Basic Switching and Routing Process and Effective IOS Troubleshooting Commands

Chapter 4:
Basic Switching and

Routing Process and
Effective IOS
Troubleshooting
Commands
CCNP TSHOOT: Maintaining and Troubleshooting IP Networks
TSHOOT v7 Chapter 4
© 2007 – 2016, Cisco Systems, Inc. All rights reserved. Cisco Public 1
Chapter 4 Objectives
 Basic Layer 2 switching process
 Basic Layer 3 routing process
 Selective information gathering using IOS show
commands, debug commands, ping, and Telnet
Chapter 4
Basic Layer 2
Switching Process
Chapter 4
Ethernet Frame Forwarding (Layer 2 Data
Plane)
Host A pings Host B on the same VLAN (subnet).
 Step 1. Host A will look up the destination (Host B) IP address in
its routing table and determine that it is on a directly connected
network.
 Step 2. Because Host B is directly reachable, Host A will consult
its Address Resolution Protocol (ARP) cache to find the MAC
address of Host B.
Chapter 4
Plane) – Cont.
DMAC SMAC Type Data FCS
BCAST MAC A 0x0806 ARP Request CRC
 Step 3. If the ARP cache on Host A does not contain an entry for
the IP address of Host B, it will send out an ARP request as a
broadcast to obtain the MAC address of Host B (see Figure 4-2 ).
Chapter 4
Plane) – Cont.
DMAC SMAC Type 802.1Q Type Data FCS
BCAST MAC A 0x8100 VLAN 10 0x0806 ARP Request CRC
 Step 4. Switch C checks the VLAN of the port upon which it receives the frame,
records the source MAC address in its MAC address table, and associates it to that
port and VLAN. Switch C will perform a lookup in its MAC address table to try to find
the port that is associated to the broadcast MAC address.
 The MAC address table never contains an entry for the broadcast MAC address
(FFFF:FFFF:FFFF). Therefore, Switch C will flood the frame on all ports in that
VLAN, including all trunks that this VLAN is allowed, that are active, and that are not
pruned on (except the port it came in from).
Chapter 4
Plane) – Cont.
DMAC SMAC Type Data FCS
MAC A MAC B 0x0806 ARP Reply CRC
 Step 5. Host B receives the ARP request, records the IP address

and MAC address of Host A in its own ARP cache, and then
proceeds to send an ARP reply as a unicast back to Host A
Chapter 4
Plane) – Cont.
MAC A MAC B 0x8100 VLAN 10 0x0806 ARP Reply CRC
 Step 6. The switches will check the VLAN of the port they received the
frame on, and because all switches now have an entry in their MAC
address table for the MAC address of Host A, they will forward the
frame containing the ARP reply on the path to Host A only, not flooding
it out on any other port.
 At the same time, they will record Host B’s MAC address and
corresponding interface and VLAN in their MAC address table if they did
not already have that entry
Chapter 4
Plane) – Cont.
MAC B MAC A 0x8100 VLAN 10 0x0800 ICMP Echo Request CRC
 Host A encapsulates the IP packet (ICMP Echo Request) in

a unicast frame and sends it to Host B.
 Switches forward ICMP Echo Request unicast frame toward
Host B.
Chapter 4
Plane) – Cont.
MAC A MAC B 0x8100 VLAN 10 0x0800 ICMP Echo Reply CRC
 Step 10. Host B receives the packet and responds to Host A (by
sending an ICMP echo-reply packet).
 Step 11. The switches again consult their MAC address tables
and forward the frame straight to Host A, without any flooding
Chapter 4
Plane) – Cont.
 Step 12. Host A receives the packet, and this concludes this
simple packet exchange
Chapter 4
Plane) – Cont.
Issues that could cause the communication to fail:
• Physical problems
• Bad, missing, or miswired cables
• Bad ports
• Power failure
• Device problems
• Software bugs
• Performance problems
• Misconfiguration
• Missing or wrong VLANs
• Misconfigured VTP settings
• Wrong VLAN setting on access ports
• Missing or misconfigured trunks
• Native VLAN mismatch
• VLANs not allowed on trunk
Chapter 4
Layer 2 Switching Verification
Following the frame path may help to reduce the scope of the problem:
Remember the mac address tables keep information for 5 minutes
Use the clear mac-address-table dynamic to force rebuilt
Common findings when following the path of the frames through the
switches:
Frames are not received on the correct VLAN: This could point to
VLAN or trunk misconfiguration as the cause of the problem.
Frames are received on a different port than you expected: This
could point to a physical problem, spanning tree issues, a native VLAN
mismatch or duplicate MAC addresses.
The MAC address is not registered in the MAC address table: This
tells you that the problem is most likely upstream from this switch.
Investigate between the last point where you know that frames were
received and this switch.
Chapter 4
Layer 2 Switching Verification – Cont.
Useful Layer 2 diagnostic commands:
 show mac-address-table: Shows learned MAC addresses and
corresponding port and VLAN associations.
 show vlan: Verifies VLAN existence and port-to-VLAN associations.
 show interfaces trunk: Displays all interfaces configured as trunks,
VLANs allowed and what the native VLAN is.
 show interfaces switchport: Provides a summary of all VLAN
related information for interfaces.
 show platform forward interface: Used to determine how the
hardware would forward a frame.
 traceroute mac: Provides a list of switch hops (layer 2 path) that a frame
from a specified source MAC address to a destination MAC address
passes through. CDP must be enabled on all switches in the network for
this command to work.
 traceroute mac ip: Displays Layer 2 path taken between two IP hosts.
Chapter 4
Basic Layer 3
Routing Process
Chapter 4
Basic Layer 3 Routing Process
 For most connectivity problems in IP networks, the network
layer is the point where troubleshooting efforts start.
 Examining network layer connectivity between two hosts
helps determine whether the problem cause is at the same,
lower, or higher layer than the network layer of the Open
Systems Interconnection (OSI) model.
 Comprehending the processes and data structures used by
routers to forward IP packets and the Cisco IOS tools that
can be used to diagnose those types of problems are
valuable when troubleshooting a network.
Chapter 4
IP Packet Forwarding (Layer 3 Data Plane)
 Which decisions does Host A make, what information does it need, and
which actions does it perform to successfully send a packet destined for
Host B to the first hop Router C?
1. Determines whether the destination network is the same or different
from its own local subnet. This is done by comparing the destination
IP address to its own IP address and subnet mask.
a) Host A concludes that the destination is not local, and therefore it attempts to
forward the packet to its default gateway, which is known through manual
configuration or learned through Dynamic Host Configuration Protocol (DHCP).
b) To encapsulate the packet in an Ethernet frame, Host A needs the MAC
address of the default gateway. This can be resolved using the Address
Resolution Protocol (ARP). Host A will either already have an entry in its ARP
cache for the default gateway IP address or, alternatively, it will send out an
ARP request to obtain the information and populate the cache.
Chapter 4
 Which decisions does Router C make, what information does it need,

and which actions does it perform to successfully send the packet from
Host A destined for Host B to the next hop, Router D?
1. Router C de-encapsulates the IP packet from the received Ethernet
frame and examines the destination IP address of the IP packet.
2. Router C decrements the Time To Live (TTL) field in the IP header of
the packet by one.
1. If this causes the TTL field to be set to zero, Router C will discard the packet
and send an Internet Control Message Protocol (ICMP) “time exceeded”
message back to the source, Host A.
2. If the TTL of the packet is not reduced to zero, the router performs a forwarding
table lookup to find the longest prefix that matches the destination IP address of
the packet being processed.
Chapter 4
 Which decisions does Router D make, what information does it

need, and which actions does it perform to successfully send the
packet from Host A destined for Host B to the next hop, Router
E? Is the answer to this question the same as the answer to the
previous question or are there any differences?
• The biggest difference with the previous step is the Layer 2 protocol of
the egress interface. Because this is a Fast Ethernet interface, the router
might have to make use of ARP to resolve the next-hop IP address.
• Normally, Router D has this address recorded in its Cisco Express
Forwarding (CEF) adjacency table and need not use ARP.
Chapter 4
 Which decisions does Router D make, what information does it

need, and which actions does it perform to successfully send the
packet from Host A destined for Host B to the next hop, Router
E? Is the answer to this question the same as the answer to the
previous question or are there any differences?
• The biggest difference with the previous step is the Layer 2 protocol of
the egress interface. Because this is a Fast Ethernet interface, the router
might have to make use of ARP to resolve the next-hop IP address.
• Normally, Router D has this address recorded in its Cisco Express
Forwarding (CEF) adjacency table and need not use ARP.
Chapter 4
 Are there any differences in the processes and information

required to successfully transmit return packets from Host B
back to Host A?
• The process in sending return packets from Host B to Host A is
similar.
Chapter 4
Chapter 4
Cisco Express Forwarding
 Executing different table lookups and combining the information
to construct a frame every time a packet needs to be routed is an
inefficient approach to forwarding IP packets.
 To improve this process and increase the performance of IP
packet-switching operations on routers, Cisco has developed
Cisco Express Forwarding (CEF).
 CEF combines the information from the routing table and other
data structures, such as Layer 3 to Layer 2 mapping tables, into
two new data structures:
• Forwarding Information Base (FIB)
• FIB mostly reflects the routing table with all the recursive lookups resolved
• A lookup in the FIB results in a pointer to an adjacency entry in the CEF
adjacency table
• CEF adjacency table.
• an adjacency table entry can consist of an egress interface only for a point-to-
point interface or an egress interface and next-hop IP address for a multipoint
interface.
Chapter 4
Using IOS Commands to Verify IP Packet
Forwarding
To display the content of the IP routing table, you can use the
following commands:
 show ip route ip-address : Display the best route that
matches the address and all associated control plane details.
• Note that the default route will never be displayed as a match for an IP
address.
 show ip route network mask : Request the routing table to be
searched for an exact match and it is displayed with all of its
associated control plane details.
 show ip route network mask longer-prefixes: Display all
prefixes in the routing table that fall within the prefix specified by
the network and mask parameters. This command can prove
useful to diagnose problems related to route summarization.
Chapter 4
Using IOS Commands to Verify IP Packet
Forwarding
To display the content of the CEF FIB table, you can use the
following commands:
 show ip cef ip-address : Similar to the show ip route ip
address command, but it searches the FIB rather than the routing
table. Therefore, the displayed results do not include any routing
protocol-related information, but only the information necessary
to forward packets.
• Note that this command will display the default route if it is the best match
for a particular IP address.
 show ip cef network mask : similar to the show ip route
network mask
 show ip cef exact-route source destination : This
command displays the exact adjacency that will be used to
forward a packet with source and destination IP addresses.
• The main reason to use this command is in a situation when you are
tracking a packet flow across the routed network but the routing table and
FIB contain two or more equal routes for a particular prefix.
Chapter 4
Using IOS Commands to Verify Data Frame
Information
 show arp: verify the dynamic IP address to Ethernet MAC
address mappings that were resolved and stored by ARP in
the ARP table
 show adjacency detail: display the full frame header that

will be used to encapsulate the packet. In addition, this
command displays packet and byte counters for all traffic
that was forwarded using this particularadjacency entry.

Chapter 4
Selective Information
Gathering Using IOS show
Commands, debug Commands,
Ping, and Telnet
Chapter 4
Filtering Output of the show ip route Command
Chapter 4
Using include , exclude , and begin Keywords
with show Commands
Chapter 4
Using the | section and the ^ Options to Filter the
Output of the show Commands
Chapter 4
Using the redirect , append , and tee Options with the
IOS show Commands
Chapter 4
Testing Network Connectivity Using Ping
 repeat repeat-count : By default, the Cisco IOS ping command

sends out five ICMP echo-request packets. The repeat option enables
you to specify how many echo request packets are sent.
 size datagram-size : This option enables you to specify the total size
of the ping packet (including headers) in bytes that will be sent. In
combination with the repeat option, you can send a steady stream of
large packets and generate some load.
 source [ address | interface ] : This option enables you to set
the source IP address or interface of the ping packet
 df-bit: This option sets the Don’t Fragment bit in the IP header to
indicate that routers should not fragment this packet. If it is larger than
the MTU of the outbound interface, the router should drop the packet
and send an ICMP “Fragmentation needed and DF bit set” message
back to the source. This option can prove very useful when you are
troubleshooting MTU-related problems.
Chapter 4
Testing Network Connectivity Using Ping
Chapter 4
ping Extended Option: Sweep Range of Sizes
Chapter 4
Testing Network Connectivity Using Telnet
Chapter 4
Collecting Real-Time Information Using Cisco
IOS debug Commands
 debug interface interface-slot/number : Provides debug messages
for specific physical ports on the device.
 debug ip icmp: Used to troubleshoot connectivity issues, from the output
you can see whether the device is sending or receiving ICMP messages.
 debug ip packet: Used to troubleshoot end-to-end communication. It
should always be used with an access control list (ACL).
 debug eigrp packets hello: Used to troubleshoot neighbor
establishment. It shows the frequency of the sent and the received hello
packets.
 debug ip ospf adjacency: Provides information about events
concerning adjacency relationships with other OSPF routers.
 debug ip ospf events: Provides information about all OSPF events.
 debug ip bgp updates: Provides information about routes you have
advertised/ received from your BGP peer.
 debug ip bgp events: Provides information about any BGP event, such
as neighbor state changes.
 debug spanning-tree bpdu receive: Used to confirm the bridge
protocol data unit (BPDU) flow on switches.
Chapter 4
Collecting Real-Time Information Using Cisco
IOS debug Commands
Chapter 4
Diagnosing Hardware Issues Using Cisco IOS
Commands
 Checking CPU Utilization
Chapter 4
Commands
 Checking Memory Utilization
Chapter 4
Commands
 Checking Interfaces
Chapter 4
Commands
 show controllers: This command provides more detailed
packet and error statistics for each type of hardware and
interface.
 show platform: The output of this command can be
helpful to troubleshoot a router crash. On many Cisco LAN
switches, this command can be used to examine the TCAM
and other specialized switch hardware components.
 show inventory: This command lists the hardware
components of a router or switch.
 show diag: On routers, you can use this command to
gather even more detailed information about the hardware
than the output provided by the show inventory command.
Chapter 4
Chapter 4 Summary – Cont.
Basic Layer 2 Switching Process
Basic Layer 3 Routing Process
Selective Information Gathering Using IOS show Commands,
debug Commands, Ping, and Telnet
Chapter 4
Chapter 4 Labs
 Lab4-1 Layer 2 Issues
 Lab4-2 Mixed Layer 2-3 Connectivity
Chapter 4
Chapter 4
Acknowledgment
• Some of the texts and images are from Troubleshooting and Maintaining Cisco
IP Networks (TSHOOT) Foundation Learning Guide by Amir Ranjbar
(158720455X)
• Copyright © 2015 – 2016 Cisco Systems, Inc.
• Special Thanks to Bruno Silva
Chapter 4

Basic Switching and Routing Process and Effective IOS Troubleshooting Commands

Uploaded by

Copyright:

Available Formats

Basic Switching and Routing Process and Effective IOS Troubleshooting Commands

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Basic Switching and Routing Process and Effective IOS Troubleshooting Commands

Uploaded by

Copyright:

Available Formats

Chapter 4:

Basic Switching and

DMAC SMAC Type Data FCS

BCAST MAC A 0x0806 ARP Request CRC

DMAC SMAC Type 802.1Q Type Data FCS

BCAST MAC A 0x8100 VLAN 10 0x0806 ARP Request CRC

DMAC SMAC Type Data FCS

MAC A MAC B 0x0806 ARP Reply CRC

 Step 5. Host B receives the ARP request, records the IP address

DMAC SMAC Type 802.1Q Type Data FCS

MAC A MAC B 0x8100 VLAN 10 0x0806 ARP Reply CRC

DMAC SMAC Type 802.1Q Type Data FCS

MAC B MAC A 0x8100 VLAN 10 0x0800 ICMP Echo Request CRC

 Host A encapsulates the IP packet (ICMP Echo Request) in

DMAC SMAC Type 802.1Q Type Data FCS

MAC A MAC B 0x8100 VLAN 10 0x0800 ICMP Echo Reply CRC

 Which decisions does Router C make, what information does it need,

 Which decisions does Router D make, what information does it

 Which decisions does Router D make, what information does it

 Are there any differences in the processes and information

 show adjacency detail: display the full frame header that

 repeat repeat-count : By default, the Cisco IOS ping command

You might also like