Diagnostic Commands¶
The toolkit for actually investigating a problem from Common Issues, rather than guessing.
Basic Reachability¶
These are Cisco IOS commands, run from privileged EXEC (Switch#) — the repeat option isn't available in user EXEC. From a laptop instead, use ping -c 100 (macOS/Linux) or ping -n 100 (Windows), and tracert on Windows.
! Basic Layer 3 reachability
ping <ip>
! Extended ping — useful for spotting intermittent loss
ping <ip> repeat 100
! Path taken, and where it stops if it doesn't reach the destination
traceroute <ip>
! Test whether a specific TCP port is reachable (e.g. telnet 10.0.99.5 22 to test SSH availability without actually needing SSH credentials)
telnet <ip> <port>
telnet <ip> <port> as a connectivity test doesn't require Telnet to be enabled anywhere as a management protocol — it's just using the client to open a raw TCP connection and confirm something's listening.
Layer 2 / Switching¶
! Where is a given MAC actually connected? — see MAC Addresses & ARP
show mac address-table
show mac address-table interface Gi0/1
! Trunk state, native VLAN, allowed VLANs — see VLANs & Inter-VLAN Routing
show interfaces trunk
! Root bridge, port states — see Spanning Tree Protocol
show spanning-tree
! What CDP-speaking gear (other Cisco switches/routers, some phones/APs) is on each port — most endpoints (laptops, consoles) won't show; use show mac address-table for those — see Interface Management
show cdp neighbors detail
Layer 3 / Routing¶
! Routing table — see Routing
show ip route
! Interface up/down + IP assignment
show ip interface brief
! IP-to-MAC mappings — see MAC Addresses & ARP
show arp
Interface-Level¶
! Full detail: status, errors, counters — see Interface Management
show interfaces Gi0/1
show interfaces Gi0/1 | include error|drop
! Reset counters to isolate a fault to a time window
clear counters Gi0/1
show interfaces summary¶
One row per interface — queue depths and rates at a glance. * marks an up interface.
| Column | Meaning |
|---|---|
| IHQ / OHQ | Packets currently waiting in the input / output hold queue (transient, normally 0) |
| IQD / OQD | Packets dropped from those queues since boot — nonzero means the port has been congested; watch whether it climbs, not that it exists |
| RXBS / TXBS | Receive / transmit rate in bits per second (load-interval average, 5 min default) |
| RXPS / TXPS | The same rates in packets per second |
| TRTL | Throttle count — times the interface disabled its receiver because the CPU fell behind; should always be 0 |
OQD is the useful column: output drops point at the congested port. clear counters then re-check to isolate to a time window.
Debug Commands (Use With Caution)¶
debug commands show real-time detail of what a process is doing — powerful, but they run on the switch's CPU and can overwhelm a busy device:
! Needed to see debug output over SSH/Telnet — console sessions get it by default (terminal no monitor to stop)
terminal monitor
! ICMP sent/received by the switch itself (e.g. replies to pings AT the switch) — does NOT show traffic passing through it
debug ip icmp
! ALWAYS turn debugging back off when done
undebug all
A debug that "shows nothing" over SSH usually isn't broken — debug output goes to the console line by default, and a vty session sees none of it until terminal monitor is run.
Caution: never leave a
debugcommand running unattended on a production device. High-volume debug output (e.g.debug ip packeton a busy interface) can spike CPU enough to cause the exact kind of outage you were trying to diagnose. Prefershowcommands and SPAN/port mirroring for anything beyond a quick, targeted check.
Full Diagnostic Snapshot¶
! Bundles a large set of diagnostic output — see Monitoring Commands
show tech-support