Walk me through `show interfaces` output. What do you look at?
Show the answer
Say this first
The first line gives interface and line protocol state. Then speed and duplex, the input and output rates against the bandwidth, and the counters: input errors, CRC, runts, giants, overruns, output drops, collisions, late collisions and interface resets. I check when counters were last cleared, because a big number collected over months means little. What matters is which counters are climbing now.
Go deeper
A port with a problem
SW1# show interfaces GigabitEthernet1/0/24
GigabitEthernet1/0/24 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 7c21.0e4f.2a18 (bia 7c21.0e4f.2a18)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 3/255, rxload 12/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:15:12
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 1432
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 48210000 bits/sec, 5120 packets/sec
5 minute output rate 12730000 bits/sec, 3890 packets/sec
4523110 packets input, 4980112245 bytes, 0 no buffer
Received 1203 broadcasts (884 multicasts)
27 runts, 0 giants, 0 throttles
418 input errors, 391 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 884 multicast, 0 pause input
0 input packets with dribble condition detected
3500211 packets output, 1120340099 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped outIn 15 minutes: 391 CRC errors and 27 runts (together the 418 input errors), so frames arrive damaged. That is a physical problem on the receive side of this port. Separately, 1432 output drops at a low average load suggest bursts toward this port.
Field by field
| Field | Meaning |
|---|---|
up, line protocol is up | layers 1 and 2 working; administratively down means shutdown |
txload, rxload | load out of 255, from the 5-minute average |
Full-duplex, 1000Mb/s | negotiated or set values; half duplex on a modern link is a red flag |
| input errors | the sum of CRC, frame, runts, giants, overruns, ignored and similar |
| CRC | frames that failed the FCS check: cabling, optics, duplex |
| runts, giants | frames below 64 bytes or above the maximum size |
| overrun, ignored, no buffer | good frames the hardware could not take in time |
| Total output drops | the egress queue was full: congestion or bursts |
| collisions, late collision | only on half duplex; late collisions mean duplex mismatch or an over-long cable |
| interface resets | the interface was reset, for example after a flap or a keepalive problem |
How I use it
Note the numbers, wait a few minutes and look again, or clear counters GigabitEthernet1/0/24 and watch.
Rates are 5-minute averages by default; load-interval 30 on the interface makes them react faster.
They will ask next
What does "up, line protocol is down" mean?
The physical layer has a signal but the data link layer is not working. On serial links it is usually an encapsulation mismatch or keepalive failure. On a switch, read the reason in brackets: a SPAN destination, for example, shows
line protocol is down (monitoring).Why set
load-interval 30?The default 5-minute average smooths bursts away. 30 seconds is the shortest interval and reacts faster, but even that hides millisecond microbursts.
Traps
- Quoting a large error count without checking "Last clearing" first.