41

I frequently use sh int | i (FastEthernet|0 packets input) or the same with GigabitEthernet, whatever kind of interfaces I want to check. sh int (which is show interfaces) gives a huge list of ste status of all interfaces The pipe symbol | can be used for filtering, but also in search expressions | i (for include) filters the output which matches the ...


36

The client switchport or the server switchport can be monitored. A third switchport can be configured as a mirror port. This means that this mirror port will receive copies of all packets on the corresponding original port, while the original traffic won't be affected. For example, on the Catalyst 3560: Enter configuration mode: conf t Define the source ...


28

Ultimately... DOCUMENTATION. You need to know where every patch cable goes to be 100% certain you aren't disconnecting something someone may expect to work at some point. Just because a port is currently "down" doesn't mean someone has not been using it. Also just because the counters are currently zero doesn't mean it's never been used or not going to be ...


27

In order of preference/priority, our company tends to upgrade based on these factors: Vulnerabilities, vulnerabilities, vulnerabilities! Bugs Attaining new features not currently available-- new cards/modules have a "first supported in" IOS version which could be higher than what you have running Migrating away from retired release trains Matching ...


18

Almost everyNote 1 Cisco IOS system running at least IOS 12.2 has built-in tcl shell programmability. You can store tcl scripts in flash and run them. Cisco IOS also has a light native programming environment called EEM (Embedded Event Manager). EEM events can be triggered by a wide variety of inputs, such as packets on a certain port (via Netflow), log ...


17

We can use the alias command in global conf mode: alias <mode> <command-alias> <original-command> <mode> is one of the many IOS command modes. If you need it in different modes, you have to call it for each one - type alias ? to get a long list of modes. An example for checking for a dhcp snooped IP, type in global conf mode ...


17

If your traffic happened to be passing through a router running Cisco IOS 12.4(20)T or greater, another possibility is to use the Embedded Packet Capture feature. This feature is NOT available on switch platforms like the 3560 or 3750. What this feature does is capture and save a small PCAP file on the router that you can download and analyze with ...


16

Try turning file prompt behavior to quiet. 6506(config)#file prompt quiet 6506(config)#end 6506#copy run tftp://192.168.1.1/file.txt .....


16

The reason your router hangs is because you're editing the ACL through the same interface that it's applied to. Usually what happens is you wind up blocking yourself accidentally. Note that I make a suggestion for reorganizing your ACLs at the bottom of this answer, although most people will be interested in this first section (the easiest way to change ...


14

Well, one way to do this would be to exclude the entire pool from assignment. This would leave the configuration of the pool in there and you would just remove the exclusion if you wanted it to assign addresses again. ip dhcp excluded-address <first address> <last address> However, I would just archive a copy of the config and remove the pool.


14

From the Cisco documentation: The major difference in a standard access list is that the Cisco IOS adds an entry by descending order of the IP address, not on a sequence number. You can read more here.


14

No this isn't doing anything. When the port is in trunk mode, then any "switchport access" statements are not used. The same is true with a port in access mode with any "switchport trunk" statements. In this case, you should be able to safely remove it. The purpose for this is usually in the use of DTP (dynamic trunking protocol). So you could configure ...


13

Strictly speaking, yes, the unused features do cost you some performance. However, "measurable" loss is questionable. Most features are initialized even if they aren't used, so that will eat into memory, and any periodic "house keeping" tasks will still get CPU time. The major features (ipv6, telephony service, routing protocols, ids/ips, etc.) have to be ...


13

The command you're looking for is file prompt quiet. If you change this setting in Global Configuration mode, it will suppress the confirmation alerts you're seeing and allow one line, automated file operations. However, it is worth noting that for the most part, the confirmation prompts are there to protect your system and "CYA"... If you feed the wrong ...


13

Cisco IOS is the standard operating system from Cisco. It runs on 800/1800/1900/2800/2900/3800/3900/7600 routers. It also runs on Catalyst 2960/3560/3750/4500/6500. Some newer platforms such as Catalyst 3650 and 3850 run IOS XE which is IOS running as a daemon on a Linux kernel. Then you have NXOS which runs on the Nexus platform. IOS XR runs on the SP ...


13

Is there any reason why Cisco show run does not show the full version which is 16.3.7 in this example? For the simple reason that the only the major and minor versions are necessary for a complete understanding of the configuration. While there may be feature changes and/or enhancements between 16.2 and 16.3, changes in the build/revision should not impact ...


12

I also like sh int | inc line protocol is|Last input which outputs FastEthernet0/29 is down, line protocol is down (notconnect) Last input never, output never, output hang never FastEthernet0/30 is up, line protocol is up (connected) Last input never, output 00:00:07, output hang never FastEthernet0/46 is down, line protocol is down (notconnect) ...


12

Decnet Maintenance Operation Protocol (MOP) is an ancient protocol that was used to administrate remote systems, and provided tools such as remote console or network bootstrap. However, as of now this is still enabled by default on all Cisco IOS Releases from 9.0 to recent 15.x. To disable MOP on the router it has to be done on a per-interface basis: ...


12

ssh version 2 for IOS 12.1(19)E and later SSH from one switch to another... for reasons I can't explain, Cisco calls SSHv2 SSH-1.99... SRV1#debug ip ssh client SSH Client debugging is on SRV1#ssh 10.19.1.2 Password: Jun 4 13:45:28.747 CDT: SSH1: sent protocol version id SSH-1.99-Cisco-1.25 <----- Jun 4 13:45:28.787 CDT: SSH CLIENT0: protocol ...


12

Cisco's IOS uses the different EXEC modes as a basic way to control user privileges. These user privilege controls can be delegated through an enable password, the local user database or AAA (RADIUS, TACACS+). The two EXEC modes are user mode and privileged mode. user EXEC mode> is limited to an array of show commands, basic reachability tests, such as ...


12

Let's calculate what we're dealing with here. CAR is basically the older version of IOS policing, so all these concepts apply to both. Committed Information Rate (CIR) = 5,000,000 (5Mbps) Burst Commit Bucket (Bc) = 937,500 Burst Excess Bucket (Be) = 1,875,000 Time Interval (Tc) = Bc / CIR = 0.1875 s = 187.5 ms The rate we want to restrict flows to is ...


12

If you actually configured line vty 04 Then you have something like: line vty 0 3 transport input telnet ssh line vty 4 transport input ssh This is because you configured only the fifth VTY line (04=4). The correct command is: line vty 0 4 or rather: line vty 0 15 since most (all?) modern Cisco switches have 16 vty lines and not 5. You ...


12

You don't have NAT enabled (you don't have ip nat outside on Vl 20). Without NAT, the ISP doesn't know how to route back to your 192.9.200.0 network. If you NAT to the VLan 20 address, the ISP will be able to route back to you.


11

I would scrape the output (or grab it with SNMP, even better) and use standard UNIX tools to parse it. Here's an easy example: Here, I saved a partial output from 'show int counters' (just for demo purposes) to a file called "counters". [mkantows@ochofu049]$ cat counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Gi1/0/1 ...


11

I like @Stefan's answer but with this command line "sh int | i (Ethernet| 0 packets input)" which now grabs all Ethernet interface types and filters out non-zero numbers that happen to end in zero. He mentioned that some fine tuning might be possible so this is just one example. Another option is... sh int counters | i (Port|_0 0 ...


11

permit tcp any any eq <protocol-port> Allows any traffic with a destination TCP port == protocol-port permit tcp any eq <protocol-port> any Allows any traffic with a source TCP port == protocol-port Example ACLs tend to use fixed ports for the server-side of a client-server connection. Typically, the client connects to a well-known port on ...


11

... The load balancing works when I replace the MPLS by ATM switches. This doesn't sound like a parallel comparison, because routers don't care whether you're forwarding through an ATM PVC or an MPLS LSP, they will load-balance in the same way, assuming the routers have the same configuration. Perhaps you've done something unusual with your ATM VCs, but ...


11

sw-R2-3#show ver | i Software Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3, RELEASE SOFTWARE (fc1) sw-R2-3#conf t Enter configuration commands, one per line. End with CNTL/Z. sw-R2-3(config)#tacacs? tacacs tacacs-server sw-R2-3(config)#tacacs ? server Server configuration sw-R2-3(config)#tacacs server ? WORD Name ...


11

tl;dr The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session. Long explanation: The default gateway on a switch has the same function as ...


10

Your question's pretty broad. There's a lot of different commands you can use to troubleshoot and monitor QoS, so I'll focus on the primary question you have, which is how to reasonably verify your QoS configuration is working and how to read the policy-map interface output. The only true way to verify that QoS is working is to hook up a traffic generator ...


Only top voted, non community-wiki answers of a minimum length are eligible