Ping and traceroute
ping tests reachability both ways: a reply proves the target has a route back. On a router, the codes are ! reply, . timeout, U unreachable (a router on the way had no route). traceroute shows each router on the path, so it shows where a path stops.
A router's ping uses the outgoing interface's address as its source. ping ... source (or the extended ping dialog: type ping alone) tests from another address, for example the LAN side, which proves the far end has a route back to the LAN:
In NetLab
▶ R1 R1>enable R1#ping 8.8.8.8 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms R1#ping 8.8.8.8 source g0/0.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: Packet sent with a source address of 192.168.10.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms R1#ping 8.8.8.8 repeat 20 size 1400 Type escape sequence to abort. Sending 20, 1400-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (20/20), round-trip min/avg/max = 1/1/1 ms R1#traceroute 8.8.8.8 Type escape sequence to abort. Tracing the route to 8.8.8.8 VRF info: (vrf in name/id, vrf out name/id) 1 8.8.8.8 1 msec 1 msec 1 msec
Logs
Interfaces going down, port channels, spanning tree events and err-disabled ports are all logged. show logging shows the buffer; filter it with | include.
Packet capture
When you need to see the traffic itself, IOS can capture packets on an interface (Embedded Packet Capture). Define where and what, start, generate traffic, stop, and read the buffer:
In NetLab
▶ R1 R1>enable R1#monitor capture CAP interface g0/0.20 both R1#monitor capture CAP match ipv4 any any R1#monitor capture CAP start *Mar 1 00:00:04.000: %BUFCAP-6-ENABLE: Capture Point CAP enabled. ▶ PC2 student@PC2:~$ ping -c 2 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=2 ttl=254 time=0.640 ms --- 8.8.8.8 ping statistics --- 2 packets transmitted, 1 received, 50% packet loss, time 1001ms rtt min/avg/max/mdev = 0.640/0.640/0.640/0.000 ms ▶ R1 R1#monitor capture CAP stop Capture statistics collected at software: Capture duration - 1 seconds Packets received - 0 Packets dropped - 0 Packets oversized - 0 *Mar 1 00:00:07.001: %BUFCAP-6-DISABLE: Capture Point CAP disabled. R1#show monitor capture CAP buffer brief ---------------------------------------------------------------------------- # size timestamp source destination dscp protocol ----------------------------------------------------------------------------
Tip: In NetLab, Packet Walk shows every frame hop by hop with the reason for each switch and router decision. Use it to check your theory, but practise reading the real show commands too: the exam (and real networks) only have those.