Packet Tracer Interpret Show Command Output

Let's dive deep into how to interpret the show command output in Packet Tracer, a crucial skill for any aspiring network engineer. Understanding these outputs allows you to diagnose network problems, verify configurations, and learn about network behavior in a simulated environment. Packet Tracer is an invaluable tool for practicing Cisco IOS commands, and mastering the show command family is paramount to your success.

Introduction to show Commands in Packet Tracer

The show commands in Cisco IOS (and emulated in Packet Tracer) are your window into the device's configuration, status, and operational information. They provide a real-time snapshot of what's happening inside a router or switch. Learning to decipher these outputs is essential for troubleshooting, validating configurations, and gaining a deeper understanding of networking concepts. Think of them as the stethoscope and X-ray for your network.

The show command offers a vast array of options, each tailored to display specific information. We'll explore some of the most common and useful ones in Packet Tracer, illustrating how to interpret their output and apply that knowledge to real-world scenarios. It's important to remember that while Packet Tracer simulates many Cisco IOS features, it doesn't replicate everything perfectly. However, the core principles of interpreting show command outputs remain the same.

Core show Commands and Their Interpretation

Let's examine some fundamental show commands and dissect their outputs. Remember to enable privileged EXEC mode (using the enable command) before executing these commands.

1. show running-config

This command is arguably the most important. It displays the currently running configuration of the device. This is the configuration that the device is actively using.

Key Output Sections and Their Interpretation:

• version: Indicates the IOS version running on the device. This is important for compatibility and feature support.
• hostname: Shows the device's hostname.
• enable secret / enable password: Displays the encrypted (or sometimes plaintext - avoid this!) enable password.
• interface configurations: These sections define the configuration for each interface (e.g., Ethernet, FastEthernet, GigabitEthernet, Serial). This includes:
  • ip address: The IP address and subnet mask assigned to the interface.
  • duplex / speed: The duplex mode and speed configured for the interface.
  • shutdown: Indicates whether the interface is administratively down (disabled). no shutdown means it's enabled.
• routing protocol configurations: This includes protocols like RIP, EIGRP, OSPF. The output will vary depending on the protocol configured.
• line vty configurations: These configure virtual terminal lines for remote access (Telnet, SSH).
• end: Marks the end of the configuration.

Example Output (Snippet):

version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname Router1
enable secret 5 $1$abc$defghijklmno
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
!
router rip
 version 2
 network 192.168.1.0
 no auto-summary
!
line vty 0 4
 password cisco
 login
!
end

Interpretation:

• The router is named "Router1".
• The enable password is encrypted.
• FastEthernet0/0 has an IP address of 192.168.1.1/24.
• RIP version 2 is configured, advertising the 192.168.1.0 network.
• Telnet access is enabled (though you should prefer SSH).

Troubleshooting Applications:

• Configuration errors: Identify misconfigured IP addresses, incorrect subnet masks, or typos in routing configurations.
• Interface status: Verify if an interface is enabled (no shutdown) and configured with the correct IP address.
• Routing protocol configuration: Check that the routing protocol is correctly configured to advertise the necessary networks.

2. show ip interface brief

This command provides a concise overview of all interfaces on the device, including their IP address, status (up/down), and protocol (up/down).

Key Output Columns and Their Interpretation:

• Interface: The name of the interface (e.g., FastEthernet0/0, Serial0/0/0).
• IP-Address: The IP address assigned to the interface. unassigned means no IP address is configured.
• OK?: Indicates whether the IP address configuration is valid (YES or NO). Usually YES.
• Method: How the IP address was assigned (e.g., manual, DHCP).
• Status: The physical layer status of the interface (e.g., up, down, administratively down). up means the physical layer is active.
• Protocol: The data link layer protocol status (e.g., up, down). up means the data link layer is functioning.

Example Output:

Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        192.168.1.1     YES manual up                    up
FastEthernet0/1        unassigned      YES unset  administratively down down
Serial0/0/0            10.1.1.1        YES manual up                    up
Serial0/0/1            unassigned      YES unset  administratively down down
Vlan1                  unassigned      YES unset  administratively down down

Interpretation:

• FastEthernet0/0 is configured with 192.168.1.1 and is up/up (both physical and data link layers are active).
• FastEthernet0/1 is administratively down (disabled).
• Serial0/0/0 is configured with 10.1.1.1 and is up/up.

Troubleshooting Applications:

• Interface status: Quickly identify interfaces that are down (either physically or logically).
• IP address assignment: Verify that interfaces have been assigned the correct IP addresses.
• Administrative status: Determine if an interface has been intentionally disabled.

3. show ip route

This command displays the routing table, which is the device's map of the network. It shows the networks the router knows how to reach and the path it will take to get there.

Key Output Columns and Their Interpretation:

• Codes: Explains the meaning of the route codes (e.g., C - connected, S - static, R - RIP, O - OSPF).
• Destination/Mask: The destination network and subnet mask.
• Proto: The routing protocol that learned the route (e.g., connected, RIP, static).
• Pref: Administrative distance (lower is better). This is used to choose between routes learned from different protocols.
• Metric: The metric used by the routing protocol to determine the best path (e.g., hop count for RIP, cost for OSPF).
• Next-Hop: The IP address of the next router in the path to the destination network.
• Last Update: How long ago the route was learned or updated.
• Outgoing Interface: The interface on the router that will be used to forward traffic to the destination network.

Example Output:

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, Serial0/0/0
L        10.1.1.1/32 is directly connected, Serial0/0/0
C        192.168.1.0/24 is directly connected, FastEthernet0/0
R        192.168.2.0/24 [120/1] via 10.1.1.2, 00:00:15, Serial0/0/0

Interpretation:

• The router knows about the 10.1.1.0/24 network because it's directly connected to Serial0/0/0 (C).
• The router also knows about the 192.168.1.0/24 network because it's directly connected to FastEthernet0/0 (C).
• The router learned about the 192.168.2.0/24 network via RIP (R), with a next-hop of 10.1.1.2, accessible through Serial0/0/0. The administrative distance is 120 and the metric is 1.

Troubleshooting Applications:

• Reachability issues: Determine if a router knows how to reach a specific network. If a network is missing from the routing table, there's a routing problem.
• Routing loops: Identify potential routing loops by examining the next-hop addresses and outgoing interfaces.
• Suboptimal routing: Identify if traffic is taking a suboptimal path by examining the routing table and comparing it to the desired path.

4. show cdp neighbors

CDP (Cisco Discovery Protocol) is a proprietary protocol that allows Cisco devices to discover each other on the same network segment. This command displays information about directly connected Cisco devices.

Key Output Columns and Their Interpretation:

• Device ID: The hostname of the neighboring device.
• Local Interface: The interface on the local device that is connected to the neighboring device.
• Holdtime: The amount of time (in seconds) that the local device will keep the CDP information about the neighbor before discarding it.
• Capability: The capabilities of the neighboring device (e.g., R - Router, S - Switch, H - Host).
• Platform: The platform or model of the neighboring device.
• Port ID: The interface on the neighboring device that is connected to the local device.

Example Output:

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
Router2          FastEthernet0/0   142          R S I       2811      FastEthernet0/1
Switch1          FastEthernet0/1   168          S I         2960      FastEthernet0/2

Interpretation:

• Router2 is connected to the local router via FastEthernet0/0. Router2's FastEthernet0/1 is connected to this router. Router2 is a Router (R), Switch (S), and supports IGMP (I).
• Switch1 is connected to the local router via FastEthernet0/1. Switch1's FastEthernet0/2 is connected to this router. Switch1 is a Switch (S) and supports IGMP (I).

Troubleshooting Applications:

• Connectivity verification: Verify that devices are physically connected to the correct ports.
• Topology discovery: Discover the network topology by examining the CDP neighbors of each device.
• Mismatched configurations: Identify potential configuration mismatches (e.g., speed/duplex) between connected devices.

5. show ip protocols

This command displays information about the configured routing protocols on the device.

Key Output Sections and Their Interpretation:

• Routing Protocol is ...: Indicates the routing protocol that is configured (e.g., RIP, EIGRP, OSPF).
• Sending updates every ... seconds: The interval at which routing updates are sent.
• Invalid after ... seconds, hold down ... seconds, flushed after ... seconds: Timers related to route aging and stability.
• Routing for Networks:: The networks that the routing protocol is advertising.
• Distance vector metric updates are sent to these interfaces:: The interfaces on which routing updates are sent.
• Default version control: send version ..., receive version ...: The version of the routing protocol being used.
• Routing Information Sources:: The routers from which routing information is being received.
• Distance:: The administrative distance of the routing protocol.

Example Output (RIP):

Routing Protocol is "rip"
  Sending updates every 30 seconds, next due in 25 seconds
  Invalid after 180 seconds, hold down 180 seconds, flushed after 240 seconds
  Routing for Networks:
    192.168.1.0
    192.168.2.0
  Distance vector metric updates are sent to these interfaces:
    FastEthernet0/0
    Serial0/0/0
  Default version control: send version 2, receive version 2
  Routing Information Sources:
    Gateway         Distance      Last Update
    10.1.1.2             120      00:00:15
  Distance: (default is 120)

Interpretation:

• RIP is configured on the router.
• It's advertising the 192.168.1.0 and 192.168.2.0 networks.
• It's sending updates on FastEthernet0/0 and Serial0/0/0.
• It's receiving routing information from 10.1.1.2.

Troubleshooting Applications:

• Routing protocol configuration: Verify that the routing protocol is correctly configured to advertise the necessary networks and send updates on the correct interfaces.
• Routing update issues: Identify if a router is not receiving routing updates from its neighbors.
• Version mismatches: Identify if there are version mismatches between neighboring routers.

6. show ip ospf neighbor

This command is specific to OSPF and displays information about OSPF neighbors. It's crucial for ensuring OSPF adjacencies are properly formed.

Key Output Columns and Their Interpretation:

• Neighbor ID: The Router ID of the OSPF neighbor. This is usually the highest IP address on the device.
• Pri: The priority of the neighbor, used in DR/BDR election.
• State: The OSPF state of the neighbor (e.g., FULL, 2WAY, INIT). FULL indicates a fully established adjacency.
• Dead Time: The amount of time (in seconds) remaining before the neighbor is declared dead.
• Address: The IP address of the neighbor's interface.
• Interface: The interface on the local router connected to the neighbor.

Example Output:

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.2.2       1   FULL/DR         00:00:35    10.1.1.2        Serial0/0/0

Interpretation:

• The router has a fully established OSPF adjacency with a neighbor with Router ID 192.168.2.2.
• The neighbor is the Designated Router (DR) on that segment.
• The neighbor's IP address is 10.1.1.2, and it's reachable through Serial0/0/0.

Troubleshooting Applications:

• OSPF adjacency issues: Identify if OSPF adjacencies are not forming correctly (e.g., stuck in INIT or 2WAY state).
• DR/BDR election: Verify that the correct routers are being elected as DR and BDR.
• Connectivity problems: Identify if a router is not seeing its OSPF neighbors.

7. show interfaces

This command displays detailed information about a specific interface or all interfaces if no interface is specified. It's a comprehensive view of the interface's configuration and status.

Key Output Sections and Their Interpretation:

• Interface ... is ... line protocol is ...: Indicates the interface's name, whether it's up or down (physically), and whether the line protocol is up or down (data link layer).
• Hardware is ...: The type of interface (e.g., FastEthernet, Serial).
• Internet address is ...: The IP address and subnet mask assigned to the interface.
• MTU ... bytes, BW ... Kbit/sec, DLY ... usec, reliability .../255, txload .../255, rxload .../255: Various performance metrics:
  • MTU: Maximum Transmission Unit (the largest packet size that can be transmitted).
  • BW: Bandwidth (configured bandwidth of the interface).
  • DLY: Delay (configured delay of the interface).
  • reliability: Interface reliability (higher is better).
  • txload: Transmit load (how busy the interface is transmitting).
  • rxload: Receive load (how busy the interface is receiving).
• Encapsulation ...: The encapsulation method used on the interface (e.g., HDLC, PPP, Ethernet).
• Keepalive is ...: Whether keepalive messages are being sent (used to detect link failures).
• Duplex ..., speed ..., ...: The duplex mode and speed of the interface.
• Last input ..., output ..., output hang ...: Timestamps of the last input, output, and output hang events.
• Input queue: .../..., drops ...; Total output drops: ...: Statistics about input and output queues and dropped packets.
• 5 minute input rate ... bits/sec, ... packets/sec: The average input rate over the last 5 minutes.
• 5 minute output rate ... bits/sec, ... packets/sec: The average output rate over the last 5 minutes.
• L2 protocol information: Information related to Layer 2 protocols like Ethernet.

Example Output (Snippet):

FastEthernet0/0 is up, line protocol is up
  Hardware is FastEthernet, address is 000a.4141.4141 (bia 000a.4141.4141)
  Internet address is 192.168.1.1/24
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Duplex auto, speed auto, media type: RJ45
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:01, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 unknown protocol drops
     0 carrier transitions

Interpretation:

• FastEthernet0/0 is up and the line protocol is up, meaning it's functioning correctly.
• It has an IP address of 192.168.1.1/24.
• The bandwidth is configured as 100 Mbps.
• There are no input or output errors.

Troubleshooting Applications:

• Interface status: Determine if an interface is up and functioning correctly.
• Configuration verification: Verify the interface's IP address, MTU, bandwidth, duplex, and speed settings.
• Performance monitoring: Monitor interface utilization, error rates, and packet drops to identify potential performance bottlenecks.

Advanced show Command Usage and Filtering

Cisco IOS provides options to filter and refine the output of show commands, making it easier to find the information you need. Two powerful tools are include and begin.

Filtering with include

The include option filters the output to display only lines that contain a specific string.

Example:

show running-config | include ip address

This command will display only the lines in the running-config that contain the string "ip address", effectively showing you all IP address assignments.

Filtering with begin

The begin option starts the output from the first line that contains a specific string. This is useful for skipping irrelevant sections of the output.

Example:

show running-config | begin interface FastEthernet0/0

This command will start displaying the running-config from the beginning of the configuration for FastEthernet0/0.

Best Practices for Using show Commands

• Start with the basics: Begin with show ip interface brief to get a quick overview of interface statuses.
• Use filtering: Leverage include and begin to narrow down the output and find the specific information you need.
• Understand the context: Know the network topology and the expected configuration before interpreting the output.
• Practice consistently: The more you use show commands, the more comfortable you'll become with interpreting their output.
• Refer to Cisco documentation: Consult the official Cisco documentation for detailed explanations of command syntax and output.
• Compare with a working configuration: If possible, compare the output of a problematic device with the output of a known working device.

Common Troubleshooting Scenarios Using show Commands

Let's illustrate how to use show commands in a couple of common troubleshooting scenarios.

Scenario 1: Connectivity Issue Between Two Routers

Two routers are unable to ping each other.

Troubleshooting Steps:

1. Check interface status: Use show ip interface brief on both routers to verify that the interfaces connected to each other are up/up and have the correct IP addresses.
2. Check routing tables: Use show ip route on both routers to verify that they have routes to each other's networks.
3. Check CDP neighbors: Use show cdp neighbors on both routers to verify that they can see each other.
4. Check for ACLs: Use show running-config to look for any access control lists (ACLs) that might be blocking traffic.
5. Check for misconfigured encapsulation: Use show interfaces serial0/0/0 (replace with appropriate interface) to ensure the encapsulation (e.g., HDLC, PPP) is correctly configured.

Scenario 2: Routing Loop

Traffic is getting stuck in a loop between two routers.

Troubleshooting Steps:

1. Examine routing tables: Use show ip route on both routers to identify any inconsistent or conflicting routes. Look for routes that point back to each other.
2. Check routing protocol configuration: Use show ip protocols on both routers to verify that the routing protocol is configured correctly and is advertising the correct networks.
3. Check for split horizon issues: If using RIP, split horizon might be preventing routes from being advertised correctly. Consider disabling split horizon on the affected interfaces (though this is generally not recommended).
4. Use traceroute: While not a show command, traceroute can help visualize the path traffic is taking and pinpoint the loop.

Conclusion

Mastering the show commands in Packet Tracer is an essential skill for any aspiring network engineer. By understanding how to interpret the output of these commands, you can effectively diagnose network problems, verify configurations, and gain a deeper understanding of networking concepts. Practice consistently, use filtering options, and consult the Cisco documentation to become proficient in using these powerful tools. The ability to quickly and accurately analyze show command output is a hallmark of a skilled network professional. While Packet Tracer is a simulation, the skills you develop here translate directly to real-world network environments.