Give me an example of a fault at each layer and the command that finds it.
Show the answer
Say this first
Layer 1: a dirty fiber or bad cable, seen as CRC errors in show interfaces or low light in
show interfaces transceiver. Layer 2: a port in the wrong VLAN or a trunk not carrying it, seen with
show interfaces status and show interfaces trunk. Layer 3: a missing route or wrong gateway, seen with
show ip route and ping. Layer 4: an ACL or firewall dropping a port, seen with ACL hit counts and
nc -vz. Application: DNS or the service, seen with nslookup, dig and curl -v.
Go deeper
| Layer | Example fault | First command |
|---|---|---|
| 1 Physical | dirty fiber, damaged cable, wrong optic type | show interfaces, show interfaces transceiver detail |
| 2 Data link | wrong access VLAN, VLAN missing on trunk, STP blocking, duplex mismatch | show interfaces status, show interfaces trunk, show spanning-tree vlan 10 |
| 3 Network | missing route, wrong mask or gateway, duplicate IP | show ip route, show ip arp, ping, traceroute |
| 4 Transport | ACL or firewall dropping TCP 443, MSS too large | show access-lists, nc -vz 10.30.0.15 443, a capture |
| 5 to 7 | DNS, expired TLS certificate, app error | nslookup, dig, curl -v, openssl s_client -connect host:443 |
Layers 5 and 6 rarely matter on their own in practice. TLS is the usual one: an expired certificate or a server that does not send its intermediate certificate.
They will ask next
Where does a duplex mismatch show up?
Layers 1 and 2. The half-duplex side counts late collisions; the full-duplex side counts CRC errors and runts. Ping looks fine, but throughput collapses under load.
Traps
- Getting stuck arguing which layer ARP belongs to. Say it maps layer 3 addresses to layer 2 and move on.