Troubleshooting with the show Commands


Troubleshooting with the show Commands

The show commands are used to troubleshoot the Physical layer of the network. The following sections discuss each of the commonly used show commands in more detail. These sections also display and explain the show command's output.

graphics/alert_icon.gif

For the exam it is important that you understand the Physical layer troubleshooting commands and when to use those commands. You also need to know how to interpret each command output.


The show interfaces Command

One of the most common show commands that you will use is show interfaces , which enables you to see what is happening on all the interfaces on the router. It gives you a quick glance at an interface; the show interfaces command indicates whether the network is up or down, provides a bit of information on network configuration, and provides a look at the packets on the network. The following is example output from show interfaces :

 DCSRootRTR#  show interfaces  Async1 is down, line protocol is down   Hardware is Async Serial   MTU 1500 bytes, BW 9 Kbit, DLY 100000 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation SLIP, loopback not set Ethernet2/1 is up, line protocol is up   Hardware is cxBus Ethernet, address is 1203.ef12.1d41 (bia 1203.ef12.1d41)   Description: Subnet 211 for Pismo Beach Site   Internet address is 192.16.32.254/24   MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,      reliability 255/255, txload 4/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:00, output 00:00:05, output hang never   Last clearing of "show interface" counters never   Queueing strategy: fifo   Output queue 0/40, 22591 drops; input queue 0/75, 929 drops   5 minute input rate 44000 bits/sec, 25 packets/sec   5 minute output rate 174000 bits/sec, 23 packets/sec      293110943 packets input, 4194038437 bytes, 0 no buffer      Received 42837453 broadcasts, 0 runts, 0 giants, 71 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 25 ignored      0 input packets with dribble condition detected      264542130 packets output, 1810892381 bytes, 0 underruns      0 output errors,  31586499 collisions,  2 interface resets      0 babbles, 0 late collision, 0 deferred      0 lost carrier, 0 no carrier      0 output buffer failures, 0 output buffers swapped out Ethernet2/2 is administratively down, line protocol is down   Hardware is cxBus Ethernet, address is 1203.ef12.1d42 (bia 1203.ef12.1d42)   Description: Subnet 212 Monterey Site   Internet address is 198.132.212.254/24   MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   ARP type: ARPA, ARP Timeout 04:00:00   Last input never, output never, output hang never   Last clearing of "show interface" counters never   Queueing strategy: fifo   Output queue 0/40, 0 drops; input queue 0/75, 0 drops   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec DCSRootRTR# 

The output above shows a serial interface on a Cisco 3725 router. By looking at the second line, you get a picture of an unhealthy interface. The interface will not connect and the Layer 3 protocols running on the interface are not receiving keepalives . Keepalive packets are sent by Layer 3 protocols at specific intervals and whenever there is a topology change in the network to verify that the interface is still active and functioning correctly. You know this because both the line and protocol identifiers are showing they are down. If you look at the line in bold you will also note that there was a very large number of collisions, which could signal either a hardware problem or a problem with the link itself.

graphics/tip_icon.gif

It's a lot easier to find current problems in the output of the show interfaces command if you erase the legacy statistics. You can reset all the counters on the show interfaces command output to zeros by using the clear counters command on the interface. This will also update the field that displays when the counters were last cleared.


The show interfaces ethernet Command

Unfortunately, you can't just type in the show interfaces ethernet command and see all the Ethernet interfaces on the router. You have to identify the interface you want to view after the command. This command allows you to examine the status of an Ethernet and get in-depth information on that interface's problems (if there are any). The following example shows the first Ethernet interface on the router indicated by the zero at the end of the show interfaces ethernet command:

 DCSRoot#  show interfaces ethernet 0  Ethernet0 is up, line protocol is up   Hardware is PQUICC Ethernet,address is 0007.eb32.d6a3 (bia 0007.eb32.d6a3)   Internet address is 207.212.78.110/29   MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Half-duplex, 10BaseT   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:00, output 00:00:00, output hang never   Last clearing of "show interface" counters never   Queueing strategy: fifo   Output queue 0/40, 0 drops; input queue 0/75, 329 drops   5 minute input rate 44000 bits/sec, 7 packets/sec   5 minute output rate 4000 bits/sec, 7 packets/sec      8812047 packets input, 539578735 bytes, 0 no buffer      Received 15611 broadcasts, 0 runts, 0 giants, 0 throttles      475 input errors, 0 CRC, 1 frame, 0 overrun, 474 ignored      0 input packets with dribble condition detected      7040396 packets output, 1116153898 bytes, 0 underruns      55169 output errors, 71884 collisions, 8 interface resets      0 babbles, 0 late collision, 0 deferred      474 lost carrier, 0 no carrier 

Let's go line by line and break down the preceding output to see what each line is telling us:

  • Ethernet 0 is {up down administratively down} ” This line indicates whether the physical port that connects to the network is active or whether it has been taken down by an administrator. The "Up" descriptor indicates the link is connected and is live, the "down" descriptor indicates that the link is not connected to another functioning device or there is a problem with the interface or cabling, and the "Disabled" descriptor indicates that the router has received more than 5,000 errors in a keepalive interval, which is 10 seconds by default. The "administratively down" descriptor means that the shutdown command was used on the interface.

  • Line protocol is {up down} ” This indicates whether keepalives are successful and that the software controller for the interface believes the interface is usable.

  • Hardware type ” Indicates the cable types used on the interface.

  • Internet address ” The IP address which is followed by the subnet mask.

  • MTU (Maximum Transmission Unit) ” This is the maximum size (in bytes) of data that can be sent out through this interface.

  • BW (Bandwidth) ” Shows the bandwidth of the interface which is displayed in kilobits per second. Bandwidth is the rated throughput capacity of a given network protocol or medium.

  • DLY (Delay) ” This displays the delay of the interface, shown in microseconds.

  • Rely (Reliability) ” This is the reliability of the interface, shown as a fraction of 255. A 255 out of 255 indicates 100% reliability. This number is shown as an average of packets sent during the last 5 minutes prior to the output on the screen.

  • Load ” This is the average load on the interface during the 5 minutes prior to the output being displayed. This average is shown as a fraction of 255. A 255 out of 255 (255/255) result indicates that the interface is completely saturated .

  • Encapsulation ” This is the type of encapsulation that is being used on the interface.

  • Loopback ” This indicates whether a loopback is being used on the interface. A loopback is usually used for testing the interface.

  • Keepalive ” This indicates whether keepalives are set or not.

  • ARP type ” This is the type of Address Resolution Protocol which is assigned to the interface.

  • Half-duplex ” Indicates that the interface is using half-duplex. The differences between half-duplex and full duplex are discussed in Chapter 3, "LAN Technologies."

  • 10BaseT ” Indicates that the interface is using 10Mbps Ethernet.

  • Last input ” Indicates in hours, minutes, and seconds the time when the last packet was received successfully. If the time indicated is more that 24 hours, the value is displayed in days and hours.

  • Output ” Indicates in hours, minutes, and seconds when the last packet was transmitted successfully. If the time indicated is more that 24 hours, the value is displayed in days and hours.

  • Output hang ” Indicates in hours, minutes, and seconds since the interface was last reset or timed out. If the time indicated is more that 24 hours, the value is displayed in days and hours.

  • Last Clearing Time of "show interface" counters ” Shows when the interface counters were last cleared using the clear counters command.

  • Output queue ” The first number indicates the current output queue size; the second number following the slash is the maximum output queue size.

  • Input queue ” The first number indicates the current input queue size; the second number following the slash is the maximum input queue size.

  • Drops ” The number of packets dropped from the queue because packets arrived faster than they could be processed or buffered.

    graphics/note_icon.gif

    A buffer is a storage area used to receive/store data waiting to be processed. Buffers are mainly used by devices that receive and store data from faster processing devices; buffers allow the device to process the data as fast as the processing speeds allow.


  • 5 minute input rate ” This displays the average number of bits received by the interface during the five minutes prior to the output being displayed.

  • 5 minute output rate ” This displays the average number of bits transmitted by the interface during the five minutes prior to the output being displayed.

  • Packets input ” This is the total number of packets received by the interface which were checked and determined to have no errors. The following value displays the total bytes which those error-free packets totaled.

  • No buffers ” This is the total number of received packets which were lost because there was no buffer space available in the main system. A large number in this field might be the indicator of a broadcast storm in the network.

  • Received broadcasts ” The total number of broadcast or multicast packets received by the interface.

  • Received runts ” The total of packets received that are smaller than the physical medium's minimum packet size. Ethernet's minimum packet size is 64 bytes.

  • Received giants ” Total number of packets that were received and discarded because they exceed the physical medium's maximum packet size. Ethernet's maximum packet size is 1518 bytes.

    graphics/note_icon.gif

    One exception applies to the Received Giants rule: When you use IEEE 802.1q Trunking, giant frames that are more than 1518 bytes are calculated as giants but they are not discarded.


  • Received throttles ” This is the total number of times the interface fails to buffer an incoming packet. This counter is also the same as the "misses" counter output obtained by using the show buffers command.

  • Received input Errors ” The total number of received error packets including runts, giants, no buffer, bad CRC, bad frames, overruns, and ignored counts.

    graphics/note_icon.gif

    CRC, or Cyclic Redundancy Checksum , is a method that is used to check for errors in packets that have been transferred across a network. A computation bit is added to the packet and recalculated at the destination to determine whether the entire packet contents have been transferred correctly.


  • Received CRC ” This totals the number of frames received where the cyclic redundancy checksum (CRC) does not match the checksum calculated from the data received. The CRC is a mathematical value of the packet calculated by the sending device. The receiving device makes its own calculation once the frame or packet is received. If it matches the receiving device, it knows that it received the packet or frame without failure.

  • Received frame ” You receive this error usually as a result of a collision on the physical medium (a collision is the result of two frames transmitted simultaneously ; when these two frames collide in an Ethernet network, both frames are destroyed ). This number increases by one when you receive a frame with a bad CRC or indifference in the size of each data field in the frame.

  • Received overrun ” This is the total number of times the received packet or frame rate exceeded the rate at which the interface could successfully send the data to the buffer.

  • Received ignored ” This is the total number of times the system's internal buffers ran low on storage space because of high volume in processes or receive rates. The internal buffers should not be confused with the system buffers. Increases in number here can be another indicator of a broadcast storm or bursts in the network.

  • Received input packets with dribble condition detected ” Dribble bit error indicates that a frame is slightly too long but the router accepted the frame.

  • Packets output ” This is the total number of packets or frames sent by the router's interface.

  • Bytes ” This is the total bytes sent out the interface on the router.

  • Underruns ” This is the total number of times the transmitter has run faster than the router itself. This is usually never reported by the interface.

  • Output errors ” This is the total of all detected errors that prevented a successful transmission.

  • Collisions ” This is the number of times the interface retransmitted a frame because of a collision of data on the physical wire.

  • Interface resets ” This is the total number of times the interface has reset since the router was started or the clear counters command was issued.

  • Babbles ” This is the number of times that the transmitter has used the interface for longer than the time needed to transmit the largest frame being sent.

  • Late collision ” This is the total number of late collisions that were detected on the physical wire. This means that while the router was sending data out of the interface, another device stated sending data.

  • Deferred ” The number of frames or packets that had to be held before transmission because of data being sent on the physical wires.

  • Lost carrier ” This is the total number of times the router lost contact with the destination device during a transmittal process.

  • No carrier ” This is the total number of times the router was unable to detect a device at the other end of the physical interface.

Good Documentation

One small, but very critical piece of troubleshooting is documentation. If your network is documented, troubleshooting is much easier. Documentation includes labeling devices, using descriptions on the router interfaces, and having a router topology with the networks defined. By having good documentation, you know all the components and devices that exist in the network, as well as what devices might be causing a problem in the network. You also can determine addressing problems much easier, and you can much more easily determine the tools necessary to resolve a problem.

It is a very tedious job, but putting labels on fiber and ports will ease the pain in finding where the cabling is connected when a problem arises. If you are in a large campus environment, the network operations center (NOC) may have 30 to 40 pieces of fiber strung across the racks. When you need to find a particular fiber belonging to a network you believe to be down, you will be thankful that you put labels on the port of the device and on the fiber.

Placing a description of the network on the router interfaces will ensure less time being spent scrolling for the correct interface. If an interface only shows an IP address, you will have to correlate it with the correct network and, sometimes, that can be stressful and time-consuming . Taking the time to provide a description will alleviate a lot of headaches in the end, especially when you are in a panic.

The show interfaces tokenring Command

The show interfaces tokenring command is used to show the status of a Token Ring interface. Just like in the show interfaces ethernet command, this command must be followed by the interface number as shown below:

 DCSRouter2#  show interface tokenring 0  TokenRing0 is up, line protocol is down   Hardware is TMS380, address is 0002.cda1.26ac (bia    0002.cda1.26ac)   Internet address is 172.16.21.254, subnet mask is    255.255.255.0   MTU 4464 bytes, BW 4000 Kbit, DLY 630 usec, rely 255/255, load 1/255   Encapsulation SNAP, loopback not set, keepalive set (10 sec)   ARP type: SNAP, ARP Timeout 04:00:00   Ring speed: 4 Mbps   Single ring node, Source Route Transparent Bridge capable   Ethernet Transit OUI: 0x000000   Last input never, output never, output hang never   Last clearing of "show interface" counters never   Queueing strategy: fifo   Output queue 0/40, 0 drops; input queue 0/75, 0 drops   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec      0 packets input, 0 bytes, 0 no buffer      Received 0 broadcasts, 0 runts, 0 giants      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort      0 packets output, 0 bytes, 0 underruns      0 output errors, 0 collisions, 0 interface resets      0 output buffer failures, 0 output buffers swapped out      1 transition 

The preceding output is very similar to the Ethernet output and has many of the same fields. Let's take a look at only the fields that are different from the show interfaces ethernet command:

  • Token Ring is {up down disabled reset initializing administratively down} ” When "up" is displayed it indicates there is a connection to the ring, the "down" indicates that there is a problem with the connection to the ring, and "disabled" indicates the router has received more than 5,000 detected errors during the router's keepalive interval. The keepalive interval is 10 seconds by default. If "reset" is displayed, a hardware error has occurred; if "initializing" appears, the connection is in the process of attaching to the ring; and if the interface states "administratively down" it has been taken down using the shutdown command.

  • Ring Speed ” The ring speed should list 4 or 16 Mbps.

  • Single ringmultiring node ” Indicates whether a single ring is being used or more than one. It is also an indicator that the interface can use Source Route Bridging (SRB).

graphics/note_icon.gif

Token Ring places data on the ring in one direction and only one station can transmit at each time. If collisions are registered on the interface, it is an indication that there is a major hardware problem.


The show controllers Command

The show controllers command output shows information on all of the router's controllers. You can specify the type of controller when using this command, as shown below:

 DCSSacramento#  show controllers ?  Ethernet      IEEE 802.3   FastEthernet  FastEthernet IEEE 802.3                Output modifiers   <cr> 

Although the preceding output only lists Ethernet and FastEthernet interfaces, routers with other types of interfaces, such as serial, BRI, CBus, FDDI, Lex, MCI, PCBus, serial, T1, T3, Token, or VGAnylan controllers, can also be specified.

This is the command you want to use if you want to view the versions of firmware being used, types of memory management, or another view of the errors detected on interfaces on the router. Much of the information displayed here is unusable, but in between is information that can be used to troubleshoot Physical layer interface problems. Let's take a look at the output from the Ethernet 0 interface on a Cisco 1720 router shown below:

 RTR#  show controllers ethernet0  PQUICC Ethernet unit 0 using SCC1, Microcode ver 0 Current station address 0007.eb32.d6a3, default address 8167.0210.8107 idb at 0x81310358, driver data structure at 0x81312140 SCC Registers: General [GSMR]=0x0:0x1088003C, Protocol-specific [PSMR]=0x80A Events [SCCE]=0x0000, Mask [SCCM]=0x001F, Status [SCCS]=0x0002 Transmit on Demand [TODR]=0x0, Data Sync [DSR]=0xD555 Interrupt Registers: Config [CICR]=0x00365F80, Pending [CIPR]=0x0400C000 Mask   [CIMR]=0x40200000, In-srv  [CISR]=0x00000000 Command register [CR]=0x600 Port A [PADIR]=0x0000, [PAPAR]=0x0903        [PAODR]=0x0000, [PADAT]=0xF7FF Port B [PBDIR]=0x0000100F, [PBPAR]=0x0000100E        [PBODR]=0x00000000, [PBDAT]=0x0003EDFC Port C [PCDIR]=0x0000, [PCPAR]=0x0000        [PCSO]=0x0030,  [PCDAT]=0x0FCC, [PCINT]=0x0000 IPM_SYS_REGS->tecr is0x11 SCC GENERAL PARAMETER RAM (at 0xFF003C00) Rx BD Base [RBASE]=0x2230, Fn Code [RFCR]=0x18 Tx BD Base [TBASE]=0x22B0, Fn Code [TFCR]=0x18 Max Rx Buff Len [MRBLR]=1520 Rx State [RSTATE]=0x18000000, BD Ptr [RBPTR]=0x2258 Tx State [TSTATE]=0x18000AE3, BD Ptr [TBPTR]=0x22C0 SCC ETHERNET PARAMETER RAM (at 0xFF003C30) CRC Preset [C_PRES]=0xFFFFFFFF, Mask [C_MASK]=0xDEBB20E3 Errors: CRC [CRCEC]=0, Alignment [ALEC]=1, Discards [DISFC]=0 PAD Char [PADS]=0x0 Retry Limit [RET_LIM]=15, Count [RET_CNT]=15 Frame Lengths: [MAXFLR]=1518, [MINFLR]=64 Max DMA Lengths: [MAXD1]=1518, [MAXD2]=1518 Group Address Filter [GADDRn]=0000:0000:0020:0100 Indiv Address Filter [IADDRn]=0000:0000:0000:0000 Physical Address [PADDR1]=A3D6.32EB.0700 Last Address Set in Filter [TADDR]=CCCC.CC0C.0001 Persistence [P_Per]=0, Backoff Cnt [BOFF_CNT]=65535 BD Pointers: First Rx [RFBD]=0x0, First Tx [TFBD]=0x22C0, Last Tx [TLBD]=0x22B8 Receive Ring         rmd(FF002230): status 9000 length 4D4 address 1CA0CA4         rmd(FF002238): status 9000 length 262 address 1CA26A4         rmd(FF002240): status 9000 length 3B6 address 1C9C524         rmd(FF002248): status 9000 length 5EE address 1CA3A24         rmd(FF002250): status 9000 length 5EE address 1C9DF24         rmd(FF002258): status 9000 length 4EC address 1C9FFA4         rmd(FF002260): status 9000 length 8A address 1C9AB24         rmd(FF002268): status 9000 length 5EE address 1C9FFA4         rmd(FF002270): status 9000 length 5EE address 1C9E5A4         rmd(FF002278): status 9000 length 5EE address 1C97724         rmd(FF002280): status 9000 length 5EE address 1CA40A4         rmd(FF002288): status 9000 length 1F3 address 1CA2024         rmd(FF002290): status 9000 length 5EE address 1C9A4A4         rmd(FF002298): status 9000 length 5EE address 1CA2D24         rmd(FF0022A0): status 9000 length 48A address 1C9F924         rmd(FF0022A8): status B000 length 5EE address 1C99E24 Transmit Ring         tmd(FF0022B0): status 5C00 length 3C address 1B343CA         tmd(FF0022B8): status 5C00 length 3C address 1B343CA         tmd(FF0022C0): status 5C00 length 3C address 1B343CA         tmd(FF0022C8): status 5C00 length 3C address 1B343CA         tmd(FF0022D0): status 5C00 length 159 address 1B35DCA         tmd(FF0022D8): status 5E00 length 3C address 1B343CA         tmd(FF0022E0): status 5C00 length 3C address 1B343CA         tmd(FF0022E8): status 5C00 length 3C address 1B343CA         tmd(FF0022F0): status 5C00 length 3C address 1B343CA         tmd(FF0022F8): status 5C00 length 3C address 1B343CA         tmd(FF002300): status 5C00 length 15D address 1B35DCA         tmd(FF002308): status 5C00 length 15C address 1B35DCA         tmd(FF002310): status 5E00 length 3C address 1B343CA         tmd(FF002318): status 5C00 length 151 address 1B3748A         tmd(FF002320): status 5C00 length 3C address 1CD9C8A         tmd(FF002328): status 7C00 length 3C address 1CD9C8A  483 missed datagrams, 0 overruns   0 transmitter underruns, 0 excessive collisions   44446 single collisions, 35471 multiple collisions   0 dma memory errors, 0 CRC errors   1 alignment errors, 0 runts, 0 giants   QUICC SCC specific errors:   483 buffer errors, 0 overflow errors   0 input aborts on late collisions   0 throttles, 0 enables  

Most of the output above is only useful to the Cisco TAC that can decifer it. However, the bolded lines at the end show a tremendous amount of useful information about the errors received on the interface. The same information, however, can be learned by other troubleshooting commands, such as the show interfaces command.

The show ip traffic Command

The show ip traffic command is used to display traffic statistics showing the numbers of IP packets that were sent and received for each IP protocol. It also shows the numbers of errors detected, numbers of multicasts, and the number of broadcasts sent and received by the interface. This command is useful because it reveals protocol problems on the interface that are not shown by the show ip interfaces command. An example of the command is shown below:

 DCSRTR#show ip traffic IP statistics:   Rcvd:  169054310 total, 1038115 local destination          0 format errors, 0 checksum errors, 21202 bad hop count          559 unknown protocol, 1 not a gateway          0 security failures, 0 bad options, 789 with options   Opts:  0 end, 0 nop, 0 basic security, 0 loose source route          230 timestamp, 0 extended security, 0 record route          0 stream ID, 0 strict source route, 559 alert, 0 cipso, 0 ump          0 other   Frags: 5 reassembled, 13 timeouts, 0 couldn't reassemble          1336 fragmented, 0 couldn't fragment   Bcast: 953104 received, 305351 sent   Mcast: 1147 received, 0 sent   Sent:  581960 generated, 167783917 forwarded   Drop:  185754 encapsulation failed, 0 unresolved, 0 no adjacency          20594 no route, 0 unicast RPF, 0 forced drop ICMP statistics:   Rcvd: 0 format errors, 1 checksum errors, 14 redirects, 19615 unreachable         1036 echo, 40 echo reply, 0 mask requests, 0 mask replies, 2 quench         0 parameter, 0 timestamp, 0 info request, 0 other         0 irdp solicitations, 5882 irdp advertisements   Sent: 162077 redirects, 36604 unreachable, 850 echo, 1036 echo reply         0 mask requests, 0 mask replies, 0 quench, 0 timestamp         0 info reply, 21214 time exceeded, 0 parameter problem         0 irdp solicitations, 0 irdp advertisements TCP statistics:   Rcvd: 37767 total, 2 checksum errors, 7018 no port   Sent: 25963 total UDP statistics:   Rcvd: 973075 total, 0 checksum errors, 972367 no port   Sent: 335235 total, 0 forwarded broadcasts BGP statistics:   Rcvd: 0 total, 0 opens, 0 notifications, 0 updates         0 keepalives, 0 route-refresh, 0 unrecognized   Sent: 0 total, 0 opens, 0 notifications, 0 updates         0 keepalives, 0 route-refresh OSPF statistics:   Rcvd: 0 total, 0 checksum errors         0 hello, 0 database desc, 0 link state req         0 link state updates, 0 link state acks   Sent: 0 total IP-EIGRP statistics:   Rcvd: 0 total   Sent: 0 total PIMv2 statistics: Sent/Received   Total: 0/0, 0 checksum errors, 0 format errors   Registers: 0/0, Register Stops: 0/0,  Hellos: 0/0   Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0   Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0   State-Refresh: 0/0 IGMP statistics: Sent/Received   Total: 0/0, Format errors: 0/0, Checksum errors: 0/0   Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0   DVMRP: 0/0, PIM: 0/0 ARP statistics:   Rcvd: 1177966 requests, 1050 replies, 110 reverse, 0 other   Sent: 181941 requests, 96748 replies (441 proxy), 0 reverse DCSRTR# 

The above output is helpful because it separates the network statistics, including errors by protocol. This enables you to rule out certain protocols as being problems during troubleshooting.

graphics/note_icon.gif

Statistics for AppleTalk and Novell can be displayed by using the show appletalk traffic or show novell traffic commands.


show arp

Another show command that may be useful is the show arp command, which is very helpful when you're trying to locate a particular device on your network. The ARP cache records all the devices that have traversed the router. The ARP cache lasts only for a short time after the device is no longer on the network, so this command is time-sensitive. By using this command, you can find the MAC address and associate it to an IP address on the network, enabling you to see how long the device was on the network. The show arp command also identifies which interface the devices are using. The following is example output from show arp :

 DCSRootRTR#  show arp  Protocol  Address          Age (min)  Hardware Addr   Type   Interface Internet  192.16.33.254             0083.12eb.1dd5  ARPA   Ethernet2/1 Internet  192.16.34.224         3   00a0.b8be.9512  ARPA   Ethernet2/4 Internet  192.16.35.65         63   0080.5abc.55b4  ARPA   Ethernet2/5 

The above output shows the ARP table from the router, which shows the MAC address to IP resolutions the router has made, as well as the interface to reach each host.



CCNP CIT Exam Cram 2 (642-831)
CCNP CIT Exam Cram 2 (Exam Cram 642-831)
ISBN: 0789730219
EAN: 2147483647
Year: 2003
Pages: 213
Authors: Sean Odom

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net