Which show commands do you run first on a Cisco device, and why?
Show the answer
Say this first
show ip interface brief for interface and protocol state. show logging for what changed and when.
show interfaces on the suspect ports for errors and drops. show version for uptime and the last
reload reason. show ip route <destination> for the path, show ip arp and show mac address-table to
find the host, and show cdp neighbors or show lldp neighbors to confirm what connects where. In a
minute they tell me whether the box restarted, a link is down or erroring, or a route is missing.
Go deeper
| Command | What it answers |
|---|---|
show ip interface brief | which interfaces are up/up, administratively down, or up/down |
show logging | link flaps, neighbor changes, err-disable events, duplicate addresses, with times |
show version | uptime, last reload reason, software version |
show interfaces Gi1/0/48 | errors, drops, load, speed and duplex, when counters were cleared |
show interfaces status | per-port VLAN, speed, duplex, and err-disabled ports on a switch |
show ip route 10.30.0.15 | which route matches and the next hop |
show ip arp 10.10.0.57, show mac address-table address <mac> | where a host lives |
show cdp neighbors, show lldp neighbors | what is plugged into each port |
show processes cpu sorted | whether the device itself is struggling |
Habits that save time
terminal length 0before collecting output, so it does not page.- Timestamps only help if they are right:
service timestamps log datetime msec localtimeand NTP. - Save what you collect before you change anything. It is your baseline and your evidence.
Other platforms
Junos: show interfaces terse, show log messages, show route 10.30.0.15. NX-OS: show interface brief,
show logging logfile. Arista EOS is close to IOS: show ip interface brief, show logging.
They will ask next
Why look at
show versionearly?Uptime and the last reload reason tell you whether the device crashed or was reloaded. A crash moves the investigation to software, power or hardware, and a crashinfo file may be waiting on flash.
Traps
- Reading logs without synced clocks. You cannot line events up across devices.