-history, session-traffic, sessions, statistics, tunnel, tunnel-history, tunnels
Show the resolved L2TP configuration. Returns the effective config after defaults and overrides. Confirms what the daemon is actually using.
Mode: read-only | Wire: ze-l2tp-api:config
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show subscriber line quality (CQM latency buckets). Pass a login name for one subscriber or 'summary' for an overview. Helps diagnose poor subscriber experience.
Mode: read-only | Wire: ze-l2tp-api:cqm
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show LCP echo health for a subscriber session. Returns echo request/reply counters and round-trip times. Rising loss or high RTT indicates a degraded line.
Mode: read-only | Wire: ze-l2tp-api:echo
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show which UDP sockets are listening for L2TP. Lists each bound address, port, and the number of tunnels on it.
Mode: read-only | Wire: ze-l2tp-api:listeners
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show recent events for a session (debug aid). Returns the event ring buffer for one session ID or 'all'. Useful for understanding why a session failed to establish.
Mode: read-only | Wire: ze-l2tp-api:observer
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the reliable transport window for a tunnel. Returns send/receive sequence numbers, window size, and retransmit queue depth. Check here when tunnel control messages seem stuck.
Mode: read-only | Wire: ze-l2tp-api:reliable
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one L2TP session. Pass the local session ID. Returns PPP state, assigned addresses, negotiated LCP/NCP options, and traffic counters.
Mode: read-only | Wire: ze-l2tp-api:session
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show state transitions for a session over time. Timestamped FSM entries for session establishment. Use this when a subscriber's session fails to come up.
Mode: read-only | Wire: ze-l2tp-api:session-history
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show traffic counters for a subscriber's PPP interface. Returns byte and packet counts, error counters, and current rates. Compare with CQM data to get the full picture of subscriber health.
Mode: read-only | Wire: ze-l2tp-api:session-traffic
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all active L2TP sessions. One line per session: local/remote ID, parent tunnel, subscriber login, and uptime.
Mode: read-only | Wire: ze-l2tp-api:sessions
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show aggregate L2TP protocol counters. Tunnels and sessions established, control messages sent/received, retransmits, and errors. Your first stop for L2TP health.
Mode: read-only | Wire: ze-l2tp-api:statistics
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one L2TP tunnel. Pass the local tunnel ID. Returns control channel state, peer endpoint, hello interval, and all assigned sessions.
Mode: read-only | Wire: ze-l2tp-api:tunnel
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show state transitions for a tunnel over time. Timestamped FSM entries showing how the tunnel reached its current state. Use this to diagnose tunnel establishment failures.
Mode: read-only | Wire: ze-l2tp-api:tunnel-history
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all active L2TP tunnels. One line per tunnel: local/remote ID, peer address, session count, and uptime.
Mode: read-only | Wire: ze-l2tp-api:tunnels
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Find your worst L2TP sessions at a glance. Sorts sessions by echo loss ratio (worst first). Shows subscriber login, session state, echo count, average RTT, and CQM bucket count. Reports how many sessions are degraded.
Mode: read-only | Wire: ze-show:l2tp-health
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show LDP FEC-to-label bindings. Lists local and remote label bindings for each FEC (prefix). Use this to verify label distribution is working.
Mode: read-only | Wire: ze-show:ldp-binding
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show LDP neighbors and their session state. Returns peer address, transport address, session state, and hold time for each LDP neighbor.
Mode: read-only | Wire: ze-show:ldp-neighbor
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Query a specific Prometheus metric by name. Usage: show metrics-query [label=value ...]. Returns matching time series from the internal registry. Multiple label filters are ANDed. More targeted than the full metrics dump.
Mode: read-only | Wire: ze-show:metrics-query
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show MPLS forwarding entries installed in the kernel. Each entry shows the incoming label, swap/push/pop operation, and outgoing next-hop. Use --limit N for large tables. Linux only.
Mode: read-only | Wire: ze-show:mpls-forwarding
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the ARP/ND neighbor table (shortcut for 'show ip arp'). Lists neighbor entries with MAC address and state. Filter with ipv4, ipv6, or any as a positional argument.
Mode: read-only | Wire: ze-show:neighbors
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
family |
enum | all, any, ipv4, ipv6 |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show what capabilities were negotiated with a peer. Compares the OPEN you sent vs the OPEN you received, so you can see which address families, add-path, or graceful-restart are active. Selector: IP, name, AS pattern, glob, or *.
Mode: read-only | Wire: ze-bgp:peer-capabilities
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
selector |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one or more peers. Returns config, state, timers, message counters, and notification history. Selector: IP, name, AS pattern (as65001), glob, or *.
Mode: read-only | Wire: ze-bgp:peer-detail
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
selector |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show FSM state transitions for a peer over time. Timestamped entries show each state change (Idle, Connect, Active, OpenSent, OpenConfirm, Established) with the trigger. Check here when diagnosing flapping. Selector: IP, name, AS pattern, glob, or *.
Mode: read-only | Wire: ze-bgp:peer-history
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
selector |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List your peers, one line each. Shows name, address, ASN, state, and uptime. Quick overview without the detail of 'peer detail'.
Mode: read-only | Wire: ze-bgp:peer-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show UPDATE throughput for your peers. Returns message counts, prefix counts, and per-second receive/send rates. Useful for spotting slow or overloaded peers. Selector: IP, name, AS pattern, glob, or *.
Mode: read-only | Wire: ze-bgp:peer-statistics
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
selector |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Ping a target from the router itself. Sends ICMP echo requests to (IP or hostname). Default count is 5. Timeout uses Go duration syntax (e.g. 3s, 500ms). Confirms reachability from this box, not from your workstation.
Mode: read-only | Wire: ze-show:ping
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
count |
uint | ||
dest |
string | ||
timeout |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Inspect a specific certificate in detail. Usage: show pki certificate [pem | bundle pem | fingerprint [sha256|sha384|sha512]]. Use 'pem' to export for another system, 'fingerprint' to verify identity.
Mode: read-only | Wire: ze-show:pki-certificate
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all loaded certificates with expiry dates. Shows name, type (CA or device), subject, issuer, expiry, and validity status. Check here to find certificates approaching expiration.
Mode: read-only | Wire: ze-show:pki-certificates
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the import/export filter chain applied to a peer. Accepts a peer selector (IP, name, as). Shows the effective chain after group inheritance is resolved. Without a direction keyword, shows both import and export.
Mode: read-only | Wire: ze-show:policy-chain
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
direction |
enum | export, import |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all available filter types and named instances. Shows each filter type and its implementing plugin. Check here when building a new policy chain to see what filters you can use.
Mode: read-only | Wire: ze-show:policy-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Test what your policy does to a specific UPDATE. Feed a hex-encoded BGP UPDATE through a peer's filter chain and see the accept/reject result plus attribute modifications at each stage. Read-only: no routes are actually forwarded. Great for validating policy changes before you commit.
Mode: read-only | Wire: ze-show:policy-test
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
direction |
enum | export, import | |
filter |
string | ||
source-asn4 |
enum | false, true | |
update |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show policy-based routing rules. Lists PBR rules with match criteria and routing actions.
Mode: read-only | Wire: ze-show:policy-routes
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
PPPoE session and protocol state. Without a subcommand, shows a summary of active sessions.
Mode: read-only | Wire: ze-pppoe-api:summary
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: interfaces, session, sessions, statistics
Show which interfaces are accepting PPPoE sessions. Lists each PPPoE-enabled interface with its service name, session limit, and how many sessions are currently active.
Mode: read-only | Wire: ze-pppoe-api:interfaces
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one PPPoE session. Pass the session ID. Returns discovery tags, LCP/NCP state, assigned addresses, and traffic counters.
Mode: read-only | Wire: ze-pppoe-api:session
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all active PPPoE sessions. One line per session: session ID, MAC, subscriber login, uptime, and assigned addresses.
Mode: read-only | Wire: ze-pppoe-api:sessions
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show PPPoE protocol message counters. Returns PADI, PADO, PADR, PADS, PADT counts, active sessions, and errors. A rising PADI count with flat PADS means sessions are not completing.
Mode: read-only | Wire: ze-pppoe-api:statistics
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Run a parallel traceroute probe round to a target. Sends all probes concurrently for faster results than sequential traceroute. Returns per-hop RTT and IP. Use probes and max-hops to tune accuracy vs speed.
Mode: read-only | Wire: ze-show:probe-round
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
dest |
string | ||
max-hops |
uint | ||
probes |
uint | ||
timeout |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show route reflector client peers. Lists each RR client with session state and reflected route counts.
Mode: read-only | Wire: ze-show:rr-peers
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show whether the route reflector is active. Returns cluster ID, running state, and summary statistics (reflected routes, client count).
Mode: read-only | Wire: ze-show:rr-status
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show RSVP-TE bandwidth allocation per interface. Returns reserved, available, and maximum bandwidth for each TE-enabled interface.
Mode: read-only | Wire: ze-show:rsvp-te-interface
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show RSVP-TE label-switched paths. Returns state, role (ingress/transit/egress), reserved bandwidth, and in/out labels for each LSP.
Mode: read-only | Wire: ze-show:rsvp-te-lsp
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show configured RSVP-TE tunnels and their current state. Returns tunnel name, endpoints, signaling state, and active LSP.
Mode: read-only | Wire: ze-show:rsvp-te-tunnel
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all notification types defined in YANG API modules. Shows which events a plugin can subscribe to.
Mode: read-only | Wire: ze-show:schema-events
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show which handler serves each YANG module. Maps module names to their implementing Go handler.
Mode: read-only | Wire: ze-show:schema-handlers
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all YANG schemas loaded by the daemon. Shows module name, namespace, and revision for each schema.
Mode: read-only | Wire: ze-show:schema-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List all RPC methods defined in YANG API modules. Useful for plugin developers to discover available operations.
Mode: read-only | Wire: ze-show:schema-methods
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the wire protocol version and format details. Useful for checking compatibility between Ze versions.
Mode: read-only | Wire: ze-show:schema-protocol
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show static routes defined in the configuration. Lists each static route with its prefix, next-hop, and interface.
Mode: read-only | Wire: ze-show:static
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show disk health via SMART data. Returns health status, temperature, power-on hours, and self-test schedule for each block device. Replace drives that report failing health before they cause data loss.
Mode: read-only | Wire: ze-show:storage-smart
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show a summary of all subscriber sessions. Counts by access type (PPPoE, L2TP, IPoE) with totals. Quick way to see how many subscribers are online.
Mode: read-only | Wire: ze-subscriber-api:summary
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: detail
Show everything about one subscriber session. Pass the session ID. Returns access type, assigned addresses, authentication state, uptime, and traffic counters.
Mode: read-only | Wire: ze-subscriber-api:detail
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show a one-line-per-peer BGP summary. Lists every peer with state, ASN, prefixes received, and uptime. Optionally scope by address family: ipv4, ipv6, or l2vpn.
Mode: read-only | Wire: ze-bgp:summary
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the kernel connection tracking table. Returns conntrack entry count, table size, timeouts, and loaded modules. Requires the nft backend. Check this when you suspect conntrack table exhaustion is dropping traffic.
Mode: read-only | Wire: ze-show:system-conntrack
Requires backend: nft
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show CPU utilization context for the daemon. Returns goroutine count, logical CPU count, and GOMAXPROCS setting. Useful when the box feels sluggish and you want to see if Ze is hogging threads.
Mode: read-only | Wire: ze-show:system-cpu
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the daemon's current wall-clock time and timezone. Useful for correlating log timestamps when the box is in a different timezone than you are.
Mode: read-only | Wire: ze-show:system-date
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show how many file descriptors the daemon has open. Summary mode: totals by type (socket, pipe, file). Detail mode: every fd with its path and type. Linux only (reads /proc/self/fd). Check this when you suspect fd exhaustion.
Mode: read-only | Wire: ze-show:system-file-descriptors
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
mode |
enum | detail, summary |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Dump goroutine stacks for debugging hangs or deadlocks. Modes: summary (groups by state), blocked (only lock/channel waiters), full (all stacks). Default: summary. Share the output with support when the daemon stops responding.
Mode: read-only | Wire: ze-show:system-goroutines
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
mode |
enum | blocked, full, summary |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show kernel log messages (dmesg-style). Reads from /dev/kmsg. Filter by syslog level (emerg through debug) and limit with count. Without count, you get everything available. Linux only. Useful for spotting NIC errors or OOM events.
Mode: read-only | Wire: ze-show:system-kernel-log
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
count |
uint | ||
level |
enum | alert, crit, debug, emerg, err, info, notice, warn |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show how much memory the daemon is using. Returns allocated bytes, heap in-use, total allocations, GC cycles, and last GC pause duration. Compare over time to spot leaks.
Mode: read-only | Wire: ze-show:system-memory
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the process memory footprint from the kernel's view. Returns VmRSS, VmSize, VmSwap, and thread count from /proc/self/status. Complements 'show system memory' (Go runtime) with the OS-level picture.
Mode: read-only | Wire: ze-show:system-memory-map
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-show:system-ntp
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: peers
Show NTP peers with offset, RTT, stratum, and reachability. Tells you whether your clock is synced and how far off each NTP server thinks you are.
Mode: read-only | Wire: ze-show:system-ntp-peers
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show what kind of platform the daemon is running on. Reports whether this is gokrazy, systemd, container, plain-linux, or darwin, along with platform-specific capabilities.
Mode: read-only | Wire: ze-show:system-platform
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Capture a runtime profile for performance analysis. Types: cpu (requires duration, e.g. 30s), heap, goroutine, allocs (instant snapshots). Output is pprof format you can open with 'go tool pprof'. Send the file to support for deep analysis.
Mode: read-only | Wire: ze-show:system-profile
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
duration |
string | ||
type |
enum | allocs, cpu, goroutine, heap |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show open TCP and UDP sockets on this box. Filters: [tcp|udp] [state ] [port ], all optional and combinable. States use kernel names (ESTABLISHED, LISTEN, TIME_WAIT). Linux only. Good for confirming listeners or spotting stuck connections.
Mode: read-only | Wire: ze-show:system-sockets
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
port |
uint | ||
protocol |
enum | tcp, udp | |
state |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
List every registered subsystem and whether it is running. Shows you which components (bgp, dns, web, l2tp, etc.) are active, stopped, or failed.
Mode: read-only | Wire: ze-show:system-subsystem-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Check if a firmware update is available. Shows the running version, latest available version, and when the last check ran. Use 'update system firmware check' to trigger an immediate re-check.
Mode: read-only | Wire: ze-show:system-update
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Subcommands: history
Show recent firmware update activity. Lists the last 20 update events: checks, downloads, installs, and rollbacks with timestamps and outcomes.
Mode: read-only | Wire: ze-show:system-update-history
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Test TCP connectivity to a remote host and port. Tries to open a TCP connection and reports success or failure with the connection time. Use 'source ' to bind a specific local address. Quick way to verify a peer's BGP port is reachable.
Mode: read-only | Wire: ze-show:tcp-check
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
host |
string | yes | |
port |
uint | yes | |
source |
string | ||
timeout |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Trace the network path from this router to a target. Shows each hop with its IP and round-trip time. Dest can be an IP or hostname. Defaults: 30 max hops, 3 probes per hop. Increase probes for more reliable RTT measurements.
Mode: read-only | Wire: ze-show:traceroute
Arguments:
| Name | Type | Required | Values |
|---|---|---|---|
dest |
string | ||
max-hops |
uint | ||
probes |
uint | ||
timeout |
string |
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show traffic control (QoS) configuration per interface. Without arguments, lists every interface with its qdisc type and class/filter counts. With an interface name, shows the full qdisc and class breakdown. Use this to verify your shaping is applied.
Mode: read-only | Wire: ze-show:traffic
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show how long the daemon has been running. Returns the start time and elapsed uptime. Handy after a maintenance window to confirm the process restarted.
Mode: read-only | Wire: ze-show:uptime
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show the running Ze version and build date. You can verify which release is deployed on this box.
Mode: read-only | Wire: ze-show:version
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show full detail for one IPsec peer. Returns IKE SA state, all child SAs with traffic selectors, and byte counts. Usage: show vpn ipsec peer .
Mode: read-only | Wire: ze-show:vpn-ipsec-peer
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show all IKE and Child Security Associations. Lists every SA with peer, negotiated algorithms, byte counts, rekey timers, and uptime. Includes SPIs, NAT detection, and child SA traffic selectors. Your main IPsec status command.
Mode: read-only | Wire: ze-show:vpn-ipsec-sa
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Quick IPsec health check. Reports whether the IKE engine is running, how many peers are configured, and how many IKE SAs are Established.
Mode: read-only | Wire: ze-show:vpn-ipsec-status
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show VPP graph node processing statistics. Returns per-node packet counts, vectors, clocks, and suspends. Helps you find which node is the bottleneck. Requires the VPP backend.
Mode: read-only | Wire: ze-show:vpp-runtime
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Discard the captured VPP trace buffer. Clears all packets so you can start a fresh trace. Requires the VPP backend.
Mode: read-only | Wire: ze-show:vpp-trace-clear
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Retrieve packets captured since the last trace start. Shows per-packet VPP graph node traversal. Requires the VPP backend.
Mode: read-only | Wire: ze-show:vpp-trace-show
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Start capturing packets in the VPP dataplane. Default input node is dpdk-input, default count is 100 (max 10000). After starting, use 'show vpp trace show' to retrieve the captured packets. Requires the VPP backend.
Mode: read-only | Wire: ze-show:vpp-trace-start
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show active warnings across all subsystems. Displays any conditions that need your attention (degraded peers, resource limits approaching, etc.). Use 'source ' to filter to a single subsystem.
Mode: read-only | Wire: ze-show:warnings
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Show YANG paths available for tab completion. Lists every valid completion point in the command tree.
Mode: read-only | Wire: ze-show:yang-completion
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Generate command reference docs from YANG schemas. Produces structured documentation with descriptions, arguments, and usage patterns for every registered command.
Mode: read-only | Wire: ze-show:yang-doc
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Print the YANG tree for a module in a readable hierarchy. Shows node types, data types, and config-vs-state annotations. Similar to 'pyang -f tree'. Useful for understanding the config or command structure.
Mode: read-only | Wire: ze-show:yang-tree
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
skills |
offline | List or retrieve agent skill definitions matching this Ze version. Use 'get ' to fetch a specific skill. |
| Command | Mode | Description |
|---|---|---|
subscribe |
read-only | Start receiving events of one or more types. |
Start receiving events of one or more types. Events are delivered asynchronously to your plugin session until you unsubscribe. Use 'event list' to see available event types.
Mode: read-only | Wire: ze-bgp:subscribe
Task support: required
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
summary |
read-only | Show a one-line-per-peer BGP summary. |
Show a one-line-per-peer BGP summary. Lists every peer with state, ASN, prefixes received, and uptime. Optionally scope by address family: ipv4, ipv6, or l2vpn.
Mode: read-only | Wire: ze-bgp:summary
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
support |
offline | Bundle logs, config, state, and diagnostics into one archive file. Send the result to support when reporting an issue. |
| Command | Mode | Description |
|---|---|---|
system command complete |
read-only | Complete command/args |
system command help |
read-only | Show command details |
system command list |
read-only | List all commands |
system dispatch |
read-only | Dispatch a text command |
system help |
read-only | Show available commands |
system subsystem list |
read-only | List available subsystems |
system version api |
read-only | Show IPC protocol version |
system version software |
read-only | Show ze version |
Mode: read-only | Wire: ze-system:command-complete
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:command-help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:command-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:dispatch
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:help
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:subsystem-list
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:version-api
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Mode: read-only | Wire: ze-system:version-software
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
unsubscribe |
read-only | Stop receiving events you previously subscribed to. |
Stop receiving events you previously subscribed to. Removes the subscription for the specified event type from your current plugin session.
Mode: read-only | Wire: ze-bgp:unsubscribe
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
update bgp peer prefix |
daemon | Pull max-prefix limits from PeeringDB for your peers. |
update system firmware apply |
daemon | Full upgrade: download, verify, stage, and restart. |
update system firmware check |
daemon | Check for a new firmware version right now. |
update system firmware download |
daemon | Download the latest firmware image right now. |
update system firmware restart |
daemon | Reboot into the already-staged firmware. |
update system firmware rollback |
daemon | Roll back to the previous firmware and restart. |
Pull max-prefix limits from PeeringDB for your peers. Queries PeeringDB by ASN and updates the configured max-prefix values so you do not have to look them up manually. Selector: IP, name, AS pattern, glob, or *.
Mode: daemon | Wire: ze-update:bgp-peer-prefix
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Full upgrade: download, verify, stage, and restart. Runs the complete update cycle in one command. Only available on platforms where Ze owns the update lifecycle (e.g. gokrazy). The box will reboot into the new version.
Mode: daemon | Wire: ze-update:system-firmware-apply
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Check for a new firmware version right now. Bypasses the scheduled interval timer and contacts the update server immediately. Compare the result with 'show system update'.
Mode: daemon | Wire: ze-update:system-firmware-check
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Download the latest firmware image right now. Bypasses the maintenance window and spread timers. The image is staged but not applied. Use 'update system firmware apply' or 'restart' to activate it.
Mode: daemon | Wire: ze-update:system-firmware-download
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Reboot into the already-staged firmware. No download happens. Use this after 'update system firmware download' when you are ready to activate the new version.
Mode: daemon | Wire: ze-update:system-firmware-restart
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
Roll back to the previous firmware and restart. Reverts to the prior image. Only available on platforms with A/B partitioning (e.g. gokrazy). Use this if the new version has issues.
Mode: daemon | Wire: ze-update:system-firmware-rollback
Pipes:
Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more
| Command | Mode | Description |
|---|---|---|
validate config |
offline | Check your config for errors without applying anything. Reports syntax and semantic issues. |
280 commands total.
Unreviewed draft. This wiki was authored in bulk and has not been reviewed. File corrections on the issue tracker.
- Overview
- YANG Model
- Editor Workflow
- Archive and Rollback
- System
- Interfaces
- BFD
- FIB
- OSPF
- IS-IS
- MPLS / LDP / RSVP-TE
- RSVP-TE
- SRv6
- Static Routes
- Policy Routing
- Firewall
- Traffic Control
- Class of Service
- L2TP/PPP
- PPPoE
- VPP Data Plane
- RPKI
- IPsec VPN
- TACACS+ AAA
- RADIUS AAA
- AS112 DNS
- Authorization
- Fleet
- BGP
- Starting and Stopping
- Show Commands
- Monitoring
- Flow Export
- DDoS Mitigation
- Anomaly Detection
- Health Checks
- Audit Trail
- Production Diagnostics
- Logging
- Operational Reports
- Healthcheck
- Self-Update
- Zero-Touch Provisioning
- MRT Analysis
- Upgrade and Restart
- Storage
- Policy
- Core
- Resilience
- Validation
- Capabilities
- Address Families
- Protocol
- Subsystems
- Infrastructure
- Route Server at an IXP
- Transit Edge with RPKI
- Public Looking Glass
- ExaBGP Migration Walkthrough
- FlowSpec Injection
- Chaos-Tested Peering
- AS Path Topology