Troubleshooting
0 of 40 nailed
Cisco IOS17
show ip interface brief- One line per interface with its IP address and status. The fastest way to spot interfaces that are down, admin down, or up with line protocol down.
show interfaces GigabitEthernet1/0/24- Full status and counters for one port, including duplex, load, CRC, runts, giants, overruns, output drops, collisions and when counters were last cleared.
show interfaces counters errors- Catalyst table of error counters per port (FCS, alignment, undersize, collisions, late collisions, giants). Good for finding the one bad port on a switch.
show interfaces transceiver detail- Optic diagnostics per port, with temperature, voltage, Tx and Rx power in dBm and the alarm and warning thresholds. Low Rx power next to CRC errors points at the fiber or optic.
show interfaces status err-disabled- Lists ports shut down by err-disable and the reason, such as bpduguard, psecure-violation, link-flap or udld.
show logging | include LINK|LINEPROTO|DUPADDR- Filters the log buffer for link flaps, line protocol changes and duplicate address warnings. The pipe filter takes a regular expression, so | means or.
clear counters GigabitEthernet1/0/24- Resets the interface counters so you can see which errors are climbing now rather than reading a total built up over months.
ping 10.20.0.10 source Loopback0 size 1500 df-bit repeat 100- Extended ping from a chosen source with DF set. Tests the return route to that source and whether full-size packets pass. M in the output means could not fragment.
Example
Output R1# ping 10.20.0.10 source Loopback0 size 1500 df-bit repeat 100 Type escape sequence to abort. Sending 100, 1500-byte ICMP Echos to 10.20.0.10, timeout is 2 seconds: Packet sent with a source address of 10.255.0.1 Packet sent with the DF bit set MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM MMMMMMMMMMMMMMMMMMMMMMMMMMMMMM Success rate is 0 percent (0/100) traceroute 10.30.0.15 source Loopback0- Traces the forward path hop by hop with UDP probes from the given source. Repeating addresses mean a loop; asterisks at one hop alone are usually ICMP rate limiting.
show ip route 10.30.0.15- Shows the route that matches this destination by longest prefix, how it was learned, its distance and metric, and the next hops.
show ip cef exact-route 10.10.0.25 10.30.0.15- Shows which next hop and interface CEF uses for one source and destination pair. Essential when ECMP sends only some flows over a broken path.
show ip arp 10.20.0.40- Shows the MAC address and interface for an IP in the ARP cache. A MAC that changes between checks points at a duplicate IP.
show mac address-table address 0c4a.21d3.9e10- Shows the VLAN and port where a MAC address was learned. Follow it hop by hop with CDP or LLDP until it lands on an access port.
show processes cpu sorted- CPU use with the busiest processes first. On classic IOS the second figure in the 5-second value is interrupt time, meaning packets switched in software.
show spanning-tree detail | include occurr|from- Shows the number of topology changes per VLAN, how long ago the last one happened, and the port it came from. Follow that port to find a flapping link.
show policy-map interface GigabitEthernet0/0/0- Per-class QoS statistics on an interface, including queue drops and policer exceeded counts. Shows whether drops come from a policy rather than a fault.
monitor capture CAP interface GigabitEthernet0/0/1 both match ipv4 host 10.10.0.25 any- Defines an IOS-XE embedded packet capture on an interface, both directions, for one host. Then start, stop, view and export it to a pcap file.
Example
Output R1# monitor capture CAP start R1# monitor capture CAP stop R1# show monitor capture CAP buffer brief R1# monitor capture CAP export bootflash:cap.pcap
NX-OS1
show interface counters errors- NX-OS per-port error counters (FCS, alignment, undersize, late collisions, giants). Note the singular interface keyword.
Arista EOS1
show interfaces counters errors- Arista per-port table of FCS, alignment, symbol, runt and giant errors, plus receive and transmit error totals.
Junos2
show interfaces ge-0/0/1 extensive- Every counter for a Junos interface, including input errors, framing errors (CRC), drops, MAC statistics and queue counters.
monitor traffic interface ge-0/0/1 no-resolve- Live tcpdump-style decode on a Junos interface. It only sees traffic to or from the Routing Engine, not transit traffic forwarded in hardware.
Linux7
mtr -rwc 100 10.30.0.15- Sends 100 rounds of probes and prints a report of loss and latency per hop. Loss that does not continue to the last hop is ICMP rate limiting, not real loss.
tcpdump -ni eth0 -w /tmp/cap.pcap host 10.30.0.15 and tcp port 443- Captures one host's HTTPS traffic to a pcap file for Wireshark. -n skips name lookups, and the filter after the options uses BPF syntax.
ping -M do -s 1472 10.30.0.15- Sends a 1500-byte packet (1472 data, 8 ICMP, 20 IP) with fragmentation prohibited. If it fails while smaller sizes pass, the path MTU is below 1500.
traceroute -T -p 443 10.30.0.15- Traceroute with TCP SYN probes to port 443, so it passes firewalls that allow the application. Needs root.
dig +trace app.example.com- Resolves a name by walking the delegation from the root servers down to the authoritative server, showing where a broken delegation stops it.
ethtool -S eth0- Driver-level NIC statistics such as CRC errors, missed and dropped frames. Counter names vary by driver, so filter with grep for err or drop.
ss -ti dst 10.30.0.15- Shows TCP connections to a host with internal details such as RTT, congestion window, MSS and retransmission counts. Good for proving loss or a small window.
Any platform2
pathping -n 10.30.0.15- Windows tool that traces the path, then probes every hop for a few minutes and reports loss per hop and per link. -n skips name lookups.
Test-NetConnection 10.30.0.15 -Port 443- Windows PowerShell test of a TCP port. Shows whether the connection succeeded, which tells you more than ping when ICMP is blocked.