plugins

Pre-Alpha. This page describes behavior that may change.

A plugin in Ze is a unit of behaviour that registers itself with the engine and reacts to events on the bus. The engine itself does not know about BGP. BGP is implemented as a stack of plugins on top of a generic message bus and a generic plugin manager. Interface management, the FIB pipeline, RPKI, address families, and the route selection policy are all plugins by the same definition.

A plugin is either an in-tree Go module compiled into the binary, or an external process started by the daemon and spoken to through a TLS-framed line protocol. The two paths use the same APIs, the same event types, and the same registration model. The trade-off is the obvious one: in-tree plugins have direct access and lower latency; external plugins can be written in any language and crash without taking the daemon down with them.

ze --plugins prints the registered set of the binary you are running, and it is the authority for a name. A few rows below name a subsystem that registers RPC handlers or an interface backend rather than an entry in the plugin registry: gnmi, host, iface-netlink, iface-vpp, l2tp, pki, pppoe, storage and tacacs. They are listed here because an operator looks for them here.

Storage

Plugin	Description
bgp-rib	The main RIB store.
bgp-adj-rib-in	Per-peer Adj-RIB-In with raw hex replay.
bgp-persist	On-disk persistence across restarts.

Core

Plugin	Description
bgp	The core BGP engine: FSM, message handling, peer reactor.
bgp-healthcheck	Service healthcheck with FSM-controlled announcement and withdrawal.
interface	OS network interface monitoring and management.
loop	Route loop detection per RFC 4271.

Policy

Plugin	Description
bgp-rs	Route server: client-to-client reflection per RFC 7947 with zero-copy fast path. Dynamic peers, RS-client role, and a control-community forwarding policy with full multi-community strip and withdrawal delivery to excluded clients.
bgp-rr	Route reflector per RFC 4456, as an alternative to the route server forward-all model.
bgp-filter-community	Community tag and strip filter (standard, large, extended), RFC 7454 Section 11 own-GA scrub with a function keep-list, RFC 8195 relation tag, and the RFC 7999 blackhole propagation guard.
bgp-filter-community-match	Community-match filter (accept/reject on community membership).
bgp-filter-family	Named address-family policy filter: removes a family's NLRI, or tears the session down.
bgp-filter-prefix	Per-prefix modify path for multi-prefix updates.
bgp-filter-aspath	AS-path regex filter.
bgp-filter-aspath-length	AS-path length filter (accept/reject by hop count).
bgp-filter-modify	Route attribute modifier on import/export: set/increment/decrement local-preference, MED, AIGP; community add/remove (standard, large, extended).
bgp-filter-remove-private-as	Strips private ASNs from AS_PATH on export.
bgp-filter-irr	IRR-based prefix filtering: AS-SET expansion via whois, periodic refresh, PeeringDB AS-SET discovery. Resolves only peers that opted in, via a filter chain reference or an explicit as-set. See bgp-filter-irr.
bgp-role	BGP Role capability enforcement (RFC 9234).
bgp-redistribute	Cross-protocol route redistribution (static, kernel, connected, L2TP routes into BGP).
redistribute-orchestrator	Dispatches protocol route events to every registered redistribution consumer.

Resilience

Plugin	Description
bgp-gr	Graceful Restart (RFC 4724) and Long-Lived GR (RFC 9494).
bgp-watchdog	Deferred announcement controlled by named watchdog groups.
bgp-route-refresh	Route Refresh and Enhanced Route Refresh (RFC 2918, RFC 7313).

Validation

Plugin	Description
bgp-rpki	RPKI origin validation (RFC 6811), ASPA path verification with policy enforcement (reject/log-only/accept), RTR v2 (RFC 9582).
bgp-rpki-decorator	Correlates UPDATE and RPKI events into merged update-rpki events.

Capabilities

Plugin	Description
bgp-capa	Core capability decoding: multiprotocol, 4-octet ASN, Add-Path, Paths-Limit, extended next-hop, extended message (RFC 4760, RFC 6793, RFC 7911, RFC 8654, RFC 8950).
bgp-aigp	Accumulated IGP Metric (RFC 7311).
bgp-hostname	FQDN capability.
bgp-llnh	Link-local next-hop for IPv6 (RFC 2545).
bgp-softver	Software version capability.

Address families

The IPv4 and IPv6 unicast and multicast families are part of the engine. Everything else is provided by an nlri plugin and is only available if the plugin is loaded.

Plugin	Description
bgp-nlri-vpn	IPv4 and IPv6 MPLS-VPN.
bgp-nlri-evpn	L2VPN EVPN.
bgp-nlri-flowspec	IPv4 and IPv6 FlowSpec, with VPN variants.
bgp-nlri-ls	BGP-LS.
bgp-nlri-labeled	MPLS-labelled unicast.
bgp-nlri-vpls	L2VPN VPLS.
bgp-nlri-mvpn	Multicast VPN.
bgp-nlri-rtc	Route Target Constrain.
bgp-nlri-mup	Mobile User Plane.
bgp-nlri-srpolicy	SR-Policy (SAFI 73) with Tunnel Encapsulation.

Run ze --plugins to list every plugin compiled into the binary you are running.

Protocol

Plugin	Description
bfd	Bidirectional Forwarding Detection (RFC 5880/5881/5882/5883). Echo mode, keyed SHA1/MD5 auth, BGP peer opt-in. See BFD.
bgp-bmp	BGP Monitoring Protocol (RFC 7854). Receiver and sender with Adj-RIB-Out (RFC 8671). See BMP.

Subsystems

Plugin	Description
l2tp	L2TPv2 LNS/LAC (RFC 2661). Tunnel and session FSMs, PPP negotiation, kernel data plane. See L2TP.
l2tp-auth-local	Static local user list for L2TP and PPPoE PPP authentication.
l2tp-auth-radius	RADIUS authentication and accounting for L2TP and PPPoE PPP sessions. See RADIUS.
l2tp-pool	IPv4 address and IPv6 prefix pool for L2TP PPP sessions.
l2tp-shaper	Traffic shaping for L2TP subscriber sessions.
firewall	Stateful packet filtering with nftables backend. See Firewall.
firewall-irr	IRR-based prefix-list filtering for firewall rules.
traffic	Per-interface queueing disciplines with tc and VPP backends. See Traffic Control.
ntp	NTP client for system clock synchronization with clock readiness gate.
sysctl	Named sysctl profiles (dsr, router, hardened, multihomed, proxy) for interface units.
tacacs	TACACS+ AAA client (RFC 8907). SSH authentication, priv-lvl mapping, accounting. See TACACS+.
dhcpserver	DHCP server (RFC 2131/2132). Address pools with multiple named ranges, static mappings, lease tracking. See DHCP Server.
static	Static route management with ECMP, BFD failover, routing tables, per-route isolation for routes that cannot be programmed. See Static Routes.
vrrp	First-hop redundancy (RFC 9568 VRRPv3, RFC 3768 VRRPv2) with a per-group virtual-MAC macvlan, IPv4 and IPv6. Netlink backend only, compile-out ze_vrrp. See VRRP.
ospf	Native OSPFv2 (IPv4) and OSPFv3 (IPv6) engine: areas/ABR, stub/NSSA, SPF, redistribution with BGP, key-chain auth, web views. See OSPF.
isis	Native IS-IS link-state IGP (ISO/IEC 10589, RFC 1195). L1/L2 levels, DIS/pseudo-node LANs, LSDB + SPF, ECMP, wide metrics, dual-stack IPv6, key-chain auth, redistribution. See IS-IS.
pppoe	PPPoE (RFC 2516) in both roles: a client for WAN interfaces, and an access concentrator with subscriber authentication (auth-method, allow-no-auth), AC-Cookie and PADI rate limiting. Shares the PPP driver, the auth handlers and the IP pool with L2TP. See PPPoE.
cos	Class of Service: 802.1p VLAN QoS maps, named profiles, dynamic per-subscriber CoS via RADIUS. See Class of Service.
policy-routes	Policy-based routing rules (PBR). See Policy Routing.
kernel	Kernel route redistribution via routewatch (RTPROT_KERNEL, RTPROT_REDIRECT).
connected	Connected routes: redistributes directly connected interface prefixes.
routing-table	Named routing table registry mapping names to kernel table IDs.

DNS

Plugin	Description
as112	AS112 anycast sink for misdirected reverse-DNS queries (RFC 7534/7535), with watchdog-gated BGP origination of the covering prefixes and optional DoT/DoH. See AS112 DNS.
geodns	GeoDNS authoritative server with per-source-IP answers on the shared DNS harness, and optional DoT (RFC 7858) and DoH (RFC 8484). See DNS.

as112 and geodns each take tls { certificate <name> }, which names an entry in the pki {} store instead of a cert-file and key-file pair. The two forms are mutually exclusive. Each plugin registers a UDP and a TCP listener default, so ze doctor probes both transports.

Security

Plugin	Description
ike	Native IKEv2 in Go with XFRM dataplane. Claims the vpn and pki config roots. The registered name is ike, not ipsec. See IPsec VPN.
pki	X.509 certificate store for IPsec and TLS, served by the ike plugin's pki config root. Health monitoring with certificate expiry warnings. Prometheus metrics. Named by environment.web.certificate and by the as112 and geodns tls { certificate } leaves.

DDoS mitigation and anomaly detection

Plugin	Description
ddos-detect	Automatic volumetric DDoS detection from live traffic stats: per-source packet-rate and bandwidth (BPS) p99 baselines, attack characterization, and incident confidence scoring. See DDoS Mitigation.
ddos-local	Local firewall responder (INPUT drop) for box-directed attacks.
ddos-flowspec	FlowSpec origination responder for transit attacks, announced upstream to peers.
ddos-flowtriq	Flowtriq incident reporter.
ddos-observe	Incident lifecycle store behind show ddos incidents.
copp	Control-plane policing (CoPP) on the INPUT chain, including TCP/179.
anomaly-detect	Report-only behavioral anomaly detector: per-source baselines (fan-out, out/in ratio, destination-port entropy, beaconing), deviation and cohort-rarity scoring, and incident correlation. See Anomaly Detection.
anomaly-shape	Shadow-first responder: surgical per-source firewall rate-limits with per-entity arming, timed auto-revert, a blast-radius cap, and a kill switch.

Provisioning

Plugin	Description
tftpserver	RFC 1350 read-only TFTP server for PXE boot.
imageserver	HTTP image server with Range support for PXE provisioning.
flowspec-firewall	FlowSpec-to-nftables bridge: converts FlowSpec rules into nftables firewall entries.

Traffic engineering

Component	Description
ldp	Label Distribution Protocol (RFC 5036): UDP multicast discovery, TCP session FSM, label information base. Emits MPLS forwarding entries on the mpls-fib bus. See MPLS / LDP / RSVP-TE.
rsvp-te	RSVP-TE (RFC 3209/2205) signaling engine over raw IP (protocol 46): PATH/RESV, ERO explicit routing, bandwidth admission control, soft-state refresh, make-before-break. See RSVP-TE.

The kernel MPLS FIB itself is programmed by fib-kernel, which stays the single owner of the kernel FIB and consumes push/swap/pop entries from the mpls-fib event bus.

Recording

Component	Description
mrt	RFC 6396 MRT recording from live BGP sessions. Three independent streams: updates (BGP4MP for UPDATE messages), all (BGP4MP for all messages plus state changes), routes (periodic TABLE_DUMP_V2 RIB snapshots). YANG config, per-peer and direction filtering, extended timestamps, add-path aware, strftime rotation, async writes. See MRT Analysis.

Management and export

Component	Description
gnmi	gNMI server (gRPC Network Management Interface) for YANG-modeled config: Capabilities, Get, Set, Subscribe ONCE and STREAM. See gNMI.
flow-export	Interface counter and per-flow export over sFlow v5, NetFlow v9 (RFC 3954), and IPFIX (RFC 7011). Also runs the nf_conntrack-backed flow tracking that feeds DDoS attack characterization; ze doctor reports its readiness through the flow-export-conntrack-tracking check. See Flow Export.
storage	YANG-modeled SMART disk health: polling, temperature alerting, scheduled self-tests, pure ioctl (no smartctl).
traffic-usage	Per-interface and per-subscriber traffic accounting and usage reporting.
exabgp-bridge	Internal ExaBGP process bridge: runs an ExaBGP-style controller script sourced from config delivery. See ExaBGP Migration.

Infrastructure

Plugin	Description
interface	OS network interface monitoring through netlink (Linux). Publishes interface and address events to the bus.
fib-kernel	Programs the Linux FIB through netlink, including AF_MPLS push/swap/pop entries from the mpls-fib bus.
fib-vpp	Programs the VPP FIB through GoVPP binary API. See VPP.
fib-p4	Experimental P4 dataplane.
iface-dhcp	DHCP client for managed interfaces with route/DNS/NTP discovery.
iface-ra	IPv6 Router Advertisement sender (RFC 4861): prefixes for SLAAC, the M and O flags, and RDNSS resolvers (RFC 8106) on an interface unit. Linux and the netlink backend only. See Interfaces.
iface-netlink	Netlink-driven interface manager (WireGuard, tunnels, bridges, VLAN).
iface-vpp	VPP interface backend via GoVPP (lifecycle, addressing, monitor).
rib	System RIB shared between protocols: selects the best route across protocols by administrative distance, with a unified Loc-RIB.
host	Hardware inventory library and show host surface.
vpp	VPP process lifecycle management: startup, DPDK NIC binding, crash recovery, GoVPP connection.

Plugin health metrics

Every plugin exposes a few standard Prometheus metrics so you can tell at a glance whether they are healthy.

Metric	Description
ze_plugin_status{plugin}	Current stage. 6 means running.
ze_plugin_restarts_total{plugin}	Cumulative restart count.
ze_plugin_events_delivered_total{plugin}	Total events enqueued to the plugin.

When a plugin is disabled (respawn limit exceeded) its metrics are deleted rather than left stale.

Beyond the standard health metrics, Go plugins can register their own Prometheus counters and gauges through a ConfigureMetrics callback on the plugin registration. bgp-rib, bgp-watchdog, bgp-rpki, bgp-persist, fib-kernel, and rib each ship with their own metric sets on the same Prometheus endpoint. See Go plugins: Prometheus metrics for the API and naming convention.

See also

• Plugin development for writing your own.
• Configuration overview for how plugins bind to peers and receive events.
• Monitoring for the event-stream surface plugins consume.

Adapted from main/docs/features/plugins.md and main/README.md.