Command manual

Cisco IOS117

netconf-yang: Enables the NETCONF server on IOS-XE (SSH on TCP 830) with the YANG models of that release.Automation and SDN
netconf-yang feature candidate-datastore: Adds a candidate datastore to IOS-XE NETCONF, so edits are validated and committed as one transaction.Automation and SDN
restconf: Enables RESTCONF on IOS-XE. It also needs ip http secure-server and a user that AAA authorizes at privilege 15.Automation and SDN
show netconf-yang sessions: Lists open NETCONF sessions with session ID, transport, user, source host and any global datastore locks.Automation and SDN
show platform software yang-management process: Shows whether the IOS-XE programmability processes (confd, ncsshd for NETCONF, nginx for RESTCONF and others) are running.Automation and SDN
show telemetry ietf subscription all: Lists configured and dynamic model-driven telemetry subscriptions with their ID, type and state.Automation and SDN
show telemetry ietf subscription 101 receiver: Shows the collector address, port and protocol for subscription 101 and whether the connection is up.Automation and SDN
show ip route summary: Counts routes by source (connected, static, OSPF, BGP) and the memory they use. A quick check that summarization works and of how large the table is getting.Network design
show ip protocols: Shows each routing process with router ID, networks, passive interfaces, redistribution, filters, distance and routing sources. A fast audit of the routing design on one device.Network design
show ip ospf border-routers: Lists the ABRs and ASBRs this router has routes to, with area and next hop. Confirms the area design and which routers inject external routes.Network design
show ip bgp summary: Lists BGP neighbors with AS, uptime and prefixes received. A number in the last column means Established; a word such as Active or Idle means the session is down.Network design
show standby brief: One line per HSRP group with priority, preempt flag, state, active and standby routers and virtual IP. Check that the active router matches the STP root for that VLAN.Network design
show vrrp brief: One line per VRRP group with priority, state and master address. Confirms the master is the switch the design intended.Network design
show track: Shows each tracked object, what it watches, its state, how often it changed, and which clients such as static routes, HSRP or VRRP depend on it.Network design
show ip sla statistics: Shows the latest result, return code and success and failure counts per IP SLA operation. Older IOS releases used show ip sla monitor statistics.Network design
show spanning-tree root: Lists the root bridge ID, root cost, timers and root port for every VLAN, so you can confirm the root sits where the design says it should.Network design
show etherchannel summary: Shows each port channel, its protocol and member ports with flags such as P (bundled), I (stand-alone) and s (suspended). Proves uplinks are bundled, not blocked.Network design
show switch: Lists Catalyst stack members with role (active, standby, member), priority, MAC address and state. Confirms the stack and its election match the design.Network design
show redundancy: Shows the redundancy mode (for example SSO), the state of the active and standby supervisor or stack member, and switchover history.Network design
show power inline: Shows PoE per port and the PoE budget in watts (available, used, remaining). Confirms a closet can power all its APs, phones and cameras.Network design
show inventory: Lists chassis, modules, power supplies and optics with product IDs and serial numbers. The input for support contracts, spares and end-of-life tracking.Network design
show lldp neighbors detail: Shows LLDP neighbors with system name, port, management address and capabilities, to draw or verify the physical diagram. show cdp neighbors detail is the Cisco-only equivalent.Network design
show interfaces summary: One line per interface with queue drops and current receive and transmit rates in bits and packets per second. A quick capacity scan of a whole switch.Network design
copy running-config flash:pre-change.cfg: Saves the running config to a file before a change, giving configure replace a known-good target and the post-check a baseline to compare with.Network design
show archive config differences flash:pre-change.cfg system:running-config: Shows the line-by-line differences between the saved pre-change file and the running config. A clean post-change review of exactly what changed.Network design
configure replace flash:pre-change.cfg list: Replaces the running config with the saved file by applying only the differences, and lists each command applied. The cleanest rollback after a failed change.Network design
configure terminal revert timer 10: Enters config mode with automatic rollback. Unless you enter configure confirm within 10 minutes, the device reverts. Needs the archive feature with a path configured.Network design
reload in 10: Schedules a reload in 10 minutes as a safety net before a risky remote change. Do not save the config until it is proven, then run reload cancel.Network design
show ip eigrp neighbors: Lists EIGRP neighbors with interface, hold time, uptime, SRTT, RTO and queue count. A Q Cnt that stays above 0 means a neighbor is not acknowledging.EIGRP, RIP and IS-IS
show ip eigrp neighbors detail: Adds per-neighbor detail such as retransmissions, prefixes received, and whether the peer is a stub and which routes it advertises.EIGRP, RIP and IS-IS
Example
Output
show ip eigrp neighbors detail | include Stub|Suppressing
show ip eigrp topology: Shows successors and feasible successors per prefix, with the FD and each path's (metric/reported distance).EIGRP, RIP and IS-IS
show ip eigrp topology all-links: Shows every path in the topology table, including neighbors that fail the feasibility condition and are hidden from the default output.EIGRP, RIP and IS-IS
show ip eigrp topology 10.50.0.0/24: Shows one prefix in full, with minimum bandwidth, total delay, hop count, originating router and route type for each path.EIGRP, RIP and IS-IS
show ip eigrp topology active: Lists routes currently active and the neighbors that still owe a reply, marked r. The starting point for stuck in active.EIGRP, RIP and IS-IS
show ip eigrp interfaces detail: Lists interfaces running EIGRP with peers, pacing, hello and hold settings and authentication. Passive interfaces are not listed.EIGRP, RIP and IS-IS
show ip eigrp traffic: Counts hellos, updates, queries, replies, acks and SIA packets sent and received. Rising query counts point to something flapping.EIGRP, RIP and IS-IS
show ip protocols: Shows each routing process with AS, K values, router ID, variance, maximum paths, network statements, passive interfaces and AD values.EIGRP, RIP and IS-IS
Example
Output
show ip protocols | include K1|Router-ID
show ip route eigrp: Shows only EIGRP routes in the routing table, D for internal and D EX for external, with [AD/metric].EIGRP, RIP and IS-IS
show eigrp address-family ipv4 neighbors: The named mode version of the neighbor table, labelled with the instance name and AS.EIGRP, RIP and IS-IS
show eigrp address-family ipv4 topology: The named mode topology table, showing 64-bit wide metric values rather than the scaled routing table values.EIGRP, RIP and IS-IS
debug eigrp packets: Prints EIGRP packets as they are sent and received, including ones ignored for authentication problems. Use briefly and on a quiet router.EIGRP, RIP and IS-IS
clear ip eigrp neighbors 10.0.12.2: Resets one EIGRP adjacency. Without an address it resets all of them, which drops every EIGRP route on the router for a moment.EIGRP, RIP and IS-IS
eigrp stub connected summary: Makes the router an EIGRP stub that advertises only connected and summary routes. Its neighbors stop sending it queries.EIGRP, RIP and IS-IS
variance 2: Installs feasible successors whose metric is within twice the best metric, for unequal cost load sharing. In named mode it goes under topology base.EIGRP, RIP and IS-IS
ip summary-address eigrp 100 10.20.0.0 255.255.252.0: Classic mode summary sent out this interface. Installs a Null0 discard route with AD 5 on the local router.EIGRP, RIP and IS-IS
eigrp upgrade-cli CAMPUS: Converts a classic EIGRP configuration into named mode with the given name, without resetting neighbors.EIGRP, RIP and IS-IS
show ip rip database: Shows every prefix RIP knows with hop count and source, including routes not installed because another protocol has lower AD.EIGRP, RIP and IS-IS
debug ip rip: Prints RIP updates sent and received with each prefix and hop count. Handy for seeing split horizon and poisoned routes with metric 16.EIGRP, RIP and IS-IS
timers basic 30 180 180 240: Sets the RIP update, invalid, holddown and flush timers. The values shown are the defaults. Must match on every RIP router.EIGRP, RIP and IS-IS
show isis neighbors: Lists IS-IS adjacencies with system ID, level, interface, IP address, state and hold time.EIGRP, RIP and IS-IS
show isis database detail: Shows every LSP per level with its prefixes, metrics and neighbors, plus the ATT, P and OL bits.EIGRP, RIP and IS-IS
show clns interface GigabitEthernet0/0/0: Shows IS-IS settings on one interface, including circuit type, network type, metrics and hello timers.EIGRP, RIP and IS-IS
set-overload-bit on-startup wait-for-bgp: Advertises the IS-IS overload bit after a reload until BGP has converged, so the router does not attract transit traffic too early.EIGRP, RIP and IS-IS
show ip access-lists BRANCH-IN: Lists every line of an IPv4 ACL with its sequence number and hit count. Leave the name off to see all IPv4 ACLs.Network security
show ip interface GigabitEthernet0/0/1 | include access list: Shows which ACL is applied inbound and outbound on an interface, the quickest check for a wrong name or direction.Network security
clear ip access-list counters BRANCH-IN: Resets the hit counters of one ACL so a single test shows exactly which line matches.Network security
ip access-list resequence BRANCH-IN 10 10: Renumbers an ACL starting at 10 in steps of 10, making room to insert lines between existing ones.Network security
show ipv6 access-list V6-SERVERS-IN: Lists an IPv6 ACL with sequence numbers and match counts. The implicit ND permits and final deny are not shown.Network security
show port-security interface GigabitEthernet1/0/5: Shows port security status, violation mode, maximum and learned MAC counts, the last source MAC and the violation counter.Network security
show port-security address: Lists every secure MAC address on the switch with its VLAN, type (static, sticky, dynamic) and port.Network security
show interfaces status err-disabled: Lists ports in err-disabled state and the reason, such as psecure-violation, arp-inspection or dhcp-rate-limit.Network security
errdisable recovery cause psecure-violation: Re-enables ports shut by port security automatically after the recovery interval (300 seconds by default).Network security
show ip dhcp snooping: Shows whether snooping is on, which VLANs are snooped, option 82 insertion, and trust and rate limit per interface.Network security
show ip dhcp snooping binding: Lists the snooping binding table of MAC, IP, lease, VLAN and port that DAI and IP Source Guard rely on.Network security
show ip arp inspection vlan 10: Shows the DAI validation checks, whether the VLAN is active, the attached ARP ACL and logging settings.Network security
show ip arp inspection statistics vlan 10: Counts ARP packets forwarded and dropped by DAI per VLAN, with the reasons for drops.Network security
show ip verify source: Lists the IP Source Guard filter on each port with the IP (and MAC, if checked) it permits.Network security
show authentication sessions interface GigabitEthernet1/0/10 details: Shows one port's 802.1X or MAB session with status, method results, user name, VLAN and downloadable ACL.Network security
show access-session interface GigabitEthernet1/0/10 details: The newer policy-style (IBNS 2.0) equivalent of show authentication sessions on IOS-XE.Network security
show aaa servers: Shows each RADIUS and TACACS+ server's state (UP or DEAD), ports, dead history and request counters.Network security
test aaa group ISE-RADIUS alice Passw0rd new-code: Sends a real RADIUS authentication request from the device and reports whether the user was accepted.Network security
debug radius authentication: Prints RADIUS requests and replies with their attributes. Filter or limit it on busy switches.Network security
show zone-pair security: Lists the zone-based firewall zone-pairs with source zone, destination zone and the attached inspect policy.Network security
show policy-map type inspect zone-pair ZP-IN-OUT sessions: Shows the class-map counters and the stateful sessions currently open through one zone-pair.Network security
show policy-map control-plane: Shows CoPP classes with conformed and exceeded packet counts, the first place to look when the CPU is under attack.Network security
show ip ssh: Shows whether SSH is enabled, its version, the authentication timeout and the retry limit.Network security
show login failures: Lists recent failed login attempts by user, source address and line, when login block-for is configured.Network security
show interfaces trunk: Lists trunk ports with mode, native VLAN, allowed VLANs and the VLANs actually forwarding after STP and pruning.Switching and VLANs
ip tcp adjust-mss 1360: Rewrites the MSS in TCP SYNs entering or leaving the interface down to this value (500 to 1460). Usual on tunnels with ip mtu 1400.TCP, UDP and applications
ip mtu 1400: Sets the largest IPv4 packet on the interface without changing the layer 2 MTU. On a tunnel, this is the size before encapsulation.TCP, UDP and applications
ping 10.2.0.10 source 10.1.0.1 size 1400 df-bit: Sends pings of an exact size with DF set from a chosen source, to test the MTU of a path such as a tunnel.TCP, UDP and applications
show tcp brief: Lists TCP connections that terminate on the router itself (SSH, BGP, TACACS+) with local and foreign address and state.TCP, UDP and applications
show ip interface brief: One line per interface with its IP address and status. The fastest way to spot interfaces that are down, admin down, or up with line protocol down.Troubleshooting
show interfaces GigabitEthernet1/0/24: Full status and counters for one port, including duplex, load, CRC, runts, giants, overruns, output drops, collisions and when counters were last cleared.Troubleshooting
show interfaces counters errors: Catalyst table of error counters per port (FCS, alignment, undersize, collisions, late collisions, giants). Good for finding the one bad port on a switch.Troubleshooting
show interfaces transceiver detail: Optic diagnostics per port, with temperature, voltage, Tx and Rx power in dBm and the alarm and warning thresholds. Low Rx power next to CRC errors points at the fiber or optic.Troubleshooting
show interfaces status err-disabled: Lists ports shut down by err-disable and the reason, such as bpduguard, psecure-violation, link-flap or udld.Troubleshooting
show logging | include LINK|LINEPROTO|DUPADDR: Filters the log buffer for link flaps, line protocol changes and duplicate address warnings. The pipe filter takes a regular expression, so | means or.Troubleshooting
clear counters GigabitEthernet1/0/24: Resets the interface counters so you can see which errors are climbing now rather than reading a total built up over months.Troubleshooting
ping 10.20.0.10 source Loopback0 size 1500 df-bit repeat 100: Extended ping from a chosen source with DF set. Tests the return route to that source and whether full-size packets pass. M in the output means could not fragment.Troubleshooting
Example
Output
R1# ping 10.20.0.10 source Loopback0 size 1500 df-bit repeat 100 Type escape sequence to abort. Sending 100, 1500-byte ICMP Echos to 10.20.0.10, timeout is 2 seconds: Packet sent with a source address of 10.255.0.1 Packet sent with the DF bit set MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM MMMMMMMMMMMMMMMMMMMMMMMMMMMMMM Success rate is 0 percent (0/100)
traceroute 10.30.0.15 source Loopback0: Traces the forward path hop by hop with UDP probes from the given source. Repeating addresses mean a loop; asterisks at one hop alone are usually ICMP rate limiting.Troubleshooting
show ip route 10.30.0.15: Shows the route that matches this destination by longest prefix, how it was learned, its distance and metric, and the next hops.Troubleshooting
show ip cef exact-route 10.10.0.25 10.30.0.15: Shows which next hop and interface CEF uses for one source and destination pair. Essential when ECMP sends only some flows over a broken path.Troubleshooting
show ip arp 10.20.0.40: Shows the MAC address and interface for an IP in the ARP cache. A MAC that changes between checks points at a duplicate IP.Troubleshooting
show mac address-table address 0c4a.21d3.9e10: Shows the VLAN and port where a MAC address was learned. Follow it hop by hop with CDP or LLDP until it lands on an access port.Troubleshooting
show processes cpu sorted: CPU use with the busiest processes first. On classic IOS the second figure in the 5-second value is interrupt time, meaning packets switched in software.Troubleshooting
show spanning-tree detail | include occurr|from: Shows the number of topology changes per VLAN, how long ago the last one happened, and the port it came from. Follow that port to find a flapping link.Troubleshooting
show policy-map interface GigabitEthernet0/0/0: Per-class QoS statistics on an interface, including queue drops and policer exceeded counts. Shows whether drops come from a policy rather than a fault.Troubleshooting
monitor capture CAP interface GigabitEthernet0/0/1 both match ipv4 host 10.10.0.25 any: Defines an IOS-XE embedded packet capture on an interface, both directions, for one host. Then start, stop, view and export it to a pcap file.Troubleshooting
Example
Output
R1# monitor capture CAP start R1# monitor capture CAP stop R1# show monitor capture CAP buffer brief R1# monitor capture CAP export bootflash:cap.pcap
show crypto isakmp sa: Lists IKEv1 (ISAKMP) SAs with peer addresses and state. QM_IDLE means phase 1 is complete; MM_NO_STATE or MM_KEY_EXCH point at policy or key problems.VPNs and tunnels
Example
Output
R1# show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 203.0.113.2 198.51.100.1 QM_IDLE 1001 ACTIVE
show crypto ikev2 sa: Lists IKEv2 SAs with local and remote address and port, FVRF and IVRF, status (READY when up), the negotiated algorithms and the lifetime used.VPNs and tunnels
show crypto ipsec sa: Shows each IPsec SA pair with local and remote selectors, peer, encaps and decaps counters, SPIs, transform, mode and remaining lifetime.VPNs and tunnels
show crypto ipsec sa peer 203.0.113.2: Limits the IPsec SA output to one peer. The quickest way to compare encaps and decaps counters on a busy headend.VPNs and tunnels
show crypto session: One summary per peer. UP-ACTIVE means IKE and IPsec SAs are up, UP-IDLE means only the IKE SA is up, DOWN means nothing is negotiated.VPNs and tunnels
Example
Output
R1# show crypto session Crypto session current status Interface: Tunnel0 Profile: IKEV2-BRANCH Session status: UP-ACTIVE Peer: 203.0.113.2 port 500 Session ID: 1 IKEv2 SA: local 198.51.100.1/500 remote 203.0.113.2/500 Active IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0 Active SAs: 2, origin: crypto map
show crypto map: Lists crypto map entries with their peers, crypto ACLs, transform sets, PFS setting and the interfaces they are applied to.VPNs and tunnels
show access-lists VPN-TRAFFIC: Shows the crypto ACL lines, so you can compare them side by side with the peer's. They must be mirror images.VPNs and tunnels
clear crypto sa peer 203.0.113.2: Deletes the IPsec SAs to one peer so they renegotiate. Use after collecting evidence; it interrupts traffic to that peer.VPNs and tunnels
clear crypto ikev2 sa: Deletes IKEv2 SAs, and with them their Child SAs. Options narrow it to a local or remote address.VPNs and tunnels
debug crypto condition peer ipv4 203.0.113.2: Restricts crypto debugs to one peer. Set it before any crypto debug on a router with many tunnels.VPNs and tunnels
debug crypto isakmp: Shows IKEv1 negotiation step by step, including which phase 1 policy matched and why quick mode was rejected.VPNs and tunnels
debug crypto ipsec: Shows IPsec SA creation and deletion and proposal checks, such as "proxy identities not supported" for mismatched crypto ACLs.VPNs and tunnels
debug crypto ikev2: Shows IKEv2 exchanges, proposal and identity matching, authentication results and Child SA creation.VPNs and tunnels
show dmvpn: Lists DMVPN peers per tunnel interface with NBMA and tunnel addresses, state, uptime and attributes such as S (static), D (dynamic) and N (NATed).VPNs and tunnels
show ip nhrp: Shows the NHRP cache, mapping tunnel addresses (and shortcut prefixes) to NBMA addresses, with type, flags and expiry.VPNs and tunnels
show ip nhrp nhs detail: On a spoke, shows each configured next hop server and whether registrations to it are being answered.VPNs and tunnels
show interfaces Tunnel0: Shows tunnel source and destination, tunnel mode, transport MTU, protection profile, line protocol and traffic counters.VPNs and tunnels
ping 10.2.0.10 source GigabitEthernet0/0/1 size 1400 df-bit: Sends LAN-sourced pings with DF set at a chosen size, which matches the crypto policy and finds the largest packet the tunnel passes.VPNs and tunnels

NX-OS4

feature nxapi: Enables NX-API on NX-OS so it accepts CLI and JSON-RPC requests over HTTP or HTTPS.Automation and SDN
show vpc brief: Shows vPC domain status, peer link, peer keepalive, consistency checks and each vPC's state. The first check of an MLAG design on Nexus switches.Network design
show ip eigrp topology: Shows the EIGRP topology table on NX-OS, with successors and feasible successors per prefix, like on IOS.EIGRP, RIP and IS-IS
show interface counters errors: NX-OS per-port error counters (FCS, alignment, undersize, late collisions, giants). Note the singular interface keyword.Troubleshooting

Arista EOS5

show version | json: Returns command output as structured JSON instead of text. NX-OS supports the same pipe.Automation and SDN
management api http-commands: Enters eAPI configuration on Arista EOS. Add no shutdown to enable the JSON-RPC API over HTTPS.Automation and SDN
configure session CUTOVER-1: Opens a named configuration session on Arista EOS. Changes stay pending until commit; show session-config diffs shows them and abort discards them.Network design
show isis neighbors: Lists IS-IS adjacencies on Arista EOS with system ID, interface, level and state.EIGRP, RIP and IS-IS
show interfaces counters errors: Arista per-port table of FCS, alignment, symbol, runt and giant errors, plus receive and transmit error totals.Troubleshooting

Junos17

set system services netconf ssh: Enables NETCONF over SSH on Junos, listening on port 830 by default.Automation and SDN
show configuration interfaces | display xml: Prints the configuration as XML, which shows the exact element path to use in a NETCONF edit.Automation and SDN
show interfaces terse | display xml rpc: Prints the NETCONF RPC that returns the same data as the CLI command, ready to use from a script.Automation and SDN
commit confirmed 5: Commits the candidate and rolls it back after 5 minutes unless you commit again. The safety net for risky remote changes.Automation and SDN
commit confirmed 5: Activates the candidate config but rolls it back automatically after 5 minutes unless you commit again. The standard safety net for remote changes on Junos.Network design
show system commit: Lists recent commits with time, user and method. Pairs with rollback n in configuration mode to return to an earlier configuration.Network design
show isis adjacency: Lists IS-IS adjacencies with interface, system name, level and state on Junos.EIGRP, RIP and IS-IS
show isis database: Shows the IS-IS link state database per level on Junos, with LSP IDs, sequence numbers and lifetimes.EIGRP, RIP and IS-IS
show security flow session source-prefix 10.10.10.51: Lists the flow sessions on an SRX firewall for one source, with the policy that allowed each one.Network security
show firewall filter GUEST-IN: Shows the counters and policers of a Junos firewall filter, for terms that have a count action.Network security
show ethernet-switching interface ge-0/0/1 detail: Shows the VLAN membership and port mode of a Junos switch port.Switching and VLANs
set security flow tcp-mss ipsec-vpn mss 1350: On an SRX, clamps the MSS of TCP sessions that enter IPsec VPN tunnels.TCP, UDP and applications
show interfaces ge-0/0/1 extensive: Every counter for a Junos interface, including input errors, framing errors (CRC), drops, MAC statistics and queue counters.Troubleshooting
monitor traffic interface ge-0/0/1 no-resolve: Live tcpdump-style decode on a Junos interface. It only sees traffic to or from the Routing Engine, not transit traffic forwarded in hardware.Troubleshooting
show security ike security-associations: Lists IKE SAs on an SRX with the remote address, state (UP or DOWN), initiator and responder cookies and mode.VPNs and tunnels
show security ipsec security-associations: Lists IPsec SAs on an SRX with SPIs, algorithms, remaining lifetime, gateway and the bound tunnel interface.VPNs and tunnels
show security ipsec statistics: Shows ESP encrypted and decrypted byte and packet counts plus errors such as authentication and replay failures.VPNs and tunnels

PAN-OS5

test security-policy-match from <zone> to <zone> source <ip> destination <ip> protocol 6 destination-port 443: Shows which security rule would match a given flow on a Palo Alto firewall, without sending any traffic.Network security
Example
Output
test security-policy-match from trust to untrust source 10.10.10.51 destination 192.0.2.80 protocol 6 destination-port 443
show session all filter source 10.10.10.51: Lists the sessions on a Palo Alto firewall for one source address, with application, zones and NAT.Network security
show vpn ike-sa: Lists IKE SAs on a Palo Alto firewall per gateway, with algorithms, lifetime and whether phase 1 is established.VPNs and tunnels
show vpn ipsec-sa: Lists IPsec SAs per tunnel with SPIs, algorithms and remaining lifetime.VPNs and tunnels
test vpn ike-sa gateway GW-BRANCH: Forces the firewall to start IKE negotiation with the named gateway, instead of waiting for interesting traffic.VPNs and tunnels

FortiOS4

diagnose debug flow trace start 20: Traces how the next 20 packets are handled on a FortiGate, including the matching policy. Set a filter first and enable output with diagnose debug enable.Network security
diagnose vpn ike gateway list: Shows each IKE gateway on a FortiGate with peer address, IKE version, NAT-T state, and phase 1 and phase 2 status.VPNs and tunnels
diagnose vpn tunnel list: Shows each IPsec tunnel with its selectors, SPIs, algorithms and encrypt and decrypt counters.VPNs and tunnels
get vpn ipsec tunnel summary: One line per IPsec tunnel with the peer and how many selectors are up, a quick health check.VPNs and tunnels

Linux77

ssh -p 830 netops@10.0.0.1 -s netconf: Opens a raw NETCONF session. The server answers with its hello and capability list, which proves NETCONF is up.Automation and SDN
Example
Output
<?xml version="1.0" encoding="UTF-8"?> <hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> <capabilities> <capability>urn:ietf:params:netconf:base:1.0</capability> <capability>urn:ietf:params:netconf:base:1.1</capability> ...
curl -sk -u netops -H "Accept: application/yang-data+json" https://10.0.0.1/restconf/data/ietf-interfaces:interfaces: Reads every interface through RESTCONF as JSON. curl prompts for the password; -k skips certificate checks (lab only).Automation and SDN
pyang -f tree ietf-interfaces.yang: Prints a YANG module as a tree showing config (rw) and state (ro) nodes, list keys and optional nodes.Automation and SDN
Example
Output
module: ietf-interfaces +--rw interfaces | +--rw interface* [name] | +--rw name string | +--rw description? string
gnmic -a 10.0.0.31:6030 -u netops -p secret --insecure capabilities: Asks a gNMI target for its gNMI version, supported models and encodings. --insecure means plaintext, lab only.Automation and SDN
gnmic -a 10.0.0.31:6030 --insecure subscribe --path /interfaces/interface/state/counters: Streams interface counters over gNMI. Add --stream-mode sample --sample-interval 10s, or --stream-mode on-change for state.Automation and SDN
git log --oneline -- data/: Short history of every commit that touched the data folder, newest first.Automation and SDN
Example
Output
3f2a9c1 CHG1234: add VLAN 30 GUESTS to dc1 leaves 8b7d0e4 CHG1201: rename VLAN 20 to VOICE
git revert 3f2a9c1: Creates a new commit that undoes a merged change without rewriting shared history.Automation and SDN
terraform plan -out tfplan: Compares code, state and real infrastructure, shows the changes and saves exactly that plan for terraform apply tfplan.Automation and SDN
terraform state list: Lists every resource recorded in the Terraform state file.Automation and SDN
Example
Output
aci_tenant.prod
ovs-ofctl dump-flows br0: Lists the OpenFlow entries in an Open vSwitch bridge with priority, match fields, actions and packet counters.Automation and SDN
ip -br addr: Lists every interface on one line with its operational state and all IPv4 and IPv6 addresses, including secondaries that ifconfig hides.Linux networking
Example
Output
lo UNKNOWN 127.0.0.1/8 ::1/128 ens192 UP 10.0.10.21/24 fe80::250:56ff:fea1:2b3c/64
ip -s link show dev ens192: Shows link flags, MTU and the RX and TX counters for packets, bytes, errors and drops. Run it twice to see which counters move.Linux networking
ip route get 198.51.100.80: Asks the kernel for the real lookup result, through policy rules and all tables, with next hop, output interface, source address and any cached path MTU.Linux networking
Example
Output
198.51.100.80 via 10.0.10.1 dev ens192 src 10.0.10.21 uid 1000 cache
ip route show table all: Prints the routes of every table, including local and any policy routing tables that plain ip route hides.Linux networking
ip rule show: Lists the policy routing rules in priority order. The defaults are 0 lookup local, 32766 lookup main and 32767 lookup default.Linux networking
ip neigh show dev ens192: Shows the ARP or NDP cache for one interface with each entry's state, such as REACHABLE, STALE, DELAY, FAILED or PERMANENT.Linux networking
ip link add link ens192 name ens192.10 type vlan id 10: Creates an 802.1Q VLAN subinterface for VLAN 10 on ens192. Put the address on ens192.10 and bring both interfaces up.Linux networking
ip link add br0 type bridge vlan_filtering 1: Creates a VLAN-aware Linux bridge. Ports are added with ip link set <dev> master br0 and VLANs with bridge vlan add.Linux networking
bridge vlan show: Lists each bridge port's VLAN membership, marking the PVID and which VLANs leave untagged.Linux networking
bridge fdb show br br0: Shows the bridge's MAC address table, with the port each MAC was learned on.Linux networking
cat /proc/net/bonding/bond0: Shows the bond mode, hash policy, link monitoring, LACP partner and aggregator, and each slave's state and failure count.Linux networking
ip netns exec red ip -br addr: Runs a command inside the red network namespace. ip -n red is the short form for ip commands.Linux networking
ip link add veth-red type veth peer name veth-red-br: Creates a veth pair, two connected virtual interfaces. Move one end into a namespace with ip link set veth-red netns red.Linux networking
ss -tulpn: Lists listening TCP and UDP sockets with numeric addresses and the owning process. Run as root to see every process.Linux networking
ss -tni state established '( dport = :443 or sport = :443 )': Shows established HTTPS connections with TCP internals per flow, such as RTT, RTO, cwnd, MSS and retransmissions.Linux networking
tcpdump -i ens192 -nn -e 'arp or icmp': Captures ARP and ICMP with MAC addresses and VLAN tags shown, without name or port lookups. The first capture for most reachability problems.Linux networking
tcpdump -i ens192 -nn -c 5000 -w /tmp/web.pcap 'host 198.51.100.80 and port 443': Saves up to 5000 packets of one conversation to a pcap file for Wireshark. Read it back with tcpdump -nn -r /tmp/web.pcap.Linux networking
dig @10.0.20.53 app.corp.example.com: Queries one DNS server directly, bypassing resolv.conf, and shows the status code, flags, answer records with TTLs and the server that replied.Linux networking
resolvectl status: Shows systemd-resolved's real upstream DNS servers and search domains per interface, and whether /etc/resolv.conf is its stub file.Linux networking
getent hosts app.corp.example.com: Resolves a name through NSS exactly as applications do, including /etc/hosts. Use it when dig and the application disagree.Linux networking
curl -sv -o /dev/null https://app.example.com/health: Shows the DNS result, TCP connect, TLS details, request headers and response status for one request, discarding the body.Linux networking
ping -M do -s 1472 -c 3 10.0.10.1: Sends 1500-byte packets with DF set to test the path MTU. A router answering Frag needed reports the smaller MTU.Linux networking
sysctl net.ipv4.ip_forward net.ipv4.conf.all.rp_filter: Shows whether IPv4 forwarding is on and the global reverse path filter mode (0 off, 1 strict, 2 loose).Linux networking
iptables -L -n -v --line-numbers: Lists the filter table's chains with policies, packet and byte counters per rule, and rule positions for inserting or deleting.Linux networking
iptables -t nat -S: Prints the nat table as the commands that would recreate it, showing DNAT, SNAT and MASQUERADE rules that plain iptables -L hides.Linux networking
nft list ruleset: Prints the whole nftables ruleset for every family, including rules added through iptables-nft.Linux networking
conntrack -L -p tcp --dport 443: Lists tracked connections to port 443 with state, timeout and both tuples, which shows any NAT translation in the reply tuple.Linux networking
ethtool ens192: Shows negotiated speed, duplex, autonegotiation and whether a link is detected. ethtool -S ens192 shows driver counters.Linux networking
netplan try: Applies the netplan config and rolls it back after 120 seconds unless you confirm. The safe way to change networking over SSH.Linux networking
nmcli device status: Lists interfaces with their NetworkManager state and active connection, showing which devices NetworkManager manages.Linux networking
sysctl net.ipv4.tcp_syncookies: Shows whether Linux SYN cookies are enabled; 1, the default, sends cookies only when the SYN queue overflows.Network security
bridge vlan show: Lists VLAN membership of each port on a Linux bridge with VLAN filtering enabled.Switching and VLANs
ss -tan: Lists all TCP sockets with numeric addresses and their state (ESTAB, TIME-WAIT, CLOSE-WAIT and so on). The modern replacement for netstat -tan.TCP, UDP and applications
ss -tanp state close-wait: Lists sockets in CLOSE-WAIT with the owning process and file descriptor. A growing list means the application is not closing sockets.TCP, UDP and applications
Example
Output
sudo ss -tanp state close-wait '( dport = :8443 )'
ss -tano state time-wait: Lists TIME-WAIT sockets with the remaining timer, for example timer:(timewait,41sec,0). Shows which side closed first.TCP, UDP and applications
ss -ti dst 10.2.20.30: Shows TCP internals per connection on the sender, including congestion control, wscale, rtt, rto, mss, pmtu, cwnd, retrans and rwnd_limited time.TCP, UDP and applications
ss -lnt: Lists listening TCP sockets. For LISTEN lines, Recv-Q is the accept queue length and Send-Q is the backlog limit.TCP, UDP and applications
tcpdump -ni eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0': Captures only connection setup and teardown segments (SYN, FIN, RST), with their TCP options, which keeps captures small on busy links.TCP, UDP and applications
tcpdump -ni eth0 -S 'host 10.0.0.20 and tcp port 80': Captures one conversation with absolute sequence numbers (-S) so seq and ack arithmetic can be checked line by line.TCP, UDP and applications
tcpdump -ni eth0 'icmp[icmptype] == icmp-unreach and icmp[icmpcode] == 4': Captures ICMP fragmentation needed messages. Their absence on the sender during a large transfer is the sign of a PMTUD black hole.TCP, UDP and applications
ping -M do -s 1472 -c 3 10.30.0.10: Sends pings with the DF bit set and 1,500-byte packets (1472 + 8 + 20). Lower -s until it passes to find the path MTU.TCP, UDP and applications
tracepath -n 10.30.0.10: Traces the path and reports the path MTU at each hop where it drops, without needing root.TCP, UDP and applications
ip route get 10.30.0.10: Shows the route used for a destination, including a cached path MTU (cache expires ... mtu 1476) learned from ICMP.TCP, UDP and applications
sysctl net.ipv4.tcp_congestion_control net.ipv4.tcp_available_congestion_control: Shows the current congestion control algorithm (cubic by default) and the ones that are loaded and available, such as bbr.TCP, UDP and applications
sysctl net.ipv4.tcp_rmem net.ipv4.tcp_wmem: Shows the minimum, default and maximum TCP receive and send buffer sizes used by autotuning. The maximum must cover the bandwidth-delay product.TCP, UDP and applications
Example
Output
sudo sysctl -w net.ipv4.tcp_rmem='4096 131072 33554432'
sysctl net.ipv4.tcp_keepalive_time net.ipv4.tcp_keepalive_intvl net.ipv4.tcp_keepalive_probes: Shows system-wide TCP keepalive defaults (7200 s idle, 75 s interval, 9 probes) for sockets that enable SO_KEEPALIVE.TCP, UDP and applications
sysctl net.ipv4.ip_local_port_range: Shows the ephemeral source port range, 32768 to 60999 by default. Its size caps outgoing connections per destination IP and port.TCP, UDP and applications
sysctl -w net.ipv4.tcp_mtu_probing=1: Enables packetization layer PMTUD, so TCP probes with smaller segments when it detects a black hole instead of relying on ICMP.TCP, UDP and applications
nstat -az TcpRetransSegs TcpExtListenOverflows TcpExtSyncookiesSent: Shows kernel counters for retransmitted segments, accept queue overflows and SYN cookies sent, for spotting loss, slow accept and SYN floods.TCP, UDP and applications
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu: Clamps the MSS in forwarded SYNs to the outgoing route MTU minus 40 on a Linux router. Use --set-mss for a fixed value.TCP, UDP and applications
openssl s_client -connect shop.example.com:443 -servername shop.example.com -showcerts: Opens a TLS connection with SNI and prints every certificate the server sends, the verify result and the negotiated protocol and cipher.TCP, UDP and applications
openssl s_client -connect shop.example.com:443 -servername shop.example.com -alpn h2 -brief: Prints a short summary of the handshake (protocol version, cipher suite, peer certificate, verification) and tests whether the server accepts HTTP/2 via ALPN.TCP, UDP and applications
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName: Shows a certificate's subject, issuer, validity dates and SAN names. The issuer must match the next certificate's subject in the chain.TCP, UDP and applications
curl -v https://shop.example.com/: Shows each step of a request, including address tried, TLS handshake messages, ALPN result, certificate checks, and request and response headers.TCP, UDP and applications
curl -o /dev/null -s -w '%{time_connect} %{time_appconnect} %{time_starttransfer}\n' https://shop.example.com/: Prints cumulative seconds to TCP connect, TLS done and first byte, showing which layer is slow. Add %{time_namelookup} for DNS.TCP, UDP and applications
Example
Output
curl -o /dev/null -s -w 'dns %{time_namelookup} connect %{time_connect} tls %{time_appconnect} ttfb %{time_starttransfer}\n' https://shop.example.com/
curl -sI --http3 https://shop.example.com/: Fetches headers over HTTP/3 (QUIC on UDP 443). Needs a curl built with HTTP/3 support; --http3-only refuses to fall back to TCP.TCP, UDP and applications
iperf3 -c 10.2.20.30 -t 30 -P 4: Measures TCP throughput to an iperf3 server with four parallel streams. Compare with -P 1 to tell a per-flow window limit from a path limit.TCP, UDP and applications
mtr -rwc 100 10.30.0.15: Sends 100 rounds of probes and prints a report of loss and latency per hop. Loss that does not continue to the last hop is ICMP rate limiting, not real loss.Troubleshooting
tcpdump -ni eth0 -w /tmp/cap.pcap host 10.30.0.15 and tcp port 443: Captures one host's HTTPS traffic to a pcap file for Wireshark. -n skips name lookups, and the filter after the options uses BPF syntax.Troubleshooting
ping -M do -s 1472 10.30.0.15: Sends a 1500-byte packet (1472 data, 8 ICMP, 20 IP) with fragmentation prohibited. If it fails while smaller sizes pass, the path MTU is below 1500.Troubleshooting
traceroute -T -p 443 10.30.0.15: Traceroute with TCP SYN probes to port 443, so it passes firewalls that allow the application. Needs root.Troubleshooting
dig +trace app.example.com: Resolves a name by walking the delegation from the root servers down to the authoritative server, showing where a broken delegation stops it.Troubleshooting
ethtool -S eth0: Driver-level NIC statistics such as CRC errors, missed and dropped frames. Counter names vary by driver, so filter with grep for err or drop.Troubleshooting
ss -ti dst 10.30.0.15: Shows TCP connections to a host with internal details such as RTT, congestion window, MSS and retransmission counts. Good for proving loss or a small window.Troubleshooting
wg show: Shows each WireGuard interface and peer with public key, endpoint, allowed IPs, latest handshake and bytes sent and received.VPNs and tunnels
ip xfrm state: Lists the kernel IPsec SAs (the SAD) with addresses, protocol, SPI, mode and algorithms, whichever IKE daemon created them.VPNs and tunnels
swanctl --list-sas: Lists strongSwan IKE SAs and their Child SAs with state, algorithms, selectors and traffic counters.VPNs and tunnels

Ansible5

ansible-playbook site.yml --check --diff --limit ASW1: Dry run against one device. Shows what would change and the before and after, without changing anything.Automation and SDN
ansible-inventory -i inventory.yml --graph: Shows the groups and hosts as Ansible sees them, including dynamic inventory such as NetBox.Automation and SDN
ansible-doc cisco.ios.ios_vlans: Shows a module's options, states, return values and examples offline.Automation and SDN
ansible-vault encrypt_string --stdin-name vault_netops_password: Encrypts one value typed on stdin into a block you can paste into a variables file, keeping it out of shell history.Automation and SDN
ansible-galaxy collection install cisco.ios arista.eos junipernetworks.junos: Installs vendor collections with their network modules, resource modules and platform plugins.Automation and SDN

Any platform2

pathping -n 10.30.0.15: Windows tool that traces the path, then probes every hop for a few minutes and reports loss per hop and per link. -n skips name lookups.Troubleshooting
Test-NetConnection 10.30.0.15 -Port 443: Windows PowerShell test of a TCP port. Shows whether the connection succeeded, which tells you more than ping when ICMP is blocked.Troubleshooting