Skip to content

Expert · Troubleshooting and the CCNA exam · topic 55 of 57 · 35 min

Troubleshooting tools and common faults

Explanation

A few tools find most faults. ping tests reachability, traceroute shows the path and where it stops, and ipconfig, ip addr and nslookup check a host. On Cisco devices, show ip interface brief, show vlan brief, show interfaces trunk, show ip route and show ip ospf neighbor reveal most problems. Learn the symptom of each common fault, such as a wrong gateway, a wrong VLAN or a DNS failure, and you can find it in minutes.

ping

ping sends ICMP echo requests and waits for echo replies. ICMP (Internet Control Message Protocol) is the helper protocol IP uses for tests and error messages. A reply proves two-way reachability at layer 3. On a Cisco device, ! means a reply, . means a timeout, and U means a router said the destination is unreachable.

output
R1# ping 10.10.50.20 source GigabitEthernet0/1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.50.20, timeout is 2 seconds:
Packet sent with a source address of 10.10.30.1
!!!!!
Success rate is 100 percent (5/5)
Cisco IOS: source makes the ping come from the LAN interface, which tests the return route to that LAN too.

Typing ping on its own in privileged EXEC mode starts an extended ping, which asks for the target, repeat count, size, source address and more. It is useful to test from a specific interface or with large packets.

Tip: The first ping from a router often shows .!!!! with one timeout. That is normal: the first packet waited for ARP to find the next hop's MAC address.

traceroute and tracert

traceroute shows each router on the path. It sends packets with TTL (time to live) 1, then 2, then 3. Each router lowers the TTL by one, and the router where it reaches zero drops the packet and sends back an ICMP time exceeded message, revealing itself. Windows uses tracert, which sends ICMP echoes; Cisco IOS and Linux traceroute send UDP probes by default. A row of * * * means no reply from that hop: often a firewall that filters these messages, or the point where the path breaks.

Checking the host

powershell
ipconfig /all            # Windows: IP, mask, gateway, DNS servers, DHCP, MAC
ip addr                  # Linux: addresses on each interface
ip route                 # Linux: the default gateway
nslookup billing.hospital.local   # does DNS resolve this name?
An address starting 169.254 means the PC got no DHCP answer and gave itself an APIPA address.

Cisco show commands

CommandWhat it tells you
show ip interface briefEvery interface with its IP address, status (layer 1) and protocol (layer 2)
show interfacesSpeed, duplex, errors (CRC, collisions), input and output rates
show vlan briefWhich VLANs exist and which access ports are in each
show interfaces trunkWhich ports are trunks, their native VLAN and the VLANs allowed and active
show ip routeThe routing table: is there a route (or a default route) to the destination?
show ip ospf neighborOSPF neighbours and their state; FULL is healthy
show cdp neighborsDirectly connected Cisco devices and the ports they connect on: a live map
show loggingRecent log messages, such as links going up and down or ports err-disabled
output
SW1# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  10.10.1.2       YES manual up                    up
GigabitEthernet1/0/1   unassigned      YES unset  up                    up
GigabitEthernet1/0/2   unassigned      YES unset  down                  down
GigabitEthernet1/0/3   unassigned      YES unset  administratively down down
up/up is healthy. down/down: no cable or the far end is off. administratively down: someone typed shutdown. up/down: a layer 2 problem, such as an encapsulation mismatch.

debug, with care

debug commands print live messages about what a protocol is doing, such as debug ip ospf adj for OSPF neighbour forming. They are powerful but can use so much CPU that a busy router stops responding. Use them in a quiet period, as narrowly as possible, and turn them off with undebug all (or no debug all). Over SSH you also need terminal monitor to see the messages.

Common faults and their symptoms

FaultSymptomCheck with
Wrong default gateway on the PCReaches PCs in its own subnet, nothing outsideipconfig /all
Wrong subnet maskSome hosts reachable, others not; strange one-way problemsipconfig /all, compare with the IP plan
Port in the wrong VLANLink is up but the PC cannot ping its gateway or neighboursshow vlan brief
Trunk does not allow the VLANA VLAN works on one switch but not across the trunkshow interfaces trunk
Duplex mismatchLink up but very slow; late collisions on the half-duplex side, CRC errors on the othershow interfaces
ACL blockingGateway answers, but certain traffic beyond it failsshow access-lists (watch the match counters)
DNS failureping 8.8.8.8 works, but names do not resolvenslookup, ipconfig /all (DNS server)
OSPF mismatchNo neighbour, or stuck in EXSTART: area, hello or dead timers, subnet, authentication or MTU differshow ip ospf neighbor, show ip ospf interface
Port err-disabledLink dead after a port security violation or BPDU guardshow interfaces status err-disabled, show logging
Careful: Common mistakes: (1) Leaving a debug running on a production router. Always end with undebug all. (2) Trusting a failed ping alone: a firewall or ACL may block ICMP while the real application works. (3) Forgetting that ping needs a route in both directions; the reply needs a way back. (4) Fixing an err-disabled port without fixing the cause: it just goes err-disabled again. Remove the cause, then shutdown and no shutdown.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Troubleshooting tools and common faults · 1/8

Troubleshooting tools

In this lesson you will meet the tools that find most network faults, and the symptoms of the common ones.

Prefer a video by a teacher? Find free videos on “Cisco troubleshooting show ip interface brief ping traceroute common faults CCNA” on YouTube ↗

In real life: Finance cannot reach the internet, but HR can

At a startup in Pune, the finance team says the internet is down. The engineer pings 8.8.8.8 from a finance PC: it works. ping google.com fails with "could not find host". ipconfig /all shows the DNS server as 10.0.5.53, an old server switched off last week, while HR PCs use 10.0.1.53. The finance VLAN's DHCP scope was never updated. She fixes the DHCP option, the PCs renew their leases, and names resolve again. Five minutes, three commands.

Practice (0/3 done)

Task 1 · Question

In show ip interface brief, an interface shows "administratively down" and "down". What is the cause?

Task 2 · Code · Python

Write not_up_up(output) that takes the text of show ip interface brief and returns a list of the interface names that are NOT up/up, in order. Skip the header line (it starts with "Interface") and blank lines. Careful: the status can be two words, "administratively down". The interface name is the first word and the protocol is the last word.

Task 3 · Code · Python

Write likely_fault(s) using the bottom-up order. s is a dict of True/False test results with the keys "link" (link light on), "dhcp" (got a real address, not 169.254), "gateway" (ping to the default gateway works), "remote_ip" (ping to a remote IP such as 8.8.8.8 works) and "dns" (names resolve). Return the FIRST failing check as: "cable", "dhcp", "vlan or ip settings", "routing or acl", "dns". If everything passes, return "application".

Quick quiz

Question 1

1.A PC can ping 8.8.8.8 but not www.irctc.co.in. What is the most likely problem?

Question 2

2.Which command shows the VLANs allowed on a trunk?

Question 3

3.How does traceroute find each router on the path?

Question 4

4.Two OSPF routers on the same link never become neighbours. Which mismatch can cause this?

Question 5

5.What should you always run after finishing with debug on a router?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

A PC can ping 8.8.8.8 but not www.irctc.co.in. What is the most likely problem?

Answer: DNS

Reaching an IP address proves routing works. Failing on a name points to name resolution (DNS).

Which command shows the VLANs allowed on a trunk?

Answer: show interfaces trunk

show interfaces trunk lists trunk ports, the native VLAN, and the VLANs allowed and active on each.

How does traceroute find each router on the path?

Answer: It sends packets with TTL 1, 2, 3 and so on; each router where the TTL expires replies

Each router lowers the TTL; where it reaches zero, the router sends an ICMP time exceeded message and so reveals itself.

Two OSPF routers on the same link never become neighbours. Which mismatch can cause this?

Answer: Different hello and dead timers

Neighbours must agree on area, hello and dead timers, subnet and authentication. Hostnames and banners do not matter.

What should you always run after finishing with debug on a router?

Answer: undebug all

undebug all (or no debug all) stops every debug, so the router's CPU is not overloaded.

Which command shows the ARP cache on a Cisco router?Related

Answer: show ip arp

show ip arp lists IP-to-MAC mappings on IOS; arp -a is the Windows command.

From ARP, the default gateway and ping

Which command shares a router's static default route with its OSPF neighbours?Related

Answer: default-information originate

default-information originate, under router ospf, advertises the default route as O*E2.

From Configuring and verifying single-area OSPF

Where do you configure ip helper-address?Related

Answer: On the router interface facing the DHCP clients

The relay must be on the interface that receives the clients' broadcasts, which is their default gateway.

From DHCP: automatic addresses

The main path is learnt by OSPF. Which AD makes a static route a correct floating backup?Related

Answer: 130

The backup must have a higher AD than OSPF's 110, so 130 works. The others would beat OSPF.

From Static and default routes

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: The CCNA 200-301 exam and your study plan →

Next steps

  1. 2 more topics in “Troubleshooting and the CCNA exam” before its exam: The CCNA 200-301 exam and your study plan, Networking careers in India and beyond.
  2. Module 12 exam: Troubleshooting and the CCNA exam · 13 questions · 20 min, without help. 4 topics of this module still to finish first.
  3. 57 topics left in the course before the final exam.

← Previous: A structured troubleshooting method