| Layer / topic | Command | Answers |
|---|---|---|
| Interfaces | show ip interface brief | Which interfaces are up/up and their addresses |
| Interfaces | show interfaces | Errors, duplex, speed, drops |
| Switching | show vlan brief / show interfaces trunk | VLANs, access ports, trunks |
| Switching | show mac address-table | Which MAC is on which port |
| Spanning tree | show spanning-tree | Root, port roles and states |
| Routing | show ip route | Known networks and how they're learned |
| OSPF | show ip ospf neighbor | Who we've adjacency with |
| Addressing (host) | ipconfig / ip addr | A PC's address, mask, gateway |
| Reachability | ping / traceroute | End to end, and where it stops |
| DHCP | show ip dhcp binding | Which addresses were leased |
| NAT | show ip nat translations | Active translations |
| ACL | show access-lists | The rules and their hit counts |
| Security | show port-security / show ip ssh | Port security and SSH state |
Tip:
pingfrom the device that has the problem, to the far end, then work inward until it fails - that's the layer or hop to fix.tracerouteshows exactly where it stops.
Remember: One show command per layer: ip int brief, vlan brief, ip route, ip ospf neighbor, ping. Learn which one answers which question.