Networking
Cisco IOS
Show commands for diagnosis, interface and VLAN configuration, routing protocols, ACLs and the recovery steps for a change that locks you out.
Cheatsheet #
| Task | Command |
|---|---|
| Stop paging | terminal length 0 |
| Running config | show running-config |
| One section of it | show running-config | section interface Gi0/1 |
| Interface summary | show ip interface brief |
| Interface detail and counters | show interfaces Gi0/1 |
| Errors only, quickly | show interfaces | include line protocol|error|drop |
| MAC table | show mac address-table |
| ARP | show ip arp |
| Neighbours | show cdp neighbors detail, show lldp neighbors |
| Routing table | show ip route |
| Best path for a prefix | show ip route 10.0.5.7 |
| VLANs | show vlan brief |
| Trunk status | show interfaces trunk |
| Log | show logging | last 50 |
| Uptime and image | show version |
| Save | copy running-config startup-config |
| Safety net before a change | reload in 5 … reload cancel |
Getting oriented #
enable
terminal length 0
show version
show inventory
show running-config | include hostname|ip route|username
show processes cpu sorted | exclude 0.00
show memory statistics
show logging | last 100show tech-support collects everything for a vendor case and is far too large to read; use targeted show commands with | include, | section and | begin filters instead.
| Filter | Effect |
|---|---|
| include X | Lines containing X |
| exclude X | Lines not containing X |
| section X | The whole configuration block whose header matches |
| begin X | From the first match to the end |
| redirect tftp://... | Send output elsewhere |
Interfaces #
configure terminal
interface GigabitEthernet0/1
description uplink to core-01
no switchport ! make it routed
ip address 10.0.0.2 255.255.255.252
mtu 9000
no shutdown
exitinterface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
spanning-tree portfast
spanning-tree bpduguard enable ! an access port should never see a BPDUinterface GigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 999 ! unused VLAN as nativeshow interfaces status
show interfaces Gi0/1 | include errors|drops|duplex|rate
show interfaces counters errors
clear counters GigabitEthernet0/1| Counter | Meaning |
|---|---|
input errors / CRC | Physical: cable, optic, or duplex mismatch |
late collisions | Duplex mismatch, almost always |
output drops | Egress congestion — the interface is oversubscribed |
input queue drops | Control plane or CPU cannot keep up |
interface resets | Link flapping; check the far end and the optic |
show interfaces trunk tells you which VLANs actually pass, which is usually different from what switchport trunk allowed vlan suggests once VTP pruning and the far-end configuration are involved.
VLANs and spanning tree #
vlan 20
name servers
exit
interface vlan 20
ip address 10.0.20.1 255.255.255.0
no shutdownshow vlan brief
show spanning-tree vlan 20
show spanning-tree root
show spanning-tree inconsistentports
spanning-tree vlan 20 root primary ! deterministic root, not whoever booted firstSet the root bridge explicitly. A network that elected its root by accident re-elects it at the worst time, and the resulting topology change flushes MAC tables network-wide.
Routing #
ip route 10.5.0.0 255.255.0.0 10.0.0.1 name to-dc2
show ip route static
show ip route 10.5.1.20 ! which entry actually winsrouter ospf 1
router-id 10.0.0.2
passive-interface default
no passive-interface GigabitEthernet0/1
network 10.0.0.0 0.0.0.255 area 0
auth-key-chain OSPF-KEYSshow ip ospf neighbor
show ip ospf interface brief
show ip ospf database| Neighbour state | Meaning |
|---|---|
DOWN | No hellos received |
INIT | Hellos received, not yet bidirectional |
2WAY | Neighbours; DR/BDR elected on broadcast links |
EXSTART/EXCHANGE | Database exchange — stuck here usually means an MTU mismatch |
FULL | Adjacency complete |
router bgp 65001
bgp log-neighbor-changes
neighbor 203.0.113.1 remote-as 65002
neighbor 203.0.113.1 password <key>
neighbor 203.0.113.1 maximum-prefix 1000 90 restart 15
address-family ipv4
network 10.0.0.0 mask 255.255.0.0
neighbor 203.0.113.1 activate
neighbor 203.0.113.1 prefix-list TO-PEER outshow ip bgp summary
show ip bgp neighbors 203.0.113.1 advertised-routes
show ip bgp neighbors 203.0.113.1 routes
show ip bgp 10.5.0.0/16
clear ip bgp 203.0.113.1 soft in ! soft: no session resetAlways apply an outbound prefix list to an external peer and set maximum-prefix inbound. Those two lines are what stops a misconfiguration becoming someone else’s outage.
ACLs #
ip access-list extended MGMT-IN
permit tcp 10.0.0.0 0.0.0.255 any eq 22
permit icmp any any echo-reply
deny ip any any log
!
interface GigabitEthernet0/1
ip access-group MGMT-IN inshow access-lists MGMT-IN
show ip access-lists | include matches
show ip interface Gi0/1 | include access listWildcard masks are inverted subnet masks: 0.0.0.255 matches a /24. Every ACL ends with an implicit deny ip any any that does not log — add an explicit one so denies are visible.
An ACL on your management path ends your session
Add the permit rule for your own source first, verify from a second session, then apply the deny. Combine with reload in 5 so a mistake self-repairs.
Recovery and change safety #
reload in 10 ! schedules a reload in 10 minutes
! ...make the change, verify from a new session...
reload cancelcopy running-config startup-config
copy running-config tftp://10.0.0.9/sw-01-$(date).cfg
archive
path tftp://10.0.0.9/archive/$h
write-memory ! archive on every saveshow archive
configure replace nvram:startup-config ! roll the running config back to the saved onePassword recovery requires console access and a reboot into ROMMON — plan for physical or out-of-band access before touching authentication.
Diagnosis #
ping 10.0.5.7 source Vlan20 repeat 100 size 1400 df-bit
traceroute 10.0.5.7 source Vlan20
show ip arp 10.0.5.7
show mac address-table address 0011.2233.4455
show interfaces | include line protocol|CRC|drops
show processes cpu history
debug ip packet detail 100 ! with an ACL limiting it — never bare
undebug all| Symptom | Where to look |
|---|---|
| Intermittent loss on one port | show interfaces counters: CRC, late collisions, resets |
| Works locally, fails across the trunk | show interfaces trunk allowed and active VLANs |
| Devices in the same VLAN cannot see each other | Port security, private VLAN, or a protected port |
| Traffic follows an unexpected path | show ip route <dest>, then routing protocol metrics |
| High CPU | show processes cpu sorted; punted traffic is a common cause |
| Neighbour flapping | Physical layer first, then MTU and authentication |
debug runs at process level and can overwhelm the control plane on a busy device. Always scope it with an ACL, always have undebug all ready, and prefer show counters when they can answer the question.
Oneliners #
! Interfaces that are down/down, ignoring admin-down
show ip interface brief | include down\s+down
! Ports with errors
show interfaces counters errors | exclude " 0 "
! Which port a MAC is on, then what that port is
show mac address-table address 0011.2233.4455
show interfaces Gi0/7 status
! Everything configured on one interface
show running-config interface Gi0/1
! Configuration differences since the last save
show archive config differences nvram:startup-config system:running-config
! Uptime, image and last reload reason
show version | include uptime|System image|Last reload
! Routes learned from one BGP peer
show ip bgp neighbors 203.0.113.1 routes | count
! CPU-heavy processes right now
show processes cpu sorted | exclude 0.00%
! Log entries since a time
show logging | begin Sep 15 09:
! Confirm an ACL is matching what you expect
show ip access-lists MGMT-IN | include matches