Arun's Technical Blog

Cisco IOS under Solaris

2010-07-03T16:11:00.002+05:30

Seeing anything strange below?

%SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command.

unix_reload()

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

Rights clause at FAR sec. 52.227-19 and subparagraph

Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cisco IOS Software, Solaris Software (UNIX-P-M), Experimental Version 12.2(20080714:162947) [arvinder-ss_auto_nightly 147]

Compiled Wed 24-Sep-08 12:28 by arvinder

Image text-base: 0x00011D98, data-base: 0x022F2008

Solaris Unix (Sparc) processor with 56561K bytes of memory.

Processor board ID 122882152

4 Ethernet interfaces

16K bytes of NVRAM.

Press RETURN to get started!

*Mar 1 00:00:00.527: Bootstrap Emulator called with code 135

%SYS-5-RESTART: System restarted --

Cisco IOS Software, Solaris Software (UNIX-P-M), Experimental Version 12.2(20080714:162947) [arvinder-ss_auto_nightly 147]

Compiled Wed 24-Sep-08 12:28 by arvinder

Router#sh ver

Cisco IOS Software, Solaris Software (UNIX-P-M), Experimental Version 12.2(20080714:162947) [arvinder-ss_auto_nightly 147]

Compiled Wed 24-Sep-08 12:28 by arvinder

ROM: Bootstrap program is Solaris

Router uptime is 43 minutes

System returned to ROM by reload at 0

System restarted at XXX

System image file is "unix:./.image"

Solaris Unix (Sparc) processor with 56561K bytes of memory.

Processor board ID 122882144

4 Ethernet interfaces

16K bytes of NVRAM.

Configuration register is 0x0

Although the Cisco IOU (IOS-on-Unix) simulator is quite old, i hope some time in the future it will be provided to customers too (i guess it started being used internally by tac people to simulate customer scenarios and now it's being used for various "internal" labs too). It also seems a much better alternative than the one that's included in the various written exam simulation labs. Some years ago, there was a rumor that Cisco employees would get in trouble for even mentioning its existence and certainly if they ever gave access to somebody (only a very small number of Cisco employees had access to it). Nowadays, that it's used widely internally, i hope the above rumor has ceased to exist.

Please do not ask here for information where to get it. Just talk to your ****.

Schedule commands with the Cisco IOS

2010-06-18T21:36:00.000+05:30

Have you ever wanted to schedule a command to run on a regular basis on a router? Then the Cisco IOS built in command scheduler called "kron" is for you. This command was introduced in Cisco IOS 12.3(1) and has been updated in 12.4.

The command scheduler will allow you to run commands, or a sequence of commands once or on a recurring basis. This is very similar to the Windows "at" command.

A common request that people have asked me for is to copy a router's running-config to startup-config or to a TFTP server on a certain day of the week every week. This will ensure that no changes are lost if someone forgets to save the config or the router dies.

Here is an example: To get a router to copy the running-config to startup-config every Sunday at 23:00, do the following:

Step 1) Kron policy list

Create a kron policy list - this is your script which lists what commands the router should run at the scheduled time

Router(config)# kron policy-list SaveConfig
Router(config-kron-policy)# cli write
Router(config-kron-policy)# exit

Note:
cli - Specifies EXEC CLI commands within a Command Scheduler policy list.
policy-list - Specifies the policy list associated with a Command Scheduler occurrence.

IMPORTANT: The reason why "write" was used rather than "copy running-config startup-config" is because kron does not support interactive prompts and "copy running-config startup-config" requires interaction. It is important to remember this when creating commands. Also note that kron does not support configuration commands.

Step 2) Create a kron occurrence

Create a kron occurrence, in which you tell the router when and how often you want to run the policy.

Router(config)# kron occurrence SaveConfigSchedule at 23:00 Sun recurring
Router(config-kron-occurrence)# policy-list SaveConfig

Note:
SaveConfigSchedule - Name of occurrence. Length of occurrence-name is from 1 to 31 characters. If the occurrence-name is new, an occurrence structure will be created. If the occurrence-name is not new, the existing occurrence will be edited.
at - Identifies that the occurrence is to run at a specified calendar date and time.
recurring - Identifies that the occurrence is to run on a recurring basis.

3) Verify

Verify that you've entered everything correctly by using the show command.

r1#sh kron schedule
Kron Occurrence Schedule
SaveConfigSchedule inactive, will run again in 1 days 12:37:47 at 23:00 on Sun

You can see that the schedule is ready to go and will run at the date above.

Note:
inactive - means that kron is not running the command(s) at present. Active means that kron is running the current command(s)

Verify that kron works via debugs:

Router#debug kron exec-cli

Dec 17 22:59:59.999: Call parse_cmd 'write'
Dec 17 23:00:01.587: Kron CLI return 0
'
**CLI 'write':
Building configuration...[OK]'
Dec 17 23:00:59.999: Call parse_cmd 'write'
Dec 17 23:01:01.559: Kron CLI return 0
'
**CLI 'write':
Building configuration...[OK]'

4) View the output of your configuration:

Router# show running-configuration

kron occurrence SaveConfigSchedule at 23:00 Sun recurring
policy-list SaveConfig

kron policy-list SaveConfig
cli write

Toll-Free Number | UIFN or ITFS?

2010-03-09T15:21:00.001+05:30

“What makes more sense for my business, a UIFN number or an ITFS number and what’s the difference?”

ITFS stands for International Toll Free Service. An ITFS number is the international equivalent of a U.S. Toll Free number in that it allows a customer to call a business and have the business pay for the call. With ITFS, customers in one country can make toll free calls that can then be terminated in another country. The numbers vary country by country.

UIFN is an acronym for Universal Free Phone service whereby businesses can advertise a single number that can be accessed from multiple countries.

Which number makes more sense really depends on each customer’s needs. While the UIFN number is a great idea in principle, in practice it does have some drawbacks.

UIFN numbers are not available from as many countries as ITFS numbers.
In some countries where UIFN is available, there are restrictions that are not imposed with ITFS numbers. As examples:
- In New Zealand, ITFS numbers can be dialed from all mobile phone networks while UIFN numbers can only be dialed from Telecom New Zealand and Vodaphone’s mobile networks.
- In Taiwan, hotels must allow guests to dial ITFS numbers from the hotel but they are not required to provide UIFN access to their guests.
UIFN has a one-time universal registration fee which is not required with ITFS numbers where the registration fee is paid by the carrier to the International Telecommunications Union (ITU).
Probably the most important difference is that with UIFN numbers different dialing prefixes are required from different parts of the world and some are counterintuitive.

UIFN numbers consist of a prefix then 800 then 8 digits. An example would be the UK which has a prefix of 00 so a UIFN number as dialed from the UK would be 00 800 XXXX XXXX. Other prefixes include Australia - 0011, Argentina - 00, Finland - 990, and Canada - 011. So here’s the advice we give to our customers...

If you only need toll-free access from one country, use an ITFS number and save yourself the universal registration fee. If you are displaying the numbers on your corporate web site and can provide a drop down box for countries and corresponding toll free numbers, it still might make sense to go with the ITFS. However, if you are paying for advertising and the “real estate” is at a premium, it may make sense to go with one UIFN number, especially if you are advertising to a large number of countries.

There really is no “one size fits all” answer, but with careful consideration companies can select the option that best meets their and enjoy the many advantages of international toll free services – ITFS or UIFN.

Wavelength Services

2009-12-09T14:34:00.000+05:30

A wavelength or lambda is light at a particular frequency or color. This characteristic is generally expressed in terms of wavelength in nanometers rather than frequency in terabits per second. Just as frequencies can be multiplexed to create a broadband wireline service, wavelengths can be multiplexed to offer multiple paths through a single fiber strand.

The multiplexing process at the physical level for fiber optics is called WDM or Wavelength Division Multiplexing. There are two technologies available. CWDM or Coarse Wavelength Division Multiplexing creates anywhere from 2 to 20 independent wavelengths, with 16 being a standard. DWDM or Dense Wavelength Division Multiplexing requires more precise equipment to create from 40 to 128 or more independent wavelengths.

As you can imagine, having dozens of independent wavelengths per fiber optic core and perhaps 100 cores in a cable, the amount of available bandwidth is truly staggering. So much so, that carriers are leasing out entire wavelengths to companies and organizations that need high bandwidth conduits. Wavelength services are similar to point to point T1 lines in that you have exclusive use of the wavelength. While the wavelengths in any particular core may be leased by dozens of different users, any multiplexing on the particular wavelength you are leasing is up to you. It's a private line service, with the line being a particular wavelength of light.

What bandwidths are available on these wavelength services? Commonly available speeds are 2.5 Gbps and 10 Gbps. Other increments of 1 Gbps and 5 Gbps are also increasingly available. Need more than 10 Gbps? It's possible to get as much as 40 Gbps in some areas. Can 100 Gbps be far behind?

Another advantage of wavelength services is that they are not locked into a particular protocol. You can use your wavelengths to transport Fast Ethernet (100 Mbps), Gigabit Ethernet, SONET OC-3, OC-12, OC-48, Fibre Channel, ESCON and Frame Relay.

Who's offering wavelength services suitable for large enterprise and other organizational use? Major competitive carriers such as Level 3, XO Communications and AboveNet have these and other fiber optic bandwidth services available right now. If you have a serious application that needs connectivity at this level, find out what wavelength services are available for your business locations.

Mobile Virtual Network Operator

2009-12-07T13:40:00.002+05:30

MVNO is a GSM phenomenon where an operator or company which does not own a licenced sprectrum and generally with out own networking infrastructure. Instead MVNOs resell wireless services under their brand name, using regular telecom operator's network with which they have a business arrangements. Usually they they buy minutes of use from the licenced telecom operator and then resell minutes of usage to their customers of MVNO. Currently MVNOs are emerging in fast pace in European markets and beginning in USA also. Slowly MVNO phenomenon catching up in Asia and other parts of the world also.

An example for MVNO is Virgin Mobile. Virgin Mobile plc is a mobile phone service provider operating in the UK, Australia and Canada, and the US. The company was the world's first Mobile Virtual Network Operator, launched in the UK in 1999. It does not maintain its own network, and instead has contracts to use the existing network(s) of other providers. In the UK, Virgin Mobile uses the T-Mobile network. In the US, the Sprint network is the carrier. In Australia, Virgin Mobile operates on the Optus network. In Canada, it uses the Bell Mobility network. These networks use different technology (GSM in the UK and Australia and CDMA in the US and Canada).

Usually MVNO's do not have their own infrastructure, some providers are actually deploying their own Mobile Switching Centers (MSC) and even Service Control Points (SCP) in some cases. Some MVNO's deploy their own mobile Intelligent Network (IN) infrastructure in order to facilitate the means to offer value-added services. In this way, MNVO's can treat incumbent infrastructure such as radio equipment as a commodity, while the MVNO offers its own advanced and differentiated services based on exploitation of their own IN infrastructure. The goal of offering value-added services is to differentiate versus the incumbent mobile operator, allowing for customer acquisition and preventing the MVNO from needing to compete on the basis of price alone.

Fiber-Optics cable color-code

2009-02-14T23:57:00.004+05:30

Color code, used in fiber optics, resembles that of copper. The major difference is 12-color sequence as oppose to 10-color for copper. The sequence of colors is the same, with addition of two colors - Rose (11-th) and Aqua (12-th).

In the high fiber count cables fibers are grouped in 6 or 12, and then the groups themselves are numbered. Therefore, the individual fiber's number equals the number of the group times 6 or 12 plus the number of the fiber in the group. The group size (6 fibers or 12) depends on the cable design and the total fiber count. Be aware that in cables with fiber count that is not a multiple of 12, especially those with more than 24 fibers, you can encounter both 6- and 12-fiber groups at the same time.

Groups of fibers can be designated in several different ways:
Fibers are housed inside of colored plastic tubes, all under the same outer jacket. In this case, colors of the tubes go in the same sequence as colors of the fibers: tube #1 - blue; tube #2 - orange and so on.
Fibers are helix-wrapped in colored threads or plastic ribbons. Same coloring scheme as above applies to the wraps.
Fibers have black stripes, one, two, three or even four. This is by far the most complicated tecnique. The stripes (or stripes pairs, triples etc.) are usually located about a foot (approx. 30 cm) from each other. So, you can't immediately tell what group the individual fiber belongs to. You would have to find the stripes, count them, and then decide what group number it is. If you can't find ANY stripes, it means that this fiber belongs to group one

There are also colors that designate the type of the optical fibers. It is not always followed by all manufacturers, and also, this code only applies to indoor cables: multimode fiber cables have orange jacket, and singlemode fiber cables have yellow.

8P8C Wiring

2009-02-12T13:20:00.004+05:30

The most talked about EIA/TIA standard in data, voice is structured wiring. Here is the EIA568B standard, an ethernet cabling. The EIA568A standard is obselete.

Use of Global Route-maps

2008-06-18T20:35:00.003+05:30

Cisco IOS has a special feature called local policy routing, which permits to apply a route-map to local (router-generated) traffic. The first way we can use this feature is to re-circulate local traffic (and force it re-enter the router). Here’s an example. By default, locally-generated packets are not inspected by outgoing access-lists. This may cause issues when local traffic is not being reflected under relfexive access-list entries. Say with configuration like that:

!
! Reflect all "session-oriented" traffic
!
ip access-list extended EGRESS
permit tcp any any reflect MIRROR
permit icmp any any reflect MIRROR
permit udp any any reflect MIRROR
!
! Evalute the reflected entries
!
ip access-list extended INGRESS
evaluate MIRROR
permit ospf any any
!
interface Serial 0/0
ip address 54.1.1.6 255.255.255.0
ip access-group INGRESS in
ip access-group EGRESS out

You would not be able to telnet out of a router to destinations behind the Serial interface, even though TCP sessions are reflected in access-list. To fix the issue, we may use local-policy to force the local traffic re-enter the router and be inspected by outgoing access-list:

!
! Redirect local telnet traffic via the Loopback interface
!
ip access-list extended LOCAL_TRAFFIC
permit tcp any any eq 23
!
route-map LOCAL_POLICY 10
match ip address LOCAL_TRAFFIC
set interface Loopback0
!
! Traffic sent to Loopback interface re-enters the router
!
interface Loopback0
ip address 150.1.6.6 255.255.255.50

!
! Apply the local-policy
!
ip local policy route-map LOCAL_POLICY

With this configuration, local telnet session will re-enter the router and hit the outgoing access-list, thereby triggering a reflected entry. This same idea may be utilized to force CBAC inspection of locally-generated traffic, by since 12.3 there has been a special IOS feature to do this natively.

The other useful application of local policy routing is using it for traffic filtering. For example you may want to prohibit outgoing telnet sessions from local router to a certain destination:

ip access-list extended BLOCK_TELNET
permit tcp any host 150.1.1.1 eq 23
!
route-map LOCAL_POLICY 10
match ip address BLOCK_TELNET
set interface Null 0

!
! Apply the local-policy
!
ip local policy route-map LOCAL_POLICY

The syntax is somewhat similar to the vlan access-maps used on Catalyst switches, and similarly the route-map is applied “globally”, i.e. to all router traffic, going out on any interface. Note that you may use the same idea to block incoming session, simply by reversing entries in access-list. (e.g. “permit tcp any eq 23 host 150.1.1.1″). Best of all, with PBR you may apply additional criteria to incoming traffic, e.g. match packet sizes.

The last example is the use of local PBR to apply special treatment to management/control plane traffic - e.g. use different output interfaces for out-of-band management. With local PBR you may also apply special marking for control traffic, e.g. selectively assign IP precedence values.

ip access-list extended MANAGEMENT_TRAFFIC
permit tcp any eq 23 any
permit tcp any eq 22 any
!
route-map LOCAL_POLICY 10
match ip address MANAGEMENT_TRAFFIC
set interface Serial 0/1
set ip precedence 7
!
ip local policy route-map LOCAL_POLICY

This exampls are very userful for real-world problems or mug it up at least for CCIE.

OSS / BSS

2008-02-03T19:36:00.000+05:30

Operations Support Systems (also called Operational Support Systems or OSS) are computer systems used by telecommunications service providers. The term OSS most frequently describes "network systems" dealing with the telecom network itself, supporting processes such as maintaining network inventory, provisioning services, configuring network components, and managing faults. The complementary term Business Support Systems or BSS is a newer term and typically refers to "business systems" dealing with customers, supporting processes such as taking orders, processing bills, and collecting payments. The two systems together are often abbreviated BSS/OSS or simply B/OSS.

The term OSS was historically used to include both network and business systems. It is still sometimes used in this sense, which can cause some confusion. When used in this way, the term OSS may be seen as inclusive of BSS. For more detail about the use of other terms such as "network management", see the section on architecture below.

OSS architecture

A lot of the work on OSS has been centred on defining its architecture. Put simply, there are four key elements of OSS:

Processes
- the sequence of events
Data
- the information that is acted upon
Applications
- the components that implement processes to manage data
Technology
- how we implement the applications

During the 1990's, new OSS architecture definitions was done by the ITU-T in its TMN model. This established a 4-layer model of TMN applicable within an OSS:

Business Management Level (BML)
Service Management Level (SML)
Network Management Level (NML)
Element Management Level (EML)

Business Support Systems (BSS) are the components that a telephone operator or telco uses to run its business operations. The term BSS is no longer limited to telephone operators offering mobile to fixed and cable services but also can apply to service providers in all sectors such as utility providers.

Typical types of activities that count as part of BSS are taking a customer’s order, managing customer data, managing order data, billing, rating, and offering B2B and B2C services. Business Support Systems are linked to Operational Support Systems (OSS) in the enhanced Telecom Operations Map (eTOM) that maps processes into the functional areas of Fulfilment, Assurance and Billing where Assurance is typically covered by OSS platform. BSS and OSS platforms are linked in the need to support various end to end services. Each area has its own data and service responsibilities.

Role of Business Support Systems

The role of Business Support Systems in a service provider is to cover 4 main areas:

Product Management
Customer Management
Revenue Management
Fulfillment Management

Product Management:

Product management supports the sales and management of products, offers and bundles to businesses and mass-market customers. Product Management regularly includes offering cross-product discounts, appropriate pricing and customer loyalty programmes.

Customer Management:

Service Providers require a single view of the customer and regularly need to support complex hierarchies across customer-facing applications. Customer Management also covers requirements for partner management and 24x7 Web-based customer self-service. Customer Management can also be thought of a full-fledge Customer Relationship Management systems implemented to help customer care agents handle the customers in a better and informed manner.

Revenue Management:

Revenue Management is a BSS focus on billing, charging and settlement, that can handle any combination of OSS services, products and offers. BSS Revenue Management supports OSS order provisioning and often partner settlement.

Fulfillment Management:

Fulfillment Management as part of assurance is normally associated with Operational Support Systems though Business Support Systems are often the business driver for Fulfillment Management and order provisioning.

TeleManagement Forum

Most recently the TM Forum (TMF) has developed a communications domain model that provides the basis for clarifying the distinction between OSS and BSS systems. As shown in the figure the BSS supports the more Customer Facing domains. Whereas the OSS supports the traditional Resource and Resource Facing Service domains.

In NGOSS, applications provide access to system capability, which can generally be categorized as either BSS or OSS. The capability offered by an application through its deployed components can be further categorized as shown in the figure. Business activities such as Fulfillment, Assurance & Billing will necessarily utilize BSS and OSS applications capability from each of the domains to support end-to-end process flows.

For example, problem handling activities (part of Assurance) inside a Service Provider define the interaction between the Customer, Product, Service, Resource and Supplier/Partner entities to resolve the reported incident/problem. As such, problem management applications are required to provide access to Customer, Product, Service, Resource and Supplier/Partner information in support of the problem handling activities that occur throughout the problem management process lifecycle.

Timed Access List

2007-12-02T21:16:00.003+05:30

Corp#config t

Corp(config)#time-range no-http
Corp(config-time-range)#periodic we?
Wednesday weekdays weekend
Corp(config-time-range)#periodic weekend ?
hh:mm Starting time
Corp(config-time-range)#periodic weekend 06:00 to 12:00
Corp(config-time-range)#exit
Corp(config)#time-range tcp-yes
Corp(config-time-range)#periodic weekend 06:00 to 12:00
Corp(config-time-range)#exit
Corp(config)#ip access-list extended Time
Corp(config-ext-nacl)#deny tcp any any eq www time-range no-http
Corp(config-ext-nacl)#permit tcp any any time-range tcp-yes
Corp(config-ext-nacl)#interface f0/0
Corp(config-if)#ip access-group Time in
Corp(config-if)#do show time-range
time-range entry: no-http (inactive)
periodic weekdays 8:00 to 15:00
used in: IP ACL entry
time-range entry: tcp-yes (inactive)
periodic weekend 8:00 to 13:00
used in: IP ACL entry
Corp(config-if)#

NMS

2007-10-30T15:01:00.000+05:30

Tools

Various software tools are available to measure network traffic. Some tools measure traffic by sniffing and others use SNMP, WMI or other local agents to measure bandwidth use on individual machines and routers. However, the latter generally do not detect the type of traffic, nor do they work for machines which are not running the necessary agent software, such as rogue machines on the network, or machines for which no compatible agent is available. In the latter case, inline appliances are preferred. These would generally 'sit' between the LAN and the LAN's exit point, generally the WAN or Internet router, and all packets leaving and entering the network would go through them. In most cases the appliance would operate as a bridge on the network so that it is undetectable by users.

Measurement tools generally have these functions and features:

user interface (web, graphical, console)
real-time traffic graphs
network activity is often reported against pre-configured traffic matching rules to show:
- local IP address
- remote IP address
- port number or protocol
- logged in user name
bandwidth quotas
support for traffic shaping or rate limiting (overlapping with the network traffic control page)
support website blocking and content filtering
alarms to notify the administrator of excessive usage (by IP address or in total)

Some of the available tools include:

Exbander Precision by DBAM Syetsms
FireBeast is a software firewall that offers bandwidth management and traffic shaping.
Infosim supports all different network flow technologies such as Netflow, sFlow, jFlow, cFlow or Netstream.
PRTG runs on Windows, with graphical and web interfaces. It captures packets using Cisco Netflow or packet sniffing or uses SNMP to monitor bandwidth usages.
MRTG
Sandvine Intelligent Network Solutions measure and manage network traffic using Policy Traffic Switches
Cricket is a tool originally written for WebTV Networks.

The Netflow article also lists devices which generate and applications which analyse Cisco Netflow records.

RRDtool

RRDtool has a graph function, which presents data from an RRD in a graphical format which is customizable.

RRDtool is a round-robin database tool. It is designed to handle time series data like network bandwidth, temperatures, CPU load etc. The data is stored in round-robin database so that system storage footprint remains constant over time. It also includes tools to extract RRD data in a graphical format. RRDtool was written by Tobi Oetiker as a replacement for MRTG and it is licensed under the GNU GPL.

Multi Router Traffic Grapher

The Multi Router Traffic Grapher or just simply MRTG is free software for monitoring and measuring the traffic load on network links. It allows the user to see traffic load on a network over time in graphical form. It was originally developed by Tobias Oetiker and Dave Rand to monitor router traffic, but has developed into a tool that can create graphs and statistics for almost anything.
MRTG uses the Simple Network Management Protocol (SNMP) to send requests with two object identifiers (OIDs) to a device. The device, which must be SNMP-enabled, will have a management information base (MIBs) to lookup the OID's specified. After collecting the information it will send back the raw data encapsulated in an SNMP protocol. MRTG records this data in a log on the client along with previously recorded data for the device. The software then creates an HTML document from the logs, containing a list of graphs detailing traffic for the selected device.

Paessler Router Traffic Grapher

With PRTG bandwidth usage of a network can be monitored and classified using the three most common bandwidth data acquisition methods:

SNMP: Reads traffic counters of network devices like switches, routers and servers
Packet Sniffer: Looks at all data packets traveling through a network using the promiscuous mode and analyzes the network packets to find out the IP addresses, protocols, etc. of the source and target machine
Netflow: Analyzes Netflow protocol packets used mostly by Cisco routers

Using SNMP not only bandwidth usage but also many other network readings (e.g. CPU usages, disk usages, temperatures) can be monitored using SNMP OIDs.

The usage data is constantly recorded and the historic data can be analyzed e.g. with data tables for usage billing and graphs for trend analysis via a web server interface and in a Windows GUI.

PRTG was originally developed by Dirk Paessler when he discovered how much effort it is to install and configure MRTG on Microsoft Windows systems. More than 100.000 installations are currently active. A freeware version is available.

IPv4 Looking Glass Sites

2007-10-30T14:17:00.000+05:30

If you know of a working IPv4 Looking Glass site that isn’t listed below, feel free to add it. Please only add sites that are true BGP looking glasses - pages that only allow ping and/or traceroute should not be included in this list.

Please correct any errors you find in this list. If a site is no longer responding, please change the “OK” in the Notes column to “FAILED” along with the date (mm/dd/yy). If the site becomes operational again, please change the “FAILED” message back to “OK”. If a site has been in “FAILED” status for over a month, it can be removed from the wiki.

Use the http://www.bgp4.net/lg URL if you wish to link to this page.

ASN	Provider	Link	Notes
174	Cogent	http://cogentco.com/htdocs/glass.php	OK
209	Qwest	http://stat.qwest.net/looking_glass.html	OK
250	as250.net	http://as250.net/lg/	OK
286	KPN Eurorings	http://stats.eurorings.net/performance/lookingglass.html	OK
286	KPN IAS	http://netcollect.kpn.net/looking-glass/index.phtml	OK
378	ILAN	http://noc.ilan.net.il/LG/	OK
513	CERN	http://dxmon.cern.ch/cgi-bin/lg.cgi	FAILED
553	BelWue	http://www.belwue.de/netz/lg.html	OK
559	SWITCH	http://lg.lan.switch.ch/lg/lg.cgi	OK
680	DFN	http://www.noc.dfn.de/cgi-bin/dfnnoc-lg	OK
766	RedIRIS	http://www.rediris.es/red/lg/	OK
852	Telus	http://aurora.on.tac.net/	OK
1120	Vienna Internet eXchange	http://www.vix.at/cgi-bin/lg.cgi	OK
1213	HEAnet	http://www.hea.net/cgi-bin/lg.cgi	OK
1239	SprintLink	http://oxide.sprintlink.net/cgi-bin/glass.pl	OK
1257	Tele2 Denmark	http://looking-glass.tele2access.dk/	OK
1273	Cable & Wireless	https://support.cw.com/?TESTDRIVE=1&LG=1	OK
1299	TeliaSonera	http://lg.telia.net/	OK
1653	SUNET	http://stats.sunet.se/looking-glass/lg.cgi	OK
1741	FUNET/CSC	http://www.csc.fi/suomi/funet/noc/looking-glass/lg.cgi	OK
1916	RNP	http://www.rnp.br/ip/lg	OK
2110	EsatBT	http://lg.as2110.net	OK
2128	INEX	https://www.inex.ie/lg/	OK
2493	Rogers Telecom	http://ops.rogerstelecom.net	OK
2603	NORDUnet	http://www.nordu.net/connectivity/looking-glass/lg.cgi	OK
2607	SIX - Slovak Internet eXchange	http://www.six.sk/lg.html	OK
2764	Connect.com/AAPT	http://looking-glass.connect.com.au/	OK
2820	Elvis-Telekom	http://noc.telekom.ru/lg/	OK
2828	XO	http://xostats.xo.com/cgi-bin/xostats/diagtool-pub/bgp	OK
3246	Song Networks	http://www.sn.net/lg/	OK
3255	Ukrainian Academic and Research Network UARNet	http://lg.uar.net/	OK
3257	Tiscali	http://www.ip.tiscali.net/lg/	OK
3267	RUNNet	http://noc.runnet.ru/lookingglass/index.htm	OK
3277	RUSnet	http://lg.rusnet.ru/	OK
3292	TDC	http://noc.tele.dk/cgi-bin/lg.cgi	OK
3303	Swisscom IP-Plus	https://my.ip-plus.net/nav.en.mpl/network/tools/LookingGlass/	OK
3308	Telia Networks (Danish Network)	http://lg.drift.telia.dk/cgi-bin/lg.cgi	OK
3320	Deutsche Telekom	https://f-lga1.f.de.net.dtag.de/	OK
3327	Linxtelecom	http://lg.version6.net/	OK
3333	RIPE NCC RIS Project	http://www.ris.ripe.net/cgi-bin/lg/index.cgi	OK
3343	RUNNet	http://noc.runnet.ru/lookingglass/index.htm	OK
3344	Kewlio.net Ltd	http://www.as3344.net/lg/index.k	OK
3356	Level3	http://lg.level3.net/	OK
3462	Taiwan IX	http://www.twix.net/probe/nmsprobe.html	OK
3491	Beyond the Networks	http://looking-glass.pccwbtn.net/	OK
3549	Global Crossing	http://www.globalcrossing.com/network/network_looking_glass.aspx	OK
3561	Savvis	http://as3561lg.savvis.net/lg.html	OK
3602	Rogers Telecom	http://ops.rogerstelecom.net	OK
3856	PCH (peering only routes from many exchange points)	http://lg.pch.net	OK
4319	Cortland Networks	http://routing.cortland.com/lg	OK
4538	CERNET	http://bgpview.6test.edu.cn/cgi-bin/querybgp.pl	OK
4589	EasyNet	http://www.noc.easynet.net/network/lg/	OK
4628	Pacific Internet	http://noc.pacific.net.sg/looking-glass/	OK
4635	Hong Kong Internet eXchange	http://www.hkix.net/hkix/hkixlg.html	OK
4670	Onse Telecom	http://nms1.shinbiro.com/lg.html	OK
4765	PacNet	http://noc.pacific.net.sg/looking-glass/	OK
4766	KORNET	http://looking.kornet.net/looking/lookingView.jsp	OK
4821	TerasNet	http://netmon.teras.net.id/cgi-bin/lg.pl	OK
4841	Zonasa	http://looking-glass.zonasa.com/cgi-bin/lg.pl	OK
5006	Onvoy	http://lg.onvoy.net/cgi-bin/bgplg	OK
5056	netINS	http://rr.netins.net/lg/lg.cgi	OK
5377	Taide	http://looking-glass.taide.net/	OK
5388	Energis	http://as5388.net/cgi-bin/lg.pl	OK
5390	EuroNet	http://lg.euronet.nl/	OK
5400	BT - British Telecom	http://lg.bt.net/	OK
5408	Greek Research & Technology Network	http://netmon.grnet.gr/lg.shtml	OK
5409	Toplink Plannet	http://lg.as12419.net/cgi-bin/lg.pl	OK
5413	PIPEX	http://bgp.pipex.net/lg	OK
5421	University of Sofia (Sofia, Bulgaria)	http://lg.uni-sofia.bg	OK
5459	LINX - London InterNet eXchange	https://www.linx.net/www_public/our_network/network_tools/	OK
5511	OpenTransit	http://www.opentransit.net/lg.htm	OK
5585	Israeli Internet eXchange	http://www.isoc.org.il/iix/2x_looking.html	OK
5617	TPNET	http://lg.tpnet.pl/	OK
5650	Electric Lighwave	http://ptlduh00.eli.net/cgi-bin/spy.cgi	OK
6315	XMission	http://stats.xmission.com/lg	OK
6373	Opus One	http://www.opus1.com/www/looking.html	OK
6395	Broadwing	http://lg.broadwing.net/looking/	OK
6453	Teleglobe	http://lg.teleglobe.net/	OK
6461	AboveNet	http://lg.above.net/	OK
6505	Equant Chile	http://www.equantpit.cl/lg/lg.pl	OK
6509	CA*net 4	http://dooka.canet4.net/lg/lg.php	OK
6661	P&T Luxembourg	http://www2.pt.lu/lg/	OK
6667	EUnet	http://www.eunetip.net/look.shtml	OK
6695	DE-CIX	http://lg.de-cix.net/cgi-bin/index.cgi	OK
6730	Sunrise	http://debby.sunrise.ch/lg/lg.cgi.html	OK
6731	Comstar	http://noc.comstar.ru/lg/lg.html	OK
6762	Seabone	http://etabeta.noc.seabone.net/cgi-bin/lg.pl	OK
6772	Improware AG	http://stats.imp.ch/lg/lg.cgi	OK
6802	NREN - Bulgaria	http://luna.acad.bg/lg	OK
6886	INTS	http://noc.ints.net/trace/	OK
6939	Hurricane Electric	http://lg.he.net/cgi-bin/index.cgi	OK
7474	Optus	http://looking-glass.optus.net.au/	OK
7543	Pacific Internet	http://mrtg.zipworld.net/zip-lg.html	OK
7718	TransACT	http://looking-glass.transact.net.au	OK
8001	Net Access	http://eng.nac.net/lookingglass/lg.html	OK
8015	VISI	http://noc.visi.com/lg	OK
8190	Viatel	http://lg.viatel.net/lg/lgform.cgi	OK
8196	Claranet	http://lg.de.clara.net/	OK
8235	TIX - Zurich	http://looking-glass.tix.ch/cgi-bin/looking-glass.cgi	OK
8258	ElVisti	http://www2.visti.net/lg/lg.html	OK
8331	RiNet	http://lg.rinet.ru/	OK
8342	RTComm.RU (Rostelecom)	http://lg.rtcomm.ru/	OK
8343	Doris UA	http://noc.skif.net/lg/	OK
8402	Corbina Telecom	http://noc.corbina.net/usr-cgi/lg.pl	OK
8422	NetCologne	http://plg.netcologne.de/lg/	OK
8437	United Telekom Austria	http://lg.net.uta.at/	OK
8493	Urbanet	https://noc.urbanet.ch/cgi-bin/lg.pl	OK
8508	Silesian University of Technology, Computer Center	http://lg.silweb.pl	OK
8515	DataForce	http://lg.df.ru/	OK
8563	DirectNet Telecom	http://isp.dn.ru/cgi-bin/lg.pl	OK
8631	MSK-IX	http://www.msk-ix.ru/eng/glass/	OK
8657	Marconi Internet Direct	http://glass.cprm.net/cgi-bin/lg.cgi	OK
8664	ICM	http://www.net.icm.edu.pl/lg/	OK
8672	Orbitel (Sofia, Bulgaria)	http://support.orbitel.bg/tech-support/looking-glass.cgi	OK
8717	SpectrumNet (Sofia, Bulgaria)	https://spnet.net/admin/lookingglass.phtml	OK
8736	Grapes Communications	http://noc.grapesnetservices.it/new_lg_p.html	OK
8745	Bulgarian Academy of Sciences	http://www.bas.bg/lg/	OK
8758	Dolphins Network Systems	http://www.dolphins.ch/network/lg.en.php	OK
8795	Mobikom (Sofia, Bulgaria)	http://home.mobikom.net/cgi-bin/nlg.pl	OK
8851	Inweb Networks	http://lg.inweb.co.uk	OK
8866	BTC Net (Sofia, Bulgaria)	http://www.btc-net.bg/lg1/lg.pl	OK
8890	ICM	http://www.net.icm.edu.pl/lg/	OK
8903	BT Spain	http://vasili.bt.es/lg.html	OK
9019	Datagrama	http://noc.datagrama.net/lg/	OK
9044	SolNet	http://stats.solnet.ch/looking-glass/lg.html	OK
9070	ITD Net	http://netguard.itdnet.net/cgi-bin/clg.cgi	OK
9120	Cohaesio A/S	http://lg.cohaesio.net/	OK
9127	NetIsSat (Sofia, Bulgaria)	http://www.netissat.bg/cgi-bin/lg.pl	OK
9199	Renam	http://lg.renam.md/	OK
9202	ZaporozhSvyazServise	http://www.zssm.zp.ua:8101/cgi-bin/lg/lg.cgi	OK
9370	Sakura Internet	http://as9370.bgp4.jp/	OK
9371	Sakura Internet	http://as9371.bgp4.jp/	OK
9443	Primus Telecom Australia	http://looking-glass.iprimus.net.au/lg	OK
9607	BroadBand Tower - Japan	http://lg01.colo01.bbtower.ad.jp/	OK
9625	PacNet	http://noc.pacific.net.sg/looking-glass/	OK
9722	PIPE Networks (QLD)	http://www.pipenetworks.com/lg/	OK
9831	Unigate	http://lg.unigate.net.tw/	OK
9894	PIPE Networks (ACT)	http://www.pipenetworks.com/lg/	OK
11260	Eastlink	http://lg.eastlink.ca/	OK
11608	Accretive Networks	http://www.accretive-networks.net/lg.html	OK
12294	Technological Systems JV	http://www.tsua.net/stor/lg.html	OK
12336	NetBG (Sofia, Bulgaria)	http://www.netbg.com/lg/lg.pl	OK
12369	UkrSat	http://support.ukrsat.com/stats/lg.html	OK
12381	Widell.Net	http://widell.net/cgi-bin/nph-wlg	OK
12412	DTR	http://lg.dtr.fr/	OK
12530	Golden Telecom	http://noc.kiev.sovam.com/lg.dhtml	OK
12541	Cable & Wireless	https://support.cw.com/?TESTDRIVE=1&LG=1	OK
12593	UkrHub.net	http://lg.ukrhub.net/lg.html	OK
12670	Completel	http://lg.completel.fr/	OK
12713	OTEGLOBE	http://www.nmc.oteglobe.net/cgi-bin/clg/lg.pl	OK
12767	PragoNet	http://nms1.prago.net/public-cgi-bin/lg/lg.cgi	OK
12859	Business Internet Trends	http://noc.bit.nl/traceroute/	OK
12867	Bulgaria Online (Sofia, Bulgaria)	http://gandalf.online.bg/look/	OK
12883	Ucomline	http://noc.ucomline.net/	OK
12897	HEAG MediaNet	http://lg.heagmedianet.de/	OK
12902	Luna.nl	http://noc.luna.nl/lg/	OK
12956	Telefonica	http://lg.ri.telefonica-data.net/cgi-bin/lg.pl	OK
13030	Init Seven AG	http://www.init7.net/looking-glass/	OK
13092	Belgrade University Computer Centre	http://netis.rcub.bg.ac.yu/cgi-bin/LookingGlass/lg.pl	OK
13105	LUKOIL-INFORM	http://noc.linia.ru/cgi-bin/lg.pl	OK
13115	Home of the Brave	http://home.of.the.brave.de/Internet-Services/Looking_Glass/	OK
13193	Nerim	http://stats.nerim.net/nav/lg/	OK
13194	Bite GSM	http://www.tinklomatas.lt/LookingGlass/	OK
13237	Lambdanet Communications GmbH	http://portal.lambdanet.net:58080/	OK
13249	ITSystems ISP	http://lg.itsinternet.net/	OK
13268	Multicom Ltd	http://proxy.multicom.bg:88/cgi-bin/lg/lg.pl	OK
13273	France Teaser	http://looking-glass.teaser.fr/	OK
13284	Brain Technology - Playnet - Italy	http://lg.playnet.it	OK
13645	BroadbandONE / Host.net	http://lg.host.net	OK
15389	Faroese Telecom	http://netcon.internet.fo/cgi-bin/lg.cgi	OK
15396	ICM	http://www.net.icm.edu.pl/lg/	OK
15474	RHnet - Iceland University Research Network	http://www.rhnet.is/cgi-bin/nlg/lg.cgi	OK
15497	ColoCall	http://noc.colocall.net/lg.html	OK
15605	Lina.Net	http://lg.linanet.is/	OK
15645	Ukrainian Exchange UA-IX	http://lg.ix.net.ua/	OK
15658	INET Communications	http://www.inetcomm.net/lg.shtml	OK
15687	Novo Nordisk IT A/S	http://traceroute.nnit.com/cgi-bin/bgp.cgi	OK
15703	TrueServer	http://noc.trueserver.nl/cgi-bin/lg.pl	OK
15744	Silesian University of Technology, Computer Center	http://lg.silweb.pl	OK
15756	Caravan ISP	http://noc.caravan.ru/cgi-bin/lg.cgi	OK
15772	WNet	http://support.wnet.ua/lg.php	OK
15785	Teleport SV	http://lg.teleportsv.net/	OK
15837	MainzKom Telekommunikation GmbH	http://looking-glass.rhein-main-saar.net/	OK
15968	Netpilot	http://noc.netpilot.net/cgi-bin/lg/lg.pl	OK
16215	Genotec Internet Consulting AG	http://lg.as16215.net/	OK
16260	XchangePoint	http://www.xchangepoint.net/tools/looking-glass.php	OK
16265	LeaseWeb	http://noc.leaseweb.com/	OK
16397	.comDOMINIO	http://lg.comdominio.com.br	OK
16422	NEWskies	http://www.newskies.net/lg/	OK
17175	NEWskies	http://www.newskies.net/lg/	OK
17557	Pakistan Internet Exchange	http://www.pie.net.pk/cgi-bin/lg.pl	OK
17801	Pacific Internet (Ausbone)	http://mrtg.zipworld.net/glass.html	OK
17999	PIPE Networks (SA)	http://www.pipenetworks.com/lg/	OK
18221	TSN Internet	http://looking-glass.tsn.cc	OK
18398	PIPE Networks (NSW)	http://www.pipenetworks.com/lg/	OK
19214	Centauri Communications	http://lg.centauricom.com/lg/lg.cgi	OK
20080	AMPATH	http://loadrunner.uits.iu.edu/~routerproxy/ampath/	OK
20485	TransTeleCom	http://lg.transtk.ru/	OK
20555	WSISiZ	http://noc.wsisiz.edu.pl/lg/lg.cgi	OK
20657	Atlantis BG Ltd. (Sofia, Bulgaria)	http://www.atlantis.bg/index.php?id=238	OK
20685	Evrocom	http://www.evrocom.net/bg/support/lg.html	OK
20766	Gitoyen	https://www.gitoyen.net/lg/	OK
20773	Hosteurope	http://latency.hosteurope.de/lg/	OK
20932	IP-MAN/SIG	http://lg.ip-man.net/	OK
20965	GEANT	http://stats.geant.net/lg/lgform.cgi	OK
21083	N-IX	http://www.n-ix.net/lg.html	OK
21131	Sacura Telecom	http://noc.cv.ua/glass.html	OK
21142	PragoNet	http://nms1.prago.net/public-cgi-bin/lg/lg.cgi	OK
21219	DataGroup (NewLine)	http://lg.newline.net.ua/	OK
21230	Mnet	http://lg.mnet.bg/	OK
21238	LIPEX	http://www.lipex.net/looking_glass/	OK
23504	Speakeasy	http://lg.speakeasy.net/	OK
23649	NEWskies	http://www.newskies.net/lg/	OK
23741	PIPE Networks (TAS)	http://www.pipenetworks.com/lg/	OK
23745	PIPE Networks (VIC)	http://www.pipenetworks.com/lg/	OK
24557	AussieHQ	http://looking-glass.aussiehq.net.au	OK
24743	Snerpa	http://network.it.is/cgi-bin/lg.cgi	OK
24770	UnixSol (Sofia, Bulgaria)	http://www.unixsol.org/lg	OK
24796	NaMeX - Nautilus Mediterranean eXchange	http://www.namex.it/lg.php	OK
24912	BiLiM Systems	http://noc.bilim-systems.net/cgi-bin/mrlg.cgi	OK
24971	Master Internet	http://www.master.cz/lg	OK
25358	NDSoftware	http://www.ip.ndsoftware.net/tools/lg.php	OK
25409	Alsys Data SRL	http://cache.alsys.ro/index1.html	OK
25462	ReTN	http://lg.retn.net/	OK
25528	Vodatel HR	http://lg.vodatel.hr	OK
25560	rh-tec	https://noc.de.rh-tec.net/nmc/	OK
27552	TowardEX	http://www.twdx.net/	OK
27750	RedCLARA	http://www.noc.redclara.net/proxy/rserver.html	OK
28681	Khmelnitsk Infocom	http://noc.ic.km.ua/cgi-bin/lg.cgi	OK
28788	Unilogic Networks	http://noc.unilogicnetworks.net/lg/	OK
28809	Nauka-Svyaz	http://lg.naukanet.ru/	OK
28909	TV SAT NET (Sofia, Bulgaria)	http://www.tvsatbg.net/lg/	OK
28968	Eurasia Telecom	http://www.eut.ru/client/lg.html	OK
29266	Danish Broadcast Corporation	http://lg.dr.dk/	OK
29327	Silvercom	https://noc.silvercom.net/lg/cgi-bin/lg.cgi	OK
29329	NODEX	http://noc.nodex.ru/lg/	OK
29527	Othello Technology Systems Ltd.	http://www.as29527.net/lg/	OK
29587	Schedom	http://lg.schedom-europe.net/lg.cgi	OK
29632	NetAssist	http://noc.netassist.kiev.ua/lg.php	OK
29686	Probe Networks	http://probe-networks.de/lg/	OK
30653	Exobit Networks	http://noc.exobitnetworks.com/lg/lg.cgi	OK
30890	Evolva Telecom	http://lg.evolva.ro	OK
30975	Telewizja Kablowa Koszalin sp. z o. o.	http://sloniewski.pl/lg/	OK
31069	United Networks of Ukraine - Kharkov	http://www.unu.kharkov.ua/lg/	OK
31138	JSC Proekt	http://lg.iptk.ru/cgi-bin/lg.cgi	OK
31203	Sharq Telekom	http://mrlg.st.uz	OK
31554	RomNet altFEL	http://lg.romnet.org	OK
31661	ComX Networks	http://lg.cxnet.dk/	OK
33843	interscholz Internet Services	http://noc.interscholz.net/lg/	OK
34043	Romania Internet Security Systems	http://lg.riss.ro/	OK
34115	Mapsolute	http://www.mapsolute.com/lg/lg.php	OK
34159	Camel Network	http://camel.net.uk/lg/	OK
35320	EuroTransTelecom	http://lg.ett.com.ua/	OK
39180	MWSP Telecom	http://lg.mwsp.fr/	OK
39397	Az.StarNet	http://noc.simsiz.az/lg	OK
41095	IPTP Networks	http://www.iptp.net/lg.php	OK
41829	RegionSet	http://www.regionset.net/lg/	OK

http://www.bgp4.net/wiki/doku.php?id=tools:ipv6_looking_glasses for IPv6

Traceroute mac ip

2007-10-26T18:45:00.000+05:30

Use the traceroute mac ip privileged EXEC command to display the Layer 2 path taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname.

traceroute mac ip {source-ip-address | source-hostname} {destination-ip-address | destination-hostname} [detail]

Syntax Description


source-ip-address	Specify the IP address of the source switch as a 32-bit quantity in dotted-decimal format.
destination-ip-address	Specify the IP address of the destination switch as a 32-bit quantity in dotted-decimal format.
source-hostname	Specify the IP hostname of the source switch.
destination-hostname	Specify the IP hostname of the destination switch.
detail	(Optional) Specify that detailed information appears.

For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.

When the switch detects an device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.

•If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path.

•If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and an error message appears.

The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination IP addresses and by using the detail keyword:

Switch# traceroute mac ip 2.2.66.66 2.2.22.22 detail

Translating IP to mac .....

2.2.66.66 => 0000.0201.0601

2.2.22.22 => 0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)

con6 / WS-2960-12T / 2.2.6.6 :

        Gi0/1 [auto, auto] => Gi0/3 [auto, auto]

con5 / WS-C2950G-24-EI / 2.2.5.5 :

        Fa0/3 [auto, auto] => Gi0/1 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows how to display the Layer 2 path by specifying the source and destination hostnames:

Switch# traceroute mac ip con6 con2

Translating IP to mac .....

2.2.66.66 => 0000.0201.0601

2.2.22.22 => 0000.0201.0201

Source 0000.0201.0601 found on con6

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Fa0/1

Destination 0000.0201.0201 found on con2

Layer 2 trace completed

This example shows the Layer 2 path when ARP cannot associate the source IP address with the corresponding MAC address:

Switch# traceroute mac ip 2.2.66.66 2.2.77.77

Arp failed for destination 2.2.77.77.

Layer2 trace aborted.

Traceroute MAC

2007-10-26T18:43:00.000+05:30

Use the traceroute mac privileged EXEC command to display the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address.

traceroute mac [interface interface-id] {source-mac-address} [interface interface-id] {destination-mac-address} [vlan vlan-id] [detail]

Syntax Description


interface interface-id	(Optional) Specify an interface on the source or destination switch.
source-mac-address	Specify the MAC address of the source switch in hexadecimal format.
destination-mac-address	Specify the MAC address of the destination switch in hexadecimal format.
vlan vlan-id	(Optional) Specify the VLAN on which to trace the Layer 2 path that the packets take from the source switch to the destination switch. Valid VLAN IDs are 1 to 4094.
detail	(Optional) Specify that detailed information appears.

For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.

When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and an error message appears.

The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears.

If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and an error message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination MAC addresses:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Gi0/1

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed

This example shows how to display the Layer 2 path by using the detail keyword:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201 detail

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

C-12T / 2.2.6.6 :

        Gi0/2 [auto, auto] => Gi0/3 [auto, auto]

con5 / WS-C2950G-24-EI / 2.2.5.5 :

        Fa0/3 [auto, auto] => Gi0/1 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows how to display the Layer 2 path by specifying the interfaces on the source and destination switches:

Switch# traceroute mac interface fastethernet0/1 0000.0201.0601 interface fastethernet0/3
0000.0201.0201

Source 0000.0201.0601 found on con6[WS-C2960-12T] (2.2.6.6)

con6 (2.2.6.6) :Gi0/1 => Gi0/3

con5                 (2.2.5.5        )  :    Gi0/3 => Gi0/1

con1                 (2.2.1.1        )  :    Gi0/1 => Gi0/2

con2                 (2.2.2.2        )  :    Gi0/2 => Gi0/1

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed

This example shows the Layer 2 path when the switch is not connected to the source switch:

Switch# traceroute mac 0000.0201.0501 0000.0201.0201 detail

Source not directly connected, tracing source .....

Source 0000.0201.0501 found on con5[WS-C2960-12T] (2.2.5.5)

con5 / WS-C2960-12T / 2.2.5.5 :

        Gi0/1 [auto, auto] => Gi0/3 [auto, auto]

con1 / WS-C3550-12G / 2.2.1.1 :

        Gi0/1 [auto, auto] => Gi0/2 [auto, auto]

con2 / WS-C3550-24 / 2.2.2.2 :

        Gi0/2 [auto, auto] => Fa0/1 [auto, auto]

Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)

Layer 2 trace completed.

This example shows the Layer 2 path when the switch cannot find the destination port for the source MAC address:

Switch# traceroute mac 0000.0011.1111 0000.0201.0201

Error:Source Mac address not found.

Layer2 trace aborted.

This example shows the Layer 2 path when the source and destination devices are in different VLANs:

Switch# traceroute mac 0000.0201.0601 0000.0301.0201

Error:Source and destination macs are on different vlans.

Layer2 trace aborted.

This example shows the Layer 2 path when the destination MAC address is a multicast address:

Switch# traceroute mac 0000.0201.0601 0100.0201.0201

Invalid destination mac address

This example shows the Layer 2 path when source and destination switches belong to multiple VLANs:

Switch# traceroute mac 0000.0201.0601 0000.0201.0201

Error:Mac found on multiple vlans.

Layer2 trace aborted.

Catalyst IOS Commands

2007-10-26T18:26:00.000+05:30

snmp-server enable traps

Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting.

Syntax Description


bridge [newroot] [topologychange]	(Optional) Generate STP bridge MIB traps. The keywords have these meanings: •newroot—(Optional) Enable SNMP STP Bridge MIB new root traps. •topologychange—(Optional) Enable SNMP STP Bridge MIB topology change traps.
cluster	(Optional) Enable cluster traps.
config	(Optional) Enable SNMP configuration traps.
copy-config	(Optional) Enable SNMP copy-configuration traps.
entity	(Optional) Enable SNMP entity traps.
envmon [fan \| shutdown \| status \| supply \| temperature]	Optional) Enable SNMP environmental traps. The keywords have these meanings: •fan—(Optional) Enable fan traps. •shutdown—(Optional) Enable environmental monitor shutdown traps. •status—(Optional) Enable SNMP environmental status-change traps. •supply—(Optional) Enable environmental monitor power-supply traps. •temperature—(Optional) Enable environmental monitor temperature traps.
flash	(Optional) Enable SNMP FLASH notifications.
hsrp	(Optional) Enable Hot Standby Router Protocol (HSRP) traps.
ipmulticast	(Optional) Enable IP multicast routing traps.
mac-notification	(Optional) Enable MAC address notification traps.
msdp	(Optional) Enable Multicast Source Discovery Protocol (MSDP) traps.
ospf [cisco-specific \| errors \| lsa \| rate-limit \| retransmit \| state-change]	(Optional) Enable Open Shortest Path First (OSPF) traps. The keywords have these meanings: •cisco-specific—(Optional) Enable Cisco-specific traps. •errors—(Optional) Enable error traps. •lsa—(Optional) Enable link-state advertisement (LSA) traps. •rate-limit—(Optional) Enable rate-limit traps. •retransmit—(Optional) Enable packet-retransmit traps. •state-change—(Optional) Enable state-change traps.
pim [invalid-pim-message \| neighbor-change \| rp-mapping-change]	(Optional) Enable Protocol-Independent Multicast (PIM) traps. The keywords have these meanings: •invalid-pim-message—(Optional) Enable invalid PIM message traps. •neighbor-change—(Optional) Enable PIM neighbor-change traps. •rp-mapping-change—(Optional) Enable rendezvous point (RP)-mapping change traps.
port-security [trap-rate value]	(Optional) Enable port security traps. Use the trap-rate keyword to set the maximum number of port-security traps sent per second. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence).
rtr	(Optional) Enable SNMP Response Time Reporter traps.
snmp [authentication \| coldstart \| linkdown \| linkup \| warmstart]	(Optional) Enable SNMP traps. The keywords have these meanings: •authentication—(Optional) Enable authentication trap. •coldstart—(Optional) Enable cold start trap. •linkdown—(Optional) Enable linkdown trap. •linkup—(Optional) Enable linkup trap. •warmstart—(Optional) Enable warmstart trap.
storm-control trap-rate value	(Optional) Enable storm-control traps. Use the trap-rate keyword to set the maximum number of storm-control traps sent per second. The range is 0 to 1000; the default is 0 (no limit is imposed; a trap is sent at every occurrence).
stpx	(Optional) Enable SNMP STPX MIB traps. The keywords have these meanings: •inconsistency—(Optional) Enable SNMP STPX MIB Inconsistency Update traps. •root-inconsistency—(Optional) Enable SNMP STPX MIB Root Inconsistency Update traps. •loop-inconsistency—(Optional) Enable SNMP STPX MIB Loop Inconsistency Update traps.
syslog	(Optional) Enable SNMP syslog traps.
tty	(Optional) Send TCP connection traps. This is enabled by default.
vlan-membership	(Optional) Enable SNMP VLAN membership traps.
vlancreate	(Optional) Enable SNMP VLAN-created traps.
vlandelete	(Optional) Enable SNMP VLAN-deleted traps.
vtp	(Optional) Enable VLAN Trunking Protocol (VTP) traps.

Defaults

The sending of SNMP traps is disabled.

Command Modes

Global configuration

snmp-server host

Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.

snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth| priv}] [vrf vrf-instance] {community-string [notification-type]}

no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] community-string

Syntax Description


host-addr	Name or Internet address of the host (the targeted recipient).
udp-port port	(Optional) Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is 0 to 65535.
informs \| traps	(Optional) Send SNMP traps or informs to this host.
version 1 \| 2c \| 3	(Optional) Version of the SNMP used to send the traps. These keywords are supported: 1—SNMPv1. This option is not available with informs. 2c—SNMPv2C. 3—SNMPv3. These optional keywords can follow the Version 3 keyword: •auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication. •noauth (Default). The noAuthNoPriv security level. This is the default if the [auth \| noauth \| priv] keyword choice is not specified. •priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the cryptographic (encrypted) software image is installed.
vrf vrf-instance	(Optional) Virtual private network (VPN) routing instance and name for this host.
community-string	Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command.
notification-type	(Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the these keywords: •bridge—Send SNMP Spanning Tree Protocol (STP) bridge MIB traps. •cluster—Send cluster member status traps. •config—Send SNMP configuration traps. •copy-config—Send SNMP copy configuration traps. •entity— Send SNMP entity traps. •envmon—Send environmental monitor traps. •flash—Send SNMP FLASH notifications. •hsrp—Send SNMP Hot Standby Router Protocol (HSRP) traps. •ipmulticast—Send SNMP IP multicast routing traps. •mac-notification—Send SNMP MAC notification traps. •msdp—Send SNMP Multicast Source Discovery Protocol (MSDP) traps. •ospf—Send Open Shortest Path First (OSPF) traps. •pim—Send SNMP Protocol-Independent Multicast (PIM) traps. •port-security—Send SNMP port-security traps. •rtr—Send SNMP Response Time Reporter traps. •snmp—Send SNMP-type traps. •storm-control—Send SNMP storm-control traps. •stpx—Send SNMP STP extended MIB traps. •syslog—Send SNMP syslog traps. •tty—Send TCP connection traps. •udp-port port—Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is from 0 to 65535. •vlan-membership— Send SNMP VLAN membership traps. •vlancreate—Send SNMP VLAN-created traps. •vlandelete—Send SNMP VLAN-deleted traps. •vtp—Send SNMP VLAN Trunking Protocol (VTP) traps.

Usage Guidelines

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.

The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.

The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.

Examples

This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:

Switch(config)# snmp-server community comaccess ro 10

Switch(config)# snmp-server host 172.20.2.160 comaccess

Switch(config)# access-list 10 deny any

This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com comaccess snmp

This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com public
DefaultsThe default is to disable port security.

switchport port-security

Use the switchport port-security interface
configuration command without keywords to enable port security on the
interface. Use the keywords to configure secure MAC addresses, sticky
MAC address learning, a maximum number of secure MAC addresses, or the
violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.

switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan
{vlan-list | {access | voice}}]]
no switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan

{vlan-list | {access | voice}}]]
switchport port-security [aging] [violation {protect | restrict | shutdown}]
no switchport port-security [aging] [violation {protect | restrict | shutdown}]

Syntax Description

aging 
   (Optional) See the switchport port-security aging command. 
  
    mac-address mac-address 
   (Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured. 
  
    vlan vlan-id 
   (Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used. 
  
    vlan access 
   (Optional) On an access port only, specify the VLAN as an access VLAN.  
  
    vlan voice 
   (Optional) On an access port only, specify the VLAN as a voice VLAN.  
  Note The voice keyword is available only if voice VLAN is configured on a port and if that port is not the access VLAN.  
  
    mac-address sticky [mac-address] 
   (Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses. 
  (Optional) Enter a mac-address to specify a sticky secure MAC address.  
  
    maximum value 
  (Optional) Set the maximum number of secure MAC addresses for the interface.The maximum number of secure MAC addresses that you can configure on a switch is set by the maximum number of available MAC addresses allowed in the system. For more information, see the sdm prefer global configuration command. This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. 
  The default setting is 1. 
  
    vlan [vlan-list] 
   (Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. 
  •vlan—set a per-VLAN maximum value. 
  •vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used. 
  
    violation 
   (Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown. 
  
    protect 
   Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. 
  Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit. 
  
    restrict 
  Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. 
  
    shutdown 
  Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

aging	(Optional) See the switchport port-security aging command.
mac-address mac-address	(Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured.
vlan vlan-id	(Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used.
vlan access	(Optional) On an access port only, specify the VLAN as an access VLAN.
vlan voice	(Optional) On an access port only, specify the VLAN as a voice VLAN. Note The voice keyword is available only if voice VLAN is configured on a port and if that port is not the access VLAN.
mac-address sticky [mac-address]	(Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses. (Optional) Enter a mac-address to specify a sticky secure MAC address.
maximum value	(Optional) Set the maximum number of secure MAC addresses for the interface.The maximum number of secure MAC addresses that you can configure on a switch is set by the maximum number of available MAC addresses allowed in the system. For more information, see the sdm prefer global configuration command. This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. The default setting is 1.
vlan [vlan-list]	(Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. •vlan—set a per-VLAN maximum value. •vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used.
violation	(Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.
protect	Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit.
restrict	Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments.
shutdown	Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Switch Stacking

2007-10-26T18:01:00.000+05:30

Stack Member Numbers

Connection Types

Full Bandwidth Connection

This illustration shows an example of a stack of Catalyst 3750 switches that provides full bandwidth and redundant StackWise cable connections:

When a cable fails at a single place, the stack will run with the half bandwidth connection.

In order to find the stack-ports through which the switches are connected to the stack, issue the show switch stack-ports command.

3750-Stk#show switch stack-ports

 Switch #    Port 1       Port 2
 --------    ------       ------
    1          Ok           Ok
    2          Ok           Ok
    3          Ok           Ok

Alternatively, in order to find the nearby switch on each port, issue the show switch neighbors command.

3750-Stk# show switch neighbors

 Switch #    Port 1       Port 2
 --------    ------       ------
     1         2            3
     2         1            3
     3         2            1

This illustration shows a stack of Cisco EtherSwitch service modules and Catalyst 3750 switches that provides full bandwidth and redundant connections:

Half Bandwidth Connection

This illustration shows an example of a stack of Catalyst 3750 switches with incomplete StackWise cable connections. This stack provides only half bandwidth and does not have redundant connections:

When a cable fails at a single place, the stack will be partitioned into two stacks.

3750-Stk# show switch stack-ports

 Switch #    Port 1       Port 2
 --------    ------       ------
    1          Ok          Down
    2          Ok           Ok
    3          Ok          Down

3750-Stk# show switch neighbors

 Switch #    Port 1       Port 2
 --------    ------       ------
    1          2           None
    2          1            3
    3          2           None

Creation and Management of Cisco Catalyst 3750 Stacks

The stack member number (1 to 9) identifies each member in the switch stack. The member number also determines the interface-level configuration that a stack member uses. You can display the stack member number if you use the show switch user EXEC mode command.

3750-Stk>show switch
                                              Current
Switch#  Role      Mac Address     Priority     State
--------------------------------------------------------
1       Slave     0016.4748.dc80     5         Ready
*2       Master    0016.9d59.db00     1         Ready
Priority Values

A higher priority value for a stack member increases its likelihood to be elected stack master and to retain its stack member number. The priority value can be 1 to 15. The default priority value is 1. You can display the stack member priority value with the show switch user EXEC mode command.

3750-Stk>show switch
Current
Switch# Role Mac Address Priority State
--------------------------------------------------------
1 Slave 0016.4748.dc80 1 Ready
*2 Master 0016.9d59.db00 5 Ready

How do you change the priority value?

From the global configuration mode, issue the command switch stack-member-number priority new-priority-value .

From the bootloader switch: prompt, issue the command set SWITCH_PRIORITY new-priority-value .
Hardware Compatibility

The Cisco Catalyst 3750 series switches use Switch Database Management (SDM) templates to optimize the system resources for specific features dependent on how the switch is used in the network. There are two versions of the SDM templates: Desktop and Aggregator. The 3750-12S switch alone supports both templates. All other model switches of the 3750 series support only the Desktop version.

When a Cisco Catalyst 3750 switch stack consists of 3750-12S and other models, make sure to use only the Desktop SDM template. This is an output from the show switch command when an SDM mismatch exists:

3750-Stk# show switch
Current
Switch# Role Mac Address Priority State
------------------------------------------------------------
*2 Master 000a.fdfd.0100 5 Ready
4 Member 0003.fd63.9c00 5 SDM Mismatch

To change the SDM template on a 3750-12S to Desktop version, complete these steps:

3750-Stk# conf t
3750-Stk(config)# sdm prefer routing desktop

3750-Stk(config)# exit
3750-Stk# reload

For more information on the SDM templates, refer to Configuring SDM Templates.

Software Compatibility

Software compatibility between the stack members is determined by the Stack Protocol Version number. To view the stack protocol version of your switch stack, you can issue the show platform stack-manager all command.

3750-Stk# show platform stack-manager all
Current
Switch# Role Mac Address Priority State
--------------------------------------------------------
1 Slave 0016.4748.dc80 5 Ready
*2 Master 0016.9d59.db00 1 Ready

!--- part of output elided

Stack State Machine View
==============================================================

Switch Master/ Mac Address Version Uptime Current
Number Slave (maj.min) State
---------------------------------------------------------------------
1 Slave 0016.4748.dc80 1.11 8724 Ready
2 Master 0016.9d59.db00 1.11 8803 Ready

!--- rest of output elided

Switches with the same Cisco IOS software version have the same stack protocol version. Such switches are fully compatible, and all features function properly across the switch stack. Switches with the same Cisco IOS software version as the stack master immediately join the switch stack.

If an incompatibility exists, the fully functional stack members generate a system message that describes the cause of the incompatibility on the specific stack members. The stack master sends the message to all stack members.

Switches with different Cisco IOS software versions likely have different stack protocol versions. Switches with different major version numbers are incompatible and cannot exist in the same switch stack.

3750-Stk# show switch
Current
Switch# Role Mac Address Priority State
--------------------------------------------------------
1 Member 0015.c6f5.6000 1 Version Mismatch
*2 Master 0015.63f6.b700 15 Ready
3 Member 0015.c6c1.3000 5 Ready

Switches with the same major version number but with a different minor version number as the stack master are considered partially compatible. When connected to a switch stack, a partially compatible switch enters version-mismatch (VM) mode and cannot join the stack as a fully functional member. The software detects the mismatched software and tries to upgrade (or downgrade) the switch in VM mode with the switch stack image or with a tar file image from the switch stack flash memory. The software uses the automatic upgrade (auto-upgrade) and the automatic advise (auto-advise) features.

The auto-upgrade occurs if the software release that runs on the stack master is compatible with the switch in VM mode and the tar file of the current image is available with any of the stack members. If tar file of the current image is not available, the auto-advise feature will recommend that a compatible image be downloaded with the required commands. The auto-upgrade and auto-advise features do not work if the switch master and switch in VM mode run different feature sets/packaging levels (IP services and IP base), but, from Cisco IOS Software Release 12.2(35)SE, auto-upgrade does support upgrades between cryptographic and non-cryptographic images of the same packaging level.

Create a Switch Stack from Two Stand-alone Stacks

This example shows how a switch stack is created from two stand-alone stacks.

Switch-A and Switch-B are merged together to form the stack.

and

A stack-master election occurs between Switch-A and Switch-B; let us consider that Switch-B wins.

Switch-A will reload itself and join the switch stack.

The stack member number of Switch-A will change since it conflicts with Switch-B. Switch-A will choose the lowest available stack number, which in this case, is number "2".

Create a Switch Stack from Two Two-member Stacks

This example shows how two switch stacks merge to form a stack.

The first switch stack consists of two members: Switch-A and Switch-B.

The second switch stack consists of members Switch-C and Switch-D with Switch-C as the stack master.

When these two switch stacks are merged together, the election for stack master occurs; let us consider that Switch-B wins the election.

Switch-A will retain its stack member number.

Switch-C and Switch-D will reload themselves and join the stack with new stack member numbers of "3" and "4" respectively.

Precautions for the Use of VLAN 1

2007-10-23T21:24:00.000+05:30

The reason VLAN 1 became a special VLAN is that L2 devices needed to have a default VLAN to assign to their ports, including their management port(s). In addition to that, many L2 protocols such as CDP, PAgP, and VTP needed to be sent on a specific VLAN on trunk links. For all these purposes VLAN 1 was chosen.

As a consequence, VLAN 1 may sometimes end up unwisely spanning the entire network if not appropriately pruned and, if its diameter is large enough, the risk of instability can increase significantly. Besides the practice of using a potentially omnipresent VLAN for management purposes puts trusted devices to higher risk of security attacks from untrusted devices that by misconfiguration or pure accident gain access to VLAN 1 and try to exploit this unexpected security hole.

To redeem VLAN 1 from its bad reputation, a simple common-sense security principle can be used: as a generic security rule the network administrator should prune any VLAN, and in particular VLAN 1, from all the ports where that VLAN is not strictly needed.

Therefore, with regard to VLAN 1, the above rule simply translates into the recommendations to:

•Not use VLAN 1 for inband management traffic and pick a different, specially dedicated VLAN that keeps management traffic separate from user data and protocol traffic.

•Prune VLAN 1 from all the trunks and from all the access ports that don't require it (including not connected and shutdown ports).

Similarly, the above rule applied to the management VLAN reads:

•Don't configure the management VLAN on any trunk or access port that doesn't require it (including not connected and shutdown ports).

•For foolproof security, when feasible, prefer out-of-band management to inband management.

As a general design rule it is desirable to "prune" unnecessary traffic from particular VLANs. For example, it is often desirable to apply VLAN ACLs and/or IP filters to the traffic carried in the management VLAN to prevent all telnet connections and allow only SSH sessions. Or it may be desirable to apply QoS ACLs to rate limit the maximum amount of ping traffic allowed.

If VLANs other than VLAN 1 or the management VLAN represent a security concern, then automatic or manual pruning should be applied as well. In particular, configuring VTP in transparent or off mode and doing manual pruning of VLANs is commonly considered the most effective method to exert a more strict level of control over a VLAN-based network.

Top Networks

2007-10-23T15:31:00.000+05:30

Here are the biggest autonomous systems in terms of peer counts, broken down by the issuing registry. Large networks typically span more than one region, but the issuing registry is a good indicator of the network's primary coverage area.

North America

MCI Communications Services, Inc. d/b/a Verizon Business	701 UUNET	2872 peers
AT&T WorldNet Services	7018 ATT-INTERNET4	2506 peers
Sprint	1239 SPRINTLINK	2011 peers
Level 3 Communications	3356 LEVEL3	1883 peers
Cogent/PSI	174 COGENT	1811 peers
Qwest	209 ASN-QWEST	1482 peers
Global Crossing Ltd.	3549 GBLX	1119 peers
Time Warner Telecom, Inc.	4323 TWTC	966 peers
Hurricane Electric	6939 HURRICANE	891 peers
AT&T Internet Services	7132 SBIS-AS	795 peers

Europe

COLT Telecommunications	8220 COLT	548 peers
Tiscali Intl Network BV	3257 TISCALI-BACKBONE	514 peers
Deutsche Telekom AG	3320 DTAG	450 peers
Interoute Communications Ltd	8928 INTEROUTE	370 peers
JSC Company TransTeleCom	20485 TRANSTELECOM	345 peers
RTComm.RU Autonomous System	8342 RTCOMM-AS	317 peers
Golden Telecom, Moscow, Russia	3216 SOVAM-AS	314 peers
RCS & RDS S.A.	8708 RDSNET	245 peers
BT European Backbone	5400 BT	215 peers
GTS Polska Sp. z o.o.	8246 GTS-POLSKA-AS	207 peers

Asia/Pacific

Korea Telecom	4766 KIXS-AS-KR	313 peers
Asia Netcom Corporation	10026 ANC	251 peers
SingTel Optus Pty Ltd	7474 OPTUSCOM-AS01-AU	182 peers
Reach Network Border AS	4637 REACH	157 peers
Hanaro Telecom Inc.	9318 HANARO-AS	138 peers
Videsh Sanchar Nigam Ltd. Autonomous System	4755 VSNL-AS	134 peers
JAPAN TELECOM CO.,LTD.	4725 ODN	133 peers
BHARTI BT INTERNET LTD.	9498 BBIL-AP	130 peers
SK Global co., Ltd	18302 SKG_NW-AS-KR	126 peers
Singapore Telecom	7473 SINGTEL-AS-AP	118 peers

Latin America

S.A.	27757 ANDINATEL	22 peers
Cooperaci�n Latino Americana de Redes Avanzadas	27750 ASN27750	15 peers
Uninet S.A. de C.V.	28513 Uninet S.A. de C.V.	14 peers
Multim�dia	27664 CTBC	10 peers
CO.PA.CO.	27768 CO.PA.CO.	9 peers
Amnet Telecomunicaciones S.A.	27742 ASN27742	8 peers
Chile	27678 NIC	7 peers
TEL Comunicacion S.A. de C.V.	28502 G	7 peers
S.A. E.M.A.	27765 TRANSNEXA	7 peers
Aeprovi	27814 Aeprovi	6 peers

Africa

UNINET	36898 UNINET	5 peers
SLC1-AS	36879 SLC1-AS	4 peers
JTL	36866 JTL	4 peers
AFOL-KE-AS	36915 AFOL-KE-AS	4 peers
DURAVITEG-AS	36893 DURAVITEG-AS	3 peers
Edgenet	36966 Edgenet	3 peers
Artel-AS	36934 Artel-AS	3 peers
MTNRW-ASN	36890 MTNRW-ASN	3 peers
Creolink-ASN	36905 Creolink-ASN	3 peers
OTAVSAT-AS	36918 OTAVSAT-AS	3 peers

Route Servers

2007-10-23T15:28:00.000+05:30

Route servers provide console access to various router functions. They are invaluable in the hands of an expert who wants to see what his network looks like from the outside. Commands like show ip bgp 1.2.3.4 are probably the largest reason route servers are useful, but traceroute and ping are frequently also available.

There are lots of lists out there. Most of them don’t bother checking the route servers, or if they do, they only check that they’re reachable. Several route servers are reachable, but aren’t actually useful, because they ask for authentication before letting you look at anything.

This list is different. All route servers are checked periodically. New route servers are discovered automatically from various other aggregators. Fingerprinting techniques are used in an attempt to determine what sort of route server is at the address specified.

Lerfjhax, bringing you not only breakfast cereral in a can, but also a high-quality list of public route servers.

Hostname	AS	Peers	Type	Status
route-server.gblx.net	3549 GBLX	1119		Up ?
route-server.eu.gblx.net	3549 GBLX	1119		Up ?
route-server.twtelecom.net	4323 TWTC	966	Cisco 7200 12.1(2)T	Up ?
route-server.he.net	6939 HURRICANE	891	Cisco 7200 12.2(11)T	Up ?
route-server.savvis.net	3561 SAVVIS	626		Up ?
route-server.ip.tiscali.net	3257 TISCALI-BACKBONE	514		Up ?
route-views.optus.net.au	7474 OPTUSCOM-AS01-AU	182		Up ?
route-server-west.gt.ca	6539 GT-BELL	154		Up ?
route-server-east.gt.ca	6539 GT-BELL	154		Up ?
route-server.gt.ca	6539 GT-BELL	154		Up ?
route-server.east.allstream.com	15290 ALLST-15290	110		Up ?
route-server.west.allstream.com	15290 ALLST-15290	110		Up ?
route-server.central.allstream.com	15290 ALLST-15290	110		Up ?
route-views.on.bb.telus.com	852 ASN852	96		Up ?
route-views.ab.bb.telus.com	852 ASN852	96		Up ?
routeserver.sunrise.ch	6730 SUNRISE	90		Up ?
route-views.bmcag.net	9132 BROADNET-AS	54		Up ?
route-server.as6667.net	6667 EUNET-FINLAND	50		Up ?
public-route-server.is.co.za	3741 IS	46		Up ?
route-server.skyinet.net	6648 ASN-SKYINTERNET	37	Cisco 3600 12.2(15)T8	Up ?
route-server.videotron.net	5769 VIDEOTRON	33		Up ?
route-view.tiscali.de	12312 NACAMAR-DE	32		Up ?
route-server.host.net	13645 BROADBANDONE	23		Up ?
route-server.eastlink.ca	11260 EASTLINK-HSI	13		Up ?
route-server.belwue.de	553 BELWUE	11		Up ?
route-server.cerf.net	17233 ATT-CERFNET-BLOCK	4	Cisco 7200 12.0(22)S2e	Up ?

AS and Peers deserve some explanation. AS is the AS that the route server’s IP address is advertised from, which usually (but not always) the AS of the route server. Similarly, Peers is the number of Autonomous Systems that are known to be directly connected to the route server’s AS, not the number of BGP peers on the route server.

Extending Ethernet Capability

2007-10-18T18:25:00.000+05:30

To extend the Ethernet twisted-pair 10BaseT capability beyond the standard 100 meters on the Cisco 4000 platform, use the squelch interface configuration command.

squelch {normal | reduced}
no squelch {normal | reduced}

Syntax Description

ormal :	Allows normal capability.
reduced :	Allows extended 10BaseT capability.

Default : Normal range

The following example extends the twisted-pair 10BaseT capability on the cable attached to interface Ethernet 2:

interface ethernet 2
squelch reduced

Advance Ping

2007-10-18T07:11:00.000+05:30

mu-t1-cr01#pi mpls ipv4 192.168.251.2/32 exp 2 repeat 5000

Sending 5000, 100-byte MPLS Echos to 192.168.251.2/32, timeout is 2 seconds, send interval is 0 msec:
Codes: \'!\' - success, \'Q\' - request not transmitted, \'.\' - timeout, \'U\' - unreachable, \'R\' - downstream router but not target, \'M\' - malformed request

Type escape sequence to abort.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Success rate is 100 percent (5000/5000), round-trip min/avg/max = 272/276/1646 ms

Configuring an 802.1Q Tunneling Port

2007-10-17T03:14:00.000+05:30

Configuring Layer 2 Tunneling Characteristics

Beginning in privileged EXEC mode, follow these steps to configure a port for Layer 2 protocol tunneling:


	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	interface interface-id	Enter the interface configuration mode and the interface to be configured as a tunnel port. This should be the edge port in the service-provider network that connects to the customer switch. Valid interfaces include physical interfaces and port-channel logical interfaces (port channels 1 to 64).
Step 3	switchport mode access or switchport mode dot1q-tunnel	Configure the interface as an access port or an 802.1Q tunnel port.
Step 4	l2protocol-tunnel {cdp \| vtp \| stp}	Enable protocol tunneling for the desired protocol.
Step 5	l2protocol-tunnel shutdown-threshold {cdp \| vtp \| stp}	(Optional) Configure the threshold for incoming Layer 2 PDUs to be received and encapsulated. The port is disabled if the configured threshold is exceeded. The range is 1 to 1000. The default is to have no threshold configured.
Step 6	exit	Return to global configuration mode.
Step 7	errdisable recovery cause l2ptguard	(Optional) Configure the recovery mechanism from a Layer 2 maximum rate error so that the interface can be brought out of the disabled state and allowed to try again. You can also set the time interval. Errdisable recovery is disabled by default; when enabled, the default time interval is 300 seconds.
Step 8	l2protocol-tunnel cos value	(Optional) Configure the CoS value for all tunneled Layer 2 PDUs. The range is 0 to 7; the default is the default COS value for the interface. If none is configured, the default is 5.
Step 9	end	Return to privileged EXEC mode.
Step 10	show l2protocol	Display the Layer 2 tunnel ports on the switch, including the protocols configured, the threshold, and the counters.
Step 11	copy running-config startup-config	(Optional) Save your entries in the configuration file.

This example shows how to configure Layer 2 protocol tunneling for STP and CDP and verify the configuration.

Switch(config)# interface gigabitethernet0/7

Switch(config-if)# l2protocol-tunnel stp

Switch(config-if)# l2protocol-tunnel cdp

Switch(config-if)# l2protocol-tunnel shutdown-threshold 400

Switch(config-if)# exit

Switch(config)# l2protocol-tunnel cos 6

Switch(config)# end

Switch# show l2protocol

Port   Protocol        Shutdown Threshold  Counters

                       (cos/cdp/stp/vtp)   (cdp/stp/vtp/decap)

--------------------------------------------------------------

Gi0/7   cdp stp         6/400 /400 /400     0/0/0/0

Monitoring and Maintaining Tunneling Status

Table 13-2 shows the privileged EXEC commands for monitoring and maintaining 802.1Q and Layer 2 protocol tunneling.

Table 13-2 Commands for Monitoring and Maintaining Tunneling
Command	Purpose
clear l2protocol-tunnel counters	Clear the protocol counters on Layer 2 protocol tunneling ports.
show dot1q-tunnel	Display 802.1Q tunnel ports on the switch.
show dot1q-tunnel interface interface-id	Verify if a specific interface is a tunnel port.
show l2protocol-tunnel	Display information about Layer 2 protocol tunneling ports.
show errdisable recovery	Verify if the recovery timer from a Layer 2 protocol-tunnel error disable state is enabled.
show l2protocol-tunnel interface interface-id	Display information about a specific Layer 2 protocol tunneling port.
show l2protocol-tunnel summary	Display only Layer 2 protocol summary information.
show vlan dot1q native	Display the status of native VLAN tagging on the switch.

For detailed information about these displays, refer to the Catalyst 3550 Multilayer Switch Command Reference for this release.

This example shows how to display the 802.1Q tunnel ports on the switch:

Switch# show dot1qtunnel

Port

-----

Gi0/1

Gi0/2

Gi0/3

Gi0/6

Po2

This example shows how to display the status of native VLAN tagging on the switch:

Switch# show vlan dot1q tag native

dot1q native vlan tagging is enabled

This example shows how to display information about the Layer 2 protocol tunneling on the switch:

Switch# show l2protocol-tunnel

Port   Protocol        Shutdown Threshold  Counters

                       (cos/cdp/stp/vtp)   (cdp/stp/vtp/decap)

--------------------------------------------------------------

Gi0/1   cdp vtp         5/10  /100 /5       0/0/0/0

Gi0/2   cdp stp vtp     5/----/----/----    0/0/0/0

Gi0/3   cdp stp vtp     5/----/----/----    0/0/0/0

Gi0/4   cdp stp vtp     5/----/----/----    4/173/0/5

Gi0/5   cdp stp vtp     5/----/----/----    0/0/0/11

Gi0/6   cdp stp vtp     5/----/----/----    0/0/0/0

Gi0/7   cdp vtp         5/----/----/----    0/0/0/0

Gi0/8   cdp stp vtp     5/----/----/----    0/0/0/0

Gi0/11  cdp stp vtp     5/----/----/----    0/0/0/0

Po2     cdp stp vtp     5/1000/1000/1000    8500/14855375/397/18391

This example shows how to display Layer 2 protocol tunneling summary information :

Switch# show l2protocol-tunnel summary

Port   Protocol        Shutdown Threshold

                       (cos/cdp/stp/vtp)

----------------------------------------

Gi0/1   cdp vtp         5/10  /100 /5

Gi0/2   cdp stp vtp     5/----/----/----

Gi0/3   cdp stp vtp     5/----/----/----

Gi0/4   cdp stp vtp     5/----/----/----

Gi0/5   cdp stp vtp     5/----/----/----

Gi0/6   cdp stp vtp     5/----/----/----

Gi0/7   cdp vtp         5/----/----/----

Gi0/8   cdp stp vtp     5/----/----/----

Gi0/11  cdp stp vtp     5/----/----/----

Po2     cdp stp vtp     5/1000/1000/1000

This example shows how to verify if the recovery timer from a Layer 2 protocol tunnel-error-disable state is enabled:

Switch# show errdisable recovery

ErrDisable Reason    Timer Status

-----------------    --------------

udld                 Disabled

bpduguard            Disabled

channel-misconfig    Disabled

pagp-flap            Disabled

dtp-flap             Disabled

link-flap            Disabled

l2ptguard            Enabled

psecure-violation    Disabled

gbic-invalid         Disabled

Timer interval: 300 seconds

Interfaces that will be enabled at the next timeout:

Quality of Service for Voice and Video

2007-10-17T00:34:00.000+05:30

Quality of service (QoS) for voice over IP (VoIP) consists of providing low-enough packet loss and low-enough delay so that voice quality is not affected by conditions in the network. The brute force solution is to simply provide sufficient bandwidth at all points in the network so that packet loss and queuing delay are small. A better alternative is to apply congestion management and congestion avoidance at oversubscribed points in the network.

A reasonable design goal for end-to-end network delay for VoIP is 150 milliseconds. At this level, delay is not noticeable to the speakers. To achieve guaranteed low delay for voice at campus speeds, it is sufficient to provide a separate outbound queue for real-time traffic. The bursty data traffic such as file transfers is placed in a different queue from the real-time traffic. Because of the relative high speed of switched Ethernet trunks in the campus, it does not matter much whether the queue allocation scheme is based on weighted round robin, weighted fair, or strict priority.

If low delay is guaranteed by providing a separate queue for voice, then packet loss will never be an issue. Weighted random early detection (WRED) is used to achieve low packet loss and high throughput in any queue that experiences bursty data traffic flows.

QoS maps very well to the multilayer campus design. Packet classification is a multilayer service that applies at the wiring-closet switch, which is the ingress point to the network. VoIP traffic flows are recognized by a characteristic port number. The VoIP packets are classified with an IP type of service (ToS) value indicating "low delay voice." Wherever the VoIP packets encounter congestion in the network, the local switch or router will apply the appropriate congestion management and congestion avoidance based on the ToS value.

BAGIC Configuration

2007-10-16T02:13:00.000+05:30

Pune#sh run int Gi 1/2/3
Building configuration...

Current configuration : 1160 bytes
!
interface GigabitEthernet 1/2/3
description Bajaj_Allianz_Life_Insurance/L3VPN-M/6MB-Primary
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 111,1108,1143-1146,2300-2397,2399-2402,2404-2411
switchport trunk allowed vlan add 2413-2489,2499,3040
switchport mode trunk
mtu 9216
no ip address
no keepalive
wrr-queue bandwidth 20 27 53
wrr-queue queue-limit 40 20 20
wrr-queue threshold 1 100 100 100 100 100 100 100 100
wrr-queue threshold 2 50 100 100 100 100 100 100 100
wrr-queue threshold 3 50 100 100 100 100 100 100 100
wrr-queue random-detect min-threshold 2 50 80 100 100 100 100 100 100
wrr-queue random-detect min-threshold 3 50 80 100 100 100 100 100 100
wrr-queue random-detect max-threshold 1 100 100 100 100 100 100 100 100
wrr-queue random-detect max-threshold 3 70 90 100 100 100 100 100 100
wrr-queue cos-map 2 1 1
wrr-queue cos-map 2 2 2
wrr-queue cos-map 3 1 3
wrr-queue cos-map 3 2 4 7
priority-queue cos-map 1 5 6
rcv-queue cos-map 1 4 1 3
rcv-queue cos-map 1 6 0 2 4 7
rcv-queue cos-map 1 8 5 6
mls qos vlan-based
no cdp enable
end

Pune#

List of Tier 1 IPv4 ISPs

2007-10-15T04:32:00.000+05:30

The following nine (9) networks are the only Tier 1 ISPs:
Name AS Number Mid-2007 degree[1][2]
----------------------------------------------------------------------------------------------
AOL Transit Data Network (ATDN) 1668 36
AT&T 7018 2079
Global Crossing (GX) 3549 944
Level 3 3356 1393
Verizon Business (formerly UUNET) 701 2644
NTT Communications (formerly Verio) 2914 524
Qwest 209 394
SAVVIS 3561 520
Sprint Nextel Corporation 1239 1700

Securing MAC

2007-10-15T04:27:00.000+05:30

Cat3750(config-if)#switchport mode access
!--- Sets the interface switchport mode as access.

Cat3750(config-if)#switchport port-security
!--- Enables port security on the interface.

Cat3750(config-if)#switchport port-security mac-address 0011.858D.9AF9
!--- Sets the secure MAC address for the interface.

Cat3750(config-if)#switchport port-security violation shutdown
!--- Sets the violation mode to shutdown. This is the default mode.

Cat3750#show port-security interface fastEthernet 1/0/2
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0011.8565.4B75:1
Security Violation Count : 1

down-when-looped

2007-10-15T03:56:00.000+05:30

Use the down-when-looped interface configuration command to configure an interface to inform the system it is down when loopback is detected.

This command is valid for HDLC or PPP encapsulation on serial and HSSI interfaces.

Backup Interfaces

When an interface has a backup interface configured, it is often desirable that the backup interface be enabled when the primary interface is either down or in loopback. By default, the backup is only enabled if the primary interface is down. By using the down-when-looped command, the backup interface will also be enabled if the primary interface is in loopback.

Testing an Interface with the Loopback Command

If testing an interface with the loopback command, or by placing the DCE into loopback, down-when-looped should not be configured; otherwise, packets will not be transmitted out the interface that is being tested.

Examples

The following example configures interface serial 0 for HDLC encapsulation. It is then configured to let the system know that it is down when in loopback mode.

interface serial0

 encapsulation hdlc

 down-when-looped

How to enable cut-through framing?

2007-10-15T03:51:00.000+05:30

To configure the interfaces on the PA-12E/2FE port adapter to use cut-through switching technology between interfaces within the same bridge group, use the cut-through interface command. To return each interface to store-and-forward switching, use the no form of this command.

cut-through [receive | transmit]

no cut-through

Syntax Description


receive	(Optional) Selects cut-through switching technology on received data.
transmit	(Optional) Selects cut-through switching technology on transmitted data.

Defaults

Store-and-forward switching technology

Cut-through

2007-10-15T03:21:00.001+05:30

cut-through [receive | transmit]

no cut-through

Syntax Description


receive	(Optional) Selects cut-through switching technology on received data.
transmit	(Optional) Selects cut-through switching technology on transmitted data.

Defaults

Store-and-forward switching technology