IT Certifyhome.com

Identifying Troubleshooting Targets 3.1 Data Link Troubleshooting 3.1.1 Troubleshooting Physical and Data Link Protocol 3.1.2 Clearing Interface Counters 3.2 The show Commands 3.3 Token

IT Certify home.com

The Only Way to get Certified Quickly

Exam :640-606SG Title:Support 2.0 (CIT) Study Guide Version Number:May,2003

You are now prepared to pass your exam This tifyhome will provide you with all the knowledge abo-

ITCer-ut the real certification exams We hope you will take full advantage of this tool

The Use of this ITcertifyhome is strictly for the purchaser Illegal dissemination is harmful to everyone So be fair to yourself and us

For Support, please go to ITcertifyhome.com and click on

Get ITcertifyhome Product Get your Certified

Study Faster Study Smarter.

Save Time.Save Money.

TABLE OF CONTENTS List of Tables

Introduction

11 Support Resources for Troubleshooting

1.1 Network Media Test Equipment

1.6 Simulation and Modeling Tools

1.7 Cisco Connection Online (CCO)

2 Understanding Troubleshooting Methods

2.1 The steps and scope of systematic troubleshooting

2.2 The Problem-Solving Model

2.3 A Baseline Model of the Network

3 Identifying Troubleshooting Targets

3.1 Data Link Troubleshooting

3.1.1 Troubleshooting Physical and Data Link Protocol 3.1.2 Clearing Interface Counters

3.2 The show Commands

3.3 Token Ring Soft Errors

3.4 Cisco Discovery Protocol (CDP)

3.4.1 Common Protocol Characteristics 3.4.2 Protocol Connection Troubleshooting

3.4.2.1 TCP Connection Sequence 3.4.2.2 Novell Connection Sequence

3.4.2.3 AppleTalk Connection Sequence

4 Applying Cisco Troubleshooting Tools

4.1 Routing and Switching Processes

4.2 Switching in Different Routers Models

4.2.1 The 7000 Series 4.2.2 The 7500 Series 4.2.3 The 4000, 3000, and 2500 Series 4.3 The debug Tool

4.4 Error Messages

4.5 Reachability and Path Tests

4.5.1 The ping Command 4.5.2 The traceroute Command 4.6 Gathering further information

4.6.1 The show version Command 4.6.2 The show buffers Command 4.6.3 The show memory Command 4.6.4 The show processes Command 4.6.5 The show controllers cxbus Command 4.6.6 The show stacks Command

4.6.7 Core Dumps

5 Diagnosing and Correcting Campus TCP/IP, Novell Networking and

AppleTalk Problems

5.1 Cisco IOS Troubleshooting Tools and Commands for TCP/IP, IPX and AppleTalk

5.1.1 The ping, traceroute and test Commands 5.1.2 The show ip, show ipx and show appletalk Commands

5.1.2.1 The show ip Commands 5.1.2.2 The show ipx Commands 5.1.2.3 The show appletalk Commands 5.1.3 The debug ip, debug ipx and debug apple Commands

5.1.3.1 The debug ip Commands 5.1.3.2 The debug ipx Commands 5.1.3.3 The debug apple Commands 5.2 General Problem Isolation Method for TCP/IP Connectivity

5.2.1 Browser Issues in Microsoft Products 5.2.2 Redistribution between IP Routing Protocols 5.3 Problem Isolation in IPX Networks

5.3.1 IPX Frame Type 5.3.2 ipx gns-response-delay 5.3.3 Specific IPX Problems, Causes, and Possible Actions

5.3.3.1 Client cannot connect to the local LAN’s server 5.3.3.2 Client cannot connect to a remote LAN’s server

5.3.3.3 NetBIOS applications on the client cannot access a remote server

5.3.3.4 No connectivity over the IPX router

5.3.3.5 Router does not propagate SAP updates

5.4 AppleTalk Configuration and Troubleshooting Checklist

5.4.1 Common AppleTalk Faults 5.4.2 Common AppleTalk Symptoms 5.4.3 Solving Common AppleTalk Problems

5.4.3.1 Configuration Mismatches 5.4.3.2 Duplicate Cable Range/Network Numbers 5.4.3.3 Phase I/Phase II Incompatibility

5.4.3.4 Unstable Routes 5.4.3.5 ZIP Storms 5.4.3.6 Old Zone Names Appearing in the Chooser 5.4.3.7 Zones do not Appeare in the Chooser

6 Diagnosing and Correcting Catalyst Problems

6.1 CiscoWorks for Switched Internetworks (CWSI)

6.2.6.1 VLAN Trunking Protocol (VTP) and Interswitch Trunk Links

6.2.7.3 Cannot Access Switch from Remote Devices

7 Troubleshooting VLANS on Routers and Switches

7.1 Troubleshooting Cisco IOS Configuration

7.2 VLAN Design Issues for Troubleshooting

7.3 Switch/Router Configuration Consistency

7.4 Router VLAN Diagnostic Tools

7.4.1 The show Commands 7.4.2 The debug Commands 7.5 Problem Isolation in Router/Switch VLAN Networks

8 Diagnosing and Correcting Frame Relay Problems

8.1 Frame Relay Troubleshooting

8.2 The Frame Relay Diagnostic Tools

8.2.1 Frame Relay Loopback Testing 8.2.2 The show Commands

8.2.3 The debug Commands 8.3 Frame Relay Problem Isolation

9 Diagnosing and Correcting ISDN BRI Problems

9.1 ISDN Components and Reference Points

9.2 BRI Channels

9.2.1 ISDN BRI Layer 1 9.2.2 ISDN Layer 2 9.2.3 ISDN Layer 3 9.2.4 ISDN End-to-End Circuit 9.2.5 PPP over B Channel

Common Failure Reported by the show stacks Command Cable Length Limitations

The show system Command Fields The show test Command Fields Default VLANs on a Catalyst 5000 Switch ISDN Reference Points

Cisco CCNP Support - Certified Internetwork

Cisco CCNA Routing and Switching Certification Exam 640-607

About This Study Guide

This Study Guide is based on the current pool of exam questions for the Cisco 640-606 – Support exam As such it provides all the information required to pass the Cisco 640-606 exam and is organized around the specific skills that are tested in that exam Thus, the information contained in this Study Guide is specific to the 640-606 exam and does not represent a complete reference work on the subject of Internetwork Troubleshooting Topics covered in this Study Guide includes Traffic and Data link Fundamentals: Identifying troubleshooting targets for connection-oriented and connectionless protocols, Identifying common data link layer characteristics and key troubleshooting targets a campus LAN environment, Identifying connection sequences and key troubleshooting targets within TCP/IP, and Identifying connection sequences and key troubleshooting targets within Novell IPX; Troubleshooting Tools, Methods and Targets: Identifying the types and purposes of tools commonly used for network troubleshooting, Describing and identifying how to use the Cisco information resources, Listing the preferred methods for escalation of troubleshooting issues to Cisco's service and support programs; Using the Cisco IOS Troubleshooting Commands and Debugging Utilities: Using troubleshooting tools and minimizing their impact on a Cisco router's switching type and data flow, and Identifying and using Cisco IOSTM software commands and debug utilities to filter, capture and display protocol traffic flows; Implementing Efficient Troubleshooting Methods: Describing an efficient problem-solving method; Implementing Problem Isolation for TCP/IP and Novell IPX: Explaining the use of problem isolation techniques to list the symptoms of common TCP/IP and IPX problems on routed networks, and Applying diagnostic tools to solve network problems; Troubleshooting VLANC on Switches and Routers: Explaining how Cisco routers and switches use VLAN technology, Applying diagnostic tools to switched and routed VLAN configuration problems, and Using Cisco IOS router troubleshooting commands and Catalyst switch troubleshooting commands; Problem Isolation and Resolution on Catalyst Switches: Explaining Catalyst technology, Describing troubleshooting and problem isolation techniques to list the symptoms of Catalyst 5000 and VLAN problems on switched Ethernet Networks, and Applying diagnostic tools to solve Catalyst 5000 problems; Problem Isolation and Resolution for ISDN BRI: Using Cisco IOS commands and problem isolation techniques to identify the symptoms of common ISDN BRI problems, and Applying diagnostic tools to solve ISDN BRI problems; and Problem Isolation and Resolution for Frame Relay WANs: Using Cisco IOS commands and problem isolation techniques to identify the symptoms of common WAN and Frame Relay problems, and Applying diagnostic tools to solve Frame Relay problems

Intended Audience

This Study Guide is targeted specifically at people who wish to take the Cisco CCNP 640-606 – Support (CIT) exam This information in this Study Guide is specific to the exam It is not a complete reference work Although our Study Guides are aimed at new comers to the world of IT, the concepts dealt with in this Study Guide are complex and require an understanding of material provided for the Cisco Certified Network Associate (CCNA) exam 640-607 Knowledge of CompTIA’s A+ course would also be advantageous but is not a requirement

Note: There is a fair amount of overlap between this Study Guide and the

640-604 and 640-605 Study Guides We would not advise skimming over the information that seems familiar as this Study Guide either expands on the information, as it does in relation to the 640-607 Study Guide, or approaches the information from a different angle

How To Use This Study Guide

To benefit from this Study Guide we recommend that you:

• Although there is a fair amount of overlap between this Study Guide and the 607, 604 and

640-605 Study Guides, the relevant information from those Study Guides are included in this Study Guide This is thus the only Study Guide you will require to pass the 640-606 exam

• Study each chapter carefully until you fully understand the information This will require regular and

disciplined work Where possible, attempt to implement the information in a lab setup

• Be sure that you have studied and understand the entire Study Guide before you take the exam

Note: Remember to pay special attention to these note boxes as they contain

important additional information that is specific to the exam

Good luck!

1 Support Resources for Troubleshooting

Today’s networks are mission critical resources, this makes the network support task very essential Should

a component break down or be misconfigured, the network support engineers must be able to diagnose and fix the problem in a timely manner while allowing connectivity through alternate devices A variety of tools has been created to help network support engineers

1.1 Network Media Test Equipment

There are three classes of equipment for testing the physical layer medium:

• Volt/Ohm meters and digital multimeters used to check for cable connectivity and continuity

• Cable testers or scanners, also test for connectivity but are more sophisticated than Volt/Ohm meters

Are able report cable conditions such as attenuation, near-end crosstalk (NEXT), and noise Can also provide the measurement of a cable’s impedance

• TDRs and OTDRs, devices that provide time domain reflectometer (TDR and optical TDR or OTDR

for fiber-optic cable testing), wire-map, and traffic monitoring functionality Can locate opens, shorts, kinks, sharp bends, crimps, and impedance mismatches

1.2 Network Monitors

A Layer 2 tool used to capture, display and save traffic passing through a network cable Can take the raw data and provide information on frame sizes, number of erroneous frames, MAC addresses, number of broadcasts, etc

Network monitors can:

• Monitor network activity over a period of time, making it possible to establishing a network baseline

• Assist in network capacity planning by observing patterns of changing network utilization

• Identify traffic overloads and bottlenecks

1.3 Protocol Analyzers

Similar to network monitors but are capable of interpreting and displaying the packet, segment, and other (higher) protocol data units (PDUs) Can be used to study the format or behavior of certain protocols; to check time delays between request and response

1.4 Network Management Systems

Most networks deploy a variety of topologies, protocols, applications, and remote access technologies and techniques Network management systems are tools that can be used to understand, monitor, troubleshoot, modify, scale, and secure networks

Five key functional areas of network management are:

• Fault management

• Performance management

• Configuration and device management

• Accounting management

• Security management

Fault management is about discovering abnormal behavior before or shortly after it happens Once a

problem is detected, take the following steps:

1 Identify the problem area

2 Isolate the problem area and direct connectivity through alternate paths and/or devices

3 Minimize the impact of the failure

4 Identify the device causing the fault

5 Identify the component/subsystem that is malfunctioning and needs to be replaced or reconfigured

6 Implement the solution to restore normal network operation

1.5.1 CiscoWorks for Switched Internetworks Software (CWSI) Campus

CWSI Campus is a suite of network management applications that provide remote monitoring, configuration, and management of switched internetworks

1.5.2 TrafficDirector Remote Monitoring Software

Considered an excellent fault and performance management tool It is a part of the CWSI Campus suite of network management applications and can be used to monitor traffic on network segments Can detect collisions, errors, utilization, and broadcast rates on a port basis

1.6 Simulation and Modeling Tools

Allow you to put a test network together and see how it performs Can be used to design a new network or to see how an existing network will perform if you modify it, expand it, or put traffic stress on it

1.7 Cisco Connection Online (CCO)

Provides interactive web-based services with access to Cisco’s information, systems, resources, and personnel The CCO consists of the Bug Toolkit, Troubleshooting Engine, Stack Decoder, and Open Forum, all of which aid diagnosis and corrective activities

2 Understanding Troubleshooting Methods

2.1 The steps and scope of systematic troubleshooting

Deploy a systematic troubleshooting technique that can eliminate different possibilities and move step toward the real causes of the problem

step-by-2.2 The Problem-Solving Model

The following is a generally accepted troubleshooting model It presents a flow chart that can effectively guide you through your troubleshooting tasks

• Define the problem in terms of the associated symptoms and possible causes

• Gather facts from different sources Talk to network administrators, other support engineers, managers,

and anyone that can provide relevant information Run some basic tests (such as ping, trace, etc)

• Consider all possibilities and eliminate the improbable possibilities so as to set a boundary for the

problem area Order the possibilities that you believe might be the cause of the network problem based

on their likelihood

• Create an action plan for each possibility in order to solve the problem Ensure the security and

performance implications of each of your proposed actions are acceptable

• Implement the action plan for each possibility in the order of their likelihood Every action and change

must be documented so that you can reverse your actions if they are not appropriate

• Observe the results of each action See if the problems or symptoms have been eliminated and that

other normal network operations are not disrupted or adversely affected

• Document the facts and report the problem as solved if the symptoms have disappeared and the

problem has been solved without creating new ones Documenting your work will save you and others a lot of time and effort in the future Also document the date and time that you made changes

• Go through an iteration process of implementing actions and observing results if there are still

unresolved issues Consider the next action plan and go about implementing it There will be times that you remain with no possibility in hand while your network problems persist In this event, you will have

to think of more possibilities This may require that you gather more facts that you might have overlooked

2.3 A Baseline Model of the Network

To be able to effectively support, troubleshoot, or modify an internetwork, you must gather and document information about the internetwork Some of the essential information includes:

• The physical and logical network map

• Active protocols

• The protocol specific addressing scheme

• The devices, configurations, operating systems, and software in the network

• Baseline traffic and performance statistics and measurements about the internetwork and its devices

• Past troubleshooting cases

• An historical profile of how the network arrived at its current state

3 Identifying Troubleshooting Targets

Your success in troubleshooting is often measured by how fast you can correctly identify the trouble causes, fix the faults, and communicate the results You should be familiar with the layered network model (OSI) and understand the dependency of each layer on the correct operation of the layers below it

3.1 Data Link Troubleshooting

All networking layers, except the physical layer, rely on the correct operation of the data link layer The data

link layer connects devices, which are called adjacent devices If the data link layer is faulty, problems such

as application failure, connection failure, slow network performance, distorted data, etc will occur When troubleshooting the data link layer with Cisco Routers in place, the interface and in some cases the controller

is examined

3.1.1 Troubleshooting Physical and Data Link Protocol

You should first ensure that the physical layer is functioning properly before you troubleshoot the data link layer To troubleshoot the physical layer:

• Use the show interfaces command and look at the first line of the output to check that the interface is

up and line protocol is up

• Check the link LED of the appropriate interface

• Check the condition cables, jacks, and connectors

• Use physical media test equipment

3.1.2 Clearing Interface Counters

If you suspect interface problems, check the output of the show interfaces command Interpret the input, output, and error statistics from the show interfaces command How you would interpret these statistics depends on when those counters were last cleared, the time period through which those counters have accumulated, and how those statistics compare to your baseline

3.2 The show Commands

There are a number of show commands that you can use to trouble shoot targets These commands include:

• show interfaces, which displays the status and statistics information about all router interfaces

• show interfaces ethernet n, which lets you to examine the status of an Ethernet interface with n

specifying the interface

• show interfaces tokenring n, which lets you to examine the status of a Token Ring interface with n

specifying the interface; and the state of source-route bridging It also provides in-depth information on that interface’s performance

• show controllers, which displays information on all of router controllers You can specify the type of controller to get only the information on that particular controller The router may have BRI, CBus, E1, Ethernet, FastEthernet, FDDI, Lex, MCI, PCBus, serial, T1, T3, Token, or VGAnylan controllers, depending on the type of router The information is displayed in separate sections

• show interfaces fddi , which displays information about the state of the FDDI interfaces Table 3.1

provides a brief description of the FDDI-specific fields of the show interfaces fddi command

TABLE 3.1: The show interfaces fddi Fields

Phy-{A | B} Lists the state the Physical A or Physical B connection is

in These could be:

• Off, which indicates that the CMT is not running on the Physical Sublayer

• Brk (Break State), which is the entry point in the start

• Sig (Signal State), which is entered from the Next State when a bit is ready to be transmitted

• Join (Join State), which is the first of three states in a unique sequence of transmitted symbol streams received as line states that lead to an active connection

• Vfy (Verify State), which is the second state in the path to the Active State and will not be reached by a connection that is not synchronized

• Act (Active State), which indicates that the CMT process has established communications with its physical neighbor

Neighbor State of the neighbor:

• A, which indicates that the CMT process has established a connection with its neighbor

• S, which indicates that the CMT process has established a connection with its neighbor and that the bits received during the CMT signaling process indicate that the neighbor is one Physical type in a singleattached station (SAS)

• B, which indicates that the CMT process has established a connection with its neighbor and that the bits received during the CMT signaling process indicate that the neighbor is a Physical B dual-attached station or concentrator that attaches to the secondary ring IN and the primary ring OUT when attaching to the dual ring

• M, which indicates that the CMT process has

established a connection with its neighbor and that the bits received during the CMT signaling process indicate that the router’s neighbor is a Physical M-type concentrator that serves as a Master to a connected station or concentrator

• unk, which indicates that the network server has not completed the CMT process

Cmt signal bits Shows the transmitted and received CMT bits

Status Status value displayed is the actual status on the fiber This

can be:

• LSU (Line State Unknown), which indicates that the criteria for entering or remaining in any other line state have not been met

• NLS (Noise Line State), which is entered upon the occurrence of 16 potential noise events without satisfying the criteria for entry into another line state

• MLS (Master Line State), which is entered upon the reception of eight or nine consecutive HQ or QH symbol pairs

• ILS (Idle Line State), which is entered upon the receipt

of four or five idle symbols

• HLS (Halt Line State), which is entered upon the receipt of 16 or 17 consecutive H symbols

• QLS (Quiet Line State), which is entered upon the receipt of 16 or 17 consecutive Q symbols or when carrier detect goes low

• ALS (Active Line State), which is entered upon receipt

of a JK symbol pair when carrier detect is high

• OVUF (Elasticity buffer Overflow/Underflow), which is

the normal states for a connected Physical type are ILS

or ALS

ECM is ECM is the SMT state entity coordination management,

which overlooks the operation of CFM and PCM This can be:

• out when the router is isolated from the network

• in when the router is actively inserted in the network

• trace when the router is trying to localize a stuck beacon condition

• leave when the router is allowing time for all the connections to break before leaving the network

• path_test when the router is testing its internal paths

• insert when the router is allowing time for the optical bypass to insert

• check when the router is making sure optical bypasses switched correctly

• deinsert when the router is allowing time for the optical bypass to deinsert

CFM is Contains information about the current state of the MAC

connection This can be:

• Isolated when the MAC is not attached to any Physical type

• Wrap A when the MAC is attached to Physical A Data

is received on Physical A and transmitted on Physical

A

• Wrap B when the MAC is attached to Physical B Data

is received on Physical B and transmitted on Physical

B

• Thru A when the MAC is attached to Physical A and

B Data is received on Physical A and transmitted on Physical B

RMT is RMT (Ring Management) is the SMT MAC-related state

machine This can be:

• Isolated when the MAC is not trying to participate in the ring

• non_op when the MAC is participating in ring recovery and ring is not operational

• ring_op when the MAC is participating in an operational ring

• detect when the ring has been nonoperational for longer than normal

• non_op_dup when indications have been received that the address of the MAC is a duplicate of another MAC

Token rotation Token rotation value is the default or configured rotation

value as determined by the fddi token rotation-time

command This value is used by all stations on the ring

The default is 5000 microseconds

Ring operational When the ring is operational, the displayed value will be

the negotiated token rotation time of all stations on the ring Operational times are displayed by the number of

hours:minutes:seconds the ring has been up If the ring

is not operational, the message "ring not operational"

is displayed

Upstream | downstream

neighbor Displays the canonical MAC address of outgoing upstream

and downstream neighbors If the interface is not up, these values will be zero (0)

• show interfaces atm Some of the output of the show interfaces atm command is similar to other

show interface commands, however there are several output fields that is unique to the show interfaces atm command Table 3.2 discusses the output for the show interfaces atm command

TABLE 3.2: The show interfaces atm Fields

ATM x is {up | down |

administratively down} Indicates if the interface hardware is active, is down, or has

been shut down

Line protocol is {up |

down} Indicates if the software processes handling the line protocol

consider the link as usable or not

NSAP address The ATM address based on the structure of the OSI network

service access point (NSAP) addresses

Encapsulation(s) ATM adaptation layer (AAL) and encapsulation type

TX buffers The maximum number of transmit buffers for simultaneous

packet fragmentation, set using the atm txbuff interface configuration command

RX buffers The maximum number of receive buffers for simultaneous

packet reassembly, set using the atm rxbuff interface configuration command

Maximum active VCs Maximum number of supported virtual circuits, set using the

atm maxvc interface configuration command Valid values are 256, 512, 1024, or 2048 The default is 2048

VCs per VP The maximum number of VCIs to support per VPI, set using

the atm vc-per-vp interface configuration command

Current VCCs Number of Current Virtual Circuits

VC idle disconnect time Number of seconds the VC can be inactive before

disconnecting

Signaling vc = x, vpi =

x, vci = x The signaling Virtual Circuit number, along with its

associated vpi/vci pair

UNI version = The User-Network Interface (UNI) version determined

through ILMI link autodetermination or using the atm universion interface configuration command

3.3 Token Ring Soft Errors

The Token Ring soft errors are divided into two classes: isolating soft errors and nonisolating soft errors

• Isolating soft errors are those that are caused by the local station; its Nearest Active Upstream

Neighbor (NAUN); or devices and/or medium between the two Table 3.3 list the isolating soft errors

• Non-isolating soft errors are not necessarily caused by the local station or its NAUN but by devices

anywhere in the ring Table 3.4 list the nonisolating soft errors

TABLE 3.3: Token Ring Isolating Soft Errors

Internal error The number of recoverable internal station errors

Burst error Incorrect incoming signal usually due to crosstalk or noise

ARI/FCI error More than one "active monitor present" or "standby monitor

present" frame was received This indicates a problem with the neighbor notification usually caused by NAUN

Abort error Errors during frame transmission

TABLE 3.4: Token Ring Nonisolating Soft Errors

Lost frame Sent frame never returned to the sender

Copy error Frame destined for the station was received with the

address-recognized bit set due to duplicate MAC addresses

Receive congested The station has been unable to copy all the data sent to it The

station could be congested because another station sends it too much data

Token error Generated by Active Monitor and is a valid action, unless it

happens too often

Frequency error Error in the frequency of the incoming signal

3.4 Cisco Discovery Protocol (CDP)

Cisco Discovery Protocol (CDP) is a Cisco proprietary layer 2 protocol that is bundled in Cisco IOS release 10.3 and later versions CDP can run on all Cisco manufactured devices including: routers, switches, hubs, bridges, and communication servers It uses SNAP (layer 2 frame type) and is multicast based By default, a Cisco device running CDP multicasts (sends) information about itself on all its links every 60 seconds Neighbor devices that are directly connected to the device will add the device and its information to their dynamic CDP tables Neighbors hold this information in their CDP tables for the period specified by the CDP hold-time value, which is 180 seconds by default, and refresh them periodically upon receiving updates

If the neighbor does not receive a multicast before its CDP hold-time expires, it deletes the CDP infprmation for the device that failed to multicast an update For this reason, the CDP timers should be consistent among neighboring devices so that a device's CDP information are not delete from a neigbor's CDP table before the device's next multicast If the CDP information is not updated and is deleted, the neighbor's CDP table would be inaccurate The CDP timer and CDP hold-time values are controlled using cdp timer x and cdp

holddown y commands only at the global level

The information a device multicasts includes:

• Its device name;

• Its device capabilities;

• Its hardware platform;

• The port type and number through which CDP information is being sent; and

• One address per upper layer protocol

The [no] cdp run command and the [no] cdp enable command can be used to disable CDP on a router

at the global configuration level The [no] cdp run command will disable the sending of CDP updates on all interfaces The [no] cdp enable command will disable a particular interface only

3.4.1 Common Protocol Characteristics

Network protocols are divided into two classes: connection-oriented protocols and connectionless protocols

• Connection-oriented protocols establish an end-to-end connection before transmitting data Most

connection-oriented protocols are reliable as they guarantee delivery of the data through usage of sequence numbers, acknowledgements, error control mechanisms, and flow control mechanisms Examples include the TCP transport layer member of the TCP/IP protocol suite and the SPX transport layer member of the IPX/SPX protocol suite

When troubleshooting these protocols, check for connection failures and multiple retransmissions Common causes of connection failures are routing problems, access control configurations, and security policies Multiple retransmissions could be due to intermittent links and paths, congestion, or busy devices

• Connectionless protocols do not establish a connection prior to transmitting data Connectionless

protocols have less overhead and are thus faster and require less network resources than connection oriented protocols An example of this type of protocol is the UDP protocol member of the TCP/IP protocol suite This type of protocol is not reliable If the destination to which data is transmitted is unreachable, or is not available, the data delivery fails and the action has to be repeated

When troubleshooting these protocols, check for failing transactions This could be due to bad routes, access control configurations, congestion, and intermittent or faulty paths

3.4.2 Protocol Connection Troubleshooting

Before a connection between two hosts can be successfully established, all the lower layer protocols must be working properly A transport layer protocol cannot establish a connection unless the physical layer, data link layer, and network layer are configured and working properly

3.4.2.1 TCP Connection Sequence

To make a TCP connection using host names, the network must have a working name resolution system to resolve a name to an IP address Routers can use a DNS or an IP host table for name-to-IP-address resolution

Once the host name has been resolved to an IP address, a MAC

address for the frame (i.e., device) via which the first IP packet,

encapsulating the TCP SYN segment, will be transmitted is

required If the destination host is on the same subnet as the local

host which is to transmit the data, the local host performs a local

ARP (Address Resolution Protocol) to obtain the destination

host’s MAC address If the two hosts are on remote subnets, the

local host will either ARP for the local router’s IP address or it

will ARP for the destination host’s address The local router will

reply to the ARP request for the destination host’s IP address if:

• The local router’s interface is configured with IP proxy-ARP

enabled

• The router can route or forward the IP address of the destination host

• The local router has not learned about the destination host’s network via the interface on which it is receiving the ARP request

If no reply is received, frame delivery and the intended IP packet delivery fails and an ICMP message is generated If a reply is received with a MAC address, the MAC address will be used and stored in the ARP table (cache) for a predetermined period of time to prevent sending ARP requests repeatedly for the subsequent frames that are part of the same transmission You can use the show ip arp EXEC command to display the ARP table This allows you to determine which device replied to the ARP request and whether that is a desirable behavior You can also use this command to check accuracy of any static ARP entries currently in the table

The local host submits the first TCP segment (SYN) to the destination host via the local router, which in turn forwards the packet to the next router, and so on until it reaches the destination host If the destination host is configured to respond favorably to the TCP segment (SYN), it will send the TCP reply segment (SYN, ACK) back to the local host On receiving the reply segment, the local host will send the third TCP segment (ACK) to the destination host Once the destination host receives the ACK segment, the TCP connection between the two hosts is established and data can be transmitted between the two Once the data transmissions complete, the connection between the two hosts is terminated

3.4.2.2 Novell Connection Sequence

When a Novell client makes a connection to a Novell server that offers a particular service such as file services, the client sends a Get Nearest Server (GNS) broadcast request via its network interface card (NIC)

If a Novell server offering the service is on the local area network (LAN), it will reply to the client’s request

If a Novell server offering the service is not on the LAN, the router searches in its IPX servers table for an entry that matches the client’s request If the router has the desired

entry, it replies to the client with the selected server’s internal IPX

address However, a reply is not sent if there is a GNS-reply filter

configured on the corresponding interface of the router If more

than one entry is present in the router's IPX server table, the

closest device in terms of hop count is chosen When the client

receives the router’s reply, it generates a RIP broadcast request for the server’s internal network address The router then searches its IPX route table for an entry that matches the client’s request If the router finds a

Segments and Subnets Throughout this study guide, the term

"segment" is used to refer to the transport layer protocol data unit (PDU) and not to a network segment, i.e a subnetwork The term subnet is used throughout this study guide to refer to a subnetwork

Address Resolution Protocol (ARP) Address Resolution Protocol (ARP) is a network layer member of the TCP/IP protocol suite

IPX Server Tables Routers build and maintain IPX server tables by accepting Service Advertisement Protocol (SAP) broadcasts that are generated by neighbor devices

match, it sends a RIP reply to the client Finally, the client sends a Novell Core Protocol (NCP) request to the server to establish a connection Once a connection is established, the file sharing mechanism begins You can use the show novell traffic command to receive information about traffic statistics concerning the number of IPX packets sent and received; the input and output errors encountered; and the broadcast and SAPs generated and received Table 3.5 discuses the various fields of the output from the show novell traffic command

TABLE 3.5: The show novell traffic Fields

Format errors The number of bad packets received A high number of

format errors can be a sign of encapsulation mismatch

Bad hop count Bad hop count increments when a packet’s hop count exceeds

16

Encapsulation failed The router is unable to encapsulate a packet

3.4.2.3 AppleTalk Connection Sequence

When an Apple Macintosh client opens the Chooser applet from Apple’s pull-down menu, the client sends a GetZoneList request on its network The Routers on the local subnet respond using GetZoneList reply, based

on their Apple Zone table and any GetZoneList filters that may be applied to their appropriate interfaces When the client receives the list of zones, its chooser zone field is populated The user then selects a zone and a service This causes the client computer to generate a Name Binding Protocol (NBP) request, which is forwarded by the connected routers towards the selected zone On the subnets that constitutes the destination zone, all devices that offer the selected service will reply to the client computer The client computer then populates the appropriate box in the chooser with the name of all those servers that have sent a reply The user can then select one of the servers When the user selects one of the servers, an AppleTalk Transaction Protocol (ATP) connection sequence between the client and the server begins Once this ATP connection successfully completes, the Apple Filing Protocol (AFP) is used to access shared files on the server

The show appletalk traffic Command

You ca use the show appletalk traffic command to receive information about the number of packets sent and received, various errors encountered, and a classified set of statistics on various AppleTalk protocols and services Table 3.6 discuses some of the fields included in the output of the show appletalk traffic command

TABLE 3.6: The show appletalk traffic Fields

Checksum errors Number of packets dropped since their DDP checksum was bad

Bad hop count Number of packets dropped since the number of hops they

travelled was larger than 15

Access denied Number of packets dropped since access list didn’t permit them

Port disabled Number of packets dropped since routing was disabled for port

due to config error or if a packet is received while in

verification/discovery mode

Encapsulation

failed Number of times packets were received for a connected network,

but the node was not found

No buffers Number of times attempted packet buffer allocation failed

Unknown Number of times Unknown AppleTalk packet types were seen

Wrong encapsulation Nonextended AppleTalk packet on extended AppleTalk port

4 Applying Cisco Troubleshooting Tools

There are some powerful troubleshooting tools that are built into the Cisco IOS Some of these tools have an impact on the way routers operate and may impede the router's performance Following the systematic troubleshooting process discussed in Section 2.2, after defining the problem, you must start gathering detailed facts about the behavior of the devices and protocols of the production network Several IOS troubleshooting tools and commands can be used in this task However, these tools utilize some processing cycles and memory of the router, and may disable or have a negative effect on some of the router’s optimal operations

Several of the Cisco IOS show commands display information about the status of the router, its interfaces, and the rate of utilization of router resources The debug command is a powerful command for finding out which packets are generated, received, and forwarded by a router Several parameters of the debug

command help focus the output on what you are interested in reviewing, but the debug command also lowers a router’s performance

4.1 Routing and Switching Processes

Routing and switching processes are two of the essential tasks performed by routers Switching is commonly defined as the process that takes charge of moving data units (frames or packets) through the anatomy of internetworking devices Routing can be defined as the operation that attempts to select an output interface and perhaps a next hop for a packet based on the packet’s destination address The routing process makes its routing decision by consulting its routing table, which it builds and maintains dynamically

4.2 Switching in Different Routers Models

4.2.1 The 7000 Series

The 7000 series routers have a fast switching option that is enabled by default Fast switching is performed using a Fast Switch Cache in the Route Processor Two major components that participate in the routing and switching operations are the Route Processor (RP) and the Silicon Switch Processor (SSP) The early models

of the 7000 series had a RP and a Switch Processor (SP) The SP only had an Autonomous Switch Cache The SSP has both an Autonomous Switch Cache and a Silicon Switch Cache However, autonomous and silicon switching are not enabled by default You can enable either or both of these switching options on a per-protocol basis at each interface of a router The commands for enabling and disabling fast switching, autonomous switching, and silicon switching are:

Router(config-if)# [no] [protocol] route-cache

Router(config-if)# [no] [protocol] route-cache cbus

Router(config-if)# [no] [protocol] route-cache sse

respectively

4.2.2 The 7500 Series

Improvements in the 7500 series routers include:

• The internal bus (CyBus) operates at 1 Gbps, i.e about twice the speed of the 7000 router’s CxBus

• The 7500 router is equipped with one component called the Route/Switch Processor instead of having two separate components for RP and SSP This eliminates the slow 153 Mbps system bus previously needed to connect the RP and SSP

• The switch cache of the 7500 series router, called Optimum Switch Cache, is faster than the Silicon Switch Cache of the 7000 router

Fast switching in the 7500 router is enabled by default and it is accomplished using the Fast Switch Cache located in the Route Switch Processor (RSP) The second type of switching performed by the 7500 router is called optimum switching and is faster than the 7000 router’s Silicon Switch Cache The Optimum Switch Cache is also located on the RSP

By default, optimum switching is enabled for IP on all supported interfaces However, it must be manually enabled on each interface for all other protocols You can use the following interface configuration command to enable or disable optimum switching for a protocol on an interface:

Router(config-if)# [no] [protocol] route-cache optimum

The 7500 routers also feature Versatile Interface Processors (VIPs) that have a RISC processor and memory locally (on the blade) The 7500 routers can be configured to distribute routing information to be stored on the VIP The VIP can then use the cached information to switch the packets on its own without having to send packets over to the RSP This method, which is called distributed switching, makes the processing of packets more than three times faster than silicon switching To enable or disable distributed switching for a protocol on a VIP card, use the following interface configuration command:

Router(config-if)# [no] [protocol] route-cache distributed

Netflow switching was introduced with Cisco IOS version 11.1(2) It identifies a flow based on the source and destination IP address, source and destination port, protocol type, type of service (TOS), and input interface Netflow switching caches security information and accounting information as well as routing information for each flow, hence, once a network flow is identified and the first packet of this flow is processed, access list checks for subsequent packets belonging to the same flow are bypassed and packet switching and statistics capture are performed in tandem Netflow also allows for exporting captured data to management utilities However, netflow switching can be resource intensive, especially with the export option On 7000 and 7500 routers with RSP, Netflow switching can be performed on a distributed basis on individual VIPs You can enable or disable netflow switching by using the following interface configuration command:

Router(config-if)# [no] [protocol] route-cache flow

4.2.3 The 4000, 3000, and 2500 Series

The 4000, 3000, and 2500 series routers are not high-end routers These routers have only the process switching and fast switching options Fast switching is enabled by default on all interfaces for all supported protocols You can disable or enable fast switching on an interface for a particular protocol using the following command:

Router(config-if)# [no] [protocol] route-cache

To determine whether fast switching is enabled or disabled for a particular protocol on a particular interface, use the following command:

Router# show [protocol] interface type number

To see the statistics on the number of packets that are process switched and fast switched, use the following command:

Router# show interface stats

Process-Switched Packets include:

• Data-link layer broadcasts;

• Packets subjected to Debug;

• Packets delivering error log messages to syslog;

• SNMP packets;

• Protocol translations;

• Tunneling;

• Custom and priority queuing;

• Link compression; and

• Keepalives

4.3 The debug Tool

Debug is a troubleshooting command that is available from the privileged exec mode in the Cisco IOS It can

be used to display information about various router operations and the related traffic generated or received

by the router, as well as any error messages

Debug is treated as a very high priority task and can consume a significant amount of resources as the router

is forced to process-switch the packets being debugged For this reason, debug should not be used as a monitoring tool Use the debug command:

• with the timestamp service to see a timestamp with each line of the debug output Load the timestamp service the using the router(config)#service timestamps debug [ datetime | uptime]

command;

• with the terminal monitor command to see the debug output from within a Telnet session;

• to diagnose a specific facility, task, or protocol

Before using the debug command, monitor the router's CPU utilization using the show processes cpu

command If the router’s CPU utilization is consistently at 50% or more, debug events instead of packets Avoid using the debug all command Also use the debug command during off peak periods when ever

list with the debug command to focus the debug output on the task you are troubleshooting This requires using the debug ip packet detail command You should issue the undo debug command as soon as possible You can use the no debug {argument} to turn off a specific debugging type; and the no debug all or undebug all commands to turn off all debugging

logging console [level] Turns console logging on and specifies the level of logging

to be directed to the console The no logging console

command disables console logging

logging buffered [level] Enables sending logging messages to the internal buffer

and specify the level of logging desired to be buffered Can

be disabled by using the no logging buffered

command

logging monitor [level] Enables sending logging messages to the virtual terminal

sessions and specify the level of logging desired to be directed to the virtual terminal lines Can be disabled by using the no logging monitor command

From within a virtual terminal session, typing the command terminal monitor enables the display of logging messages The command terminal no monitor

turns this feature off

logging trap [level] Allows you to enable sending logging messages to syslog

servers and specify the level of these messages Can be disabled by using the no logging trap command

logging [ip-address] Identifies the IP address of the syslog server so that the

router can direct its logging messages to this address Use the no form of this command to take a server off the list

There are eight levels of logging that you can specify Each level determines a different level of severity that

is logged The eight levels are: emergencies; alerts; critical; errors; warnings; notifications;

informational; and debugging Table 4.2 discusses the eight levels of logging messages

TABLE 4.2: Logging Message Severity Levels

notifications 5 Normal significant

condition

LOG_NOTICE

informational 6 Informational messages only LOG_INFO

The privileged EXEC show logging command can be used to display the state of syslog error and event logging, including host addresses, which type of destination logging is enabled, and other logging statistics This command also displays the messages that are logged in the buffer

4.5 Reachability and Path Tests

Testing reachability from one node to another in a network is one of the most basic tests to perform during support tasks Testing the path a packet takes, i.e the nodes through which it passes is another These tests are often used during fact gathering or when observing the results of an action taken Two commands that are useful for testing reachability and paths are ping and traceroute (also referred to as trace)

4.5.1 The ping Command

The ping command is supported at the user and privileged exec modes In user mode, you must specify an

IP address or a host name, if the host name can be resolved to an IP address, with the ping command The

ping command tests the round-trip path to and from a target In privileged mode, you must enter a protocol,

a target IP address, a repeat count, datagram size, and a timeout in seconds

Cisco IOS makes ping available for a number of protocols including IPX and AppleTalk Cisco introduced ping for IPX in IOS version 8.2 This is, however, a Cisco proprietary tool Therefore non-Cisco devices such as Novell servers do not respond to it If you want the Cisco router to generate Novell-compliant pings, you must use the global configuration command ipx ping-default novell Ping for AppleTalk sends AppleTalk Echo Protocol (AEP) packets to the destination node and waits for replies

4.5.2 The traceroute Command

The traceroute command was introduced with the release 10.0 of Cisco IOS and can be used to find the path between IP devices Initially, traceroute was available only for the IP protocol but since release 12.0 of Cisco IOS, traceroute is also available for IPX The traceroute command can be executed in user and privileged exec modes, but in privileged exec mode, you can the extended trace, which is more flexible and informative

4.6 Gathering further information

Network diagrams and the output of the show version and show running-config commands are among the most general information you can gather If you are dealing with hang or crash scenarios, the output of the show stacks command and core dump are useful

4.6.1 The show version Command

Depending on the type of router, different hardware configuration and non-standard software options are displayed by the show version command The show version command displays the IOS version number and its internal name It also displays the Bootstrap software and the RXBOOT image versions; the system uptime, how the system last restarted, and the image filename and where it loaded from If the router encounters errors such as software crashes that force the router to reload, this information can be quite useful The show version command also provides hardware information such as processor type, memory size, existing controllers and non-standard software options, as well as the value of the config register in hex format

4.6.2 The show buffers Command

The show buffers command displays statistics on buffer

elements, public buffer pools, and interface buffer pools Buffer

elements are small data structures that are used for internal

operating system queues or when a buffer must be associated with

more than one queue The public buffer pools are presented in the

second section of the show buffers output and each buffer size is

presented with its own statistics The last section of the show

buffers command output displays the buffer statistics for each of

the router’s interfaces

4.6.3 The show memory Command

The show memory exec command is used to check the amount of

free memory on a router This is useful in troubleshooting cases

where router performance is the issue

4.6.4 The show processes Command

The show processes exec command displays the router’s CPU utilization and lists the active processes

together with their corresponding process ID, priority, CPU time, etc This command is useful when you are evaluating the router’s performance and CPU utilization To get a more reliable indication of which processes are invoked most often and how much CPU time they consumed, execute the show processes

command a few times at one-minute intervals

System Buffers System buffers are memory that is allocated from main system memory (RAM) to hold packets while they are process-switched There are six buffer sizes: Small Buffers (104 Bytes); Middle Buffers (600 Bytes); Big Buffers (1524 Bytes); Very Big Buffers (4520 Bytes); Large Buffers (5024 Bytes); and Huge Buffers (18024 Bytes) A buffer must be allocated and free at the time a packet arrives, or the packet will be dropped However, the router cannot have too many buffers allocated and free as that will reduce the available memory Therefore routers have minimum number of buffers for each size allocated at all times, and dynamically allocated and de-allocated buffers based on the traffic rate

4.6.5 The show controllers cxbus Command

The show controllers cxbus command is used on the Cisco 7x00 series routers to display information

about the SP, the CxBus controller, and the contents and microcode of cards attached to the bus This information is useful for diagnostic tasks performed by Cisco support engineers only

4.6.6 The show stacks Command

The exec command show stacks can be used to diagnose system crashes This command’s output displays stack utilization of processes and interrupt routines, and the reason for the last system reboot When a system crash occurs, failure type, failure program counter (PC), address, and a stack trace are saved by the ROM Monitor The show stacks command displays this data It also displays the stack trace if a crash

occurred Crashes are usually caused by one of the errors listed in table 4.3

TABLE 4.3 : Common Failure Reported by the show stacks Command

Bus error The processor tried to use a device or a memory location

that either did not exist or did not respond properly

Address error The software tried to access data on incorrectly aligned

boundaries

Watchdog timeout Watchdog timer was not reset and caused a trap

Parity error Internal hardware checks have failed due to hardware

problems

Emulator trap Processor executed an illegal instruction Can also be

caused by a hardware problem

4.6.7 Core Dumps

Core dumps can also be useful for determining the cause of a crash A full copy of memory image is called a core dump These dumps are usually submitted to Cisco support engineers, who are specialized in analyzing the memory image The core dump can transfer the binary image file using TFTP, FTP, or RCP protocols However, performing a core dump disrupts regular network operation Therefore, if the router is malfunctioning, but has not crashed, you should use the write core command to generate a core dump without reloading You must also ensure that the server is reachable and has enough storage space for the core dump The exception dump ip-address global configuration command, where ip-address is the address of the server, causes the router to attempt to produce a core dump when it crashes and write the core

dump to a file named <hostname->core on the server, where <hostname> is the name of the router You

can use the exception core-file filename command to change the name of the core file

Note: If you use the TFTP protocol to dump the core file to a server, the router

will only dump the first 16 MB of its memory image If the router’s memory

is larger than 16 MB, part of the image will be missing If the router’s memory is larger than 16 MB you should use either the FTP or the RCP protocol to dump the core file

5 Diagnosing and Correcting Campus TCP/IP, Novell Networking and AppleTalk Problems

5.1 Cisco IOS Troubleshooting Tools and Commands for TCP/IP, IPX and AppleTalk

Tools and commands include ping, trace, show and debug For apple talk, it also includes the test

command

5.1.1 The ping , traceroute and test Commands

As discussed in Section 4.5, ping is included as a part of the TCP/IP protocol suite and has been introduced IPX with Cisco IOS release 8.2 Ping can be used to test reachability in a TCP/IP or IPX/SPX network On Cisco routers, ping is provided in user mode and in privileged exec mode The latter has an extended ping Before Cisco IOS Release 11.1, the privileged ping command with the confirm, lookup and poll (NBP) option, also known as nbtest, provided information on NBP-registered entities which is useful for identifying problem nodes on AppleTalk networks The confirm option sends an NBP confirm packet to the specified entity; the lookup option will prompt you for a name, type, and zone before looking up a Network Visible Entity (NVE); and the poll option searches for all devices in all zones As of IOS Release 11.1, this functionality is provided by the test appletalk privileged exec command The test appletalk command also uses the NBP options to provide information on NBP-registered entities

Another testing application that is part of the TCP/IP suite is the trace command which can be used to find

the path between two IP devices In Cisco IOS the command is called traceroute, but usage of the shortened form, trace, is also supported In Microsoft operating systems the command for the trace utility is called tracert The traceroute utility is available from the user mode and from privileged exec mode

The extended traceroute is only available from the latter

5.1.2 The show ip , show ipx and show appletalk Commands

The show ip command, the show ipx command and show appletalk command lists a summary of an

interface’s IP, IPX or AppleTalk information and status, depending on which command is used

5.1.2.1 The show ip Commands

The show ip command can have a number of parameters Each of these IP parameters can cause significant change in a router’s behavior In addition, there are a number of show ip commands These commands include:

• show ip interfaces [ type name ], which allows you to verify that the interface is properly configured;

• show ip access-list [ access-list-number | name], which displays the contents of all current IP access lists As indicated, you can specify an access list number or name with this command to display only the contents of the specified access list

• show ip route [ address [ mask]] | [ protocol [ process-id]], which displays the current state of the routing table If you specify a protocol name, such as bgp, igrp, eigrp, rip, ospf and isis, and

AS number or process ID, then only those entries corresponding to the routing protocol specified will be displayed

• show ip arp [ ip-address] [ hostname] [ mac-address] [ type number], which displays the

IP Address Resolution Protocol (ARP) cache You can use the optional parameters to verify only the ARP entries corresponding to a particular host, or only entries learned via a specific interface

• show ip traffic, which displays statistics about IP traffic This allows you to monitor statistics such

as the number of packets sent and received, error counts, and broadcasts/multicasts

• show ip protocols, which displays the parameters and current state of the active routing protocols This is useful for checking which routing protocols are active, what their AS-numbers or process-ids are, which networks they are configured for, if they are redistributing any routing information, and if there are any filters active for the routing protocols

5.1.2.2 The show ipx Commands

Similarly, there are a number of show ipx commands, including:

• show ipx interfaces, which is useful for verifying the settings for various timers such as SAP and RIP update/aging intervals This command can also be used to view information about all the filters that may be active for traffic, routing, and SAP management purposes; as well as packet statistics such as the number of RIP and SAP packets sent and received in the output of this command

• show ipx route [ type name ], which can be used to display a router’s IPX routing table This table contains information about connected IPX networks, static routes, and dynamic IPX routes leaned through IPX routing protocols in Alternatively, you can use the show [protocol] route command to check the state of the routing table for a specific protocol in order to ensure that the router is properly configured for the networks it is directly connected to and that it is properly receiving routing information from its routing peers

• show ipx traffic, which displays information about the total number of packets received; the number

of broadcasts sent and received, and the number of packets sent, forwarded, and dropped; as well as statistics on SAP, RIP, IPX Echo, Watchdog, queue lengths, and any other IPX routing protocols that are active Thus, this command informs you if the router is successfully sending and receiving IPX packets, broadcasts, SAP, RIP, and other IPX-related traffic

• show ipx servers, which displays the content of the local router’s SAP table This table contains a list

of IPX servers learned through received SAPs, or those servers that the local router is statically configured to advertise

• show ipx eigrp [ interfaces | neighbors | topology | traffic ], which displays information about the IPX-related operation and activities of the EIGRP protocol The neighbors

option can be used to find out if your router has a neighbor relationship with those intended, while the

topology option can be used to view EIGRP’s topology table

• show ipx nlsp, which can be used to obtaining information about the state, database, neighbors, and activities of the NetWare Link Services Protocol (NLSP) NLSP is a link state routing protocol can be used for IPX routing and may be activated with or without a process tag A process tag is useful in cases where you must run multiple copies of the NLSP process on the same router The show ipx nlsp

[process-tag] command must be used with a database, neighbors or spf-log parameter

5.1.2.3 The show appletalk Commands