Traceroute mac ip

Use the traceroute mac ip privileged EXEC command to display the Layer 2 path taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname.

traceroute mac ip {source-ip-address | source-hostname} {destination-ip-address | destination-hostname} [detail]

Syntax Description

source-ip-address	Specify the IP address of the source switch as a 32-bit quantity in dotted-decimal format.
destination-ip-address	Specify the IP address of the destination switch as a 32-bit quantity in dotted-decimal format.
source-hostname	Specify the IP hostname of the source switch.
destination-hostname	Specify the IP hostname of the destination switch.
detail	(Optional) Specify that detailed information appears.

For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.

When the switch detects an device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.

•If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path.

•If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and an error message appears.

The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination IP addresses and by using the detail keyword:

Switch# traceroute mac ip 2.2.66.66 2.2.22.22 detail

Translating IP to mac .....

2.2.66.66 => 0000.0201.0601

2.2.22.22 => 0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)

con6 / WS-2960-12T / 2.2.6.6 :

        Gi0/1 [auto, auto] => Gi0/3 [auto, auto]

con5 / WS-C2950G-24-EI / 2.2.5.5 :

        Fa0/3 [auto, auto] => Gi0/1 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows how to display the Layer 2 path by specifying the source and destination hostnames:

Switch# traceroute mac ip con6 con2

Translating IP to mac .....

2.2.66.66 => 0000.0201.0601

2.2.22.22 => 0000.0201.0201

Source 0000.0201.0601 found on con6

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Fa0/1

Destination 0000.0201.0201 found on con2

Layer 2 trace completed

This example shows the Layer 2 path when ARP cannot associate the source IP address with the corresponding MAC address:

Switch# traceroute mac ip 2.2.66.66 2.2.77.77

Arp failed for destination 2.2.77.77.

Layer2 trace aborted.

Traceroute MAC

Use the traceroute mac privileged EXEC command to display the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address.

traceroute mac [interface interface-id] {source-mac-address} [interface interface-id] {destination-mac-address} [vlan vlan-id] [detail]

Syntax Description

interface interface-id	(Optional) Specify an interface on the source or destination switch.
source-mac-address	Specify the MAC address of the source switch in hexadecimal format.
destination-mac-address	Specify the MAC address of the destination switch in hexadecimal format.
vlan vlan-id	(Optional) Specify the VLAN on which to trace the Layer 2 path that the packets take from the source switch to the destination switch. Valid VLAN IDs are 1 to 4094.
detail	(Optional) Specify that detailed information appears.

For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.

When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and an error message appears.

The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears.

If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and an error message appears.

The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination MAC addresses:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Gi0/1

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed

This example shows how to display the Layer 2 path by using the detail keyword:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201 detail

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

C-12T / 2.2.6.6 :

        Gi0/2 [auto, auto] => Gi0/3 [auto, auto]

con5 / WS-C2950G-24-EI / 2.2.5.5 :

        Fa0/3 [auto, auto] => Gi0/1 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows how to display the Layer 2 path by specifying the interfaces on the source and destination switches:

Switch# traceroute mac interface fastethernet0/1 0000.0201.0601 interface fastethernet0/3
0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Gi0/1

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed

This example shows the Layer 2 path when the switch is not connected to the source switch:

Switch# traceroute mac 0000.0201.0501 0000.0201.0201 detail

Source not directly connected, tracing source .....

Source 0000.0201.0501 found on con5[WS-C2960-12T] (2.2.5.5)

con5 / WS-C2960-12T / 2.2.5.5 :

        Gi0/1 [auto, auto] => Gi0/3 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows the Layer 2 path when the switch cannot find the destination port for the source MAC address:

Switch# traceroute mac 0000.0011.1111 0000.0201.0201

Error:Source Mac address not found.

Layer2 trace aborted.

This example shows the Layer 2 path when the source and destination devices are in different VLANs:

Switch# traceroute mac 0000.0201.0601 0000.0301.0201

Error:Source and destination macs are on different vlans.

Layer2 trace aborted.

This example shows the Layer 2 path when the destination MAC address is a multicast address:

Switch# traceroute mac 0000.0201.0601 0100.0201.0201

Invalid destination mac address

This example shows the Layer 2 path when source and destination switches belong to multiple VLANs:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201

Error:Mac found on multiple vlans.

Layer2 trace aborted.

Catalyst IOS Commands

snmp-server enable traps

Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting.

snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate value] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate value | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

no snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

Syntax Description

bridge [newroot] [topologychange]	(Optional) Generate STP bridge MIB traps. The keywords have these meanings: •newroot—(Optional) Enable SNMP STP Bridge MIB new root traps. •topologychange—(Optional) Enable SNMP STP Bridge MIB topology change traps.
cluster	(Optional) Enable cluster traps.
config	(Optional) Enable SNMP configuration traps.
copy-config	(Optional) Enable SNMP copy-configuration traps.
entity	(Optional) Enable SNMP entity traps.
envmon [fan | shutdown | status | supply | temperature]	Optional) Enable SNMP environmental traps. The keywords have these meanings: •fan—(Optional) Enable fan traps. •shutdown—(Optional) Enable environmental monitor shutdown traps. •status—(Optional) Enable SNMP environmental status-change traps. •supply—(Optional) Enable environmental monitor power-supply traps. •temperature—(Optional) Enable environmental monitor temperature traps.
flash	(Optional) Enable SNMP FLASH notifications.
hsrp	(Optional) Enable Hot Standby Router Protocol (HSRP) traps.
ipmulticast	(Optional) Enable IP multicast routing traps.
mac-notification	(Optional) Enable MAC address notification traps.
msdp	(Optional) Enable Multicast Source Discovery Protocol (MSDP) traps.
ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change]	(Optional) Enable Open Shortest Path First (OSPF) traps. The keywords have these meanings: •cisco-specific—(Optional) Enable Cisco-specific traps. •errors—(Optional) Enable error traps. •lsa—(Optional) Enable link-state advertisement (LSA) traps. •rate-limit—(Optional) Enable rate-limit traps. •retransmit—(Optional) Enable packet-retransmit traps. •state-change—(Optional) Enable state-change traps.
pim [invalid-pim-message | neighbor-change | rp-mapping-change]	(Optional) Enable Protocol-Independent Multicast (PIM) traps. The keywords have these meanings: •invalid-pim-message—(Optional) Enable invalid PIM message traps. •neighbor-change—(Optional) Enable PIM neighbor-change traps. •rp-mapping-change—(Optional) Enable rendezvous point (RP)-mapping change traps.
port-security [trap-rate value]	(Optional) Enable port security traps. Use the trap-rate keyword to set the maximum number of port-security traps sent per second. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence).
rtr	(Optional) Enable SNMP Response Time Reporter traps.
snmp [authentication | coldstart | linkdown | linkup | warmstart]	(Optional) Enable SNMP traps. The keywords have these meanings: •authentication—(Optional) Enable authentication trap. •coldstart—(Optional) Enable cold start trap. •linkdown—(Optional) Enable linkdown trap. •linkup—(Optional) Enable linkup trap. •warmstart—(Optional) Enable warmstart trap.
storm-control trap-rate value	(Optional) Enable storm-control traps. Use the trap-rate keyword to set the maximum number of storm-control traps sent per second. The range is 0 to 1000; the default is 0 (no limit is imposed; a trap is sent at every occurrence).
stpx	(Optional) Enable SNMP STPX MIB traps. The keywords have these meanings: •inconsistency—(Optional) Enable SNMP STPX MIB Inconsistency Update traps. •root-inconsistency—(Optional) Enable SNMP STPX MIB Root Inconsistency Update traps. •loop-inconsistency—(Optional) Enable SNMP STPX MIB Loop Inconsistency Update traps.
syslog	(Optional) Enable SNMP syslog traps.
tty	(Optional) Send TCP connection traps. This is enabled by default.
vlan-membership	(Optional) Enable SNMP VLAN membership traps.
vlancreate	(Optional) Enable SNMP VLAN-created traps.
vlandelete	(Optional) Enable SNMP VLAN-deleted traps.
vtp	(Optional) Enable VLAN Trunking Protocol (VTP) traps.

Defaults

The sending of SNMP traps is disabled.

Command Modes

Global configuration

snmp-server host

Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.

snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth| priv}] [vrf vrf-instance] {community-string [notification-type]}

no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] community-string

Syntax Description

host-addr	Name or Internet address of the host (the targeted recipient).
udp-port port	(Optional) Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is 0 to 65535.
informs | traps	(Optional) Send SNMP traps or informs to this host.
version 1 | 2c | 3	(Optional) Version of the SNMP used to send the traps. These keywords are supported: 1—SNMPv1. This option is not available with informs. 2c—SNMPv2C. 3—SNMPv3. These optional keywords can follow the Version 3 keyword: •auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication. •noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth | priv] keyword choice is not specified. •priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the cryptographic (encrypted) software image is installed.
vrf vrf-instance	(Optional) Virtual private network (VPN) routing instance and name for this host.
community-string	Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command.
notification-type	(Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the these keywords: •bridge—Send SNMP Spanning Tree Protocol (STP) bridge MIB traps. •cluster—Send cluster member status traps. •config—Send SNMP configuration traps. •copy-config—Send SNMP copy configuration traps. •entity— Send SNMP entity traps. •envmon—Send environmental monitor traps. •flash—Send SNMP FLASH notifications. •hsrp—Send SNMP Hot Standby Router Protocol (HSRP) traps. •ipmulticast—Send SNMP IP multicast routing traps. •mac-notification—Send SNMP MAC notification traps. •msdp—Send SNMP Multicast Source Discovery Protocol (MSDP) traps. •ospf—Send Open Shortest Path First (OSPF) traps. •pim—Send SNMP Protocol-Independent Multicast (PIM) traps. •port-security—Send SNMP port-security traps. •rtr—Send SNMP Response Time Reporter traps. •snmp—Send SNMP-type traps. •storm-control—Send SNMP storm-control traps. •stpx—Send SNMP STP extended MIB traps. •syslog—Send SNMP syslog traps. •tty—Send TCP connection traps. •udp-port port—Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is from 0 to 65535. •vlan-membership— Send SNMP VLAN membership traps. •vlancreate—Send SNMP VLAN-created traps. •vlandelete—Send SNMP VLAN-deleted traps. •vtp—Send SNMP VLAN Trunking Protocol (VTP) traps.

Usage Guidelines

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.

The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.

The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.

Examples

This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:

Switch(config)# snmp-server community comaccess ro 10

Switch(config)# snmp-server host 172.20.2.160 comaccess

Switch(config)# access-list 10 deny any

This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com comaccess snmp

This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com public
DefaultsThe default is to disable port security.

switchport port-security

Use the switchport port-security interface
configuration command without keywords to enable port security on the
interface. Use the keywords to configure secure MAC addresses, sticky
MAC address learning, a maximum number of secure MAC addresses, or the
violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.

switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan
{vlan-list | {access | voice}}]]
no switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan

{vlan-list | {access | voice}}]]
switchport port-security [aging] [violation {protect | restrict | shutdown}]
no switchport port-security [aging] [violation {protect | restrict | shutdown}]

Syntax Description

aging 
 
 
 (Optional) See the switchport port-security aging command. 
 
 
   
 mac-address mac-address 
 
 
 (Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured. 
 
 
   
 vlan vlan-id 
 
 
 (Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used. 
 
 
   
 vlan access 
 
 
 (Optional) On an access port only, specify the VLAN as an access VLAN.  
 
 
   
 vlan voice 
 
 
 (Optional) On an access port only, specify the VLAN as a voice VLAN.  
 
 Note The voice keyword is available only if voice VLAN is configured on a port and if that port is not the access VLAN.  
 
 
   
 mac-address sticky [mac-address] 
 
 
 (Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses. 
 
 (Optional) Enter a mac-address to specify a sticky secure MAC address.  
 
 
   
 maximum value 
 
 
(Optional) Set the maximum number of secure MAC addresses for the interface.The maximum number of secure MAC addresses that you can configure on a switch is set by the maximum number of available MAC addresses allowed in the system. For more information, see the sdm prefer global configuration command. This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. 
 
 The default setting is 1. 
 
 
   
 vlan [vlan-list] 
 
 
 (Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. 
 
 •vlan—set a per-VLAN maximum value. 
 
 •vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used. 
 
 
   
 violation 
 
 
 (Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown. 
 
 
   
 protect 
 
 
 Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. 
 
 Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit. 
 
 
   
 restrict 
 
 
Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. 
 
 
   
 shutdown 
 
 
Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.