show commands

Pre-Alpha. This page describes behavior that may change.

This is the day-2 operator's quick reference for the ze show family. The full command list is in reference/command-reference.md. What follows is the ten you will type the most.

ze show is the read-only path. It cannot mutate state, which makes it the right thing to put in monitoring scripts and dashboards. The same commands work inside the interactive shell after ze cli, just without the ze prefix.

The most-used

ze show bgp peer list                  # Brief peer list with state
ze show bgp summary                    # The BGP summary table
ze show bgp peer <name> detail         # Everything about one peer
ze show bgp peer <name> capabilities   # Negotiated capabilities for one peer
ze show bgp rib received [filters...]
ze show bgp rib sent [filters...]
ze show interface brief                # One-line-per-interface summary
ze show interface rate                 # Per-interface rate tracking
ze show uptime                         # Daemon start time and running duration
ze show bgp rpki status                # RTR sessions and VRP counts
ze show health                         # Component health registry
ze show warnings                       # Active operational warnings
ze show errors                         # Recent error events
ze show version                        # Version, build, plugin list
ze show debug                          # Live debug module state

Every one of these is verb-first. The bare spellings an older page or an older habit may suggest (peer list, bgp summary, rpki status, rib routes, daemon status) are not in the command tree, and the dispatcher answers unknown command for each.

show bgp peer list

Brief table for "is anything down right now".

$ ze show bgp peer list
NAME       REMOTE          AS       STATE
upstream   10.0.0.1        65001    ESTABLISHED
ixp        192.0.2.42      65010    ESTABLISHED
backup     10.0.0.2        65001    CONNECT

show bgp summary

The same shape network operators have been reading for thirty years. Add a family (show bgp summary ipv4/unicast) for a per-family table.

$ ze show bgp summary
NEIGHBOR        AS       UP        STATE          PFXRCVD
10.0.0.1     65001    2h13m     ESTABLISHED      947213
192.0.2.42   65010    18d4h     ESTABLISHED       12047
10.0.0.2     65001    -         CONNECT               -

uptime

ze show uptime reports when the daemon started and how long it has been running. Two fields: start-time (RFC 3339) and uptime (duration string). Useful after a graceful restart or reload to confirm the process came up when you expected.

For per-peer uptime, use show bgp peer list or show bgp summary, which both show the per-session uptime in their tables.

show bgp peer detail

Everything Ze knows about one session, including capability negotiation, families, prefix counters, and timer state. Use it the moment a peer behaves oddly.

It reports connect-retry-counter, the RFC 4271 Section 8.1.1 session attribute counting how many times the peer has tried to establish a session. Only an operator start or stop resets it to zero, so a high value on an ESTABLISHED session says the session flapped to get there. The same value is exported as the ze_bgp_connect_retry_counter gauge.

show bgp rib received and show bgp rib sent

The Adj-RIB-In and Adj-RIB-Out, filterable by peer, family, prefix, AS path, and community. Pipe through | match for a regex filter, | count for a row count, or | json for structured output.

ze show bgp rib received family ipv4/unicast count
ze show bgp rib received community 65000:100
ze show bgp rib received prefix 192.0.2.0/24 | no-more
ze show bgp rib sent count

show interface

The show interface family reshaped: the name is now selected with name <name> before the keyword, and each keyword has its own handler. show interface detail <name> and show interface counters <name> were removed.

ze show interface                       # every interface, full detail
ze show interface brief                 # one line each: name, state, IP, MTU
ze show interface scan                  # discover and classify every OS interface
ze show interface type ethernet         # only interfaces of that type
ze show interface errors                # only interfaces with a non-zero error or drop counter
ze show interface rate [<name>]         # per-second rx/tx rates
ze show interface name eth0 detail      # full detail for one interface
ze show interface name eth0 counters    # counters for one interface

Bare ze show interface and ze show interface <name> are served in-process, so they read the local kernel with no daemon. The other seven go to the daemon. The long forms return structured JSON; pipe through | table or | json as needed.

Connectivity tests: resolve ping, resolve traceroute

ze resolve ping and ze resolve traceroute use an internal ICMP engine (no OS shell-out) and are available inside the shell and over the API without needing a separate shell account on the router.

ze resolve ping 10.0.0.1
ze resolve ping --source 192.0.2.1 --count 5 --size 1500 10.0.0.1
ze resolve traceroute 10.0.0.1
ze resolve traceroute --source 192.0.2.1 10.0.0.1

Flag	Subcommand	Purpose
--source <addr>	both	Bind to a specific local address.
--count <N>	ping	Number of probes.
--size <bytes>	ping	Payload size.

ping has a 15-second wall-clock timeout, traceroute has 30 seconds. Both use the internal ICMP engine (no OS shell-out) with context-based cancellation so they cannot stall the dispatcher. Tab-completion walks YANG and suggests the known interfaces for the source address.

show bgp rib rpf

Reverse Path Forwarding lookup on the sharded Loc-RIB. Returns the best-path entry for the longest matching prefix. Useful for external multicast daemons (PIM-SM) that need to resolve upstream next-hops. CIDR families only (IPv4/IPv6 unicast/multicast).

ze show bgp rib rpf ipv4/unicast 10.0.1.5

show bgp rpki status, warnings, errors

show bgp rpki status shows your RTR session count, the cache server, and the VRP totals. The rest of the family reads the same way: show bgp rpki cache, show bgp rpki roa [<prefix>], show bgp rpki summary, show bgp rpki aspa, and request bgp rpki validate <prefix> <origin-asn>. warnings and errors query the operational report bus that the BGP reactor and the rest of the subsystems publish to. Warnings are state-based (something is wrong right now). Errors are events (something happened, with a timestamp). Both return JSON by default.

ze show warnings | json
ze show errors  | json

The login banner reads from the same bus and surfaces the active warnings when you connect.

Diagnostics

Production debugging commands, all available from the CLI shell.

ze show health                    # Component health (bgp, fib, firewall, iface, ...)
ze show tcp-check <ip> <port>     # TCP connectivity probe
ze show traceroute <target>       # ICMP path trace
ze show capture interface <iface> tcp port 179 count 10 format text
ze show dns lookup <name> type A  # DNS resolution
ze show dns cache stats           # Cache hit/miss statistics
ze show system sockets tcp        # Socket state (replaces ss)
ze show system kernel-log level warning count 50
ze show system goroutines summary # Goroutine distribution
ze show system file-descriptors summary
ze show system profile cpu duration 10s
ze show crashes                   # Panic crash reports

show crashes and show host fall back to in-process reading when the daemon is not running, so you can inspect a crash or the hardware inventory after the process has died.

See Production Diagnostics for the full symptom-based guide.

Routing and forwarding

ze show rib                       # Protocol RIB as sysrib holds it
ze show nexthop-table             # Resolved next-hops with recursion depth
ze show ecmp-groups               # ECMP nexthop groups (max 128 members)
ze show mpls forwarding           # Kernel AF_MPLS label table (push/swap/pop)
ze show ospf neighbor          # OSPF adjacencies (also: interface, database, route, spf, border-routers)
ze show isis neighbor             # IS-IS adjacencies (also: database, route, interface, hostname, spf-log)
ze show isis database [detail]    # LSDB; every row carries own
ze show rsvp-te fast-reroute      # RSVP-TE FRR protection state (PLR, bypass LSPs)
ze show policy routes             # Policy-based routing rules (PBR)
ze show policy test peer <peer> ...  # Dry-run a policy against routes, no apply

show rib reports route-type for a discard route: blackhole, unreachable, or prohibit. The key is omitted for an ordinary route, so its presence is the signal. show isis database reports own, true for an LSP this node originated, on every row.

Subsystem status

ze show flow export [<collector>] # sFlow/NetFlow/IPFIX exporter stats
ze show storage smart             # Per-device SMART health and self-tests
ze show gnmi                      # gNMI server status and subscriptions
ze show audit                     # Local audit log (action/actor/surface/time filters)
ze show pki certificates          # Certificate store
ze show pki certificate name <name> pem        # Export a certificate as PEM
ze show pki certificate name <name> bundle pem # Export the full chain as PEM
ze show pki certificate name <name> fingerprint

IPsec

ze show vpn ipsec status                  # Engine status
ze show vpn ipsec sa                      # Active IKE and Child SA detail
ze show vpn ipsec peer name <name>        # One peer, full detail
ze show vpn ipsec dataplane sa [spi <spi>]  # Kernel SAD read back
ze show vpn ipsec dataplane policy        # Kernel SPD read back
ze show vpn ipsec dataplane drift         # Child SAs the kernel does not hold
ze clear vpn ipsec sa
ze monitor vpn ipsec

show vpn ipsec sa and show vpn ipsec peer name <name> report bytes-in, packets-in, bytes-out, packets-out, and counters-known inside child-sa, plus peer-window-size. A counter is null, never zero, when the SAD could not be read, so a null says "unknown" and a zero says "no traffic".

The three dataplane commands read the kernel rather than the engine's own belief about what it installed. dataplane sa refuses SPI 0, which RFC 4303 Section 2.1 reserves. dataplane drift exits non-zero when it finds a Child SA the engine counts as installed whose SPI the kernel SAD does not hold, so a script can test it. A rekey window holds two SPIs and is not drift.

Traffic, anomaly, and DDoS

All read-only and safe in scripts. The feature, anomaly, and DDoS views report facts and status; they do not act.

ze show traffic stat              # Aggregated snapshot: rates, top talkers, top ports, protocol mix
ze show traffic usage             # Per-interface eBPF byte accounting
ze show traffic feature           # Neutral per-source traffic feature signals (facts, not verdicts)
ze show anomaly detect            # Recent behavioral anomaly incidents (report-only)
ze show anomaly shape             # Anomaly responder mode and armed sources
ze show ddos status               # DDoS observation status
ze show ddos incidents            # Recent DDoS incident ring (newest first)
ze show metrics pool              # Per-attribute-pool occupancy and dedup rates

monitor traffic stat opens the same data as a full-screen live monitor (top talkers, ports with amplification labels, protocol mix, severity, sparkline history); Esc or q quits.

Debug, Class of Service, and IRR

ze show debug                             # Live daemon debug state (not stored profile)
ze show class-of-service                  # CoS profiles and assignments
ze show bgp irr                           # IRR filter status per ASN
ze show bgp irr prefix <peer>            # IRR-resolved prefixes for a peer
ze show bgp irr check <peer> <prefix>    # Test prefix against IRR filter

Live monitoring

show ping <target>                # Bounded ICMP batch, prints a summary (5 probes, 5s timeout)
show ping <target> count 10 size 1400   # count 1-100, size = ICMP payload bytes (1-65507)
monitor ping <target>             # Continuous ICMP with live stats, until Ctrl-C
monitor ping <target> interval 500ms count 5   # send cadence 100ms-30s, stop after 5
monitor traceroute <target>       # mtr-style continuous traceroute
monitor system netlink all        # Kernel route/link/address changes
monitor interface rate            # Live interface rate tracking
monitor traffic stat              # Full-screen live traffic monitor (top talkers, ports)

show ping and monitor ping share count (1-100) and size (1-65507); monitor ping also takes interval. size is the ICMP payload, so size 1400 sends 1400 payload bytes on top of the 8-byte ICMP and 20-byte IPv4 headers. monitor traceroute supports pipe enrichment: | log | origin annotates hops with ASN names, | log | resolve adds reverse DNS.

Pipes

The shell understands a small set of pipe operators borrowed from network OS shells.

Pipe	Effect
| json	Render the structured response as JSON.
| table	Render as a table.
| match <regex>	Drop rows that do not match.
| count	Just the row count.
| no-more	Disable paging for long output.
| log	Scrollback output for streaming commands.
| first N	Keep only the first N items. Server-side early termination when supported.
| last N	Keep only the last N items (trailing window).
| origin	Annotate IPs with ASN names (Team Cymru).
| resolve	Annotate IPs with reverse DNS hostnames.

See also

• Monitoring for live event streams and the auto-refreshing dashboard.
• Production Diagnostics for symptom-based troubleshooting.
• Health Checks for the health registry and report bus.
• Command reference for every command and every flag.
• CLI reference for the interactive shell, history, and tab completion.

Adapted from main/docs/guide/command-reference.md and main/docs/features/cli-commands.md.