CCNA Troubleshooting Commands: The Show Commands That Find the Fault
Knowing fifty show commands does not help if you reach for the wrong one. This cheat sheet is organised the way a fault arrives - as a symptom - with the command that answers it, real output from a working and a broken network, and the one field to read first.
The short list: show ip interface brief for interface state, show vlan brief and show interfaces trunk for Layer 2, show etherchannel summary and show spanning-tree for uplinks, show ip route for reachability, show ip ospf neighbor for OSPF, show ip nat translations for NAT, and show port-security interface for err-disabled ports - plus ping and traceroute from both ends.
Use these commands on a live network
The free CCNA code opens a five-device network with one hidden fault. Every command on this page works in its console, and the network grades your fix.
CCNA-EXAM-FULL
Open the free scenario
Already have an account? Log in and open it
In This Guide
Symptom to command: the quick reference
| Symptom | Run this first | What to look for |
|---|---|---|
| A host cannot reach its gateway | ipconfig / ping on the host, show ip interface brief on the router | Wrong IP, mask or gateway on the host; the router interface down |
| An interface is down | show ip interface brief, show interfaces | administratively down = shut down in config; down/down = physical; errors, CRC, duplex |
| A switch port stopped forwarding | show interfaces status, show port-security interface | err-disabled, Secure-shutdown, a rising violation count |
| Two hosts in one subnet cannot talk | show vlan brief, show mac address-table | A port in the wrong access VLAN |
| A VLAN works on one switch, not across | show interfaces trunk | The VLAN missing from "allowed", a native VLAN mismatch, a port not trunking |
| The uplink runs at half capacity | show etherchannel summary, show spanning-tree | Members flagged (s), (I) or (D); a redundant link blocking |
| A remote network is unreachable | show ip route, traceroute / tracert | No route, the wrong next hop, timeouts after a given hop |
| The request arrives, the reply does not | show ip route on the far router | No route back to the source network |
| An OSPF neighbour is missing | show ip ospf neighbor, show ip ospf interface brief, show ip protocols | State not FULL; area, hello/dead timers, passive interface, network statement |
| IPv6 is down while IPv4 works | show ipv6 interface brief, show ipv6 route | A missing address or prefix; no IPv6 route |
| Inside users cannot reach the internet | show ip nat translations, show ip nat statistics, show access-lists | No translations; inside/outside roles; an ACL blocking |
| Clients get no DHCP address | show ip dhcp snooping, show ip dhcp binding | The server-facing port untrusted; no helper address on the gateway |
| The backup gateway is carrying traffic | show standby brief | The wrong router Active; a group stuck in Init |
A troubleshooting routine that works
- Reproduce it from the user's side.
ipconfig, thenpingthe gateway and the destination from the host that is failing. - Walk the path.
tracerttells you the last hop that answered; start there. - Check each device bottom-up. Interfaces first, then VLANs and trunks, then routing, then services (NAT, DHCP, ACLs).
- Check both directions. A missing route back looks exactly like a missing route forward.
- Change one thing, then test again. A second change before retesting hides which one worked.
- Leave everything else as you found it. Fixing a fault by breaking policy (removing an ACL, opening a VLAN) is a new fault.
Interfaces and err-disabled ports
show ip interface brief is the first command on almost every device. Read the Status and Protocol columns together:
R1#show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 10.10.10.1 YES NVRAM administratively down down
GigabitEthernet0/1 10.0.0.1 YES NVRAM up up
administratively down / down means the interface is shut down in the configuration. no shutdown fixes it. down / down without the word administratively points at the physical layer; up / down at encapsulation or keepalives.
On switches, a port can stop forwarding while its configuration looks fine. show interfaces status shows the state per port:
SW1#show interfaces status
Port Name Status Vlan Duplex Speed Type
Gi0/1 connected 60 a-full a-1000 10/100/1000BaseTX
Gi0/2 err-disabled 60 auto auto 10/100/1000BaseTX
Gi0/3 connected 60 a-full a-1000 10/100/1000BaseTX
SW1#show port-security interface GigabitEthernet0/2
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0200.0d05.0001:60
Security Violation Count : 4
A maximum of one secure address, four violations: more devices sit behind this port than the policy allows. Raise the maximum (or remove the device), then shutdown and no shutdown to recover the port.
VLANs and trunks
When two hosts in the same subnet cannot talk, check that both ports sit in the same access VLAN:
SW2#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
30 STAFF active
99 GUEST active Gi0/1, Gi0/2
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
Here the server's port (Gi0/1) sits in GUEST (VLAN 99) instead of STAFF (VLAN 30). switchport access vlan 30 on the port moves it back.
When a VLAN works on one switch but not across the link, the trunk is the suspect:
SW1#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/24 30
Port Vlans allowed and active in management domain
Gi0/24 30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/24 30
Read the Vlans allowed on trunk block. A VLAN missing from it cannot cross; switchport trunk allowed vlan add 30 adds one without replacing the list.
EtherChannel and spanning tree
DIST#show etherchannel summary
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
R - Layer3 S - Layer2
U - in use u - unsuitable for bundling
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) LACP Gi0/1(s) Gi0/2(P)
(s) is suspended: the member did not join the bundle. Compare the channel-group mode on both ends - on never negotiates with active or passive.
With the bundle down, spanning tree treats the loose member and the port-channel as two paths and blocks one, which is why the uplink runs at half capacity rather than failing outright:
ACCESS#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 4106
Address 0200.0d01.0001
Cost 4
Port 1 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32778 (priority 32768 sys-id-ext 10)
Address 0200.0d02.0001
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- ----------------
Gi0/1 Root FWD 4 128.1 P2p
Gi0/10 Desg FWD 4 128.3 P2p Edge
Po1 Altn BLK 4 128.4 P2p
Gi0/1 forwards on its own as the root port while Po1 sits in Alternate / Blocking. Once both members bundle, Po1 becomes the single root port and carries the full capacity.
Routing and the return path
From the user's PC, a traceroute that answers at hop 1 and then times out tells you where to look next:
C:\>tracert 192.168.20.20
Tracing route to 192.168.20.20 over a maximum of 30 hops
1 <1 ms 2 ms 3 ms 192.168.10.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
Trace complete.
The forward route may be fine. Check the far router's table for a route back:
R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is not set
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.0.0/30 is directly connected, GigabitEthernet0/1
L 172.16.0.2/32 is directly connected, GigabitEthernet0/1
192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0
L 192.168.20.1/32 is directly connected, GigabitEthernet0/0
Only connected networks: no route to 192.168.10.0/24, where the PC lives. The requests arrive and the replies have nowhere to go. A static route (or a default route) toward the branch fixes it:
R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is not set
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.0.0/30 is directly connected, GigabitEthernet0/1
L 172.16.0.2/32 is directly connected, GigabitEthernet0/1
S 192.168.10.0/24 [1/0] via 172.16.0.1
192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0
L 192.168.20.1/32 is directly connected, GigabitEthernet0/0
OSPF adjacencies
HQ#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 1 FULL/DR 00:00:40 10.0.13.2 GigabitEthernet0/1
HQ has two OSPF links but only one neighbour. The usual causes, in the order worth checking: a passive interface, mismatched hello/dead timers, mismatched areas, or a network statement that does not cover the link.
HQ#show ip ospf interface brief
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Gi0/0 1 0 10.0.12.1/30 1 BDR 1/1
Gi0/1 1 0 10.0.13.1/30 1 BDR 1/1
Gi0/2 1 0 192.168.1.1/24 1 DR 0/0
show ip ospf interface brief shows each OSPF interface's area, cost, state and neighbour count at once - the fastest way to spot the interface that is not doing what you think.
IPv6, NAT and DHCP snooping
R1#show ipv6 interface brief
GigabitEthernet0/0 [up/up]
fe80::dff:fe02:1
2001:db8:a::1
GigabitEthernet0/1 [up/up]
fe80::dff:fe02:2
2001:db8:ff::1
Each interface lists its link-local (fe80::) and global addresses. An interface with only a link-local address has no global address configured.
EDGE#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 203.0.113.1:1 10.10.0.20:1 198.51.100.9 198.51.100.9
An inside host (10.10.0.20) translated to the public address. No translations while users generate traffic usually means the inside/outside roles or the NAT ACL are wrong.
SW1#show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
70
DHCP snooping is operational on following VLANs:
70
Smartlog is configured on following VLANs:
none
DHCP snooping is configured on the following L3 Interfaces:
Insertion of option 82 is enabled
circuit-id default format: vlan-mod-port
remote-id: switch (string)
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:
Interface Trusted Allow option Rate limit (pps)
----------------------- ------- ------------ ----------------
GigabitEthernet0/2 yes yes unlimited
DHCP snooping drops server replies arriving on untrusted ports. The port facing the DHCP server (or the relay) must be trusted.
Redeem it and troubleshoot a live network
Every run of a FigigExams scenario hides one fault. You get the symptom, the topology and a console on every device - and the network grades your fix.
CCNA-EXAM-FULL
Redeem the code
Already have an account? Log in and open it
CCNA troubleshooting commands quiz
Five questions on choosing the right command and reading what it says.
Practise the routine on a real fault
9 CCNA scenarios, 28 faults between them, one free. See all of them in the CCNA troubleshooting labs.
Frequently Asked Questions
What are the most important CCNA troubleshooting commands?
show ip interface brief (interface and IP status), show interfaces (errors and duplex), show vlan brief, show interfaces trunk, show etherchannel summary, show spanning-tree, show ip route, show ip ospf neighbor, show ip nat translations and show port-security interface, plus ping and traceroute. Knowing which one answers which symptom matters more than knowing all of them.
What does "administratively down" mean in show ip interface brief?
That the interface is shut down in the configuration. no shutdown in interface configuration mode brings it up. A physical problem shows as down / down without the word administratively.
How do I check which VLAN a switch port is in?
show vlan brief lists every VLAN with its access ports. show interfaces status shows the VLAN column per port, and show interfaces GigabitEthernet0/1 switchport gives the full detail for one port.
How do I see which VLANs are allowed on a trunk?
show interfaces trunk. Its second block, "Vlans allowed on trunk", is the configured allowed list; the later blocks show which of those are active and forwarding. A VLAN missing from the allowed list cannot cross that trunk.
What does (s) mean in show etherchannel summary?
Suspended: the member port did not negotiate into the bundle, usually because the two ends use incompatible modes (on against active or passive) or mismatched settings. (P) means bundled, (I) stand-alone and (D) down.
How do I recover an err-disabled port?
Fix the cause first - for port security, raise the maximum or remove the unexpected device - then bounce the port with shutdown and no shutdown in interface configuration mode. Without the fix the port goes straight back to err-disabled.
What is the best way to learn CCNA troubleshooting commands?
Use them on networks you did not build, where you do not already know the answer. Reading the output with a question in mind ("is the port in the right VLAN?") is what makes the commands stick.