command catalog

Pre-Alpha. This page is auto-generated from ze help command --json.

Command Catalog

announce

Command	Mode	Description
`announce`	daemon	Announce a route on demand to selected peers.

`announce`

Announce a route on demand to selected peers. Usage: announce <unicast|blackhole|flowspec> [tag ] [for ]

Mode: daemon | Wire: ze-bgp:announce

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

clear

Command	Mode	Description
`clear bgp rib in`	daemon	Remove all routes received from a peer.
`clear bgp rib out`	daemon	Re-advertise all routes to a peer.
`clear debug`	offline	Clear the default debug profile.
`clear dns cache`	daemon	Flush all DNS cache entries and reset all DNS cache counters.
`clear dns cache record`	daemon	Evict DNS cache entries for one record name, or one name and type when a type is provided.
`clear dns cache stats`	daemon	Reset DNS cache hit, miss, eviction, and expiry counters without removing cached entries.
`clear interface counters`	daemon	Zero the Rx/Tx counters for every managed interface.
`clear interface name counters`	daemon	Zero the Rx/Tx counters for one interface.
`clear isis adjacency`	daemon	Tear down every IS-IS adjacency so neighbors re-form.
`clear isis counters`	daemon	Reset IS-IS observational counters and the SPF log.
`clear l2tp session all`	daemon	Disconnect every L2TP session on this box.
`clear l2tp session id`	daemon	Disconnect one subscriber session.
`clear l2tp tunnel all`	daemon	Tear down every L2TP tunnel on this box.
`clear l2tp tunnel id`	daemon	Gracefully tear down one L2TP tunnel.
`clear ospf counters`	daemon	Reset the OSPF SPF-run history.
`clear ospf neighbor`	daemon	Tear down every OSPF adjacency so neighbors re-form.
`clear ospf process`	daemon	Full OSPF reset: tear down every adjacency and re-run SPF.
`clear vpn ipsec sa`	daemon	Tear down IKE Security Associations.
`clear vrrp statistics`	daemon	Reset every VRRP virtual router's counters to zero.

`clear bgp rib in`

Remove all routes received from a peer. Wipes the Adj-RIB-In for matched peers. They will need to re-advertise everything (or you can send a route-refresh). Selector: IP, name, AS pattern, glob, or *.

Mode: daemon | Wire: ze-rib-api:clear-in Task support: forbidden

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear bgp rib out`

Re-advertise all routes to a peer. Triggers a full Adj-RIB-Out replay to the selected peers. Useful after a policy change to push updated attributes without tearing down the session. Selector: IP, name, AS pattern, glob, or *.

Mode: daemon | Wire: ze-rib-api:clear-out Task support: forbidden

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear dns cache`

Mode: daemon | Wire: ze-clear:dns-cache

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: record, stats

`clear dns cache record`

Mode: daemon | Wire: ze-clear:dns-cache-record

Arguments:

Name	Type	Required	Values
`name`	string	yes
`type`	enum		A, AAAA, CNAME, MX, NS, PTR, TXT

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear dns cache stats`

Mode: daemon | Wire: ze-clear:dns-cache-stats

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear interface counters`

Zero the Rx/Tx counters for every managed interface. Usage: clear interface counters.

Mode: daemon | Wire: ze-clear:interface-counters

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear interface name counters`

Zero the Rx/Tx counters for one interface. Usage: clear interface name counters.

Mode: daemon | Wire: ze-clear:interface-counters

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear isis adjacency`

Tear down every IS-IS adjacency so neighbors re-form. Usage: clear isis adjacency. Adjacencies re-learn from the next Hello; the circuit is not closed and the configuration is unchanged.

Mode: daemon | Wire: ze-clear:isis-adjacency

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear isis counters`

Reset IS-IS observational counters and the SPF log. Usage: clear isis counters. Monotonic Prometheus series are not reset; the SPF-run history is cleared.

Mode: daemon | Wire: ze-clear:isis-counters

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear l2tp session all`

Disconnect every L2TP session on this box. Sends CDN for all sessions across all tunnels. Tunnels themselves stay up. Use with care.

Mode: daemon | Wire: ze-l2tp-api:session-teardown-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear l2tp session id`

Disconnect one subscriber session. Sends a CDN to gracefully close the session. Pass the local session ID: clear l2tp session id [reason ] [cause ].

Mode: daemon | Wire: ze-l2tp-api:session-teardown

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear l2tp tunnel all`

Tear down every L2TP tunnel on this box. Sends StopCCN for all tunnels. Every subscriber session will be disconnected. Use with care during maintenance.

Mode: daemon | Wire: ze-l2tp-api:tunnel-teardown-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear l2tp tunnel id`

Gracefully tear down one L2TP tunnel. Sends a StopCCN to the peer. All sessions on this tunnel will be disconnected. Pass the local tunnel ID: clear l2tp tunnel id .

Mode: daemon | Wire: ze-l2tp-api:tunnel-teardown

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear ospf counters`

Reset the OSPF SPF-run history. Usage: clear ospf counters. Monotonic Prometheus series are not reset; the SPF-run log is cleared.

Mode: daemon | Wire: ze-clear:ospf-counters

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear ospf neighbor`

Tear down every OSPF adjacency so neighbors re-form. Usage: clear ospf neighbor. Adjacencies re-learn from the next Hello.

Mode: daemon | Wire: ze-clear:ospf-neighbor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear ospf process`

Full OSPF reset: tear down every adjacency and re-run SPF. Usage: clear ospf process. Adjacencies re-form from the next Hello; the configuration is unchanged.

Mode: daemon | Wire: ze-clear:ospf-process

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear vpn ipsec sa`

Tear down IKE Security Associations. Without arguments, terminates all SAs. Use 'peer ' to clear just one peer. The tunnel will renegotiate automatically if the config is still active.

Mode: daemon | Wire: ze-clear:vpn-ipsec-sa

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`clear vrrp statistics`

Reset every VRRP virtual router's counters to zero. Protocol state is untouched: clearing counters never triggers a failover.

Mode: daemon | Wire: ze-clear:vrrp-statistics

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

create

Command	Mode	Description
`create interface address`	daemon	Add an IP address to an interface.
`create interface bridge name`	daemon	Create a Linux bridge for L2 forwarding.
`create interface bridge name address`	daemon	Add an IP address to the bridge.
`create interface bridge name unit`	daemon	Add a VLAN sub-interface to the bridge.
`create interface dummy name`	daemon	Create a dummy (loopback-style) interface.
`create interface dummy name address`	daemon	Add an IP address to the dummy.
`create interface dummy name unit`	daemon	Add a VLAN sub-interface to the dummy.
`create interface unit`	daemon	Add a VLAN sub-interface (802.1Q tagged).
`create interface veth name`	daemon	Create a veth pair (two linked virtual Ethernet interfaces).

`create interface address`

Add an IP address to an interface. Usage: create interface address . Interface must already exist.

Mode: daemon | Wire: ze-iface:interface-addr-add

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface bridge name`

Create a Linux bridge for L2 forwarding. Usage: create interface bridge name .

Mode: daemon | Wire: ze-iface:interface-create-bridge

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: address, unit

`create interface bridge name address`

Add an IP address to the bridge. Usage: create interface bridge name address .

Mode: daemon | Wire: ze-iface:interface-addr-add

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface bridge name unit`

Add a VLAN sub-interface to the bridge. Usage: create interface bridge name unit .

Mode: daemon | Wire: ze-iface:interface-unit-add

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface dummy name`

Create a dummy (loopback-style) interface. Usage: create interface dummy name .

Mode: daemon | Wire: ze-iface:interface-create-dummy

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: address, unit

`create interface dummy name address`

Add an IP address to the dummy. Usage: create interface dummy name address .

Mode: daemon | Wire: ze-iface:interface-addr-add

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface dummy name unit`

Add a VLAN sub-interface to the dummy. Usage: create interface dummy name unit .

Mode: daemon | Wire: ze-iface:interface-unit-add

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface unit`

Add a VLAN sub-interface (802.1Q tagged). Usage: create interface unit . Parent must already exist.

Mode: daemon | Wire: ze-iface:interface-unit-add

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`create interface veth name`

Create a veth pair (two linked virtual Ethernet interfaces). Usage: create interface veth name .

Mode: daemon | Wire: ze-iface:interface-create-veth

Requires backend: netlink

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

debug

Command	Mode	Description
`debug ip ospf inject opaque`	daemon	Inject a crafted IPv4 opaque LSA into the local LSDB (RFC 5250).
`debug ipv6 ospf inject lsa`	daemon	Inject a crafted OSPFv3 LSA into the local LSDB (RFC 5340).
`debug ospf inject disable`	daemon	Disable OSPF debug LSA injection. Usage: debug ospf inject disable.
`debug ospf inject enable`	daemon	Enable OSPF debug LSA injection (shared across both address

`debug ip ospf inject opaque`

Inject a crafted IPv4 opaque LSA into the local LSDB (RFC 5250). Usage: debug ip ospf inject opaque scope <link|area|as> id [type <128-255>] [hex | tlv ...] [withdraw]. The default Opaque Type is Private-Use so a test LSA never collides with a standards-track consumer. Requires debug ospf inject enable.

Mode: daemon | Wire: ze-debug:ospf-inject

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`debug ipv6 ospf inject lsa`

Inject a crafted OSPFv3 LSA into the local LSDB (RFC 5340). Usage: debug ipv6 ospf inject lsa scope <link|area|as> type id [hex ] [withdraw]. The flooding scope is derived from the LS Type S2/S1 bits (a reserved scope is rejected). Requires debug ospf inject enable.

Mode: daemon | Wire: ze-debug:ospfv3-inject

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`debug ospf inject disable`

Mode: daemon | Wire: ze-debug:ospf-inject-disable

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`debug ospf inject enable`

Enable OSPF debug LSA injection (shared across both address families). Off by default. Usage: debug ospf inject enable.

Mode: daemon | Wire: ze-debug:ospf-inject-enable

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

delete

Command	Mode	Description
`delete bgp peer`	daemon	Remove a peer from the running config.
`delete debug module`	offline	Disable debug for a subsystem, or remove one of its flags/scopes.
`delete debug profile name`	offline	Delete a named debug profile.
`delete interface name`	daemon	Delete an interface from the kernel.
`delete interface name address`	daemon	Remove an IP address from an interface.
`delete interface name unit`	daemon	Remove a VLAN sub-interface.

`delete bgp peer`

Remove a peer from the running config. Tears down the TCP session and deletes the peer from the running configuration. Does not modify the config file on disk.

Mode: daemon | Wire: ze-delete:bgp-peer

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`delete interface name`

Delete an interface from the kernel. Usage: delete interface name .

Mode: daemon | Wire: ze-iface:interface-delete

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: address, unit

`delete interface name address`

Remove an IP address from an interface. Usage: delete interface name address .

Mode: daemon | Wire: ze-iface:interface-addr-del

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`delete interface name unit`

Remove a VLAN sub-interface. Usage: delete interface name unit.

Mode: daemon | Wire: ze-iface:interface-unit-del

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

doctor

Command	Mode	Description
`doctor`	offline	Verify kernel features, file descriptor limits, sockets, and required dependencies. Run this before first start or after platform changes.

explain

Command	Mode	Description
`explain`	offline	Print the meaning, likely cause, and recommended fix for a Ze diagnostic code. Pass the code you saw in a log or error message.

fakeas112

Command	Mode	Description
`fakeas112 emit`	daemon	Emit the AS112 covering prefixes as route-change batches
`fakeas112 help`	daemon	Print the fakeas112 command surface

`fakeas112 emit`

Mode: daemon | Wire: ze-fakeas112-api:fakeas112-emit

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`fakeas112 help`

Mode: daemon | Wire: ze-fakeas112-api:fakeas112-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

fakel2tp

Command	Mode	Description
`fakel2tp emit`	daemon	Emit one synthetic L2TP route-change batch
`fakel2tp help`	daemon	Print the fakel2tp command surface

`fakel2tp emit`

Mode: daemon | Wire: ze-fakel2tp-api:fakel2tp-emit

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`fakel2tp help`

Mode: daemon | Wire: ze-fakel2tp-api:fakel2tp-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

fakeredist

Command	Mode	Description
`fakeredist emit`	daemon	Emit one synthetic route-change batch
`fakeredist emit-burst`	daemon	Emit N synthetic batches sequentially
`fakeredist help`	daemon	Print the fakeredist command surface

`fakeredist emit`

Mode: daemon | Wire: ze-fakeredist-api:fakeredist-emit

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`fakeredist emit-burst`

Mode: daemon | Wire: ze-fakeredist-api:fakeredist-emit-burst

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`fakeredist help`

Mode: daemon | Wire: ze-fakeredist-api:fakeredist-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

generate

Command	Mode	Description
`generate wireguard keypair`	offline	Generate a WireGuard keypair. Prints private and public keys to stdout for use in your config.

help

Command	Mode	Description
`help`	read-only	Show available commands at this level.
`help ai`	offline	AI reference generated from the binary. Sections: cli, api, mcp, dispatch, all (add --json).
`help command`	offline	List every command with its description. Use a filter to narrow the list.

`help`

Show available commands at this level. Lists every registered command verb with a brief description.

Mode: read-only | Wire: ze-bgp:help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

monitor

Command	Mode	Description
`monitor bgp`	read-only	Live BGP peer dashboard that refreshes automatically.
`monitor event`	read-only	Stream live events as they happen.
`monitor interface rate`	read-only	Stream per-second traffic rates for your interfaces.
`monitor ping`	read-only	Continuous ping with live loss and RTT statistics.
`monitor system netlink`	read-only	Watch kernel networking changes in real time.
`monitor traceroute`	read-only	Live mtr-style traceroute that updates continuously.
`monitor traffic stat`	read-only	Start streaming traffic monitor (per-second snapshots).
`monitor vpn ipsec`	read-only	Watch IPsec SA events as they happen.

`monitor bgp`

Live BGP peer dashboard that refreshes automatically. Shows all peers with state, uptime, and prefix counts. State changes highlight as they happen. Ctrl-C to stop.

Mode: read-only | Wire: ze-bgp:monitor Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor event`

Stream live events as they happen. Shows a real-time feed of internal events. Filter with include or exclude to focus on what matters. Patterns match event type names.

Mode: read-only | Wire: ze-event:monitor Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor interface rate`

Stream per-second traffic rates for your interfaces. Shows rx/tx bytes and packets per second, updating every second. Optionally pass an interface name to watch just one link.

Mode: read-only | Wire: ze-monitor:interface-rate Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor ping`

Continuous ping with live loss and RTT statistics. Pings until you stop it. Adjust interval and timeout as needed. Shows running min/avg/max RTT and packet loss.

Mode: read-only | Wire: ze-monitor:ping Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor system netlink`

Watch kernel networking changes in real time. Streams netlink events: route adds/deletes, link state changes, address assignments. Filter with route, link, address, or all.

Mode: read-only | Wire: ze-monitor:system-netlink Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor traceroute`

Live mtr-style traceroute that updates continuously. Shows each hop with running RTT statistics. Keeps probing so you can watch path changes and latency shifts over time.

Mode: read-only | Wire: ze-monitor:traceroute Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor traffic stat`

Start streaming traffic monitor (per-second snapshots). Without arguments, shows all interfaces. With 'name ', filters to one interface.

Mode: read-only | Wire: ze-monitor:traffic-stat

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`monitor vpn ipsec`

Watch IPsec SA events as they happen. Streams sa-up, sa-down, child-up, child-down, and child-rekey events. Useful for debugging tunnel flaps or rekey issues.

Mode: read-only | Wire: ze-monitor:vpn-ipsec Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

peer

Command	Mode	Description
`peer raw`	daemon	Send raw bytes into a peer's TCP stream (dangerous).
`peer update`	daemon	Send a pre-built BGP UPDATE to a peer.

`peer raw`

Send raw bytes into a peer's TCP stream (dangerous). Injects arbitrary bytes with no BGP framing or validation. Intended for conformance testing and fuzzing only. Will likely break the session if used carelessly.

Mode: daemon | Wire: ze-bgp:peer-raw

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`peer update`

Send a pre-built BGP UPDATE to a peer. Payload can be text (human-readable route syntax), hex, or base64. Use 'show bgp encode' to build the payload, then send it here.

Mode: daemon | Wire: ze-bgp:peer-update

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

plugin

Command	Mode	Description
`plugin ack`	read-only	Choose sync or async event delivery.
`plugin command complete`	read-only	Complete command/args
`plugin command help`	read-only	Show command details
`plugin command list`	read-only	List plugin commands
`plugin encoding`	read-only	Choose json or text encoding for plugin events.
`plugin format`	read-only	Choose how BGP message bytes appear in events.
`plugin help`	read-only	List plugin subcommands
`plugin session bye`	read-only	Disconnect
`plugin session ping`	read-only	Health check (returns PID)
`plugin session ready`	read-only	Signal plugin init complete

`plugin ack`

Choose sync or async event delivery. sync: Ze waits for your plugin to acknowledge each event before sending the next one. Safer but slower. async: events fire without waiting, giving higher throughput at the cost of backpressure control.

Mode: read-only | Wire: ze-bgp:plugin-ack

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin command complete`

Mode: read-only | Wire: ze-plugin:command-complete

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin command help`

Mode: read-only | Wire: ze-plugin:command-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin command list`

Mode: read-only | Wire: ze-plugin:command-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin encoding`

Choose json or text encoding for plugin events. Controls how events are serialized in this session. JSON is structured and parseable; text is more compact.

Mode: read-only | Wire: ze-bgp:plugin-encoding

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin format`

Choose how BGP message bytes appear in events. hex and base64 are compact wire representations. parsed decodes attributes into structured fields. full includes both wire bytes and parsed content.

Mode: read-only | Wire: ze-bgp:plugin-format

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin help`

Mode: read-only | Wire: ze-plugin:help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin session bye`

Mode: read-only | Wire: ze-plugin:session-bye

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin session ping`

Mode: read-only | Wire: ze-plugin:session-ping

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`plugin session ready`

Mode: read-only | Wire: ze-plugin:session-ready

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

request

Command	Mode	Description
`request as112 healthcheck`	daemon	One-shot authoritative query against an anycast service
`request bgp rib inject`	daemon	Inject a synthetic route into the Adj-RIB-In.
`request bgp rib withdraw`	daemon	Withdraw a route from the Adj-RIB-In.
`request cache expire`	daemon	Remove a cached message immediately.
`request cache forward`	daemon	Forward a cached UPDATE to peers matching a selector.
`request cache release`	daemon	Ack without forwarding (cache consumer) or undo retain (API).
`request cache retain`	daemon	Prevent eviction of a cached message.
`request commit`	daemon	Group route changes into named atomic commits.
`request config archive`	daemon	Save a snapshot of the current running configuration.
`request halt`	daemon	Dump goroutine stacks to stderr and terminate immediately.
`request interface down`	daemon	Shut down an interface.
`request interface mac`	daemon	Set the MAC address on an interface.
`request interface migrate`	daemon	Move IP addresses between interfaces with minimal downtime.
`request interface mtu`	daemon	Set the MTU on an interface.
`request interface up`	daemon	Bring an interface up.
`request l2tp outgoing-call remote called`	daemon	Place an LNS-side outgoing call (RFC 2661 S10.4).
`request log level`	daemon	Change a subsystem's log level without restarting.
`request ospf graceful-restart`	daemon	Trigger a planned OSPFv2 graceful restart (RFC 3623 section 2.1).
`request peer borr`	daemon	Start an Enhanced Route Refresh cycle (RFC 7313).
`request peer clear soft`	daemon	Soft-clear a peer without dropping the session.
`request peer eorr`	daemon	Finish an Enhanced Route Refresh cycle (RFC 7313).
`request peer flush`	daemon	Wait until all queued updates for a peer are sent.
`request peer pause`	daemon	Pause reading from a peer's TCP socket.
`request peer plugin session ready`	daemon	Signal that per-peer plugin setup is complete.
`request peer refresh`	daemon	Ask a peer to re-send all routes (RFC 2918).
`request peer resume`	daemon	Resume reading from a previously paused peer.
`request peer teardown`	daemon	Tear down a peer session.
`request quiesce`	daemon	Block until every subsystem has drained pending async work, then reply. A test/operator barrier that replaces a fixed sleep.
`request reboot`	daemon	Gracefully shutdown then reboot the system.
`request reload`	daemon	Reload the configuration without restarting.
`request shutdown`	daemon	Gracefully shutdown: drain connections, close peers, exit.
`request subscribe`	daemon	Start receiving events of one or more types.
`request unsubscribe`	daemon	Stop receiving events you previously subscribed to.

`request as112 healthcheck`

One-shot authoritative query against an anycast service address (or the given target), exit 0 iff the expected AS112 answer comes back. Finding M4: the tool a healthcheck probe calls, since dig is not on the gokrazy appliance and 'ze resolve dns' cannot target a specific server. Usage: request as112 healthcheck [target ].

Mode: daemon | Wire: ze-as112:health

Arguments:

Name	Type	Required	Values
`target`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request bgp rib inject`

Inject a synthetic route into the Adj-RIB-In. Behaves as if the route was received from a peer. Use this for testing policy filters or simulating route announcements.

Mode: daemon | Wire: ze-rib-api:inject Task support: forbidden

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request bgp rib withdraw`

Withdraw a route from the Adj-RIB-In. Removes a previously injected or received route from a peer's Adj-RIB-In, triggering best-path recomputation.

Mode: daemon | Wire: ze-rib-api:withdraw Task support: forbidden

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request cache expire`

Remove a cached message immediately. Usage: request cache expire .

Mode: daemon | Wire: ze-bgp:cache-expire

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request cache forward`

Forward a cached UPDATE to peers matching a selector. Usage: request cache forward .

Mode: daemon | Wire: ze-bgp:cache-forward

Arguments:

Name	Type	Required	Values
`id`	string	yes
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request cache release`

Ack without forwarding (cache consumer) or undo retain (API). Usage: request cache release .

Mode: daemon | Wire: ze-bgp:cache-release

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request cache retain`

Prevent eviction of a cached message. Usage: request cache retain .

Mode: daemon | Wire: ze-bgp:cache-retain

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request commit`

Group route changes into named atomic commits. Actions: start (begin a commit), end (finalize), eor (signal end of RIB), rollback (undo), show (inspect), withdraw (remove all routes in a commit), list (show all commits). Grammar: request commit [args].

Mode: daemon | Wire: ze-bgp:commit

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request config archive`

Save a snapshot of the current running configuration. Captures the config into the store for later rollback or comparison. Optional name labels the snapshot; defaults to a timestamp.

Mode: daemon | Wire: ze-config-archive:trigger

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request halt`

Mode: daemon | Wire: ze-system:daemon-quit

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request interface down`

Shut down an interface. Usage: request interface down.

Mode: daemon | Wire: ze-iface:interface-down

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request interface mac`

Set the MAC address on an interface. Usage: request interface mac aa:bb:cc:dd:ee:ff.

Mode: daemon | Wire: ze-iface:interface-mac

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request interface migrate`

Move IP addresses between interfaces with minimal downtime. Takes a source interface, a target interface, and the address to move. Adds addresses to the target before removing them from the source (make-before-break).

Mode: daemon | Wire: ze-iface:interface-migrate

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request interface mtu`

Set the MTU on an interface. Usage: request interface mtu . Range: 68 to 65535.

Mode: daemon | Wire: ze-iface:interface-mtu

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request interface up`

Bring an interface up. Usage: request interface up.

Mode: daemon | Wire: ze-iface:interface-up

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request l2tp outgoing-call remote called`

Place an LNS-side outgoing call (RFC 2661 S10.4). Usage: request l2tp outgoing-call remote called . Dials the named remote (which must have outgoing-calls enabled), sends OCRQ, and blocks until the call establishes or fails. On failure the cause and RFC 2661 Result Code are reported (auth reject, tie-breaker loss, peer CDN, or timeout).

Mode: daemon | Wire: ze-l2tp-api:outgoing-call

Arguments:

Name	Type	Required	Values
`called`	string	yes
`remote`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request log level`

Change a subsystem's log level without restarting. Usage: request log level . Takes effect immediately. Set to debug when troubleshooting, then back to info when you are done.

Mode: daemon | Wire: ze-bgp:log-set

Arguments:

Name	Type	Required	Values
`logger`	string
`target`	enum		debug, disabled, err, info, warn

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request ospf graceful-restart`

Trigger a planned OSPFv2 graceful restart (RFC 3623 section 2.1). Usage: request ospf graceful-restart. The engine originates one Grace-LSA per interface, persists the non-volatile restart fact, and suppresses route churn so the FIB is retained across the ensuing control-plane restart. Refused when graceful-restart is not configured.

Mode: daemon | Wire: ze-ospf:graceful-restart-prepare

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer borr`

Start an Enhanced Route Refresh cycle (RFC 7313). Tells the peer to mark existing routes as stale. After re-sending, send EORR to purge anything not refreshed.

Mode: daemon | Wire: ze-bgp:peer-borr

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer clear soft`

Soft-clear a peer without dropping the session. Sends ROUTE-REFRESH for every negotiated AFI/SAFI, causing the peer to re-send all routes. No session bounce, no traffic impact.

Mode: daemon | Wire: ze-bgp:peer-clear-soft

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer eorr`

Finish an Enhanced Route Refresh cycle (RFC 7313). The peer purges any routes not re-advertised since the matching BORR. Only send this after the peer has finished re-advertising.

Mode: daemon | Wire: ze-bgp:peer-eorr

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer flush`

Wait until all queued updates for a peer are sent. Usage: request peer flush.

Mode: daemon | Wire: ze-bgp:peer-flush

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer pause`

Pause reading from a peer's TCP socket. Usage: request peer pause.

Mode: daemon | Wire: ze-bgp:peer-pause

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer plugin session ready`

Signal that per-peer plugin setup is complete. Usage: request peer plugin session ready.

Mode: daemon | Wire: ze-plugin:session-peer-ready

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer refresh`

Ask a peer to re-send all routes (RFC 2918). Sends a ROUTE-REFRESH message for the specified AFI/SAFI. The peer will re-advertise its entire Adj-RIB-Out.

Mode: daemon | Wire: ze-bgp:peer-refresh

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer resume`

Resume reading from a previously paused peer. Usage: request peer resume.

Mode: daemon | Wire: ze-bgp:peer-resume

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request peer teardown`

Tear down a peer session. Usage: request peer teardown [cease-subcode].

Mode: daemon | Wire: ze-bgp:peer-teardown

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request quiesce`

Mode: daemon | Wire: ze-system:quiesce

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request reboot`

Mode: daemon | Wire: ze-system:daemon-reboot

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request reload`

Mode: daemon | Wire: ze-system:daemon-reload

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request shutdown`

Mode: daemon | Wire: ze-system:daemon-shutdown

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request subscribe`

Start receiving events of one or more types. Events are delivered asynchronously to your plugin session until you unsubscribe. Use 'show event list' to see available event types.

Mode: daemon | Wire: ze-bgp:subscribe Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`request unsubscribe`

Stop receiving events you previously subscribed to. Removes the subscription for the specified event type from your current plugin session.

Mode: daemon | Wire: ze-bgp:unsubscribe

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

resolve

Command	Mode	Description
`resolve cymru asn-name`	read-only	Find out who owns an AS number.
`resolve dns a`	read-only	Look up IPv4 addresses (A records) for a hostname.
`resolve dns aaaa`	read-only	Look up IPv6 addresses (AAAA records) for a hostname.
`resolve dns ptr`	read-only	Reverse-lookup an IP address to its hostname (PTR).
`resolve dns txt`	read-only	Look up TXT records for a hostname.
`resolve irr expand`	read-only	Expand an AS-SET into its member AS numbers.
`resolve irr prefix`	read-only	Get all prefixes announced by an AS-SET's members.
`resolve peeringdb as-set`	read-only	Find the IRR AS-SET registered for an ASN in PeeringDB.
`resolve peeringdb max-prefix`	read-only	Get max-prefix limits for an ASN from PeeringDB.
`resolve ping`	read-only	Ping from the router with optional source binding.
`resolve traceroute`	read-only	Traceroute from the router with optional source binding.

`resolve cymru asn-name`

Find out who owns an AS number. Queries Team Cymru DNS to return the organization name for the ASN. Usage: resolve cymru asn-name .

Mode: read-only | Wire: ze-resolve:cymru-asn-name

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve dns a`

Look up IPv4 addresses (A records) for a hostname. Usage: resolve dns a .

Mode: read-only | Wire: ze-resolve:dns-a

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve dns aaaa`

Look up IPv6 addresses (AAAA records) for a hostname. Usage: resolve dns aaaa .

Mode: read-only | Wire: ze-resolve:dns-aaaa

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve dns ptr`

Reverse-lookup an IP address to its hostname (PTR). Usage: resolve dns ptr .

Mode: read-only | Wire: ze-resolve:dns-ptr

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve dns txt`

Look up TXT records for a hostname. Usage: resolve dns txt . Returns all TXT strings.

Mode: read-only | Wire: ze-resolve:dns-txt

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve irr expand`

Expand an AS-SET into its member AS numbers. Recursively resolves nested AS-SET objects via WHOIS into a flat list. Useful for building prefix filters from IRR data.

Mode: read-only | Wire: ze-resolve:irr-expand

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve irr prefix`

Get all prefixes announced by an AS-SET's members. Expands the AS-SET, then returns every route/route6 object for each member ASN. Use this to build or verify prefix filters.

Mode: read-only | Wire: ze-resolve:irr-prefix

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve peeringdb as-set`

Find the IRR AS-SET registered for an ASN in PeeringDB. Usage: resolve peeringdb as-set . Feed the result into 'resolve irr expand' to get the full member list.

Mode: read-only | Wire: ze-resolve:peeringdb-as-set

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve peeringdb max-prefix`

Get max-prefix limits for an ASN from PeeringDB. Returns IPv4 and IPv6 prefix limits. Apply via the config editor. Usage: resolve peeringdb max-prefix .

Mode: read-only | Wire: ze-resolve:peeringdb-max-prefix

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve ping`

Ping from the router with optional source binding. Usage: resolve ping [source ] [count ] [size ].

Mode: read-only | Wire: ze-resolve:ping

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`resolve traceroute`

Traceroute from the router with optional source binding. Usage: resolve traceroute [source ] [max-hops N] [timeout D] [probes N].

Mode: read-only | Wire: ze-resolve:traceroute

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

set

Command	Mode	Description
`set debug active name`	offline	Load a named debug profile and apply it to the running daemon.
`set debug module`	offline	Enable debug for a subsystem; optionally set level/flag/scope. E.g. 'set debug module bgp.reactor level debug'.
`set debug profile name`	offline	Save the current debug state as a named profile.
`set debug timeout`	offline	Set the debug auto-disable timer (e.g. 30m, 1h, 90s; 0 disables).
`set system file-descriptors`	daemon	Raise the file descriptor limit for the daemon process.

`set system file-descriptors`

Raise the file descriptor limit for the daemon process. Pass a number or 'max' to go to the hard limit. Takes effect immediately. Check current limits with 'show system file-descriptors'.

Mode: daemon | Wire: ze-set:system-file-descriptors

Arguments:

Name	Type	Required	Values
`limit`	union		max

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

show

Command	Mode	Description
`show aaa accounting`	read-only	Show AAA accounting counters and any dropped records.
`show announcements`	read-only	List active on-demand announcements.
`show anomaly detect`	read-only	Show recent behavioral anomaly incidents (report-only): source entity, cohort,
`show anomaly shape`	read-only	Show the shadow-first anomaly responder status: mode (shadow/armed), action,
`show arp`	read-only	Show the IPv4 ARP table (shortcut for 'show neighbor ipv4').
`show as112`	read-only	AS112 node status: enabled, address-family, hostname/
`show audit`	read-only	Show who did what and when on this box.
`show bfd profile`	read-only	Show BFD timer profiles with effective values.
`show bfd profile name`	read-only	Show one BFD profile by name.
`show bfd session address`	read-only	Show full detail for one BFD session.
`show bfd sessions`	read-only	List all active BFD sessions.
`show bgp decode`	read-only	Decode a hex-encoded BGP message into readable JSON.
`show bgp encode`	read-only	Turn a route announcement into wire-format hex.
`show bgp health`	read-only	Quick health check for all your BGP peers.
`show bgp irr`	read-only	Show IRR filter status per ASN.
`show bgp irr check`	read-only	Check if a prefix is accepted by the IRR filter.
`show bgp irr prefix`	read-only	Show IRR-resolved prefixes for a peer.
`show bgp peer capabilities`	read-only	Show what capabilities were negotiated with a peer.
`show bgp peer detail`	read-only	Show full detail for one or more peers.
`show bgp peer history`	read-only	Show FSM state transitions for a peer over time.
`show bgp peer list`	read-only	List your peers, one line each.
`show bgp peer rib`	read-only	Show RIB data scoped to one peer.
`show bgp peer statistics`	read-only	Show UPDATE throughput for your peers.
`show bgp rib`	read-only	Query routes in the BGP RIB.
`show bgp rib best`	read-only	Show the winning route for each prefix.
`show bgp rib best status`	read-only	Check whether best-path computation is still running.
`show bgp rib rpf`	read-only	Reverse-path forwarding lookup in the Loc-RIB.
`show bgp rib status`	read-only	Get a quick RIB overview without dumping routes.
`show bgp summary`	read-only	Show a one-line-per-peer BGP summary.
`show bmp collectors`	read-only	Show BMP collector connection status.
`show bmp peers`	read-only	Show BGP peers as seen through BMP monitoring.
`show bmp rib`	read-only	Show routes received via BMP monitoring sessions.
`show bmp sessions`	read-only	Show active BMP receiver sessions.
`show cache`	read-only	List cached BGP UPDATE message IDs with their
`show capture`	read-only	Show captured control-plane messages.
`show capture interface`	read-only	Capture live packets on an interface (like tcpdump).
`show capture raw`	read-only	Control raw byte capture for protocol debugging.
`show command complete`	read-only	Get tab-completion candidates for a partial command.
`show command help`	read-only	Show usage and arguments for a specific command.
`show command list`	read-only	List every command the daemon knows about.
`show config cat`	read-only	Print the full text of a stored configuration snapshot.
`show config diff`	read-only	Compare two configuration versions side by side.
`show config dump`	read-only	Show the fully resolved configuration tree.
`show config fmt`	read-only	Pretty-print the configuration with consistent formatting.
`show config graph`	offline	Show how components and peers depend on each other (DOT graph format).
`show config history`	read-only	List available configuration rollback points.
`show config ls`	read-only	List all configuration files stored in the database.
`show crashes`	read-only	View saved crash reports from panics.
`show data cat`	read-only	Print the raw content of a blob store entry.
`show data ls`	read-only	List everything stored in the ZeFS blob store.
`show data registered`	read-only	List the key patterns registered by all subsystems.
`show ddos flowspec`	read-only	Show the upstream FlowSpec/RTBH DDoS mitigation status: whether a rule is
`show ddos incidents`	read-only	Show the recent DDoS incident ring (newest first): per incident the
`show ddos local`	read-only	Show the on-host DDoS mitigation status: whether an nft drop rule is
`show ddos status`	read-only	Show DDoS observation status: whether the incident store is running, the
`show debug`	read-only	Show live debug state from the running daemon.
`show debug profile`	offline	Show stored debug profiles (list, 'name ' for one, add 'module ' to filter).
`show dns cache list`	read-only	List all non-expired DNS cache entries, sorted by shortest TTL first.
`show dns cache record`	read-only	Show DNS cache entries for one record name.
`show dns cache stats`	read-only	Show DNS cache hit, miss, eviction, expiry, and hit-rate counters without changing cache contents.
`show dns lookup`	read-only	Look up a DNS name from the router.
`show doctor`	read-only	Check if this box is ready to run Ze.
`show env get`	read-only	Show one environment variable in detail.
`show env list`	read-only	List all Ze environment variables with their current values.
`show env registered`	read-only	List every registered environment variable with metadata.
`show errors`	read-only	Show recent errors across all subsystems, newest first.
`show event delivery`	read-only	Show which peers feed which attached processes.
`show event list`	read-only	List every event type you can subscribe to.
`show event namespaces`	read-only	List all event namespaces and how many events each has logged.
`show event recent`	read-only	Show recent events, newest first.
`show firewall group`	read-only	Show members of a firewall address/port group.
`show firewall irr`	read-only	Show IRR filter status for all cached ASN/AS-SET entries.
`show firewall irr prefix`	read-only	Show IRR-resolved prefixes for a cached entry.
`show firewall ruleset`	read-only	Show the live firewall ruleset with per-term counters.
`show flow export`	read-only	Show flow export (NetFlow/IPFIX) collector status.
`show flow recent`	read-only	Show recent conntrack flow records from the bounded recent-flow ring.
`show geodns`	read-only	GeoDNS server status: enabled, bind addresses/port, client-IP
`show gnmi`	read-only	Show whether the gNMI server is running and how it is configured.
`show health`	read-only	Is this box healthy? One command to find out.
`show host`	read-only	Hardware inventory for this box.
`show host all`	read-only	Show the full hardware inventory in one shot.
`show host cpu`	read-only	Show what CPUs are in this box.
`show host dmi`	read-only	Show the box's identity from SMBIOS/DMI.
`show host kernel`	read-only	Show the running kernel version and boot parameters.
`show host memory`	read-only	Show installed memory and ECC health.
`show host nic`	read-only	Show physical NICs installed in this box.
`show host platform`	read-only	Show platform capabilities and constraints.
`show host storage`	read-only	Show storage devices attached to this box.
`show host thermal`	read-only	Show temperature sensors and thermal throttle events.
`show interface`	read-only	Show network interfaces on this box.
`show interface brief`	read-only	One-line summary per interface: name, state, IP, and MTU.
`show interface errors`	read-only	Show interfaces that have errors or drops.
`show interface name counters`	read-only	Show counters for one interface.
`show interface name detail`	read-only	Show full detail for one interface.
`show interface rate`	read-only	Show per-second traffic rates on your interfaces.
`show interface scan`	read-only	Discover and classify all OS interfaces.
`show interface type`	read-only	Show only interfaces of a given type.
`show isis database`	read-only	Show the IS-IS link-state database.
`show isis database detail`	read-only	Show the IS-IS link-state database with TLV detail.
`show isis hostname`	read-only	Show the IS-IS dynamic-hostname mapping (RFC 5301).
`show isis interface`	read-only	Show IS-IS-enabled circuits.
`show isis neighbor`	read-only	Show IS-IS adjacencies.
`show isis route`	read-only	Show IS-IS-computed routes.
`show isis route ipv6`	read-only	Show IS-IS-computed IPv6 routes (RFC 5308).
`show isis spf-log`	read-only	Show recent IS-IS SPF runs.
`show l2tp`	read-only	L2TP tunnel, session, and subscriber state.
`show l2tp config`	read-only	Show the resolved L2TP configuration.
`show l2tp cqm`	read-only	Show subscriber line quality (CQM latency buckets).
`show l2tp echo`	read-only	Show LCP echo health for a subscriber session.
`show l2tp health`	read-only	Find your worst L2TP sessions at a glance.
`show l2tp listeners`	read-only	Show which UDP sockets are listening for L2TP.
`show l2tp observer`	read-only	Show recent events for a session (debug aid).
`show l2tp reliable`	read-only	Show the reliable transport window for a tunnel.
`show l2tp session history`	read-only	Show state transitions for a session over time.
`show l2tp session id`	read-only	Show full detail for one L2TP session.
`show l2tp session traffic`	read-only	Show traffic counters for a subscriber's PPP interface.
`show l2tp sessions`	read-only	List all active L2TP sessions.
`show l2tp statistics`	read-only	Show aggregate L2TP protocol counters.
`show l2tp tunnel history`	read-only	Show state transitions for a tunnel over time.
`show l2tp tunnel id`	read-only	Show full detail for one L2TP tunnel.
`show l2tp tunnels`	read-only	List all active L2TP tunnels.
`show ldp binding`	read-only	Show LDP FEC-to-label bindings.
`show ldp neighbor`	read-only	Show LDP neighbors and their session state.
`show log levels`	read-only	Show what log level each subsystem is using.
`show log recent`	read-only	Show recent log entries from the in-memory ring.
`show metrics list`	read-only	List all registered metric names (no values).
`show metrics name`	read-only	Show one Prometheus metric by name.
`show metrics pool`	read-only	Show attribute pool memory usage and dedup efficiency.
`show metrics values`	read-only	Dump all metrics in Prometheus text format.
`show mpls forwarding`	read-only	Show MPLS forwarding entries installed in the kernel.
`show neighbor`	read-only	Show the ARP and neighbor discovery table.
`show ospf`	read-only	OSPFv2 process summary: router-id, areas, ABR/ASBR status, and stub-router (max-metric) state (RFC 2328).
`show ospf border-routers`	read-only	Show routes to OSPF area-border and AS-boundary routers.
`show ospf database`	read-only	Show the OSPF link-state database.
`show ospf database asbr-summary`	read-only	Show only ASBR-Summary-LSAs (Type 4).
`show ospf database external`	read-only	Show only AS-external-LSAs (Type 5).
`show ospf database network`	read-only	Show only Network-LSAs (Type 2).
`show ospf database nssa-external`	read-only	Show only NSSA-external-LSAs (Type 7, RFC 3101).
`show ospf database opaque-area`	read-only	Show only area-scope opaque-LSAs (Type 10, RFC 5250).
`show ospf database opaque-area detail`	read-only	Decode each area-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).
`show ospf database opaque-as`	read-only	Show only AS-scope opaque-LSAs (Type 11, RFC 5250).
`show ospf database opaque-as detail`	read-only	Decode each AS-scope opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).
`show ospf database opaque-link`	read-only	Show only link-local opaque-LSAs (Type 9, RFC 5250).
`show ospf database opaque-link detail`	read-only	Decode each link-local opaque LSA body into its typed TLVs (TE / Router-Information / Extended / Segment-Routing) or a generic type/length/hex view (spec-ospf-ext-14, RFC 5250).
`show ospf database router`	read-only	Show only Router-LSAs (Type 1).
`show ospf database router-information`	read-only	Show the Router Information LSAs (RFC 7770) for both address
`show ospf database summary`	read-only	Show only Summary-LSAs (Type 3, inter-area network).
`show ospf graceful-restart`	read-only	Show OSPFv2 (IPv4) Graceful Restart state (RFC 3623): the restarter
`show ospf instance`	read-only	Show the configured OSPFv2 instances (RFC 6549 Multi-Instance).
`show ospf interface`	read-only	Show OSPF-enabled interfaces.
`show ospf interface detail`	read-only	Show full per-interface state (spec-ospf-ext-14): ISM, DR/BDR election detail, all three timers, and the opaque-capable neighbour count.
`show ospf ipv6`	read-only	Show the OSPFv3 (IPv6) address-family instances (RFC 5838).
`show ospf ipv6 database`	read-only	Show the OSPFv3 (IPv6) link-state database with each native scope-aware LSA decoded (RFC 5340). Base types decode into named fields; unknown function codes fall back to a scope-aware header + body-hex view (spec-ospf-ext-14).
`show ospf ipv6 database detail`	read-only	Decode every OSPFv3 LSA body with its scope-aware header (RFC 5340 section A.4.2.1).
`show ospf ipv6 database extended`	read-only	Show the RFC 8362 extended OSPFv3 LSAs (E-Router / E-Network / E-Inter-Area / E-AS-External / E-Link / E-Intra-Area-Prefix) decoded into named TLVs.
`show ospf ipv6 database router detail`	read-only	Decode each OSPFv3 Router-LSA body.
`show ospf ipv6 database router-information`	read-only	Show the OSPFv3 Router Information LSAs (RFC 7770, function code 12) decoded into capability bits and TLVs.
`show ospf ipv6 database scope area`	read-only	Show only area-scope (S2/S1 = 01) LSAs.
`show ospf ipv6 database scope as`	read-only	Show only AS-scope (S2/S1 = 10) LSAs.
`show ospf ipv6 database scope link`	read-only	Show only link-local (S2/S1 = 00) LSAs, including the per-interface Link-LSA store.
`show ospf ipv6 database segment-routing`	read-only	Summarise the OSPFv3 Segment Routing content (RFC 8666) carried in the RI and extended LSAs.
`show ospf ipv6 graceful-restart`	read-only	Show OSPFv3 (IPv6) Graceful Restart state (RFC 5187): the restarter
`show ospf ipv6 instance`	read-only	Enumerate the active OSPFv3 address-family instances (RFC 5838 section 2): each with its address family, Instance ID, area count, and neighbor count.
`show ospf ipv6 interface`	read-only	Show OSPFv3 (IPv6-family) interfaces and their RFC 4552 IPsec status.
`show ospf ipv6 interface detail`	read-only	Show full per-interface OSPFv3 state (spec-ospf-ext-14): ISM, DR/BDR by Router ID, timers, the local Interface ID and Instance ID.
`show ospf ipv6 neighbor`	read-only	Show OSPFv3 (IPv6) neighbors: the link-local address as identity, adjacency state, DR/BDR by Router ID, and dead time.
`show ospf ipv6 neighbor detail`	read-only	Show full per-neighbor OSPFv3 state (spec-ospf-ext-14): the advertised Interface ID, DD sequence, decoded Options (R/V6/E/N/AF), list sizes, last NSM event, and timers.
`show ospf ipv6 segment-routing`	read-only	Show OSPFv3 (IPv6) Segment Routing state (RFC 8666): the configured
`show ospf ipv6 spf`	read-only	Show the OSPFv3 (IPv6) per-area SPF run history.
`show ospf ipv6 spf detail`	read-only	Explain why each OSPFv3 route won (spec-ospf-ext-14), AF/Instance-ID tagged; read-only.
`show ospf ldp-sync`	read-only	Show OSPF LDP-IGP synchronization state (RFC 5443, RFC 6138).
`show ospf neighbor`	read-only	Show OSPF neighbors.
`show ospf neighbor detail`	read-only	Show full per-neighbor state (spec-ospf-ext-14): DD sequence, decoded Options (incl. the RFC 5250 O-bit), request/summary list sizes, last NSM event, and timers.
`show ospf route`	read-only	Show OSPF-computed routes.
`show ospf route fast-reroute`	read-only	Show OSPF fast-reroute (LFA / TI-LFA) backups (RFC 5286).
`show ospf segment-routing`	read-only	Show OSPFv2 (IPv4) Segment Routing state (RFC 8665): the configured
`show ospf spf`	read-only	Show recent OSPF SPF runs.
`show ospf spf detail`	read-only	Explain why each route won (spec-ospf-ext-14): the candidate paths considered per prefix, the winning cost, and the RFC 2328 section 16.4 path-preference tie-break. Read-only; the route table and SPF run count are unchanged.
`show ospf te-database`	read-only	Show the OSPF Traffic Engineering Database (RFC 3630 / RFC 5392):
`show ospf virtual-links`	read-only	Show OSPF virtual links (RFC 2328 section 15).
`show ping`	read-only	Ping a target from the router itself.
`show pki certificate name`	read-only	Inspect a specific certificate in detail.
`show pki certificates`	read-only	List all loaded certificates with expiry dates.
`show policy chain peer`	read-only	Show the import/export filter chain applied to a peer.
`show policy list`	read-only	List all available filter types and named instances.
`show policy routes`	read-only	Show policy-based routing rules.
`show policy test peer`	read-only	Test what your policy does to a specific UPDATE.
`show pppoe`	read-only	PPPoE session and protocol state.
`show pppoe interfaces`	read-only	Show which interfaces are accepting PPPoE sessions.
`show pppoe session id`	read-only	Show full detail for one PPPoE session.
`show pppoe sessions`	read-only	List all active PPPoE sessions.
`show pppoe statistics`	read-only	Show PPPoE protocol message counters.
`show probe-round`	read-only	Run a parallel traceroute probe round to a target.
`show reload-status`	read-only	Show how many config reloads the daemon has processed.
`show route`	read-only	Show the kernel routing table.
`show route lookup`	read-only	Look up which route the kernel would use for a given IP.
`show rr peers`	read-only	Show route reflector client peers.
`show rr status`	read-only	Show whether the route reflector is active.
`show rsvp-te fast-reroute`	read-only	Show RSVP-TE Fast Reroute (RFC 4090) protection state.
`show rsvp-te interface`	read-only	Show RSVP-TE bandwidth allocation per interface.
`show rsvp-te lsp`	read-only	Show RSVP-TE label-switched paths.
`show rsvp-te tunnel`	read-only	Show configured RSVP-TE tunnels and their current state.
`show runtime memory`	read-only	Show the Go runtime allocator memory stats.
`show schema events`	read-only	List all notification types defined in YANG API modules.
`show schema handlers`	read-only	Show which handler serves each YANG module.
`show schema list`	read-only	List all YANG schemas loaded by the daemon.
`show schema methods`	read-only	List all RPC methods defined in YANG API modules.
`show schema protocol`	read-only	Show the wire protocol version and format details.
`show static`	read-only	Show static routes defined in the configuration.
`show status`	read-only	Show process status, uptime, and resource usage.
`show storage smart`	read-only	Show disk health via SMART data.
`show subscriber`	read-only	Show a summary of all subscriber sessions.
`show subscriber id detail`	read-only	Show everything about one subscriber session.
`show system conntrack`	read-only	Show the kernel connection tracking table.
`show system cpu`	read-only	Show CPU utilization context for the daemon.
`show system date`	read-only	Show the daemon's current wall-clock time and timezone.
`show system file-descriptors`	read-only	Show how many file descriptors the daemon has open.
`show system goroutines`	read-only	Dump goroutine stacks for debugging hangs or deadlocks.
`show system kernel-log`	read-only	Show kernel log messages (dmesg-style).
`show system memory`	read-only	Show how much memory the daemon is using, from the OS's view.
`show system ntp`	read-only	NTP clock synchronization status
`show system ntp peers`	read-only	Show NTP peers with offset, RTT, stratum, and reachability.
`show system platform`	read-only	Show what kind of platform the daemon is running on.
`show system profile`	read-only	Capture a runtime profile for performance analysis.
`show system sockets`	read-only	Show open TCP and UDP sockets on this box.
`show system subsystem list`	read-only	List every registered subsystem and whether it is running.
`show system update`	read-only	Check if a firmware update is available.
`show system update history`	read-only	Show recent firmware update activity.
`show tcp-check`	read-only	Test TCP connectivity to a remote host and port.
`show traceroute`	read-only	Trace the network path from this router to a target.
`show traffic control`	read-only	Show traffic control (QoS) configuration per interface.
`show traffic feature`	read-only	Show neutral per-source traffic feature signals: fan-out (distinct destinations),
`show traffic stat`	read-only	Show aggregated traffic snapshot (interface rates, top talkers, top ports, severity).
`show traffic usage`	read-only	Show per-interface traffic byte counters captured by eBPF TCX.
`show uptime`	read-only	Show how long the daemon has been running.
`show version`	read-only	Show the running Ze version and build date.
`show vpn ipsec dataplane drift`	read-only	Compare what the IKE engine believes against what the kernel holds.
`show vpn ipsec dataplane policy`	read-only	Show the Security Policy Database the kernel holds.
`show vpn ipsec dataplane sa`	read-only	Show the Security Association Database the kernel holds.
`show vpn ipsec peer name`	read-only	Show full detail for one IPsec peer.
`show vpn ipsec sa`	read-only	Show all IKE and Child Security Associations.
`show vpn ipsec status`	read-only	Quick IPsec health check.
`show vpp runtime`	read-only	Show VPP graph node processing statistics.
`show vpp trace clear`	read-only	Discard the captured VPP trace buffer.
`show vpp trace show`	read-only	Retrieve packets captured since the last trace start.
`show vpp trace start`	read-only	Start capturing packets in the VPP dataplane.
`show vrrp`	read-only	Show every VRRP virtual router: its group name, VRID, address
`show vrrp interface name`	read-only	Show the VRRP virtual routers on one parent interface.
`show vrrp statistics`	read-only	Show per-virtual-router counters: advertisements sent and
`show warnings`	read-only	Show active warnings across all subsystems.
`show yang completion`	read-only	Show YANG paths available for tab completion.
`show yang doc`	read-only	Generate command reference docs from YANG schemas.
`show yang tree`	read-only	Print the YANG tree for a module in a readable hierarchy.

`show aaa accounting`

Show AAA accounting counters and any dropped records. Tells you whether TACACS+ accounting is working or if records are being lost due to server unreachability.

Mode: read-only | Wire: ze-show:aaa-accounting

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show announcements`

List active on-demand announcements. Usage: show announcements [tag ] [selector ] [family ]

Mode: read-only | Wire: ze-bgp:show-announcements

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show anomaly detect`

Show recent behavioral anomaly incidents (report-only): source entity, cohort, fired features with their deviation z-scores, combined score, and severity. The detector reports; the anomaly/shape responder (Spec 2b) acts.

Mode: read-only | Wire: ze-show:anomaly

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show anomaly shape`

Show the shadow-first anomaly responder status: mode (shadow/armed), action, kill-switch state, and the currently armed source entities with live firewall actions.

Mode: read-only | Wire: ze-show:anomaly-shape

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show arp`

Show the IPv4 ARP table (shortcut for 'show neighbor ipv4'). Lists IPv4 ARP entries with MAC address and state. ARP is IPv4-only; use 'show neighbor' for both families or 'show neighbor ipv6' for the IPv6 ND table.

Mode: read-only | Wire: ze-show:arp

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show as112`

AS112 node status: enabled, address-family, hostname/ facility/location, allow-from count, served zone count, and the current SOA serial.

Mode: read-only | Wire: ze-show:as112

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show audit`

Show who did what and when on this box. Returns audit log entries with timestamps, actors, and actions. Filters (all optional, combinable): action , actor , surface (cli, web, api), since/until , count . Actions include config-commit, login, peer-teardown, and more.

Mode: read-only | Wire: ze-show:audit

Arguments:

Name	Type	Required	Values
`action`	string
`actor`	string
`count`	uint
`since`	string
`surface`	string
`until`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bfd profile`

Show BFD timer profiles with effective values. Returns min-tx, min-rx, and detect-multiplier after inheritance. Use 'show bfd profile' for every profile or 'show bfd profile name ' for one profile.

Mode: read-only | Wire: ze-bfd-api:show-profile

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: name

`show bfd profile name`

Mode: read-only | Wire: ze-bfd-api:show-profile

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bfd session address`

Show full detail for one BFD session. Pass the peer address. Returns local/remote discriminators, negotiated timers, detection time, and packet counters.

Mode: read-only | Wire: ze-bfd-api:show-session

Arguments:

Name	Type	Required	Values
`address`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bfd sessions`

List all active BFD sessions. One line per session: peer address, state, negotiated tx/rx intervals, and detect multiplier.

Mode: read-only | Wire: ze-bfd-api:show-sessions

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp decode`

Decode a hex-encoded BGP message into readable JSON. Paste a hex BGP UPDATE and get back parsed attributes, NLRI, and withdrawn prefixes. Handy for reading pcap captures or debugging wire issues. Also available in the web UI under tools.

Mode: read-only | Wire: ze-show:bgp-decode

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp encode`

Turn a route announcement into wire-format hex. Takes a route in API syntax and returns the BGP UPDATE as a hex string. Useful for building test payloads, feeding to ze-test, or verifying that your announcement encodes correctly.

Mode: read-only | Wire: ze-show:bgp-encode

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp health`

Quick health check for all your BGP peers. Lists every peer with address, state, ASN, and uptime. Reports how many are not Established. Much faster than 'show bgp peer *' when you just need a status overview.

Mode: read-only | Wire: ze-show:bgp-health

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp irr`

Show IRR filter status per ASN. Lists each enrolled ASN with its resolved AS-SET, prefix counts, last refresh time, and error status. Use this to confirm that IRR prefix-lists are loaded and current.

Mode: read-only | Wire: ze-show:irr-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: check, prefix

`show bgp irr check`

Check if a prefix is accepted by the IRR filter. Usage: show bgp irr check . Reports whether the prefix would be accepted or rejected, and which entry matches.

Mode: read-only | Wire: ze-show:irr-check

Arguments:

Name	Type	Required	Values
`peer`	string	yes
`prefix`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp irr prefix`

Show IRR-resolved prefixes for a peer. Usage: show bgp irr prefix . Lists all IPv4 and IPv6 prefixes in the IRR-resolved prefix-list for the given peer address.

Mode: read-only | Wire: ze-show:irr-prefix

Arguments:

Name	Type	Required	Values
`peer`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer capabilities`

Show what capabilities were negotiated with a peer. Usage: show bgp peer capabilities.

Mode: read-only | Wire: ze-bgp:peer-capabilities

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer detail`

Show full detail for one or more peers. Usage: show bgp peer detail. The selector can be an IP, peer name, AS pattern (as65001), glob, or *.

Mode: read-only | Wire: ze-bgp:peer-detail

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer history`

Show FSM state transitions for a peer over time. Usage: show bgp peer history.

Mode: read-only | Wire: ze-bgp:peer-history

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer list`

List your peers, one line each. Shows name, address, ASN, state, and uptime. Quick overview without the detail of 'show bgp peer detail'.

Mode: read-only | Wire: ze-bgp:peer-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer rib`

Show RIB data scoped to one peer. Usage: show bgp peer rib [scope|filters|terminal].

Mode: read-only | Wire: ze-bgp:peer-rib

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp peer statistics`

Show UPDATE throughput for your peers. Usage: show bgp peer statistics.

Mode: read-only | Wire: ze-bgp:peer-statistics

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp rib`

Query routes in the BGP RIB. Look at received or advertised routes with flexible filters: peer, family, prefix, AS path regex, community, match expression. Pipe operators: | count, | prefix-summary, | graph. This is the main route inspection command.

Mode: read-only | Wire: ze-rib-api:routes Task support: required

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Command-specific:

advertised -- Select advertised routes
community <value> -- Filter by standard community
count -- Count matching routes without serializing rows
family <value> -- Filter by AFI/SAFI
first <value> -- Take first N routes
graph -- Render AS-path topology graph
last <value> -- Take last N routes
match <value> -- Cross-field structured match
path <value> -- Filter by AS path
peer <value> -- Filter by peer
prefix <value> -- Filter by prefix
prefix-summary -- Summarize by family and prefix length
received -- Select received routes

Subcommands: best, rpf, status

`show bgp rib best`

Show the winning route for each prefix. Same filters as 'show bgp rib'. Use '| reason' to see why each path was selected (local-pref, AS path length, MED, etc.).

Mode: read-only | Wire: ze-rib-api:best

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Command-specific:

community <value> -- Filter by standard community
count -- Count matching best paths without serializing rows
family <value> -- Filter by AFI/SAFI
first <value> -- Take first N best paths
graph -- Render AS-path topology graph
last <value> -- Take last N best paths
match <value> -- Cross-field structured match
path <value> -- Filter by AS path
peer <value> -- Filter by peer
prefix <value> -- Filter by prefix
prefix-summary -- Summarize by family and prefix length
reason -- Explain best-path selection

Subcommands: status

`show bgp rib best status`

Check whether best-path computation is still running. Reports idle, pending, or running, plus the last run duration.

Mode: read-only | Wire: ze-rib-api:best-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp rib rpf`

Reverse-path forwarding lookup in the Loc-RIB. Performs a longest-prefix-match and returns the best-path entry. Use this to verify RPF checks would pass for a given source.

Mode: read-only | Wire: ze-rib-api:rpf

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp rib status`

Get a quick RIB overview without dumping routes. Shows total peers, received/accepted/advertised route counts, and per-family breakdowns. Use this to confirm convergence after a peer comes up.

Mode: read-only | Wire: ze-rib-api:status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bgp summary`

Show a one-line-per-peer BGP summary. Lists every peer with state, ASN, prefixes received, and uptime. Optionally scope by address family: ipv4, ipv6, or l2vpn.

Mode: read-only | Wire: ze-bgp:summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bmp collectors`

Show BMP collector connection status. Lists configured collectors with connection state, sent message counts, and error statistics. Check here if your collector is not receiving data.

Mode: read-only | Wire: ze-show:bmp-collectors

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bmp peers`

Show BGP peers as seen through BMP monitoring. Lists peers reported via BMP with their state and route statistics.

Mode: read-only | Wire: ze-show:bmp-peers

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bmp rib`

Show routes received via BMP monitoring sessions. Returns the BMP RIB content. Use this to verify what your collector is seeing from remote peers.

Mode: read-only | Wire: ze-show:bmp-rib

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show bmp sessions`

Show active BMP receiver sessions. Lists each session with connection state and message counters. Check here to confirm your BMP collector is receiving data.

Mode: read-only | Wire: ze-show:bmp-sessions

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show cache`

List cached BGP UPDATE message IDs with their retain and consumer state.

Mode: read-only | Wire: ze-bgp:cache-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show capture`

Show captured control-plane messages. Returns protocol messages you previously enabled capture for. Without a protocol keyword, shows all protocols. Filters: tunnel-id (L2TP), peer (remote address), count (limit entries). Use this to debug session establishment issues.

Mode: read-only | Wire: ze-show:capture

Arguments:

Name	Type	Values
`count`	uint
`peer`	string
`protocol`	enum	bgp, l2tp
`tunnel-id`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: interface, raw

`show capture interface`

Capture live packets on an interface (like tcpdump). Uses AF_PACKET for zero-copy capture. Filter by protocol and port. Limit with count or duration. Output as pcap (for Wireshark) or text. Snap-len controls how many bytes per packet are captured.

Mode: read-only | Wire: ze-show:capture-interface

Arguments:

Name	Type	Values
`count`	uint
`duration`	string
`format`	enum	pcap, text
`iface`	string
`protocol`	string
`snap-len`	uint

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show capture raw`

Control raw byte capture for protocol debugging. Actions: start (begin capturing), stop (halt), dump (retrieve). Protocols: l2tp, bgp. Output formats: pcap (for Wireshark), json. Limit with count .

Mode: read-only | Wire: ze-show:capture-raw

Arguments:

Name	Type	Values
`action`	enum	dump, start, stop
`count`	uint
`format`	enum	json, pcap
`protocol`	enum	bgp, l2tp

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show command complete`

Get tab-completion candidates for a partial command. Returns possible completions for the given input. Used internally by the CLI editor, but also callable for scripting.

Mode: read-only | Wire: ze-bgp:command-complete

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show command help`

Show usage and arguments for a specific command. Gives you the full description, expected arguments, and usage pattern for one command.

Mode: read-only | Wire: ze-bgp:command-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show command list`

List every command the daemon knows about. Returns dispatch key and description for each. Useful for scripting or discovering commands not shown in the top-level help.

Mode: read-only | Wire: ze-bgp:command-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config cat`

Print the full text of a stored configuration snapshot. Usage: show config cat . Outputs the config as-is.

Mode: read-only | Wire: ze-show:config-cat

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config diff`

Compare two configuration versions side by side. Shows what was added, removed, or changed. Commonly used with rollback revisions to review what changed before you roll back.

Mode: read-only | Wire: ze-show:config-diff

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config dump`

Show the fully resolved configuration tree. Parses the config and outputs it after includes, defaults, and group inheritance have been applied. What you see here is exactly what the daemon is using.

Mode: read-only | Wire: ze-show:config-dump

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config fmt`

Pretty-print the configuration with consistent formatting. Normalizes indentation and ordering. Output goes to stdout (read-only). To rewrite the file in place, use 'ze config fmt -w' from the CLI.

Mode: read-only | Wire: ze-show:config-fmt

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config history`

List available configuration rollback points. Shows revisions with timestamps and commit metadata. Pair with 'show config diff' to review changes before rolling back.

Mode: read-only | Wire: ze-show:config-history

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show config ls`

List all configuration files stored in the database. Shows archived snapshots and the active config.

Mode: read-only | Wire: ze-show:config-ls

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show crashes`

View saved crash reports from panics. Without arguments, lists available crash files. Use 'latest' to see the newest crash or 'name ' to print one specific report. Send the output to support when reporting a crash.

Mode: read-only | Wire: ze-show:crashes

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show data cat`

Print the raw content of a blob store entry. Usage: show data cat . Outputs the value for the given key, like 'cat' for ZeFS.

Mode: read-only | Wire: ze-show:data-cat

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show data ls`

List everything stored in the ZeFS blob store. Shows all keys and their sizes. Use 'show data cat ' to see the content of a specific entry.

Mode: read-only | Wire: ze-show:data-ls

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show data registered`

List the key patterns registered by all subsystems. Shows you what types of data ZeFS knows about.

Mode: read-only | Wire: ze-show:data-registered

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ddos flowspec`

Show the upstream FlowSpec/RTBH DDoS mitigation status: whether a rule is currently announced, the target vector it covers, and whether the leak-probe is running.

Mode: read-only | Wire: ze-show:ddos-flowspec

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ddos incidents`

Show the recent DDoS incident ring (newest first): per incident the target vector (prefix/proto/port), attack family, top source addresses, peak pps/bps, start/end time, and whether it is still active.

Mode: read-only | Wire: ze-show:ddos-incidents

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ddos local`

Show the on-host DDoS mitigation status: whether an nft drop rule is currently installed and the target vector (prefix / proto / port) it covers.

Mode: read-only | Wire: ze-show:ddos-local

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ddos status`

Show DDoS observation status: whether the incident store is running, the number of currently active attacks, and the number of incidents retained in the ring.

Mode: read-only | Wire: ze-show:ddos-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show debug`

Show live debug state from the running daemon. Lists every registered subsystem with its current log level and any active flag or scope filters. Unlike 'debug show' (which reads the stored profile), this reflects actual runtime state.

Mode: read-only | Wire: ze-debug:debug-state

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show dns cache list`

Mode: read-only | Wire: ze-show:dns-cache-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show dns cache record`

Mode: read-only | Wire: ze-show:dns-cache-record

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show dns cache stats`

Mode: read-only | Wire: ze-show:dns-cache-stats

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show dns lookup`

Look up a DNS name from the router. Resolves using the daemon's DNS resolver (falls back to the system resolver if no DNS component is configured). Default type is A. Returns records, TTL, and query time. Supports A, AAAA, MX, NS, TXT, CNAME, and PTR.

Mode: read-only | Wire: ze-show:dns-lookup

Arguments:

Name	Type	Required	Values
`hostname`	string	yes
`type`	enum		A, AAAA, CNAME, MX, NS, PTR, TXT

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show doctor`

Check if this box is ready to run Ze. Verifies runtime dependencies: required files, sockets, ports, and kernel modules. Each check reports pass or fail with a reason. Run this before first start or after changing the platform setup.

Mode: read-only | Wire: ze-show:doctor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show env get`

Show one environment variable in detail. Returns the variable name, current value, default, and what it controls. Usage: show env get .

Mode: read-only | Wire: ze-show:env-get

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show env list`

List all Ze environment variables with their current values. Shows which env vars are set and their defaults.

Mode: read-only | Wire: ze-show:env-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show env registered`

List every registered environment variable with metadata. Includes type, default, description, and whether it is currently set.

Mode: read-only | Wire: ze-show:env-registered

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show errors`

Show recent errors across all subsystems, newest first. This is the first place to look when something goes wrong. Filter with source to narrow to one subsystem, count to limit output.

Mode: read-only | Wire: ze-show:errors

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show event delivery`

Show which peers feed which attached processes. One block per peer, one row per attach process block on it: the event types that process is fed, and the message types it may send toward that peer. A token the event registry does not know is listed as unresolved and carries no edge. Answer to 'why does my program see nothing from this peer'.

Mode: read-only | Wire: ze-show:event-delivery

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show event list`

List every event type you can subscribe to. Shows event name, category, and payload structure. Use this to discover what events are available before subscribing.

Mode: read-only | Wire: ze-bgp:event-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show event namespaces`

List all event namespaces and how many events each has logged. Tells you which subsystems are generating events and how active they are.

Mode: read-only | Wire: ze-show:event-namespaces

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show event recent`

Show recent events, newest first. Each event includes timestamp, namespace, and type. Filter with namespace to focus on one area, count to limit output. Useful for reconstructing what happened before an incident.

Mode: read-only | Wire: ze-show:event-recent

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show firewall group`

Show members of a firewall address/port group. Without arguments, lists all known groups. With a name, shows the set elements. Reads from the last applied config, not the kernel.

Mode: read-only | Wire: ze-show:firewall-group

Requires backend: nft

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show firewall irr`

Show IRR filter status for all cached ASN/AS-SET entries. Lists each cached entry with prefix counts, last refresh time, and error status. Use this to confirm that IRR prefix-lists are loaded and current before committing firewall config.

Mode: read-only | Wire: ze-show:firewall-irr-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: prefix

`show firewall irr prefix`

Show IRR-resolved prefixes for a cached entry. Usage: show firewall irr prefix . Lists all IPv4 and IPv6 prefixes in the cached prefix-list for the given ASN or AS-SET.

Mode: read-only | Wire: ze-show:firewall-irr-prefix

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show firewall ruleset`

Show the live firewall ruleset with per-term counters. Usage: show firewall ruleset . Joins applied desired state with kernel counters from the nft backend.

Mode: read-only | Wire: ze-show:firewall-ruleset

Requires backend: nft

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show flow export`

Show flow export (NetFlow/IPFIX) collector status. Without arguments, lists all configured collectors. With 'name ', shows details for that collector including protocol stats and errors. Returns not-configured when no exporter is active.

Mode: read-only | Wire: ze-show:flow-export

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show flow recent`

Show recent conntrack flow records from the bounded recent-flow ring. Without arguments, returns every ring record (oldest to newest, up to the configured recent-flow-ring capacity). With 'dst ', filters to flows whose destination is inside that prefix. The ring is fed only while conntrack export is enabled; the filter is by destination prefix (conntrack is host-global and carries no ingress interface).

Mode: read-only | Wire: ze-show:flow-recent

Arguments:

Name	Type	Required	Values
`dst`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show geodns`

GeoDNS server status: enabled, bind addresses/port, client-IP source mode, zones, nameserver/host-set/source counts, and the current SOA serial.

Mode: read-only | Wire: ze-show:geodns

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show gnmi`

Show whether the gNMI server is running and how it is configured. Returns listen address, TLS details, authentication mode, and the number of active streaming subscribers.

Mode: read-only | Wire: ze-show:gnmi

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show health`

Is this box healthy? One command to find out. Returns per-component health (bgp, fib, iface, plugins, l2tp, etc.) plus an overall status. Each component reports healthy, degraded, or unhealthy with a reason. Start here when troubleshooting.

Mode: read-only | Wire: ze-show:health

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host`

Hardware inventory for this box. Sections: cpu, nic, dmi, memory, thermal, storage, kernel, platform. Use a subcommand for one section, or 'show host all' for everything. The bare 'show host' is an alias of 'show host all'.

Mode: read-only | Wire: ze-show:host-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: all, cpu, dmi, kernel, memory, nic, platform, storage, thermal

`show host all`

Show the full hardware inventory in one shot. Returns every section (cpu, nic, dmi, memory, thermal, storage, kernel, platform) as a single JSON response. Ideal for support bundles or automated inventory collection.

Mode: read-only | Wire: ze-show:host-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host cpu`

Show what CPUs are in this box. Returns vendor, model, core/thread topology, hybrid layout, scaling driver, current/min/max frequencies, and throttle counts.

Mode: read-only | Wire: ze-show:host-cpu

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host dmi`

Show the box's identity from SMBIOS/DMI. Returns system vendor, board name, BIOS version, and chassis type. Useful for inventory or confirming which hardware model you are on.

Mode: read-only | Wire: ze-show:host-dmi

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host kernel`

Show the running kernel version and boot parameters. Returns kernel release, command line, CPU microcode revision, boot time, and security-relevant CPU flags (spectre mitigations, etc.).

Mode: read-only | Wire: ze-show:host-kernel

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host memory`

Show installed memory and ECC health. Returns DIMM sizes and, when the edac driver is present, correctable and uncorrectable error counters. Non-zero ECC counts mean you should plan a DIMM replacement.

Mode: read-only | Wire: ze-show:host-memory

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host nic`

Show physical NICs installed in this box. Returns driver, PCI vendor/device IDs, link speed, queue counts, and firmware version. Virtual interfaces are excluded. Use this to confirm NIC firmware before an upgrade.

Mode: read-only | Wire: ze-show:host-nic

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host platform`

Show platform capabilities and constraints. Reports read-only root, privilege level, systemd presence, gokrazy update socket, reboot-allowed flag, persistent-storage writability, and fd limits. Helps you understand what operations are possible on this particular deployment.

Mode: read-only | Wire: ze-show:host-platform

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host storage`

Show storage devices attached to this box. Returns size, model, transport type (nvme, sata, mmc, virtio), rotational flag, and NVMe firmware version where applicable.

Mode: read-only | Wire: ze-show:host-storage

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show host thermal`

Show temperature sensors and thermal throttle events. Returns hwmon sensor readings and per-CPU throttle counters. Non-zero throttle counts mean the box has been running hot enough to slow down.

Mode: read-only | Wire: ze-show:host-thermal

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface`

Show network interfaces on this box. Without arguments, returns all interfaces with full detail. Subcommands: brief, type , errors, rate [], name detail, name counters.

Mode: read-only | Wire: ze-show:interface

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: brief, errors, name, rate, scan, type

`show interface brief`

One-line summary per interface: name, state, IP, and MTU. Quick way to see what is up and what addresses are assigned.

Mode: read-only | Wire: ze-show:interface-brief

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface errors`

Show interfaces that have errors or drops. Filters to only interfaces with non-zero Rx/Tx error or drop counters. Quick way to find troubled links.

Mode: read-only | Wire: ze-show:interface-errors

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface name counters`

Show counters for one interface. Usage: show interface name counters.

Mode: read-only | Wire: ze-show:interface-counters

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface name detail`

Show full detail for one interface. Usage: show interface name detail.

Mode: read-only | Wire: ze-show:interface-detail

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface rate`

Show per-second traffic rates on your interfaces. Returns rx/tx bytes and packets per second. Pass an interface name to narrow the output. Requires the rate tracker. For continuous monitoring, use 'monitor interface rate' instead.

Mode: read-only | Wire: ze-show:interface-rate

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface scan`

Discover and classify all OS interfaces. Returns name, Ze type (ethernet, bridge, vxlan, etc.), and MAC for each interface found. Pipe to table, yaml, or json for different views. Useful during initial setup to see what the box has.

Mode: read-only | Wire: ze-show:interface-scan

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show interface type`

Show only interfaces of a given type. Usage: show interface type . Types include ethernet, bridge, vxlan, wireguard, tunnel, bond, and more. If you pick an invalid type, the error lists all valid ones.

Mode: read-only | Wire: ze-show:interface-type

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis database`

Show the IS-IS link-state database. Lists each LSP with its LSP ID, sequence number, remaining lifetime, checksum, and overload bit, across Level-1 and Level-2. The own field is true on the LSPs this node originated and false on the LSPs it learned from a neighbor.

Mode: read-only | Wire: ze-show:isis-database

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show isis database detail`

Show the IS-IS link-state database with TLV detail. Expands each LSP into its decoded TLVs (type, length, value) so you can read exactly what each node advertises. It carries the same fields as the summary view, the own field included.

Mode: read-only | Wire: ze-show:isis-database-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis hostname`

Show the IS-IS dynamic-hostname mapping (RFC 5301). Maps each System ID to the hostname it advertises in TLV 137.

Mode: read-only | Wire: ze-show:isis-hostname

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis interface`

Show IS-IS-enabled circuits. Returns level, circuit type, metric, hello interval, hold multiplier, passive flag, DIS state, and the count of Up adjacencies per circuit.

Mode: read-only | Wire: ze-show:isis-interface

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis neighbor`

Show IS-IS adjacencies. Returns the neighbor System ID, interface, level, adjacency state, and hold time for each IS-IS neighbor.

Mode: read-only | Wire: ze-show:isis-neighbor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis route`

Show IS-IS-computed routes. Lists each prefix the SPF installed with its metric, level, up/down bit, and next-hops (address and outgoing interface).

Mode: read-only | Wire: ze-show:isis-route

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: ipv6

`show isis route ipv6`

Show IS-IS-computed IPv6 routes (RFC 5308). Lists each IPv6 prefix the SPF installed with its metric, level, and next-hops (link-local address and outgoing interface).

Mode: read-only | Wire: ze-show:isis-route-ipv6

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show isis spf-log`

Show recent IS-IS SPF runs. Returns the most recent SPF runs with their timestamp, level, trigger, duration, and node count.

Mode: read-only | Wire: ze-show:isis-spf-log

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp`

L2TP tunnel, session, and subscriber state. Without a subcommand, shows a summary of tunnels and sessions.

Mode: read-only | Wire: ze-l2tp-api:summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: config, cqm, echo, health, listeners, observer, reliable, session, sessions, statistics, tunnel, tunnels

`show l2tp config`

Show the resolved L2TP configuration. Returns the effective config after defaults and overrides. Confirms what the daemon is actually using.

Mode: read-only | Wire: ze-l2tp-api:config

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp cqm`

Show subscriber line quality (CQM latency buckets). Pass a login name for one subscriber or 'summary' for an overview. Helps diagnose poor subscriber experience.

Mode: read-only | Wire: ze-l2tp-api:cqm

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp echo`

Show LCP echo health for a subscriber session. Returns echo request/reply counters and round-trip times. Rising loss or high RTT indicates a degraded line.

Mode: read-only | Wire: ze-l2tp-api:echo

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp health`

Find your worst L2TP sessions at a glance. Sorts sessions by echo loss ratio (worst first). Shows subscriber login, session state, echo count, average RTT, and CQM bucket count. Reports how many sessions are degraded.

Mode: read-only | Wire: ze-show:l2tp-health

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp listeners`

Show which UDP sockets are listening for L2TP. Lists each bound address, port, and the number of tunnels on it.

Mode: read-only | Wire: ze-l2tp-api:listeners

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp observer`

Show recent events for a session (debug aid). Returns the event ring buffer for one session ID or 'all'. Useful for understanding why a session failed to establish.

Mode: read-only | Wire: ze-l2tp-api:observer

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp reliable`

Show the reliable transport window for a tunnel. Returns send/receive sequence numbers, window size, and retransmit queue depth. Check here when tunnel control messages seem stuck.

Mode: read-only | Wire: ze-l2tp-api:reliable

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp session history`

Show state transitions for a session over time. Timestamped FSM entries for session establishment. Use this when a subscriber's session fails to come up.

Mode: read-only | Wire: ze-l2tp-api:session-history

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp session id`

Show full detail for one L2TP session. Pass the local session ID. Returns PPP state, assigned addresses, negotiated LCP/NCP options, and traffic counters.

Mode: read-only | Wire: ze-l2tp-api:session

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp session traffic`

Show traffic counters for a subscriber's PPP interface. Returns byte and packet counts, error counters, and current rates. Compare with CQM data to get the full picture of subscriber health.

Mode: read-only | Wire: ze-l2tp-api:session-traffic

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp sessions`

List all active L2TP sessions. One line per session: local/remote ID, parent tunnel, subscriber login, and uptime.

Mode: read-only | Wire: ze-l2tp-api:sessions

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp statistics`

Show aggregate L2TP protocol counters. Tunnels and sessions established, control messages sent/received, retransmits, and errors. Your first stop for L2TP health.

Mode: read-only | Wire: ze-l2tp-api:statistics

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp tunnel history`

Show state transitions for a tunnel over time. Timestamped FSM entries showing how the tunnel reached its current state. Use this to diagnose tunnel establishment failures.

Mode: read-only | Wire: ze-l2tp-api:tunnel-history

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp tunnel id`

Show full detail for one L2TP tunnel. Pass the local tunnel ID. Returns control channel state, peer endpoint, hello interval, and all assigned sessions.

Mode: read-only | Wire: ze-l2tp-api:tunnel

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show l2tp tunnels`

List all active L2TP tunnels. One line per tunnel: local/remote ID, peer address, session count, and uptime.

Mode: read-only | Wire: ze-l2tp-api:tunnels

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ldp binding`

Show LDP FEC-to-label bindings. Lists local and remote label bindings for each FEC (prefix). Use this to verify label distribution is working.

Mode: read-only | Wire: ze-show:ldp-binding

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ldp neighbor`

Show LDP neighbors and their session state. Returns peer address, transport address, session state, and hold time for each LDP neighbor.

Mode: read-only | Wire: ze-show:ldp-neighbor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show log levels`

Show what log level each subsystem is using. Lists every registered logger with its current level. Use 'request log level' to change a level at runtime without restarting.

Mode: read-only | Wire: ze-bgp:log-levels

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show log recent`

Show recent log entries from the in-memory ring. Filters (all optional): level , component , count . Newest entries first. Useful when you cannot access the log file directly.

Mode: read-only | Wire: ze-bgp:log-recent

Arguments:

Name	Type	Values
`component`	string
`count`	uint
`level`	enum	debug, disabled, err, info, warn

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show metrics list`

List all registered metric names (no values). Useful for discovering what metrics exist before querying them.

Mode: read-only | Wire: ze-bgp:metrics-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show metrics name`

Show one Prometheus metric by name. Usage: show metrics name [label=value ...]. Returns matching time series from the internal registry. Multiple label filters are ANDed. More targeted than the full metrics dump.

Mode: read-only | Wire: ze-show:metrics-query

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show metrics pool`

Show attribute pool memory usage and dedup efficiency. Returns allocated entries, reference counts, and deduplication hit rates per attribute type. Watch the dedup rate to gauge how much memory pooling is saving you.

Mode: read-only | Wire: ze-bgp:pool-stats

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show metrics values`

Dump all metrics in Prometheus text format. Outputs every registered metric with labels and values. Suitable for feeding into Prometheus, Grafana, or curl-based monitoring.

Mode: read-only | Wire: ze-bgp:metrics-values

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show mpls forwarding`

Show MPLS forwarding entries installed in the kernel. Each entry shows the incoming label, swap/push/pop operation, and outgoing next-hop. Pass 'limit N' to cap large tables. Linux only.

Mode: read-only | Wire: ze-show:mpls-forwarding

Arguments:

Name	Type	Required	Values
`limit`	uint

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show neighbor`

Show the ARP and neighbor discovery table. Lists IPv4 ARP and IPv6 ND entries with MAC addresses and states. Pass ipv4 or ipv6 to filter by address family; no argument shows both. For the IPv4-only view, 'show arp' is a shortcut.

Mode: read-only | Wire: ze-show:neighbor

Arguments:

Name	Type	Required	Values
`family`	enum		all, any, ipv4, ipv6

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf`

Mode: read-only | Wire: ze-show:ospf

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: border-routers, database, graceful-restart, instance, interface, ipv6, ldp-sync, neighbor, route, segment-routing, spf, te-database, virtual-links

`show ospf border-routers`

Show routes to OSPF area-border and AS-boundary routers. Lists each reachable ABR/ASBR with its router-id, cost, next-hops, and area.

Mode: read-only | Wire: ze-show:ospf-border-routers

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database`

Show the OSPF link-state database. Lists each LSA with its LS Type, Link State ID, Advertising Router, sequence number, age, and checksum.

Mode: read-only | Wire: ze-show:ospf-database

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: asbr-summary, external, network, nssa-external, opaque-area, opaque-as, opaque-link, router, router-information, summary

`show ospf database asbr-summary`

Mode: read-only | Wire: ze-show:ospf-database-asbr-summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database external`

Mode: read-only | Wire: ze-show:ospf-database-external

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database network`

Mode: read-only | Wire: ze-show:ospf-database-network

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database nssa-external`

Mode: read-only | Wire: ze-show:ospf-database-nssa-external

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database opaque-area`

Mode: read-only | Wire: ze-show:ospf-database-opaque-area

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf database opaque-area detail`

Mode: read-only | Wire: ze-show:ospf-database-opaque-area-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database opaque-as`

Mode: read-only | Wire: ze-show:ospf-database-opaque-as

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf database opaque-as detail`

Mode: read-only | Wire: ze-show:ospf-database-opaque-as-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database opaque-link`

Mode: read-only | Wire: ze-show:ospf-database-opaque-link

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf database opaque-link detail`

Mode: read-only | Wire: ze-show:ospf-database-opaque-link-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database router`

Mode: read-only | Wire: ze-show:ospf-database-router

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database router-information`

Show the Router Information LSAs (RFC 7770) for both address families -- OSPFv2 opaque type 4 and OSPFv3 function code 12 -- decoded into the advertised informational capability bits and the TLV list.

Mode: read-only | Wire: ze-show:ospf-database-router-information

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf database summary`

Mode: read-only | Wire: ze-show:ospf-database-summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf graceful-restart`

Show OSPFv2 (IPv4) Graceful Restart state (RFC 3623): the restarter state (in-restart or not, grace end, reason) and the per-neighbor helper sessions (which neighbors are being helped and their remaining grace).

Mode: read-only | Wire: ze-show:ospf-graceful-restart

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf instance`

Show the configured OSPFv2 instances (RFC 6549 Multi-Instance). Lists each Instance ID with its router-id and the size of its isolated area, interface, neighbor, and link-state database state.

Mode: read-only | Wire: ze-show:ospf-instance

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf interface`

Show OSPF-enabled interfaces. Returns area, network-type, cost, ISM state, DR/BDR, hello/dead intervals, priority, and passive flag per interface.

Mode: read-only | Wire: ze-show:ospf-interface

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf interface detail`

Mode: read-only | Wire: ze-show:ospf-interface-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6`

Show the OSPFv3 (IPv6) address-family instances (RFC 5838). Lists each configured address family (ipv6-unicast, ipv6-multicast, ipv4-unicast, ipv4-multicast) with its Instance ID, router-id, and neighbor/interface counts, so multiple AF instances on a link are distinguishable.

Mode: read-only | Wire: ze-show:ospf-ipv6

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: database, graceful-restart, instance, interface, neighbor, segment-routing, spf

`show ospf ipv6 database`

Mode: read-only | Wire: ze-show:ospfv3-database

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail, extended, router, router-information, scope, segment-routing

`show ospf ipv6 database detail`

Mode: read-only | Wire: ze-show:ospfv3-database-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database extended`

Mode: read-only | Wire: ze-show:ospfv3-database-extended

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database router detail`

Mode: read-only | Wire: ze-show:ospfv3-database-router-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database router-information`

Mode: read-only | Wire: ze-show:ospfv3-database-router-information

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database scope area`

Mode: read-only | Wire: ze-show:ospfv3-database-scope-area

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database scope as`

Mode: read-only | Wire: ze-show:ospfv3-database-scope-as

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database scope link`

Mode: read-only | Wire: ze-show:ospfv3-database-scope-link

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 database segment-routing`

Mode: read-only | Wire: ze-show:ospfv3-database-segment-routing

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 graceful-restart`

Show OSPFv3 (IPv6) Graceful Restart state (RFC 5187): the restarter state (in-restart or not, grace end, reason) and the per-neighbor helper sessions (which neighbors are being helped and their remaining grace).

Mode: read-only | Wire: ze-show:ospf-ipv6-graceful-restart

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 instance`

Mode: read-only | Wire: ze-show:ospfv3-instance

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 interface`

Show OSPFv3 (IPv6-family) interfaces and their RFC 4552 IPsec status. Returns per interface whether IPsec is configured, the protocol (ah/esp) and SPI, and whether the kernel SA is installed. The key is never shown.

Mode: read-only | Wire: ze-show:ospf-ipv6-interface

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf ipv6 interface detail`

Mode: read-only | Wire: ze-show:ospfv3-interface-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 neighbor`

Mode: read-only | Wire: ze-show:ospfv3-neighbor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf ipv6 neighbor detail`

Mode: read-only | Wire: ze-show:ospfv3-neighbor-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 segment-routing`

Show OSPFv3 (IPv6) Segment Routing state (RFC 8666): the configured SRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node Prefix-SIDs, and the Adjacency-SIDs allocated per adjacency.

Mode: read-only | Wire: ze-show:ospf-ipv6-segment-routing

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ipv6 spf`

Mode: read-only | Wire: ze-show:ospfv3-spf

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf ipv6 spf detail`

Mode: read-only | Wire: ze-show:ospfv3-spf-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf ldp-sync`

Show OSPF LDP-IGP synchronization state (RFC 5443, RFC 6138). Lists each ldp-sync interface with its state (not-synchronized / hold-down / synchronized), remaining hold-down, effective metric, and whether it is stuck not-synchronized after having been synchronized.

Mode: read-only | Wire: ze-show:ospf-ldp-sync

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf neighbor`

Show OSPF neighbors. Returns each neighbor's router-id, interface, adjacency state, DR/BDR, priority, dead time, and address.

Mode: read-only | Wire: ze-show:ospf-neighbor

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf neighbor detail`

Mode: read-only | Wire: ze-show:ospf-neighbor-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf route`

Show OSPF-computed routes. Lists each prefix with its path type (intra/inter/external-1/2), cost, next-hops, and area.

Mode: read-only | Wire: ze-show:ospf-route

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: fast-reroute

`show ospf route fast-reroute`

Show OSPF fast-reroute (LFA / TI-LFA) backups (RFC 5286). Lists each prefix's primary next-hops with their pre-computed loop-free backup, protection class (node/link/downstream), and TI-LFA repair label stack. Unprotected primaries are shown as unprotected.

Mode: read-only | Wire: ze-show:ospf-route-fast-reroute

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf segment-routing`

Show OSPFv2 (IPv4) Segment Routing state (RFC 8665): the configured SRGB/SRLB label ranges, the advertised SR-Algorithm, this node's node Prefix-SIDs, and the Adjacency-SIDs allocated per adjacency.

Mode: read-only | Wire: ze-show:ospf-segment-routing

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf spf`

Show recent OSPF SPF runs. Returns the most recent per-area SPF runs with their timestamp, duration, node count, and pending state.

Mode: read-only | Wire: ze-show:ospf-spf

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: detail

`show ospf spf detail`

Mode: read-only | Wire: ze-show:ospf-spf-detail

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf te-database`

Show the OSPF Traffic Engineering Database (RFC 3630 / RFC 5392): router addresses plus TE links with their Link ID, local/remote address, link type, TE metric, bandwidths, admin group, and (for inter-AS links) remote AS and remote ASBR.

Mode: read-only | Wire: ze-show:ospf-te-database

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ospf virtual-links`

Show OSPF virtual links (RFC 2328 section 15). Lists each configured virtual link with its transit area, remote router-id, adjacency state, computed cost, and transit next hop.

Mode: read-only | Wire: ze-show:ospf-virtual-links

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show ping`

Ping a target from the router itself. Sends ICMP echo requests to (IP or hostname). Default count is 5. Timeout uses Go duration syntax (e.g. 3s, 500ms). Confirms reachability from this box, not from your workstation.

Mode: read-only | Wire: ze-show:ping

Arguments:

Name	Type	Required	Values
`count`	uint
`dest`	string
`size`	uint
`timeout`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pki certificate name`

Inspect a specific certificate in detail. Usage: show pki certificate name [pem | bundle pem | fingerprint [sha256|sha384|sha512]]. Use 'pem' to export for another system, 'fingerprint' to verify identity.

Mode: read-only | Wire: ze-show:pki-certificate

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pki certificates`

List all loaded certificates with expiry dates. Shows name, type (CA or device), subject, issuer, expiry, and validity status. Check here to find certificates approaching expiration.

Mode: read-only | Wire: ze-show:pki-certificates

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show policy chain peer`

Show the import/export filter chain applied to a peer. Usage: show policy chain peer [import|export]. The selector (IP, name, as) and the optional direction are parsed by the handler. Shows the effective chain after group inheritance is resolved. Without a direction keyword, shows both import and export.

Mode: read-only | Wire: ze-show:policy-chain

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show policy list`

List all available filter types and named instances. Shows each filter type and its implementing plugin. Check here when building a new policy chain to see what filters you can use.

Mode: read-only | Wire: ze-show:policy-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show policy routes`

Show policy-based routing rules. Lists PBR rules with match criteria and routing actions.

Mode: read-only | Wire: ze-show:policy-routes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show policy test peer`

Test what your policy does to a specific UPDATE. Feed a hex-encoded BGP UPDATE through a peer's filter chain and see the accept/reject result plus attribute modifications at each stage. Read-only: no routes are actually forwarded. Great for validating policy changes before you commit. Usage: show policy test peer import|export [filter ] update [source-asn4 true|false]. The selector and the import/export/filter/update/source-asn4 tokens are parsed by the handler so the peer selector can be a free-form name or address.

Mode: read-only | Wire: ze-show:policy-test

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pppoe`

PPPoE session and protocol state. Without a subcommand, shows a summary of active sessions.

Mode: read-only | Wire: ze-pppoe-api:summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: interfaces, session, sessions, statistics

`show pppoe interfaces`

Show which interfaces are accepting PPPoE sessions. Lists each PPPoE-enabled interface with its service name, session limit, and how many sessions are currently active.

Mode: read-only | Wire: ze-pppoe-api:interfaces

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pppoe session id`

Show full detail for one PPPoE session. Pass the session ID. Returns discovery tags, LCP/NCP state, assigned addresses, and traffic counters.

Mode: read-only | Wire: ze-pppoe-api:session

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pppoe sessions`

List all active PPPoE sessions. One line per session: session ID, MAC, subscriber login, uptime, and assigned addresses.

Mode: read-only | Wire: ze-pppoe-api:sessions

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show pppoe statistics`

Show PPPoE protocol message counters. Returns PADI, PADO, PADR, PADS, PADT counts, active sessions, and errors. A rising PADI count with flat PADS means sessions are not completing.

Mode: read-only | Wire: ze-pppoe-api:statistics

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show probe-round`

Run a parallel traceroute probe round to a target. Sends all probes concurrently for faster results than sequential traceroute. Returns per-hop RTT and IP. Use probes and max-hops to tune accuracy vs speed.

Mode: read-only | Wire: ze-show:probe-round

Arguments:

Name	Type	Required	Values
`dest`	string
`max-hops`	uint
`probes`	uint
`timeout`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show reload-status`

Show how many config reloads the daemon has processed. Returns a generation counter, the outcome of the most recent reload (applied or failed), and when it finished. The counter advances on every processed reload, including one that rejected or changed nothing, so you can confirm a SIGHUP was acted on even when it deliberately left the running config alone.

Mode: read-only | Wire: ze-show:reload-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show route`

Show the kernel routing table. Lists installed routes with next-hop, interface, protocol, and metric. Pass a CIDR prefix or 'default' to filter, or a route limit to cap the output.

Mode: read-only | Wire: ze-show:route

Arguments:

Name	Type	Required	Values
`limit`	uint
`prefix`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: lookup

`show route lookup`

Look up which route the kernel would use for a given IP. Performs a longest-prefix-match and returns the matching route with gateway, interface, protocol, and metric. Usage: show route lookup .

Mode: read-only | Wire: ze-show:route-lookup

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rr peers`

Show route reflector client peers. Lists each RR client with session state and reflected route counts.

Mode: read-only | Wire: ze-show:rr-peers

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rr status`

Show whether the route reflector is active. Returns cluster ID, running state, and summary statistics (reflected routes, client count).

Mode: read-only | Wire: ze-show:rr-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rsvp-te fast-reroute`

Show RSVP-TE Fast Reroute (RFC 4090) protection state. Returns each configured facility-backup bypass LSP and each protected LSP with its armed bypass, mode, and whether local protection is available and in use.

Mode: read-only | Wire: ze-show:rsvp-te-fast-reroute

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rsvp-te interface`

Show RSVP-TE bandwidth allocation per interface. Returns reserved, available, and maximum bandwidth for each TE-enabled interface.

Mode: read-only | Wire: ze-show:rsvp-te-interface

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rsvp-te lsp`

Show RSVP-TE label-switched paths. Returns state, role (ingress/transit/egress), reserved bandwidth, and in/out labels for each LSP.

Mode: read-only | Wire: ze-show:rsvp-te-lsp

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show rsvp-te tunnel`

Show configured RSVP-TE tunnels and their current state. Returns tunnel name, endpoints, signaling state, and active LSP.

Mode: read-only | Wire: ze-show:rsvp-te-tunnel

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show runtime memory`

Show the Go runtime allocator memory stats. Returns allocated bytes, heap in-use, total allocations, GC cycles, and last GC pause duration. Compare over time to spot leaks. For the OS-level process memory (RSS/VSZ) use 'show system memory'.

Mode: read-only | Wire: ze-show:system-memory

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show schema events`

List all notification types defined in YANG API modules. Shows which events a plugin can subscribe to.

Mode: read-only | Wire: ze-show:schema-events

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show schema handlers`

Show which handler serves each YANG module. Maps module names to their implementing Go handler.

Mode: read-only | Wire: ze-show:schema-handlers

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show schema list`

List all YANG schemas loaded by the daemon. Shows module name, namespace, and revision for each schema.

Mode: read-only | Wire: ze-show:schema-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show schema methods`

List all RPC methods defined in YANG API modules. Useful for plugin developers to discover available operations.

Mode: read-only | Wire: ze-show:schema-methods

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show schema protocol`

Show the wire protocol version and format details. Useful for checking compatibility between Ze versions.

Mode: read-only | Wire: ze-show:schema-protocol

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show static`

Show static routes defined in the configuration. Lists each static route with its prefix, next-hop, and interface.

Mode: read-only | Wire: ze-show:static

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show status`

Mode: read-only | Wire: ze-system:daemon-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show storage smart`

Show disk health via SMART data. Returns health status, temperature, power-on hours, and self-test schedule for each block device. Replace drives that report failing health before they cause data loss.

Mode: read-only | Wire: ze-show:storage-smart

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show subscriber`

Show a summary of all subscriber sessions. Counts by access type (PPPoE, L2TP, IPoE) with totals. Quick way to see how many subscribers are online.

Mode: read-only | Wire: ze-subscriber-api:summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: id

`show subscriber id detail`

Show everything about one subscriber session. Pass the session ID. Returns access type, assigned addresses, authentication state, uptime, and traffic counters.

Mode: read-only | Wire: ze-subscriber-api:detail

Arguments:

Name	Type	Required	Values
`id`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system conntrack`

Show the kernel connection tracking table. Returns conntrack entry count, table size, timeouts, and loaded modules. Requires the nft backend. Check this when you suspect conntrack table exhaustion is dropping traffic.

Mode: read-only | Wire: ze-show:system-conntrack

Requires backend: nft

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system cpu`

Show CPU utilization context for the daemon. Returns goroutine count, logical CPU count, and GOMAXPROCS setting. Useful when the box feels sluggish and you want to see if Ze is hogging threads.

Mode: read-only | Wire: ze-show:system-cpu

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system date`

Show the daemon's current wall-clock time and timezone. Useful for correlating log timestamps when the box is in a different timezone than you are.

Mode: read-only | Wire: ze-show:system-date

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system file-descriptors`

Show how many file descriptors the daemon has open. Summary mode: totals by type (socket, pipe, file). Detail mode: every fd with its path and type. Linux only (reads /proc/self/fd). Check this when you suspect fd exhaustion.

Mode: read-only | Wire: ze-show:system-file-descriptors

Arguments:

Name	Type	Required	Values
`mode`	enum		detail, summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system goroutines`

Dump goroutine stacks for debugging hangs or deadlocks. Modes: summary (groups by state), blocked (only lock/channel waiters), full (all stacks). Default: summary. Share the output with support when the daemon stops responding.

Mode: read-only | Wire: ze-show:system-goroutines

Arguments:

Name	Type	Required	Values
`mode`	enum		blocked, full, summary

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system kernel-log`

Show kernel log messages (dmesg-style). Reads from /dev/kmsg. Filter by syslog level (emerg through debug) and limit with count. Without count, you get everything available. Linux only. Useful for spotting NIC errors or OOM events.

Mode: read-only | Wire: ze-show:system-kernel-log

Arguments:

Name	Type	Required	Values
`count`	uint
`level`	enum		alert, crit, debug, emerg, err, info, notice, warning

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system memory`

Show how much memory the daemon is using, from the OS's view. Returns VmRSS, VmSize, VmSwap, and thread count from /proc/self/status (Linux only). This is what the operating system reports the process is using. For the Go runtime allocator view (heap, GC), use 'show runtime memory'.

Mode: read-only | Wire: ze-show:system-memory-map

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system ntp`

Mode: read-only | Wire: ze-show:system-ntp

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: peers

`show system ntp peers`

Show NTP peers with offset, RTT, stratum, and reachability. Tells you whether your clock is synced and how far off each NTP server thinks you are.

Mode: read-only | Wire: ze-show:system-ntp-peers

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system platform`

Show what kind of platform the daemon is running on. Reports whether this is gokrazy, systemd, container, plain-linux, or darwin, along with platform-specific capabilities.

Mode: read-only | Wire: ze-show:system-platform

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system profile`

Capture a runtime profile for performance analysis. Types: cpu (requires duration, e.g. 30s), heap, goroutine, allocs (instant snapshots). Output is pprof format you can open with 'go tool pprof'. Send the file to support for deep analysis.

Mode: read-only | Wire: ze-show:system-profile

Arguments:

Name	Type	Required	Values
`duration`	string
`type`	enum		allocs, cpu, goroutine, heap

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system sockets`

Show open TCP and UDP sockets on this box. Filters: [tcp|udp] [state ] [port ], all optional and combinable. States use kernel names (ESTABLISHED, LISTEN, TIME_WAIT). Linux only. Good for confirming listeners or spotting stuck connections.

Mode: read-only | Wire: ze-show:system-sockets

Arguments:

Name	Type	Values
`port`	uint
`protocol`	enum	tcp, udp
`state`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system subsystem list`

List every registered subsystem and whether it is running. Shows you which components (bgp, dns, web, l2tp, etc.) are active, stopped, or failed.

Mode: read-only | Wire: ze-show:system-subsystem-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show system update`

Check if a firmware update is available. Shows the running version, latest available version, and when the last check ran. Use 'update system firmware check' to trigger an immediate re-check.

Mode: read-only | Wire: ze-show:system-update

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: history

`show system update history`

Show recent firmware update activity. Lists the last 20 update events: checks, downloads, installs, and rollbacks with timestamps and outcomes.

Mode: read-only | Wire: ze-show:system-update-history

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show tcp-check`

Test TCP connectivity to a remote host and port. Tries to open a TCP connection and reports success or failure with the connection time. Use 'source ' to bind a specific local address. Quick way to verify a peer's BGP port is reachable.

Mode: read-only | Wire: ze-show:tcp-check

Arguments:

Name	Type	Required
`host`	string	yes
`port`	uint	yes
`source`	string
`timeout`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show traceroute`

Trace the network path from this router to a target. Shows each hop with its IP and round-trip time. Dest can be an IP or hostname. Defaults: 30 max hops, 3 probes per hop. Increase probes for more reliable RTT measurements.

Mode: read-only | Wire: ze-show:traceroute

Arguments:

Name	Type	Required	Values
`dest`	string
`max-hops`	uint
`probes`	uint
`timeout`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show traffic control`

Show traffic control (QoS) configuration per interface. Without arguments, lists every interface with its qdisc type and class/filter counts. With an interface name, shows the full qdisc and class breakdown. Use this to verify your shaping is applied.

Mode: read-only | Wire: ze-show:traffic

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show traffic feature`

Show neutral per-source traffic feature signals: fan-out (distinct destinations), out/in byte ratio (exfiltration), destination-port entropy, new-peer, rare-port/proto, and coarse beaconing. Without arguments, shows the top source entities. With 'name

', filters to one source.

Mode: read-only | Wire: ze-show:traffic-feature

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show traffic stat`

Show aggregated traffic snapshot (interface rates, top talkers, top ports, severity). Without arguments, shows all interfaces. With 'name ', filters to one interface.

Mode: read-only | Wire: ze-show:traffic-stat

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show traffic usage`

Show per-interface traffic byte counters captured by eBPF TCX. Per destination/source port and protocol counters are always present; per-IP top-talker counters appear when track-ip is enabled. Without arguments, lists all monitored interfaces. With 'name ', shows that one interface.

Mode: read-only | Wire: ze-show:traffic-usage

Arguments:

Name	Type	Required	Values
`name`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show uptime`

Show how long the daemon has been running. Returns the start time and elapsed uptime. Handy after a maintenance window to confirm the process restarted.

Mode: read-only | Wire: ze-show:uptime

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show version`

Show the running Ze version and build date. You can verify which release is deployed on this box.

Mode: read-only | Wire: ze-show:version

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec dataplane drift`

Compare what the IKE engine believes against what the kernel holds. Reports each Child SA the engine counts as installed whose SPI the kernel SAD does not hold. The command exits non-zero when it finds drift, so a script CAN test it. A rekey window holds two SPIs and is not drift.

Mode: read-only | Wire: ze-show:vpn-ipsec-dataplane-drift

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec dataplane policy`

Show the Security Policy Database the kernel holds. Lists each policy with its selector prefixes and ports, direction, priority, upper-layer protocol, if_id, tunnel endpoints, and the peer that installed it. A policy with no matching SA is the failure this command exists to show. RFC 4301 Section 4.4 keeps the SPD and the SAD separate, and so does this tree.

Mode: read-only | Wire: ze-show:vpn-ipsec-dataplane-policy

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec dataplane sa`

Show the Security Association Database the kernel holds. Lists each installed ESP SA with its SPI, addresses, mode, algorithms, replay window, byte and packet counters, and timestamps. Give 'spi ' to show one SA. Without a selector the command dumps every SA, which on a device with many tunnels is one row per SA.

Mode: read-only | Wire: ze-show:vpn-ipsec-dataplane-sa

Arguments:

Name	Type	Required	Values
`spi`	uint

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec peer name`

Show full detail for one IPsec peer. Returns IKE SA state, all child SAs with traffic selectors, and byte counts. Usage: show vpn ipsec peer name .

Mode: read-only | Wire: ze-show:vpn-ipsec-peer

Arguments:

Name	Type	Required	Values
`name`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec sa`

Show all IKE and Child Security Associations. Lists every SA with peer, negotiated algorithms, byte counts, rekey timers, and uptime. Includes SPIs, NAT detection, and child SA traffic selectors. Your main IPsec status command.

Mode: read-only | Wire: ze-show:vpn-ipsec-sa

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpn ipsec status`

Quick IPsec health check. Reports whether the IKE engine is running, how many peers are configured, and how many IKE SAs are Established.

Mode: read-only | Wire: ze-show:vpn-ipsec-status

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpp runtime`

Show VPP graph node processing statistics. Returns per-node packet counts, vectors, clocks, and suspends. Helps you find which node is the bottleneck. Requires the VPP backend.

Mode: read-only | Wire: ze-show:vpp-runtime

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpp trace clear`

Discard the captured VPP trace buffer. Clears all packets so you can start a fresh trace. Requires the VPP backend.

Mode: read-only | Wire: ze-show:vpp-trace-clear

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpp trace show`

Retrieve packets captured since the last trace start. Shows per-packet VPP graph node traversal. Requires the VPP backend.

Mode: read-only | Wire: ze-show:vpp-trace-show

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vpp trace start`

Start capturing packets in the VPP dataplane. Default input node is dpdk-input, default count is 100 (max 10000). After starting, use 'show vpp trace show' to retrieve the captured packets. Requires the VPP backend.

Mode: read-only | Wire: ze-show:vpp-trace-start

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vrrp`

Show every VRRP virtual router: its group name, VRID, address family, state (initialize, backup, master), configured and effective priority, virtual addresses, and the macvlan device that carries the virtual MAC.

Mode: read-only | Wire: ze-show:vrrp

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

Subcommands: interface, statistics

`show vrrp interface name`

Show the VRRP virtual routers on one parent interface. Pass the interface name: show vrrp interface name .

Mode: read-only | Wire: ze-show:vrrp-interface

Arguments:

Name	Type	Required	Values
`value`	string

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show vrrp statistics`

Show per-virtual-router counters: advertisements sent and received, priority-zero advertisements, gratuitous ARP and unsolicited neighbor advertisement bursts, receive-validation errors by reason, and the derived skew and master-down timers in microseconds (a VRRPv3 skew is sub-millisecond).

Mode: read-only | Wire: ze-show:vrrp-statistics

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show warnings`

Show active warnings across all subsystems. Displays any conditions that need your attention (degraded peers, resource limits approaching, etc.). Use 'source ' to filter to a single subsystem.

Mode: read-only | Wire: ze-show:warnings

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show yang completion`

Show YANG paths available for tab completion. Lists every valid completion point in the command tree.

Mode: read-only | Wire: ze-show:yang-completion

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show yang doc`

Generate command reference docs from YANG schemas. Produces structured documentation with descriptions, arguments, and usage patterns for every registered command.

Mode: read-only | Wire: ze-show:yang-doc

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`show yang tree`

Print the YANG tree for a module in a readable hierarchy. Shows node types, data types, and config-vs-state annotations. Similar to 'pyang -f tree'. Useful for understanding the config or command structure.

Mode: read-only | Wire: ze-show:yang-tree

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

skills

Command	Mode	Description
`skills`	offline	List or retrieve agent skill definitions matching this Ze version. Use 'get ' to fetch a specific skill.

support

Command	Mode	Description
`support`	offline	Bundle logs, config, state, and diagnostics into one archive file. Send the result to support when reporting an issue.

system

Command	Mode	Description
`system command complete`	read-only	Complete command/args
`system command help`	read-only	Show command details
`system command list`	read-only	List all commands
`system dispatch`	read-only	Dispatch a text command
`system help`	read-only	Show available commands
`system subsystem list`	read-only	List available subsystems
`system version api`	read-only	Show IPC protocol version
`system version software`	read-only	Show ze version

`system command complete`

Mode: read-only | Wire: ze-system:command-complete

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system command help`

Mode: read-only | Wire: ze-system:command-help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system command list`

Mode: read-only | Wire: ze-system:command-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system dispatch`

Mode: read-only | Wire: ze-system:dispatch

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system help`

Mode: read-only | Wire: ze-system:help

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system subsystem list`

Mode: read-only | Wire: ze-system:subsystem-list

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system version api`

Mode: read-only | Wire: ze-system:version-api

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`system version software`

Mode: read-only | Wire: ze-system:version-software

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

update

Command	Mode	Description
`update bgp irr all`	daemon	Refresh all IRR prefix-lists immediately.
`update bgp irr as-set`	daemon	Refresh IRR prefix-list for a specific AS-SET.
`update bgp irr asn`	daemon	Refresh IRR prefix-list for a specific ASN.
`update bgp peer prefix`	daemon	Refresh max-prefix limits from PeeringDB.
`update firewall irr all`	daemon	Refresh all cached IRR prefix-lists.
`update firewall irr as-set`	daemon	Fetch or refresh IRR prefix-list for an AS-SET.
`update firewall irr asn`	daemon	Fetch or refresh IRR prefix-list for an ASN.
`update serve`	offline	Run a local update server for firmware checks
`update system firmware apply`	daemon	Full upgrade: download, verify, stage, and restart.
`update system firmware check`	daemon	Check for a new firmware version right now.
`update system firmware download`	daemon	Download the latest firmware image right now.
`update system firmware restart`	daemon	Reboot into the already-staged firmware.
`update system firmware rollback`	daemon	Roll back to the previous firmware and restart.

`update bgp irr all`

Refresh all IRR prefix-lists immediately. Re-queries the IRR server for every enrolled ASN and atomically swaps prefix-lists on success. Failed refreshes preserve the existing prefix-list and report an error.

Mode: daemon | Wire: ze-update:irr-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update bgp irr as-set`

Refresh IRR prefix-list for a specific AS-SET. Usage: update bgp irr as-set . Re-queries the IRR server for all peers using the given AS-SET name.

Mode: daemon | Wire: ze-update:irr-as-set

Arguments:

Name	Type	Required	Values
`as-set`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update bgp irr asn`

Refresh IRR prefix-list for a specific ASN. Usage: update bgp irr asn . Re-queries the IRR server for the given ASN only.

Mode: daemon | Wire: ze-update:irr-asn

Arguments:

Name	Type	Required	Values
`asn`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update bgp peer prefix`

Refresh max-prefix limits from PeeringDB. Usage: update bgp peer prefix. Queries PeeringDB for each matched peer's ASN, applies the configured margin, and writes the result to the config draft. Run 'config commit' to apply.

Mode: daemon | Wire: ze-update:bgp-peer-prefix

Arguments:

Name	Type	Required	Values
`selector`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update firewall irr all`

Refresh all cached IRR prefix-lists. Re-queries the IRR server for every cached ASN/AS-SET entry and updates the zefs cache on success. Failed refreshes preserve the existing cache and report an error.

Mode: daemon | Wire: ze-update:firewall-irr-all

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update firewall irr as-set`

Fetch or refresh IRR prefix-list for an AS-SET. Usage: update firewall irr as-set . Queries the IRR server and saves resolved prefixes to the zefs cache.

Mode: daemon | Wire: ze-update:firewall-irr-as-set

Arguments:

Name	Type	Required	Values
`as-set`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update firewall irr asn`

Fetch or refresh IRR prefix-list for an ASN. Usage: update firewall irr asn . Queries the IRR server and saves resolved prefixes to the zefs cache. Creates the cache entry if it does not exist.

Mode: daemon | Wire: ze-update:firewall-irr-asn

Arguments:

Name	Type	Required	Values
`asn`	string	yes

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update system firmware apply`

Full upgrade: download, verify, stage, and restart. Runs the complete update cycle in one command. Only available on platforms where Ze owns the update lifecycle (e.g. gokrazy). The box will reboot into the new version.

Mode: daemon | Wire: ze-update:system-firmware-apply

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update system firmware check`

Check for a new firmware version right now. Bypasses the scheduled interval timer and contacts the update server immediately. Compare the result with 'show system update'.

Mode: daemon | Wire: ze-update:system-firmware-check

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update system firmware download`

Download the latest firmware image right now. Bypasses the maintenance window and spread timers. The image is staged but not applied. Use 'update system firmware apply' or 'restart' to activate it.

Mode: daemon | Wire: ze-update:system-firmware-download

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update system firmware restart`

Reboot into the already-staged firmware. No download happens. Use this after 'update system firmware download' when you are ready to activate the new version.

Mode: daemon | Wire: ze-update:system-firmware-restart

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

`update system firmware rollback`

Roll back to the previous firmware and restart. Reverts to the prior image. Only available on platforms with A/B partitioning (e.g. gokrazy). Use this if the new version has issues.

Mode: daemon | Wire: ze-update:system-firmware-rollback

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

validate

Command	Mode	Description
`validate config`	offline	Check your config for errors without applying anything. Reports syntax and semantic issues.

withdraw

Command	Mode	Description
`withdraw`	daemon	Withdraw on-demand announcements.

`withdraw`

Withdraw on-demand announcements. Usage: withdraw tag <value|*> | withdraw tag * | withdraw id | withdraw all

Mode: daemon | Wire: ze-bgp:withdraw

Pipes: Global: json, table, text, yaml, ndjson, match, count, resolve, origin, no-more

399 commands total.

Unreviewed draft. This wiki was authored in bulk and has not been reviewed. File corrections on the issue tracker.

AGPL-3.0 | Source on GitHub | Discord | Edit this page

Home

About

First Steps

Configuration

Overview
YANG Model
Editor Workflow
Archive and Rollback
System
Interfaces
VRRP
BFD
FIB
OSPF
IS-IS
MPLS / LDP / RSVP-TE
RSVP-TE
SRv6
Static Routes
Policy Routing
Firewall
Traffic Control
Class of Service
L2TP/PPP
PPPoE
VPP Data Plane
RPKI
IPsec VPN
TACACS+ AAA
RADIUS AAA
AS112 DNS
DNS
Authorization
Fleet
BGP
- Peers
- Policies
- Address Families
- ADD-PATH
- Graceful Restart
- BGP Role
- Route Reflection
- Route Injection
- Route Filters

Operation

Interfaces

Plugins

Storage
Policy
Core
- bgp
- bgp-healthcheck
- interface
- loop
Resilience
Validation
- bgp-rpki
- bgp-rpki-decorator
Capabilities
Address Families
Protocol
- bfd
- bgp-bmp
Subsystems
- l2tp
- pppoe
- firewall
- traffic-control
- ntp
- sysctl
- tacacs
- static-routes
- policy-routes
- dhcp-server
- cos
Infrastructure
- fib-kernel
- fib-vpp
- fib-p4
- iface-dhcp
- iface-netlink
- iface-vpp
- sysrib
- host
- vpp

Plugin Development

Chaos Testing

Blueprints

Development

Reference

Uh oh!

command catalog

Command Catalog

Contents

announce

announce

clear

clear bgp rib in

clear bgp rib out

clear dns cache

clear dns cache record

clear dns cache stats

clear interface counters

clear interface name counters

clear isis adjacency

clear isis counters

clear l2tp session all

clear l2tp session id

clear l2tp tunnel all

clear l2tp tunnel id

clear ospf counters

clear ospf neighbor

clear ospf process

clear vpn ipsec sa

clear vrrp statistics

create

create interface address

create interface bridge name

create interface bridge name address

create interface bridge name unit

create interface dummy name

create interface dummy name address

create interface dummy name unit

create interface unit

create interface veth name

debug

debug ip ospf inject opaque

debug ipv6 ospf inject lsa

debug ospf inject disable

debug ospf inject enable

delete

delete bgp peer

delete interface name

delete interface name address

delete interface name unit

doctor

explain

fakeas112

fakeas112 emit

fakeas112 help

fakel2tp

fakel2tp emit

fakel2tp help

fakeredist

fakeredist emit

fakeredist emit-burst

fakeredist help

generate

help

help

monitor

monitor bgp

monitor event

monitor interface rate

monitor ping

monitor system netlink

monitor traceroute

monitor traffic stat

monitor vpn ipsec

peer

peer raw

peer update

plugin

plugin ack

plugin command complete

plugin command help

plugin command list

plugin encoding

plugin format

plugin help

`announce`

`clear bgp rib in`

`clear bgp rib out`

`clear dns cache`

`clear dns cache record`

`clear dns cache stats`

`clear interface counters`

`clear interface name counters`

`clear isis adjacency`

`clear isis counters`

`clear l2tp session all`

`clear l2tp session id`

`clear l2tp tunnel all`

`clear l2tp tunnel id`

`clear ospf counters`

`clear ospf neighbor`

`clear ospf process`

`clear vpn ipsec sa`

`clear vrrp statistics`

`create interface address`

`create interface bridge name`

`create interface bridge name address`

`create interface bridge name unit`

`create interface dummy name`

`create interface dummy name address`

`create interface dummy name unit`

`create interface unit`

`create interface veth name`

`debug ip ospf inject opaque`

`debug ipv6 ospf inject lsa`

`debug ospf inject disable`

`debug ospf inject enable`

`delete bgp peer`

`delete interface name`

`delete interface name address`

`delete interface name unit`

`fakeas112 emit`

`fakeas112 help`

`fakel2tp emit`

`fakel2tp help`

`fakeredist emit`

`fakeredist emit-burst`

`fakeredist help`

`help`

`monitor bgp`

`monitor event`

`monitor interface rate`

`monitor ping`

`monitor system netlink`

`monitor traceroute`

`monitor traffic stat`

`monitor vpn ipsec`

`peer raw`

`peer update`

`plugin ack`

`plugin command complete`

`plugin command help`

`plugin command list`

`plugin encoding`

`plugin format`

`plugin help`

`plugin session bye`

`plugin session ping`

`plugin session ready`

`request as112 healthcheck`

`request bgp rib inject`

`request bgp rib withdraw`

`request cache expire`

`request cache forward`

`request cache release`

`request cache retain`

`request commit`

`request config archive`

`request halt`

`request interface down`

`request interface mac`

`request interface migrate`

`request interface mtu`

`request interface up`

`request l2tp outgoing-call remote called`