Catalyst 2940 Switch Command Reference, Release 12.1(13)AY
Cisco IOS Commands - s
Downloads: This chapterpdf (PDF - 1.19MB) The complete bookPDF (PDF - 3.64MB) | Feedback

Table Of Contents

setup express

show boot

show cluster

show cluster candidates

show cluster members

show controllers ethernet-controller

show dot1x

show env

show errdisable recovery

show etherchannel

show file

show interfaces

show interfaces counters

show ip igmp snooping

show ip igmp snooping mrouter

show lacp

show mac address-table

show mac address-table multicast

show mac address-table notification

show mls qos interface

show monitor

show mvr

show mvr interface

show mvr members

show pagp

show port-security

show running-config vlan

show setup express

show spanning-tree

show storm-control

show system mtu

show udld

show version

show vlan

show vmps

show vtp

show wrr-queue bandwidth

show wrr-queue cos-map

shutdown

shutdown vlan

snmp-server enable traps

snmp-server host

snmp trap mac-notification

spanning-tree backbonefast

spanning-tree bpdufilter

spanning-tree bpduguard

spanning-tree cost

spanning-tree etherchannel guard misconfig

spanning-tree extend system-id

spanning-tree guard

spanning-tree link-type

spanning-tree loopguard default

spanning-tree mode

spanning-tree port-priority

spanning-tree portfast (global configuration)

spanning-tree portfast (interface configuration)

spanning-tree stack-port

spanning-tree uplinkfast

spanning-tree vlan

speed

storm-control

switchport access

switchport mode

switchport nonegotiate

switchport port-security

switchport port-security aging

switchport priority extend

switchport protected

switchport trunk

switchport voice vlan

system mtu


setup express

Use the setup express global configuration command to enable Express Setup mode on the switch. This is the default setting. Use the no form of this command to disable Express Setup mode.

setup express

no setup express

Syntax Description

This command has no arguments or keywords.

Defaults

Express Setup is enabled.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

When Express Setup is enabled on a new (unconfigured) switch, pressing the Mode button for 3 seconds activates Express Setup. You can access the switch through an Ethernet port by using the IP address 10.0.0.1 and then can configure the switch with the web-based Express Setup program or the CLI-based setup program.

When you press the Mode button for 3 seconds on a configured switch, the mode LEDs start flashing. If you press the Mode button for a total of 10 seconds, the switch configuration is deleted, and the switch reboots. The switch can then be configured like a new switch, either through the web-based Express Setup program or the CLI-based setup program.


Note As soon as you make any change to the switch configuration (including entering no at the beginning of the CLI-based setup program), configuration by Express Setup is no longer available. You can only run Express Setup again by pressing the Mode button for 10 seconds. This deletes the switch configuration and reboots the switch.


If Express Setup is active on the switch, entering the write memory or copy running-configuration startup-configuration privileged EXEC commands deactivates Express Setup. The IP address 10.0.0.1 is no longer valid on the switch, and your connection using this IP address is terminated.

The primary purpose of the no setup express command is to prevent someone from deleting the switch configuration by pressing the Mode button for 10 seconds.

For more information about Express Setup, refer to Chapter 1, "Quick Setup," and Appendix D, "Configuring the Switch with the CLI-Based Setup Program," in the hardware installation guide.

Examples

This example shows how to enable Express Setup mode:

Switch(config)# setup express

You can verify that Express Setup mode is enabled by pressing the Mode button:

On an unconfigured switch, the mode LEDs turn solid green after 3 seconds.

On a configured switch, the mode LEDs begin flashing after 10 seconds.


Caution If you hold the Mode button down for a total of 10 seconds, the configuration is deleted, and the switch reboots.

This example shows how to disable Express Setup mode:

Switch(config)# no setup express

You can verify that Express Setup mode is disabled by pressing the Mode button. The mode LEDs will only turn solid green or begin flashing if Express Setup mode is enabled on the switch.

Related CommandsYou

Command
Description

clear setup express

Exits Express Setup mode without saving the configuration

show setup express

Displays if Express Setup mode is active on the switch.


show boot

Use the show boot privileged EXEC command to display the settings of the boot environment variables.

show boot [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.


Note Only the IOS software can read and write a copy of the private configuration file. You cannot read, write, delete, or display a copy of this file.


Examples

This is an example of output from the show boot command. Table 2-2 describes each field in the output.

Switch# show boot
BOOT path-list:      flash:boot
Config file:         flash:config.text
Private Config file: flash:private-config.text
Enable Break:        no
Manual Boot:         yes
HELPER path-list:
NVRAM/Config file
      buffer size:   32768 

Table 2-2 show boot Field Descriptions

Field
Description

BOOT path-list

Displays a semicolon-separated list of executable files to load and to execute when automatically booting.

If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the Flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory.

If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the Flash file system.

Config file

Displays the filename that IOS uses to read and write a nonvolatile copy of the system configuration.

Private Config file

Displays the filename that IOS uses to read and write a nonvolatile copy of the private configuration.

Enable Break

Displays whether a break during booting is enabled or disabled. If it is set to yes, on, or 1, you can interrupt the automatic boot process by pressing the Break key on the console after the Flash file system is initialized.

Manual Boot

Displays whether the switch automatically or manually boots. If it is set to no or 0, the boot loader attempts to automatically boot the system. If it is set to anything else, you must manually boot the switch from the boot loader mode.

Helper path-list

Displays a semicolon-separated list of loadable files to dynamically load during the boot loader initialization. Helper files extend or patch the functionality of the boot loader.

NVRAM/Config file buffer size

Displays the buffer size that IOS uses to hold a copy of the configuration file in memory. The configuration file cannot be larger than the buffer size allocation.


Related Commands

Command
Description

boot private-config-file

Specifies the filename that IOS uses to read and write a nonvolatile copy of the private configuration.


show cluster

Use the show cluster privileged EXEC command to display the cluster status and a summary of the cluster to which the switch belongs. This command can be entered on command and member switches.

show cluster [ candidate | members | | {begin | exclude | include} expression]

show cluster [ | {begin | exclude | include} expression]

Syntax Descriptionshow cluster

candidates

Lists cluster candidates information.

members

Lists cluster members information.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

On a member switch, this command displays the identity of the command switch, the switch member number, and the state of its connectivity with the command switch.

On a command switch, this command displays the cluster name and the total number of members. It also shows the cluster status and time since the status changed. If redundancy is enabled, it displays the primary and secondary command-switch information.

If you enter this command on a switch that is not a cluster member, the error message Not a management cluster member appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output when this command is entered on the active command switch:

Switch# show cluster
Command switch for cluster "Switch1"
        Total number of members:        7
        Status:                         1 members are unreachable
        Time since last status change:  0 days, 0 hours, 2 minutes
        Redundancy:                     Enabled
                Standby command switch: Member 1
                Standby Group:          Switch1_standby
                Standby Group Number:   110
        Heartbeat interval:             8
        Heartbeat hold-time:            80
        Extended discovery hop count:   3 

This is an example of output when this command is entered on a member switch:

Switch# show cluster
Member switch for cluster "commander"
        Member number:                  3
        Management IP address:          192.192.192.192
        Command switch mac address:     0000.0c07.ac14
        Heartbeat interval:             8
        Heartbeat hold-time:            80 

This is an example of output when this command is entered on a member switch that is configured as the standby command switch:

Switch# show cluster
Member switch for cluster "commander"
        Member number:                  3 (Standby command switch)
        Management IP address:          192.192.192.192
        Command switch mac address:     0000.0c07.ac14
        Heartbeat interval:             8
        Heartbeat hold-time:            80 

This is an example of output when this command is entered on the command switch that has lost connectivity from member 1:

Switch# show cluster
Command switch for cluster "Switch1"
        Total number of members:        7
        Status:                         1 members are unreachable
        Time since last status change:  0 days, 0 hours, 5 minutes
        Redundancy:                     Disabled
        Heartbeat interval:             8
        Heartbeat hold-time:            80
        Extended discovery hop count:   3 

This is an example of output when this command is entered on a member switch that has lost connectivity with the command switch:

Switch# show cluster
Member switch for cluster "commander"
        Member number:                  <UNKNOWN>
        Management IP address:          192.192.192.192
        Command switch mac address:     0000.0c07.ac14
        Heartbeat interval:             8
        Heartbeat hold-time:            80 

Related Commands

Command
Description

cluster enable

Enables a command-capable switch as the cluster command switch, assigns a cluster name, and optionally assigns a member number to it.

show cluster candidates

Displays a list of candidate switches.

show cluster members

Displays information about the cluster members.


show cluster candidates

Use the show cluster candidates privileged EXEC command on the command switch to display a list of candidate switches.

show cluster candidates [detail | mac-address H.H.H.] [ | {begin | exclude | include} expression]

Syntax Description

detail

(Optional) Display detailed information for all candidates.

mac-address H.H.H.

(Optional) Hexadecimal MAC address of the cluster candidate.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You should only enter this command on a command switch.

If the switch is not a command switch, the command displays an empty line at the prompt.

The SN in the output means switch member number. If E is in the SN column, it means that the switch is discovered through extended discovery. If E does not appear in the SN column, it means that the switch member number is the upstream neighbor of the candidate switch. The hop count is the number of devices the candidate is from the command switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show cluster candidates command:

Switch# show cluster candidates
|---Upstream---|
MAC Address    Name         Device Type      PortIf  FEC Hops SN PortIf  FEC
0030.85f5.8e80 3550-12T     WS-C3550-12T     Gi0/4         1   0  Fa0/1        
0005.313c.5880 Switch2      WS-C3550-12T     Gi0/1         2   E  Gi0/5        
0005.dcc8.01c0 2950-145     WS-C2950T-24     Fa0/1         3   E  Gi0/2 
0002.b922.7180 C2820        WS-C2820-24      Fa0/3        Up 

This is an example of output from the show cluster candidates command that uses the MAC address of a member switch directly connected to the command switch:

Switch# show cluster candidates mac-address 0005.313c.5880
Device 'Switch2' with mac address number 0005.313c.5880
        Device type:              cisco WS-C3550-12T
        Upstream MAC address:     0030.85f5.8e80
        Local port:               Gi0/1  FEC number: 
        Upstream port:            Gi0/5  FEC Number: 
        Hops from cluster edge:   2
        Hops from command device: -

This is an example of output from the show cluster candidates command that uses the MAC address of a member switch three hops from the cluster edge:

Switch# show cluster candidates mac-address 0010.7bb6.1cc0
Device 'c2950-24' with mac address number 0010.7bb6.1cc0
        Device type:            cisco WS-C2950-24
        Upstream MAC address:   0010.7bb6.1cd4
        Local port:             Fa2/1   FEC number: 
        Upstream port:          Fa0/24  FEC Number: 
        Hops from cluster edge: 3
        Hops from command device: -

This is an example of output from the show cluster candidates detail command:

Switch# show cluster candidates detail
Device 'c2950-12' with mac address number 00d0.7961.c4c0
        Device type:            cisco WS-C2950-12
        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 1)
        Local port:             Fa0/3   FEC number: 
        Upstream port:          Fa0/13  FEC Number: 
        Hops from cluster edge: 1
        Hops from command device: 2
	Device '1900_Switch' with mac address number 00e0.1e7e.be80
        Device type:            cisco 1900
        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 2)
        Local port:             3       FEC number: 0
        Upstream port:          Fa0/11  FEC Number: 
        Hops from cluster edge: 1
        Hops from command device: 2
Device 'c2924-XL' with mac address number 00e0.1e9f.7a00
        Device type:            cisco WS-C2924-XL
        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 3)
        Local port:             Fa0/5   FEC number: 
        Upstream port:          Fa0/3   FEC Number: 
        Hops from cluster edge: 1
        Hops from command device: 2

Related Commands

Command
Description

show cluster

Displays the cluster status and a summary of the cluster to which the switch belongs.

show cluster members

Displays information about the cluster members.


show cluster members

Use the show cluster members privileged EXEC command on the command switch to display information about the cluster members.

show cluster members [n | detail] [ | {begin | exclude | include} expression]

Syntax Description

n

(Optional) Number that identifies a cluster member. The range is from 0 to 15.

detail

(Optional) Display detailed information for all cluster members.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You should only enter this command on a command switch.

If the cluster has no members, this command displays an empty line at the prompt.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show cluster members command. The SN in the display means switch number.

|---Upstream---|
SN MAC Address    Name         PortIf FEC Hops   SN PortIf  FEC  State
0  0003.fd62.9180 2940-8TT-S-1              0                     Up   (Cmdr)
1  0003.fd62.91c0 2940-8TT-S-1 Fa0/6        1     0  Fa0/6        Up  
2  0002.b922.7180 WS-C2820     B        0   1     0  Fa0/3        Up 

Switch# show cluster members
                                                |---Upstream---|
SN MAC Address    Name         PortIf FEC Hops   SN PortIf  FEC  State
0  0002.4b29.2e00 StLouis1                 0                    Up   (Cmdr)
1  0030.946c.d740 tal-switch-1 Fa0/13      1     0  Gi0/1       Up
2  0002.b922.7180 nms-2820     10      0   2     1  Fa0/18      Up
3  0002.4b29.4400 SanJuan2     Gi0/1       2     1  Fa0/11      Up
4  0002.4b28.c480 GenieTest    Gi0/2       2     1  Fa0/9       Up

This is an example of output from the show cluster members 3 command for cluster member 3:

Switch# show cluster members 3
Device 'SanJuan2' with member number 3
        Device type:            cisco WS-C3550-12T
        MAC address:            0002.4b29.4400
        Upstream MAC address:   0030.946c.d740 (Cluster member 1)
        Local port:             Gi0/1   FEC number:
        Upstream port:          Fa0/11  FEC Number:
        Hops from command device: 2

This is an example of output from the show cluster members detail command:

Switch# show cluster members detail
Device 'StLouis1' with member number 0 (Command Switch)
        Device type:            cisco WS-C3550-12T
        MAC address:            0002.4b29.2e00
        Upstream MAC address:
        Local port:                     FEC number:
        Upstream port:                  FEC Number:
        Hops from command device: 0                 
Device 'tal-switch-14' with member number 1
        Device type:            cisco WS-C3548-XL
        MAC address:            0030.946c.d740
        Upstream MAC address:   0002.4b29.2e00 (Cluster member 0)
        Local port:             Fa0/13  FEC number:
        Upstream port:          Gi0/1   FEC Number:
        Hops from command device: 1                   
Device 'nms-2820' with member number 2
        Device type:            cisco 2820
        MAC address:            0002.b922.7180
        Upstream MAC address:   0030.946c.d740 (Cluster member 1)
        Local port:             10      FEC number: 0
        Upstream port:          Fa0/18  FEC Number:
        Hops from command device: 2                        
Device 'SanJuan2' with member number 3
        Device type:            cisco WS-C3550-12T
        MAC address:            0002.4b29.4400
        Upstream MAC address:   0030.946c.d740 (Cluster member 1)
        Local port:             Gi0/1   FEC number:
        Upstream port:          Fa0/11  FEC Number:
        Hops from command device: 2
Device 'Test' with member number 4
        Device type:            cisco SeaHorse
        MAC address:            0002.4b28.c480
        Upstream MAC address:   0030.946c.d740 (Cluster member 1)
        Local port:             Gi0/2   FEC number:
        Upstream port:          Fa0/9   FEC Number:
        Hops from command device: 2
Device 'Palpatine' with member number 5
        Device type:            cisco WS-C2924M-XL
        MAC address:            00b0.6404.f8c0
        Upstream MAC address:   0002.4b29.2e00 (Cluster member 0)
        Local port:             Gi2/1   FEC number:
        Upstream port:          Gi0/7   FEC Number:
        Hops from command device: 1 

Related Commands

Command
Description

show cluster

Displays the cluster status and a summary of the cluster to which the switch belongs.

show cluster candidates

Displays a list of candidate switches.


show controllers ethernet-controller

Use the show controllers ethernet-controller privileged EXEC command without keywords to display per-interface send and receive statistics read from the hardware. Use with keywords to display the interface internal registers.

show controllers ethernet-controller interface-id [asic | phy] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

The physical interface.

asic

(Optional) Display the state of the internal registers on the forwarding application-specific integrated circuit (ASIC) for the interface.

phy

(Optional) Display the status of the internal registers on the switch physical layer device (PHY) for the interface.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

This display without keywords provides traffic statistics, basically the RMON statistics for the interface.

When you enter the asic or phy keyword, the displayed information is useful primarily for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show controllers ethernet-controller command. For this example, Table 2-3 describes the Transmit fields, and Table 2-4 describes the Receive fields.

Switch# show controllers ethernet-controller fastethernet0/2
Transmit                                Receive
19188 Bytes                            53052 Bytes
180 Frames                             679 Frames
86 Multicast frames                     0 FCS errors
1 Broadcast frames                   678 Multicast frames
0 Pause frames                         0 Broadcast frames
0 Single defer frames                  0 Control frames
0 Multiple defer frames                0 Pause frames
0 1 collision frames                   0 Unknown opcode frames
0 2-15 collisions                      0 Alignment errors
0 Late collisions                      0 Length out of range
0 Excessive collisions                 0 Symbol error frames
0 Total collisions                     0 False carrier errors
0 Control frames                       0 Valid frames, too small
0 VLAN discard frames                  0 Valid frames, too large
0 Too old frames                       0 Invalid frames, too small
0 Tagged frames                        0 Invalid frames, too large
0 Aborted Tx frames                    0 Discarded frames

Table 2-3 Transmit Field Descriptions From the show controllers ethernet-controller Command Output 

Field
Description

Bytes

The total number of bytes transmitted on an interface.

Frames

The total number of frames transmitted on an interface.

Multicast frames

The total number of frames transmitted to multicast addresses.

Broadcast Frames

The total number of frames transmitted to broadcast addresses.

Pause frames

The number of pause frames transmitted on an interface.

Single defer frames

The number of frames for which the first transmission attempt on an interface is not successful. This value excludes frames in collisions.

Multiple defer frames

The number of frames that are not be transmitted after the time exceeds 2*maximum-packet time.

1 Collision frames

The number of frames that are successfully transmitted on an interface after one collision occurs.

2-15 collisions

The number of frames that are successfully transmitted on an interface after more than one collision occurs.

Late collisions

After a frame is transmitted, the number of times that a collision is detected on an interface later than 512 bit times.

Excessive collisions

The number of frames that could not be transmitted on an interface because more than 16 collisions occurred.

Total collisions

The total number of collisions on an interface.

Control frames

The number of control frames transmitted on an interface, such as STP1 BPDUs2 .

VLAN discard frames

The number of frames dropped on an interface because the CFI3 bit is set.

Too old frames

The number of frames dropped on the egress port because the packet is aged out.

Tagged frames

The number of tagged frames transmitted on an interface.

Aborted Tx frames

The number of aborted transmission attempts on the interface.

1 STP = Spanning Tree Protocol

2 BPDU = bridge protocol data unit

3 CFI = Canonical Format Indicator


Table 2-4 Receive Field Descriptions From the show controllers ethernet-controller Command Output 

Field
Description

Bytes

The total amount of memory (in bytes) used by frames received on an interface, including the FCS1 value and the incorrectly-formed frames. This value excludes the frame header bits.

Frames

The total number of frames received on an interface, including multicast frames, broadcast frames, and incorrectly-formed frames.

FCS errors

The total number of frames received on an interface that have a valid length (in bytes) but do not have the correct FCS values.

Muliticast frames

The total number of frames successfully received on the interface that are directed to multicast addresses.

Broadcast frames

The total number of frames successfully received on an interface that are directed to broadcast addresses.

Control frames

The number of control frames received on an interface, such as STP BPDUs.

Pause frames

The number of pause frames received on an interface.

Unknown opcode frames

The number of frames received with an unknown operation code.

Alignment errors

The total number of frames received on an interface that have alignment errors.

Length out of range

The number of frames received on an interface that have an out-of-range length.

Symbol error frames

The number of frames received on an interface that have symbol errors.

False carrier errors

The number of occurrences in which the interface detects a false carrier when frames are not transmitted or received.

Valid frames, too small

The number of frames received on an interface that are less than 64 bytes (or 68 bytes for VLAN tagged frames) and have valid FCS values. The frame size includes the FCS bits but excludes the frame header bits.

Valid frames, too large

The number of frames received on an interface that are larger than the maximum allowed frame size.

Invalid frames, too small

The number of frames received that are less than 64 bytes (including the FCS bits and excluding the frame header) and have either an FCS error or an alignment error.

Invalid frames, too large

The number of frames received that were longer than maximum allowed MTU2 size (including the FCS bits and excluding the frame header) and have either an FCS error or an alignment error.

Discarded frames

The number of frames discarded because of lack of receive buffer memory.

1 FCS = frame check sequence

2 MTU = maximum transmission unit


Related Commands

Command
Description

show interfaces

Displays the administrative and operational status of all interfaces or a specified interface.


show dot1x

Use the show dot1x privileged EXEC command to display the 802.1X statistics, administrative status, and operational status for the switch or for the specified interface.

show dot1x [interface interface-id] | [statistics [interface interface-id]] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id

(Optional) Display the 802.1X status for the specified port.

statistics [interface interface-id]

(Optional) Display 802.1X statistics for the switch or the specified interface.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If you do not specify an interface, global parameters and a summary appear. If you specify an interface, details for that interface appear.

If you specify the statistics keyword without the interface interface-id option, statistics appear for all interfaces. If you specify the statistics keyword with the interface interface-id option, statistics appear for the specified interface.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show dot1x command:

Switch# show dot1x

Global 802.1X Parameters
    reauth-enabled                no
    reauth-period               3600
    quiet-period                  60
    tx-period                     30
    supp-timeout                  30
    server-timeout                30
    reauth-max                     2
    max-req                        2

802.1X Port Summary
    Port Name                Status      Mode                Authorized
    Gi0/1                    enabled     Auto (negotiate)    no

    802.1X Port Details

    802.1X is enabled on GigabitEthernet0/1
      Status                Unauthorized
      Port-control          Auto
      Supplicant            0060.b0f8.fbfb
      Multiple Hosts        Disallowed
      Current Identifier    2

      Authenticator State Machine
        State               AUTHENTICATING
        Reauth Count        1

      Backend State Machine
        State               RESPONSE
        Request Count       0
        Identifier (Server) 2

      Reauthentication State Machine
        State               INITIALIZE


Note In the previous example, the supp-timeout, server-timeout, and reauth-max values in the Global 802.1X Parameters section are not configurable. When relaying a request from the Remote Authentication Dial-In User Service (RADIUS) authentication server to the client, the supp-timeout is the amount of time the switch waits for a response before it resends the request. When relaying a response from the client to the RADIUS authentication server, the server-timeout is the amount of time the switch waits for a reply before it resends the response. The reauth-max parameter is the maximum number of times that the switch tries to authenticate the client without receiving any response before the switch resets the port and restarts the authentication process.


In the 802.1X Port Summary section of the example, the Status column shows whether the port is enabled for 802.1X (the dot1x port-control interface configuration command is set to auto or force-unauthorized). The Mode column shows the operational status of the port; for example, if you configure the dot1x port-control interface configuration command to force-unauthorized, but the port has not transitioned to that state, the Mode column displays auto. If you disable 802.1X, the Mode column displays n/a.

The Authorized column shows the authorization state of the port. For information about port states, refer to the "Configuring 802.1X Port-Based Authentication" chapter in the Catalyst 2940 Switch Software Configuration Guide.

This is an example of output from the show dot1x interface gigabitethernet0/1 privileged EXEC command. Table 2-5 describes the fields in the example.

Switch# show dot1x interface gigabitethernet0/1

802.1X is enabled on GigabitEthernet0/1 
  Status                Authorized 
  Port-control          Auto 
  Supplicant            0060.b0f8.fbfb 
  Multiple Hosts        Disallowed 
  Current Identifier    3

  Authenticator State Machine 
    State               AUTHENTICATED 
    Reauth Count        0

  Backend State Machine 
    State               IDLE 
    Request Count       0 
    Identifier (Server) 2

  Reauthentication State Machine 
    State               INITIALIZE

Table 2-5 show dot1x interface Field Description

Field
Description

802.1X is enabled on GigabitEthernet0/2

 

Status

Status of the port (authorized or unauthorized). The status of a port appears as authorized if the dot1x port-control interface configuration command is set to auto, and authentication was successful.

Port-control

Setting of the dot1x port-control interface configuration command.

Supplicant

Ethernet MAC address of the client, if one exists. If the switch has not discovered the client, this field displays Not set.

Multiple Hosts

Setting of the dot1x multiple-hosts interface configuration command (allowed or disallowed).

Current Identifier1

Each exchange between the switch and the client includes an identifier, which matches requests with responses. This number is incremented with each exchange and can be reset by the authentication server.

1 This field and the remaining fields in the example show internal state information. For a detailed description of these state machines and their settings, refer to the IEEE 802.1X standard.


This is an example of output from the show dot1x statistics interface gigiabitethernet0/1 command. Table 2-6 describes the fields in the example.

Switch# show dot1x statistics interface gigabitethernet0/1

GigabitEthernet0/1

    Rx: EAPOL     EAPOL     EAPOL     EAPOL     EAP       EAP       EAP
        Start     Logoff    Invalid   Total     Resp/Id   Resp/Oth  LenError
        0         0         0         21        0         0         0

        Last      Last
        EAPOLVer  EAPOLSrc
        1         0002.4b29.2a03

    Tx: EAPOL     EAP       EAP
        Total     Req/Id    Req/Oth
        622       445       0 

Table 2-6 show dot1x statistics Field Descriptions 

Field
Description

RX EAPOL1 Start

Number of valid EAPOL-start frames that have been received

RX EAPOL Logoff

Number of EAPOL-logoff frames that have been received

RX EAPOL Invalid

Number of EAPOL frames that have been received and have an unrecognized frame type

RX EAPOL Total

Number of valid EAPOL frames of any type that have been received

RX EAP2 Resp/ID

Number of EAP-response/identity frames that have been received

RX EAP Resp/Oth

Number of valid EAP-response frames (other than response/identity frames) that have been received

RX EAP LenError

Number of EAPOL frames that have been received in which the packet body length field is invalid

Last EAPOLVer

Protocol version number carried in the most recently received EAPOL frame

LAST EAPOLSrc

Source MAC address carried in the most recently received EAPOL frame

TX EAPOL Total

Number of EAPOL frames of any type that have been sent

TX EAP Req/Id

Number of EAP-request/identity frames that have been sent

TX EAP Req/Oth

Number of EAP-request frames (other than request/identity frames) that have been sent

1 EAPOL = Extensible Authentication Protocol over LAN

2 EAP = Extensible Authentication Protocol


Related Commands

Command
Description

dot1x default

Resets the global 802.1X parameters to their default values.


show env

Use the show env user EXEC command to display fan information for the switch.

show env {all | fan | power | rps} [ | {begin | exclude | include} expression]

Syntax Description

all

Display both fan and temperature environmental status.

fan

Display the switch fan status (only available in privileged EXEC mode).

power

Display the internal power supply status.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.



Note Though visible in the command-line help string, the rps keyword is not supported.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show env command:

Switch> show env all
FAN is OK
Internal POWER supply is OK

show errdisable recovery

Use the show errdisable recovery user EXEC command to display the error-disable recovery timer information.

show errdisable recovery [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show errdisable recovery command:

Switch> show errdisable recovery
ErrDisable Reason    Timer Status
-----------------    --------------
udld                 Disabled
bpduguard            Disabled
security-violatio    Disabled
channel-misconfig    Disabled
vmps                 Disabled
pagp-flap            Disabled
dtp-flap             Disabled
link-flap            Disabled
gbic-invalid         Disabled
psecure-violation    Disabled

Timer interval:300 seconds

Interfaces that will be enabled at the next timeout:

Related Commands

Command
Description

errdisable recovery

Configures the recover mechanism variables.

show interfaces trunk

Displays interface status or a list of interfaces in error-disabled state.


show etherchannel

Use the show etherchannel user EXEC command to display EtherChannel information for a channel.

show etherchannel [channel-group-number] {brief | detail | load-balance | port | port-channel | summary} [ | {begin | exclude | include} expression]

Syntax Description

channel-group-number

(Optional) Number of the channel group. Valid numbers range from 1 to 6.

brief

Display a summary of EtherChannel information.

detail

Display detailed EtherChannel information.

load-balance

Display the load-balance or frame-distribution scheme among ports in the port channel.

port

Display EtherChannel port information.

port-channel

Display port-channel information.

summary

Display a one-line summary per channel-group.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If you do not specify a channel-group, all channel groups appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show etherchannel 1 detail command:

Switch> show etherchannel 1 detail
Group state = L2
Ports: 1   Maxports = 8
Port-channels: 1 Max Port-channels = 1
                Ports in the group:
                -------------------
Port: Fa0/3
------------

Port state    = Down Not-in-Bndl
Channel group = 1           Mode = Automatic-Sl     Gcchange = 0
Port-channel  = null        GC   = 0x00000000    Pseudo port-channel = Po1
Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.
        A - Device is in Auto mode.        P - Device learns on physical port.
        d - PAgP is down.
Timers: H - Hello timer is running.        Q - Quit timer is running.
        S - Switching timer is running.    I - Interface timer is running.

Local information:
                                Hello    Partner  PAgP     Learning  Group
Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex
Fa0/3     dA    U1/S1           1s       0        200        Any      0

Age of the port in the current state: 10d:23h:07m:37s
                Port-channels in the group:
                ----------------------

Port-channel: Po1
------------

Age of the Port-channel   = 03d:02h:22m:43s
Logical slot/port   = 1/0           Number of ports = 0
GC                  = 0x00000000      HotStandBy port = null
Port state          = Port-channel Ag-Not-Inuse

This is an example of output from the show etherchannel 1 summary command:

Switch> show etherchannel 1 summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        R - Layer3      S - Layer2
		u - unsuitable for bundling
        U - port-channel in use 
		d - default port
Group Port-channel  Ports
-----+------------+-----------------------------------------------------------
1     Po1(SU)     Fa0/6(Pd)		 Fa0/15(P)

This is an example of output from the show etherchannel 1 brief command:

Switch> show etherchannel 1 brief
Group state = L2
Ports: 1   Maxports = 8
Port-channels: 1 Max Port-channels = 1

This is an example of output from the show etherchannel 1 port command:

Switch> show etherchannel 1 port
                Ports in the group:
                -------------------
Port: Fa0/3
------------

Port state    = Down Not-in-Bndl
Channel group = 1           Mode = Automatic-Sl     Gcchange = 0
Port-channel  = null        GC   = 0x00000000    Pseudo port-channel = Po1
Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.
        A - Device is in Auto mode.        P - Device learns on physical port.
        d - PAgP is down.
Timers: H - Hello timer is running.        Q - Quit timer is running.
        S - Switching timer is running.    I - Interface timer is running.

Local information:
                                Hello    Partner  PAgP     Learning  Group
Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex
Fa0/3     dA    U1/S1           1s       0        200        Any      0

Age of the port in the current state: 10d:23h:13m:21s

Related Commands

Command
Description

channel-group

Assigns an Ethernet interface to an EtherChannel group.

interface port-channel

Accesses or creates the port channel.


show file

Use the show file privileged EXEC command to display a list of open file descriptors, file information, and file system information.

show file {descriptors | information {device:}filename | systems} [ | {begin | exclude |
include} expression]

Syntax Description

descriptors

Display a list of open file descriptors.

information

Display file information.

device:

Device containing the file. Valid devices include the switch Flash memory.

filename

Name of file.

systems

Display file system information.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

File descriptors are the internal representations of open files. You can use this command to see if another user has a file open.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show file descriptors command:

Switch# show file descriptors
File Descriptors:
FD  Position  Open  PID  Path
0    187392   0001    2  tftp://temp/hampton/c2950g.a
1    184320   030A    2  flash:c2950-i-m.a

Table 2-7 describes the fields in the show file descriptors command output.

Table 2-7 show file descriptors Field Descriptions 

Field
Description

FD

File descriptor. The file descriptor is a small integer used to specify the file once it has been opened.

Position

Byte offset from the start of the file.

Open

Flags supplied when opening the file.

PID

Process ID of the process that opened the file.

Path

Location of the file.


This is an example of output from the show file information nvram:startup-config command:

Switch# show file information nvram:startup-config
nvram:startup-config:
  type is ascii text

Table 2-8 lists the possible file types for the previous example.

Table 2-8 Possible File Types 

Field
Description

ascii text

Configuration file or other text file.

coff

Runnable image in coff format.

ebcdic

Text generated on an IBM mainframe.

image (a.out)

Runnable image in a.out format.

image (elf)

Runnable image in elf format.

lzw compression

Lzw compressed file.

tar

Text archive file used by the CIP.


This is an example of output from the show file systems command:

Switch# show file systems
File Systems:

     Size(b)     Free(b)      Type  Flags  Prefixes
*    7741440      433152     flash     rw   flash:
     7741440      433152   unknown     rw   zflash:
       32768       25316     nvram     rw   nvram:
           -           -   network     rw   tftp:
           -           -    opaque     rw   null:
           -           -    opaque     rw   system:
           -           -    opaque     ro   xmodem:
           -           -    opaque     ro   ymodem:
           -           -   network     rw   rcp:
           -           -   network     rw   ftp:

For this example, Table 2-9 describes the fields in the show file systems command output. Table 2-10 lists the file system types. Table 2-11 lists the file system flags.

Table 2-9 show file systems Field Descriptions 

Field
Description

Size(b)

Amount of memory in the file system, in bytes.

Free(b)

Amount of free memory in the file system, in bytes.

Type

Type of file system.

Flags

Permissions for file system.

Prefixes

Alias for file system.


Table 2-10 File System Types 

Field
Description

disk

The file system is for a rotating medium.

flash

The file system is for a Flash memory device.

network

The file system is a network file system, such as TFTP, rcp, or FTP.

nvram

The file system is for an NVRAM device.

opaque

The file system is a locally generated pseudo file system (for example, the system) or a download interface, such as brimux.

rom

The file system is for a ROM or EPROM device.

tty

The file system is for a collection of terminal devices.

unknown

The file system is of unknown type.


Table 2-11 File System Flags

Field
Description

ro

The file system is Read Only.

wo

The file system is Write Only

rw

The file system is Read/Write.


show interfaces

Use the show interfaces privileged EXEC command to display the administrative and operational status of all interfaces or a specified interface.

show interfaces [interface-id | vlan vlan-id] [accounting | capabilities [module {module-number]} | description | etherchannel | flowcontrol | pruning | stats | status [err-disabled] | switchport | trunk] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) Valid interfaces include physical ports (including type, slot, and port number) and port channels. The valid port-channel range is 1 to 6.

vlan vlan-id

(Optional) VLAN ID. The valid VLAN range is 1 to 1005.

accounting

(Optional) Display interface accounting information.

capabilities

(Optional) Display the capabilities of the ports.

description

(Optional) Display the administrative status and description set for an interface.

etherchannel

(Optional) Display interface EtherChannel information.

flowcontrol

(Optional) Display interface flowcontrol information.

pruning

(Optional) Display interface trunk VTP pruning information.

stats

(Optional) Display the input and output packets by switching path for the interface.

status

(Optional) Display the status of the interface.

err-disabled

(Optional) Display interfaces in error-disabled state.

switchport

(Optional) Display the administrative and operational status of a switching (nonrouting) port.

trunk

Display interface trunk information. If you do not specify an interface, information for only active trunking ports appears.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

| module module-number

(Optional) The module or interface number. If you do not specify a module number, the information is displayed for all ports.

expression

Expression in the output to use as a reference point.



Note Though visible in the command-line help strings, the crb, fair-queue, irb, mac-accounting, precedence, random-detect, rate-limit, and shape options are not supported.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show interfaces accounting command:

Switch# show interfaces accounting
Vlan1 
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                      IP     788351   52972014     251412  100879066
                     ARP      20717    1243020         96       7478
FastEthernet0/1 
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
           Spanning Tree     578189   33534928     867150   55497352
                     CDP       9643    3975395      11364    4844104
                     VTP          0          0        938      92862
                     DTP      19276    1118008          0          0
<output truncated>

This is an example of output from the show interfaces capabilities command:

Switch# show interfaces fastethernet0/1 capabilities 
FastEthernet0/1
  Model:                 WS-C2940-8TT-S
  Type:                  10/100BaseTX
  Speed:                 10,100,auto
  Duplex:                half,full,auto
  UDLD:                  yes
  Trunk encap. type:     802.1Q
  Trunk mode:            on,off,desirable,nonegotiate
  Channel:               yes
  Broadcast suppression: percentage(0-100)
  Flowcontrol:           rx-(none),tx-(none)
  Fast Start:            yes
  CoS rewrite:           yes
  ToS rewrite:           yes
  Inline power:          no
  SPAN:                  source/destination
  PortSecure:            Yes
  Dot1x:                 Yes

This is an example of output from the show interfaces gigabitethernet0/1 command:

Switch# show interfaces gigabitethernet0/1 
GigabitEthernet0/1
  Model:                 WS-C2940-8TT-S
  Type:                  unknown
  Speed:                 10,100,1000,auto
  Duplex:                half,full,auto
  UDLD:                  yes
  Trunk encap. type:     802.1Q
  Trunk mode:            on,off,desirable,nonegotiate
  Channel:               yes
  Broadcast suppression: percentage(0-100)
  Flowcontrol:           rx-(off,on,desired),tx-(off,on,desired)
  Fast Start:            yes
  CoS rewrite:           yes
  ToS rewrite:           yes
  Inline power:          no

This is an example of output from the show interfaces gigabitethernet0/1 description command when the interface has been described as Connects to Marketing by using the description interface configuration command.

Switch# show interfaces gigabitethernet0/1 description
Interface Status         Protocol Description
G10/1 up             down     Connects to Marketing

This is an example of output from the show interfaces fastethernet0/1 pruning command when pruning is enabled in the VTP domain:

Switch# show interfaces fastethernet0/1 pruning

Port      Vlans pruned for lack of request by neighbor
Fa0/1     4,196

Port      Vlan traffic requested of neighbor
Fa0/1     1,4

This is an example of output from the show interfaces stats command:

Switch# show interfaces stats
Vlan1
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor    3224706  223689126    3277307  280637322
             Route cache          0          0          0          0
                   Total    3224706  223689126    3277307  280637322
Interface Vlan5 is disabled

FastEthernet0/1
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor    3286423  231672787     179501   17431060
             Route cache          0          0          0          0
                   Total    3286423  231672787     179501   17431060

This is an example of output from the show interfaces status command. It displays the status of all interfaces.

Switch# show interfaces status

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/1                        connected    trunk      a-full  a-100 10/100BaseTX
Fa0/2                        notconnect   1            auto   auto 10/100BaseTX
Fa0/3                        connected    trunk      a-full  a-100 10/100BaseTX
Fa0/4                        notconnect   1            auto   auto 10/100BaseTX
Fa0/5                        notconnect   1            auto   auto 10/100BaseTX
Fa0/6                        notconnect   1            auto   auto 10/100BaseTX
Fa0/7                        notconnect   1            auto   auto 10/100BaseTX
Fa0/8                        notconnect   1            auto   auto 10/100BaseTX
Gi0/1                        notconnect   1            auto   auto unknown

This is an example of output from the show interfaces status err-disabled command. It displays the status of interfaces in error-disabled state.

switch#show interfaces fastethernet0/15 status err-disabled 

Port    Name               Status       Reason
Fa0/15                     err-disabled psecure-violation

This is an example of output from the show interfaces etherchannel command when port channels are configured on the switch:

Switch# show interfaces etherchannel
----
FastEthernet0/1:
Port state    = Up Mstr In-Bndl 
Channel group = 1           Mode = On/FEC     Gcchange = 0
Port-channel  = Po1         GC   = 0x00010001    Pseudo port-channel = Po1
Port index    = 0           Load = 0x00

Age of the port in the current state:00d:00h:06m:54s
----
Port-channel1:
Age of the Port-channel   = 09d:22h:45m:14s
Logical slot/port   = 1/0           Number of ports = 1
GC                  = 0x00010001      HotStandBy port = null
Port state          = Port-channel Ag-Inuse 

Ports in the Port-channel:

Index   Load   Port    EC state
------+------+------+------------
  0     00     Fa0/1    on         

Time since last port bundled:   00d:00h:06m:54s    Fa0/1

This is an example of output from the show interfaces flowcontrol command. Table 2-12 lists the fields in this display.

Switch# show interfaces flowcontrol
Port    Send FlowControl  Receive FlowControl  RxPause TxPause
        admin    oper     admin    oper                       
-----   -------- -------- -------- --------    ------- -------
Gi0/1   desired  off      off      off         0       0 

Table 2-12 show interfaces flowcontrol Field Descriptions 

Field
Description

Port

Displays the port name.

Send FlowControl

Admin

Displays the administrative (configured) setting for the flow control send mode.

Oper

Displays the operational (running) setting for the flow control send mode.

Receive FlowControl

Admin

Displays the administrative (configured) setting for the flow control receive mode.

Oper

Displays the operational (running) setting for the flow control receive mode.

RxPause

Displays the number of pause frames received.

TxPause

Displays the number of pause frames sent.

On

Flow control is enabled.

Off

Flow control is disabled.

Desired

Flow control is enabled if the other end supports it.

Unsupp.

Flow control is not supported.


This is an example of output from the show interfaces switchport command for a single interface. Table 2-13 describes the fields in the output.

Switch# show interfaces gigabitethernet0/1 switchport
Name: Gi0/1
Switchport:Enabled
Administrative Mode:dynamic desirable
Operational Mode:static access
Administrative Trunking Encapsulation:negotiate
Negotiation of Trunking:On
Access Mode VLAN:1 (default)
Trunking Native Mode VLAN:1 (default)
Voice VLAN:none
Administrative private-vlan host-association:none
Administrative private-vlan mapping:none
Operational private-vlan:none
Trunking VLANs Enabled:ALL
Pruning VLANs Enabled:2-1001
Capture Mode: Disabled
Capture VLANs Allowed:ALL



Protected:true
Unknown unicast blocked:disabled
Unknown multicast blocked:disabled

Voice VLAN:none (Inactive)
Appliance trust:none

Table 2-13 show interfaces switchport Field Descriptions 

Field
Description

Name

Displays the port name.

Switchport

Displays the administrative and operational status of the port. In this output, the port is in switchport mode.

Administrative Mode

Operational Mode

Displays the administrative and operational mode.

Administrative Trunking Encapsulation

Negotiation of Trunking

Displays the administrative and operational encapsulation method, and whether trunking negotiation is enabled.

Access Mode VLAN

Displays the VLAN ID to which the port is configured.

Trunking Native Mode VLAN

Trunking VLANs Enabled

Trunking VLANs Active

Lists the VLAN ID of the trunk that is in native mode. Lists the allowed VLANs on the trunk. Lists the active VLANs on the trunk.

Pruning VLANs Enabled

Lists the VLANs that are pruning-eligible.

Administrative private-vlan host-association

Administrative private-vlan mapping

Operational private-vlan

Displays the administrative and operational status of the private VLAN, and displays the private-VLAN mapping.

Capture Mode

Captured VLANs Allowed

Displays the capture mode and the number of captured VLANs allowed.

Note Because the switch does not support the capture feature, the values for these fields do not change.

Protected

Displays whether or not protected port is enabled (True) or disabled (False) on the interface.

Voice VLAN

Displays the VLAN ID on which voice VLAN is enabled.

Appliance trust

Displays the class of service (CoS) setting of the data packets of the IP phone.


This is an example of output from the show interfaces trunk command:

Switch# show interfaces trunk

Port      Mode         Encapsulation  Status        Native vlan
Fa0/4     on           802.1q         trunking      1
Fa0/6     on           802.1q         trunking      1

Port      Vlans allowed on trunk
Fa0/4     1-1005
Fa0/6     1-1005

Port      Vlans allowed and active in management domain
Fa0/4     1-2,51-52
Fa0/6     1-2,51-52

Port      Vlans in spanning tree forwarding state and not pruned
Fa0/4     1
Fa0/6     1-2,51-52

This is an example of output from the show interfaces fastethernet0/1 trunk command. It displays trunking information for the interface.

Switch# show interfaces fastethernet0/1 trunk

Port      Mode         Encapsulation  Status        Native vlan
Fa0/1     desirable    802.1q         trunking      1


Port      Vlans allowed and active in management domain
Fa0/1     1,4,196,306

Port      Vlans in spanning tree forwarding state and not pruned
Fa0/1     1,306

Related Commands

Command
Description

switchport access

Configures a port as a static-access or dynamic-access port.

switchport protected

Isolates Layer 2 unicast, multicast, and broadcast traffic from other protected ports on the same switch.

switchport trunk pruning

Configures the VLAN pruning-eligible list for ports in trunking mode.


show interfaces counters

Use the show interfaces counters privileged EXEC command to display various counters for a specific interface or for all interfaces.

show interfaces [interface-id | vlan vlan-id] counters [broadcast | errors | multicast | trunk | unicast] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) ID of the physical interface, including type and slot and port number.

vlan vlan-id

(Optional) VLAN number of the management VLAN. Valid IDs are from 1 to 1001.

broadcast

(Optional) Display discarded broadcast traffic.

errors

(Optional) Display error counters.

multicast

(Optional) Display discarded multicast traffic.

trunk

(Optional) Display trunk counters.

unicast

(Optional) Display discarded unicast traffic.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If you do not enter any keywords, all counters for all interfaces are included.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show interfaces counters command. It displays all the counters for the switch.

Switch# show interfaces counters
Port            InOctets   InUcastPkts   InMcastPkts   InBcastPkts
Gi0/1           23324617         10376        185709        126020

Port           OutOctets  OutUcastPkts  OutMcastPkts  OutBcastPkts
Gi0/1            4990607         28079         21122            10

This is an example of output from the show interfaces counters broadcast command. It displays the dropped broadcast traffic for all interfaces.

Switch# show interfaces counters broadcast
Port      BcastSuppDiscards
Gi0/1                     1

This is an example of output from the show interfaces gigabitethernet0/1 counters broadcast command. It displays the dropped broadcast traffic for an interface.

Switch# show interfaces gigabitethernet0/1 counters broadcast

Port      BcastSuppDiscards
Gi0/1                     0 

This is an example of output from the show interfaces counters errors command. It displays the interface error counters for all interfaces.

Switch# show interfaces counters errors

Port        Align-Err    FCS-Err   Xmit-Err    Rcv-Err UnderSize
Gi0/1               0          0          0          0         0
Gi0/2               0          0          0          0         0

Port      Single-Col Multi-Col  Late-Col Excess-Col Carri-Sen     Runts    Giants
Gi0/1         0        0       0        0       0       0       0

This is an example of output from the show interfaces counters multicast command. It displays the dropped multicast traffic for all interfaces.

Switch# show interfaces counters multicast

Port      McastSuppDiscards
Gi0/1                     0

This is an example of output from the show interfaces counters trunk command. It displays the trunk counters for all interfaces.

Switch# show interfaces counters trunk

Port        TrunkFramesTx  TrunkFramesRx  WrongEncap
Gi0/1                   0              0           0

This is an example of output from the show interfaces counters unicast command. It displays the dropped unicast traffic for all interfaces.

Switch# show interfaces counters unicast

Port      UcastSuppDiscards
Gi0/1                  6872

Related Commands

Command
Description

show interfaces

Displays interface characteristics.

storm-control

Configures broadcast, multicast, and unicast storm control for an interface.


show ip igmp snooping

Use the show ip igmp snooping privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping configuration of the switch or the VLAN.

show ip igmp snooping [vlan vlan-id] [ | {begin | exclude | include} expression]

show ip igmp snooping [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

vlan vlan-id

(Optional) Keyword and variable to specify a VLAN; valid values are 1 to 1001.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use this command to display snooping characteristics for the switch or for a specific VLAN.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping command:

Switch# show ip igmp snooping 

vlan 1
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is enabled on this Vlan
  IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan
vlan 2
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is enabled on this Vlan
  IGMP snooping mrouter learn mode is cgmp on this Vlan
vlan 3
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is disabled on this Vlan
  IGMP snooping mrouter learn mode is cgmp on this Vlan
vlan 4
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is disabled on this Vlan 
IGMP snooping mrouter learn mode is cgmp on this Vlan
vlan 5
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is disabled on this Vlan
  IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan
vlan 33
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is disabled on this Vlan
  IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan 

This is an example of output from the show ip igmp snooping vlan 1 command:

Switch# show ip igmp snooping vlan 1

vlan 1
----------
  IGMP snooping is globally enabled
  IGMP snooping is enabled on this Vlan
  IGMP snooping immediate-leave is enabled on this Vlan
  IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan 

Related Commands

Command
Description

ip igmp snooping

Enables IGMP snooping.

ip igmp snooping vlan vlan-id

Enables IGMP snooping on the VLAN interface.

ip igmp snooping vlan immediate-leave

Configures IGMP Immediate-Leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 port as a multicast router port.

show mac address-table multicast

Displays the Layer 2 multicast entries for a VLAN.


show ip igmp snooping mrouter

Use the show ip igmp snooping mrouter privileged EXEC command to display information on dynamically learned and manually configured multicast router ports.

show ip igmp snooping mrouter [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

vlan vlan-id

(Optional) Keyword and variable to specify a VLAN; valid values are 1 to 1001.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can also use the show mac address-table multicast command to display entries in the MAC address table for a VLAN that has Internet Group Management Protocol (IGMP) snooping enabled.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping mrouter vlan 1 command:


Note In this example, Fa0/3 is a dynamically learned router port, and Fa0/2 is a configured static router port.


Switch# show ip igmp snooping mrouter vlan 1

Vlan    ports
----    -----
   1    Fa0/2(static), Fa0/3(dynamic) 

Related Commands

Command
Description

ip igmp snooping

Enables IGMP snooping.

ip igmp snooping vlan

Enables IGMP snooping on the VLAN interface.

ip igmp snooping vlan immediate-leave

Configures IGMP Immediate-Leave processing.

ip igmp snooping vlan mrouter

Configures a Layer 2 port as a multicast router port.

show mac address-table multicast

Displays the Layer 2 multicast entries for a VLAN.


show lacp

Use the show lacp user EXEC command to display Link Aggregation Control Protocol (LACP) channel-group information.

show lacp {channel-group-number {counters | internal | neighbor} | {counters | internal | neighbor | sys-id }} [ | {begin | exclude | include} expression]

Syntax Description

channel-group-number

(Optional) Number of the channel group. Valid numbers range from 1 to 6.

counters

Display traffic information.

internal

Display internal information.

neighbor

Display neighbor information.

sys-id

Display the system identifier that is being used by LACP. The system identifier is made up of the LACP system priority and a MAC address.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enter any show lacp command to display the active port-channel information. To display the nonactive information, enter the show lacp command with a group number.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show lacp counters command:

Switch> show lacp counters
LACPDUs         Marker      Marker Response    LACPDUs
Port       Sent   Recv     Sent   Recv     Sent   Recv      Pkts Err
---------------------------------------------------------------------
Channel group:1
Fa0/5      19     10       0      0        0      0         0     
Fa0/6      14     6        0      0        0      0         0     
Fa0/7      8      7        0      0        0      0         0 

This is an example of output from the show lacp 1 internal command:

Switch> show lacp internal 
Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode     
 
Channel group 1
                            LACP port     Admin     Oper    Port     Port
Port      Flags   State     Priority      Key       Key     Number   State
Fa0/5     SP      indep     32768         0x1       0x1     0x4      0x7C  
Fa0/6     SP      indep     32768         0x1       0x1     0x5      0x7C  
Fa0/7     SP      down      32768         0x1       0x1     0x6      0xC 

This is an example of output from the show lacp neighbor command:

Switch> show lacp neighbor

Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode     
 
Channel group 1 neighbors
 
Partner's information:
 
          Partner               Partner                     Partner
Port      System ID             Port Number     Age         Flags
Fa0/5     00000,0000.0000.0000  0x0             85947s        SP
 
          LACP Partner         Partner         Partner
          Port Priority        Oper Key        Port State
          0                    0x0             0x0 

Partner's information:
 
          Partner               Partner                     Partner
Port      System ID             Port Number     Age         Flags
Fa0/6     00000,0000.0000.0000  0x0             86056s        SP
 
          LACP Partner         Partner         Partner
          Port Priority        Oper Key        Port State
          0                    0x0             0x0 
 
Partner's information:
 
          Partner               Partner                     Partner
Port      System ID             Port Number     Age         Flags
Fa0/7     00010,0008.a343.b580  0x6             86032s        SA
 
          LACP Partner         Partner         Partner
          Port Priority        Oper Key        Port State
          32768                0x1             0x35

This is an example of output from the show lacp sys-id command:

Switch> show lacp sys-id 
32765,0002.4b29.3a00

Related Commands

Command
Description

clear lacp

Clears LACP channel-group information.


show mac address-table

Use the show mac address-table user EXEC command to display the MAC address table.

show mac address-table [aging-time | count | dynamic | static] [address hw-addr]
[interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

aging-time

(Optional) Display aging time for dynamic addresses for all VLANs.

count

(Optional) Display the count for different kinds of MAC addresses (only available in privileged EXEC mode).

dynamic

(Optional) Display only the dynamic addresses.

static

(Optional) Display only the static addresses.

address hw-addr

(Optional) Display information for a specific address (only available in privileged EXEC mode).

interface interface-id

(Optional) Display addresses for a specific interface.

vlan vlan-id

(Optional) Display addresses for a specific VLAN. Valid IDs are from 1 to 1001.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

This command displays the MAC address table for the switch. Specific views can be defined by using the optional keywords and values. If more than one optional keyword is used, all of the conditions must be true in order for that entry to appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table command:

Switch> show mac-address-table

Dynamic Addresses Count:               9
Secure Addresses (User-defined) Count: 0
Static Addresses (User-defined) Count: 0
System Self Addresses Count:           41
Total MAC addresses:                   50
Non-static Address Table:
Destination Address  Address Type  VLAN  Destination Port
-------------------  ------------  ----  --------------------
0010.0de0.e289       Dynamic          1  FastEthernet0/1
0010.7b00.1540       Dynamic          2  FastEthernet0/5
0010.7b00.1545       Dynamic          2  FastEthernet0/5
0060.5cf4.0076       Dynamic          1  FastEthernet0/1
0060.5cf4.0077       Dynamic          1  FastEthernet0/1
0060.5cf4.1315       Dynamic          1  FastEthernet0/1
0060.70cb.f301       Dynamic          1  FastEthernet0/1
00e0.1e42.9978       Dynamic          1  FastEthernet0/1
00e0.1e9f.3900       Dynamic          1  FastEthernet0/1

This is an example of output from the show mac address-table static interface fastethernet0/2 vlan 1 command:

Switch> show  mac address-table static interface fastethernet0/2 vlan 1
vlan   mac address     type     ports   
-----+---------------+--------+---------
   1  abcd.2345.0099  static    Fa0/2
   1  abcd.0070.0070  static    Fa0/2
   1  abcd.2345.0099  static    Fa0/2
   1  abcd.2345.0099  static    Fa0/2
   1  00d0.d333.7f34  static    Fa0/2
   1  abcd.2345.0099  static    Fa0/2
   1  0005.6667.0007  static    Fa0/2

This is an example of output from the show mac address-table count vlan 1 command:

Switch# show  mac address-table count vlan 1
MAC Entries for Vlan 1 :
Dynamic Address Count: 1
Static Address (User-defined) Count: 41
Total MAC Addresses In Use:42
Remaining MAC addresses: 8150

This is an example of output from the show mac address-table aging-time command:

Switch> show  mac address-table aging-time
Vlan Aging Time
---- ----------
1    450
2    300
3    600
300  450
301  450

This is an example of output from the show mac address-table aging-time vlan 1 command:

Switch> show  mac address-table aging-time vlan 1
Vlan Aging Time
---- ----------
1    450

Related Commands

Command
Description

clear mac address-table dynamic

Deletes from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN.


show mac address-table multicast

Use the show mac address-table multicast user EXEC command to display the Layer 2 multicast entries for the switch or for the VLAN.

show mac address-table multicast [vlan vlan-id] [count] [igmp-snooping | user] [ | {begin | exclude | include} expression]

Syntax Description

vlan vlan-id

(Optional) Specify a VLAN; valid values are 1 to 1005. (This keyword is only available in privileged EXEC mode.)

count

(Optional) Display total number of entries for the specified criteria instead of the actual entries (only available in privileged EXEC mode).

igmp-snooping

(Optional) Display only entries learned through Internet Group Management Protocol (IGMP) snooping (only available in privileged EXEC mode).

user

(Optional) Display only the user-configured multicast entries (only available in privileged EXEC mode).

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Defaults

This command has no default setting.

Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table multicast vlan 1 command:

Switch# show  mac address-table multicast vlan 1

Vlan    Mac Address     Type    Ports
----    -----------     ----    -----
   1    0100.5e00.0128  IGMP    Fa0/1
   1    0100.5e01.1111  USER    Fa0/3, Fa0/4, Fa0/5, Fa0/6

This is an example of output from the show mac address-table multicast count command:

Switch# show  mac address-table multicast count
Multicast Mac Entries for all vlans: 10

This is an example of output from the show mac address-table multicast vlan 1 count command:

Switch# show  mac address-table multicast vlan 1 count
Multicast Mac Entries for vlan 1: 2

This is an example of output from the show mac address-table multicast vlan 1 user command:

Switch# show  mac address-table multicast vlan 1 user
vlan   mac address      type        ports
-----+----------------+-------+---------------------
1     0100.5e02.0203    user     Fa0/1,Fa0/2,Fa0/4

This is an example of output from the show mac address-table multicast vlan 1 igmp-snooping count command:

Switch# show  mac address-table multicast vlan 1 igmp-snooping count
Number of igmp-snooping programmed entries : 1

show mac address-table notification

Use the show mac address-table notification user EXEC command to display parameters for the MAC notification feature.

show mac address-table notification [interface interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id

(Optional) Specify an interface.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Defaults

This command has no default setting.

Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use the show mac address-table notification command without keywords to display parameters for all interfaces.

Use this command with the interface keyword to display parameters for a specific interface.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table notification command:

Switch> show mac address-table notification
MAC Notification Feature is Disabled on the switch

Related Commands

Command
Description

clear mac address-table notification

Clears the MAC address notification global counters.

mac address-table notification

Enables the MAC notification feature.

snmp trap mac-notification

Enables MAC-notification traps on a port.


show mls qos interface

Use the show mls qos interface user EXEC command to display quality of service (QoS) information at the interface level.

show mls qos interface [interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) Display QoS information for the specified interface.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.



Note Though visible in the command-line help strings, the vlan vlan-id option and the policers keyword are not supported.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use the show mls qos interface command without keywords to display parameters for all interfaces.

Use the show mls qos interface interface-id command to display the parameters for a specific interface.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mls qos interface command when the Cisco IP phone is a trusted device:

Switch> show mls qos interface fastethernet0/1
FastEthernet0/1
trust state:trust cos
trust mode:trust cos
COS override:dis
default COS:0
pass-through:none
trust device:cisco-phone

This is an example of output from the show mls qos interface command when pass-through mode is configured on an interface:

Switch> show mls qos interface fastethernet0/2
FastEthernet0/2
trust state:not trusted
trust mode:not trusted
COS override:dis
default COS:0
pass-through:dscp

Related Commandstrust device:nonetrust device:cisco-phone

Command
Description

mls qos trust

Configures the port trust state. Ingress traffic can be trusted, and classification is performed by examining the CoS or DSCP value.


show monitor

Use the show monitor user EXEC command to display Switched Port Analyzer (SPAN) session information.

show monitor [session {session_number | all | local | range | remote}] [ | {begin | exclude | include} expression]

Syntax Description

session session_number

(Optional) Specify the session number identified with this SPAN session.

all

Specify all sessions.

local

Specify local sessions.

range

Specify a range of sessions.

remote

Specify remote sessions.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.



Note Though visible in the command-line help string, the remote keyword is not supported.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output for the show monitor privileged EXEC command for SPAN source session 1:

Switch# show monitor session 1
Session 1
---------
Type: 					: Local Session
Source Ports 					:
    Both: 					: Fa0/6

Related Commands

Command
Description

monitor session

Enables SPAN monitoring on a port and configures a port as a source or destination port.


show mvr

Use the show mvr privileged EXEC command without keywords to display the Multicast VLAN Registration (MVR) global parameter values, including whether or not MVR is enabled, the MVR multicast VLAN, the maximum query response time, the number of multicast groups, and the MVR mode (dynamic or compatible).

show mvr [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr command:

Switch# show mvr
MVR Running: TRUE
MVR multicast vlan: 1
MVR Max Multicast Groups: 256
MVR Current multicast groups: 256
MVR Global query response time: 5 (tenths of sec)
MVR Mode: compatible 

In the previous example, the maximum number of multicast groups is 256. The MVR mode is either compatible (for interoperability with Catalyst 2900 XL and Catalyst 3500 XL switches) or dynamic (where operation is consistent with Internet Group Management Protocol [IGMP] snooping operation, and dynamic MVR membership on source ports is supported).

Related Commands

Command
Description

mvr

Enables and configures multicast VLAN registration on the switch.

mvr type

Configures an MVR port as a receiver or a source port.

show mvr interface

Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs.

show mvr members

Displays all ports that are members of an MVR multicast group.


show mvr interface

Use the show mvr interface privileged EXEC command without keywords to display the Multicast VLAN Registration (MVR) receiver and source ports. Use the command with keywords to display MVR parameters for a specific receiver port.

show mvr interface [interface-id [members [vlan vlan-id]] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) Display MVR type, status, and Immediate-Leave setting for the interface.

members

(Optional) Display all MVR groups to which the specified interface belongs.

vlan vlan-id

(Optional) Display the VLAN to which the receiver port belongs.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If the entered port identification is a non-MVR port or a source port, the command returns an error message. For receiver ports, it displays the port type, per port status, and Immediate-Leave setting.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr interface command:

Switch# show mvr interface
Port    Type            Status          Immediate Leave
----    ----            -------         ---------------
Gi0/1 RECEIVER        ACTIVE/DOWN     DISABLED

In the previous example, Status is defined as:

Active means the port is part of a VLAN.

Up/Down means that the port is forwarding/nonforwarding.

Inactive means that the port is not part of any VLAN.

This is an example of output from the show mvr interface gigabitethernet0/1 command:

Switch# show mvr interface gigabitethernet0/1
Type: RECEIVER Status: ACTIVE Immediate Leave: DISABLED 

This is an example of output from the show mvr interface fastethernet0/6 member command:

Switch# show mvr interface fastethernet0/6 member
239.255.0.0     DYNAMIC ACTIVE
239.255.0.1     DYNAMIC ACTIVE
239.255.0.2     DYNAMIC ACTIVE
239.255.0.3     DYNAMIC ACTIVE
239.255.0.4     DYNAMIC ACTIVE
239.255.0.5     DYNAMIC ACTIVE
239.255.0.6     DYNAMIC ACTIVE
239.255.0.7     DYNAMIC ACTIVE
239.255.0.8     DYNAMIC ACTIVE
239.255.0.9     DYNAMIC ACTIVE

Related Commands

Command
Description

mvr

Enables and configures multicast VLAN registration on the switch.

mvr type

Configures an MVR port as a receiver or a source port.

show mvr

Displays the global MVR configuration on the switch.

show mvr members

Displays all receiver ports that are members of an MVR multicast group.


show mvr members

Use the show mvr members privileged EXEC command to display all receiver and source ports that are currently members of an IP multicast group.

show mvr members [ip-address] [ | {begin | exclude | include} expression]

Syntax Description

ip-address

(Optional) The IP multicast address. If the address is entered, all receiver and source ports that are members of the multicast group appear. If no address is entered, all members of all Multicast VLAN Registration (MVR) groups are listed. If a group has no members, the group is listed as Inactive.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The show mvr members command applies to receiver and source ports. For MVR compatible mode, all source ports are members of all multicast groups.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr members command:

Switch# show mvr members
MVR Group IP    Status          Members
------------    ------          -------
239.255.0.1     ACTIVE          Gi0/1(d), Fa0/2(s)
239.255.0.2     INACTIVE        None
239.255.0.3     INACTIVE        None
239.255.0.4     INACTIVE        None
239.255.0.5     INACTIVE        None
239.255.0.6     INACTIVE        None
239.255.0.7     INACTIVE        None
239.255.0.8     INACTIVE        None

<output truncated>

239.255.0.255   INACTIVE        None
239.255.1.0     INACTIVE        None 

This is an example of output from the show mvr members 239.255.0.2 command. It shows how to view the members of the IP multicast group 239.255.0.2.

Switch# show mvr member 239.255.0.2
239.255.0.2     ACTIVE          Gi0/1(d), Fa0/2(d)

Related Commands

Command
Description

mvr

Enables and configures multicast VLAN registration on the switch.

mvr type

Configures an MVR port as a receiver or a source port.

show mvr

Displays the global MVR configuration on the switch.

show mvr interface

Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs.


show pagp

Use the show pagp user EXEC command to display Port Aggregation Protocol (PAgP) channel-group information.

show pagp [channel-group-number] {counters | internal | neighbor} [ | {begin | exclude | include} expression]

Syntax Description

channel-group-number

(Optional) Number of the channel group. Valid numbers range from 1 to 6.

counters

Display traffic information.

internal

Display internal information.

neighbor

Display neighbor information.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enter any show pagp command to display the active port channel information. To display the nonactive information, enter the show pagp command with a group number.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show pagp 1 counters command:

Switch> show pagp 1 counters
           Information        Flush
Port       Sent   Recv     Sent   Recv
--------------------------------------
Channel group: 1
  Gi0/1    45     42       0      0 

This is an example of output from the show pagp 1 internal command:

Switch> show pagp 1 internal
Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.
        A - Device is in Auto mode.
Timers: H - Hello timer is running.        Q - Quit timer is running.
        S - Switching timer is running.    I - Interface timer is running.

Channel group 1
                                Hello    Partner  PAgP     Learning  Group
Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex
Gi0/1     SC    U6/S7   H       30s      1        128        Any      16

This is an example of output from the show pagp 1 neighbor command:

Switch> show pagp 1 neighbor
Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.
        A - Device is in Auto mode.        P - Device learns on physical port.

Channel group 1 neighbors
          Partner              Partner          Partner         Partner Group
Port      Name                 Device ID        Port       Age  Flags   Cap.
Gi0/1     device-p2            0002.4b29.4600   Gi0/1        9s SC      10001 

Related Commands

Command
Description

clear pagp

Clears PAgP channel-group information.

pagp learn-method

Sets the source-address learning method of incoming packets received from an EtherChannel port.


show port-security

Use the show port-security privileged EXEC command to display the port security settings defined for an interface or for the switch.

show port-security [interface interface-id] [address] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id

(Optional) Display the port security settings for the specified interface.

address

(Optional) Display all the secure addresses on all ports.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If you enter this command without keywords, the output includes the administrative and the operational status of all secure ports on the switch.

If you enter an interface-id, the show port-security command displays port security settings for the interface.

If you enter the address keyword, the show port-security address command displays the secure MAC addresses for all interfaces and the aging information for each secure address.

If you enter an interface-id and the address keyword, the show port-security interface interface-id address command displays all the MAC addresses for the interface with aging information for each secure address. You can also use this command to display all the MAC addresses for an interface even if you have not enabled port security on it.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show port-security command:

Switch# show port-security
Secure Port      MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                    (Count)        (Count)      (Count)
-------------------------------------------------------------------------------
     Fa0/4           1               1             0              Shutdown
-------------------------------------------------------------------------------
Total Addresses in System : 1
Max Addresses limit in System : 1024

This is an example of output from the show port-security interface fastethernet0/2 command:

Switch# show port-security interface fastethernet0/2
Port Security :Enabled
Port status :SecureUp
Violation mode :Shutdown
Maximum MAC Addresses :11
Total MAC Addresses :11
Configured MAC Addresses :3
Aging time :20 mins
Aging type :Inactivity
SecureStatic address aging :Enabled
Security Violation count :0

This is an example of output from the show port-security address command:

Switch# show port-security address

Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                         (mins)
----    -----------       ----                -----   -------------
   1    0001.0001.0001    SecureDynamic       Fa0/1      15 (I)
   1    0001.0001.0002    SecureDynamic       Fa0/1      15 (I)
   1    0001.0001.1111    SecureConfigured    Fa0/1      16 (I)
   1    0001.0001.1112    SecureConfigured    Fa0/1      -
   1    0001.0001.1113    SecureConfigured    Fa0/1      -
   1    0005.0005.0001    SecureConfigured    Fa0/5      23
   1    0005.0005.0002    SecureConfigured    Fa0/5      23
   1    0005.0005.0003    SecureConfigured    Fa0/5      23
-------------------------------------------------------------------
Total Addresses in System :10
Max Addresses limit in System :1024

This is an example of output from the show port-security interface fastethernet0/5 address command:

Switch# show port-security interface fastethernet0/5 address
Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                         (mins)
----    -----------       ----                -----   -------------
   1    0005.0005.0001    SecureConfigured    Fa0/5      19 (I)
   1    0005.0005.0002    SecureConfigured    Fa0/5      19 (I)
   1    0005.0005.0003    SecureConfigured    Fa0/5      19 (I)
-------------------------------------------------------------------
Total Addresses:3

Related Commands

Command
Description

switchport port-security

Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.


show running-config vlan

Use the show running-config vlan privileged EXEC command to display all or a range of VLAN-related configurations on the switch.

show running-config vlan [vlan-ids] [ | {begin | exclude | include} expression]

Syntax Description

vlan-ids

(Optional) Display configuration information for a single VLAN identified by VLAN ID number or a range of VLANs separated by a hyphen. For vlan-ids, the range is 1 to to 1005.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show running-config vlan command:

Switch# show running-config vlan 100-1000
Building configuration...

Current configuration:
!
vlan 107
!
vlan 120
!
vlan 925
!
vlan 1000
end

Related Commands

Command
Description

show running-config

Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

vlan (global configuration)

Enters config-vlan mode for creating and editing VLANs.

vlan database

Enters VLAN configuration mode for creating and editing normal-range VLANs.


show setup express

Use the show setup express privileged EXEC command to display if Express Setup mode is active on the switch.

show setup express

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

For more information about Express Setup, refer to Chapter 1, "Quick Setup," and Appendix D, "Configuring the Switch with the CLI-Based Setup Program," in the hardware installation guide.

Examples

This is an example of output from the show setup express command:

Switch# show setup express
express setup mode is active

Related Commands

Command
Description

clear setup express

Exits Express Setup mode without saving the configuration

setup express

Enables Express Setup mode on the switch.


show spanning-tree

Use the show spanning-tree user EXEC command to display spanning-tree state information.

show spanning-tree [active [detail] | backbonefast | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | pathcost method | root | summary [totals] | uplinkfast | vlan vlan-id] [ | {begin | exclude | include} expression]

show spanning-tree vlan vlan-id [active [detail] | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | root | summary] [ | {begin | exclude | include} expression

show spanning-tree {vlan vlan-id} bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol] [ | {begin | exclude | include} expression]

show spanning-tree {vlan vlan-id} root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id] [ | {begin | exclude | include} expression]

show spanning-tree interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state] [ | {begin | exclude | include} expression]

Syntax Description

active [detail]

(Optional) Display spanning-tree information only on active interfaces (only available in privileged EXEC mode).

backbonefast

(Optional) Display spanning-tree BackboneFast status (only available in privileged EXEC mode).

blockedports

(Optional) Display blocked port information (only available in privileged EXEC mode).

bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol]

(Optional) Display status and configuration of this switch (only available in privileged EXEC mode).

detail [active]

(Optional) Display a detailed summary of interface information (only available in privileged EXEC mode).

inconsistentports

(Optional) Display inconsistent port information (only available in privileged EXEC mode).

interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state]

(Optional) Display spanning-tree information for the specified interface (all options only available in privileged EXEC mode). Enter each interface separated by a space. Ranges are not supported. Valid interfaces include physical ports, VLANs, and port channels. The valid VLAN range is 1 to 1005. The valid port-channel range is 1 to 6.

pathcost method

(Optional) Display the default path cost method (only available in privileged EXEC mode).

root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id]]

(Optional) Display root switch status and configuration (all options only available in privileged EXEC mode).

summary [totals]

(Optional) Display a summary of port states or the total lines of the spanning-tree state section (only available in privileged EXEC mode).

uplinkfast

(Optional) Display spanning-tree UplinkFast status (only available in privileged EXEC mode).

vlan vlan-id [active [detail] | backbonefast | blockedports | bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol]

(Optional) Display spanning-tree information for a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma (only available in privileged EXEC mode).

The range is 1 to  1005.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC; indicated keywords available only in privileged EXEC mode

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If the vlan-id variable is omitted, the command applies to the spanning-tree instance for all VLANs.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show spanning-tree active command:

Switch# show spanning-tree active

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32768
             Address     0001.425b.4d80
             Cost        76
             Port        2 (FastEthernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     0003.fd62.8d40
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 57 

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/2            Root FWD 19        128.2    P2p 
Po1              Desg FWD 19        128.65   P2p 

This is an example of output from the show spanning-tree detail command:

Switch> show spanning-tree detail

VLAN0001 is executing the ieee compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, sysid 1, address 0003.fd62.8d40
  Configured hello time 2, max age 20, forward delay 15
  Current root has priority 32768, address 0001.425b.4d80
  Root port is 2 (FastEthernet0/2), cost of root path is 76
  Topology change flag not set, detected flag not set
  Number of topology changes 4 last change occurred 17:53:47 ago
          from Port-channel1
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15 
  Timers: hello 0, topology change 0, notification 0, aging 57

 Port 2 (FastEthernet0/2) of VLAN0001 is forwarding 
   Port path cost 19, Port priority 128, Port Identifier 128.2.
   Designated root has priority 32768, address 0001.425b.4d80
   Designated bridge has priority 32769, address 0030.85f5.8e80
   Designated port id is 128.4, designated path cost 57
   Timers: message age 5, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point by default
   BPDU: sent 4, received 36891

 Port 65 (Port-channel1) of VLAN0001 is forwarding 
   Port path cost 19, Port priority 128, Port Identifier 128.65.
   Designated root has priority 32768, address 0001.425b.4d80
   Designated bridge has priority 32769, address 0003.fd62.8d40
   Designated port id is 128.65, designated path cost 76
   Timers: message age 0, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point by default
   BPDU: sent 32233, received 2

This is an example of output from the show spanning-tree interface fastethernet 0/1 command:

Switch> show spanning-tree interface fastethernet0/1

Vlan             Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
VLAN0001         Root FWD 19        128.2    P2p 
VLAN0002         Desg FWD 19        128.2    P2p 
VLAN0003         Desg FWD 19        128.2    P2p 
VLAN0004         Desg FWD 19        128.2    P2p 

This is an example of output from the show spanning-tree summary command:

Switch> show spanning-tree summary
Switch is in PVST+ mode
Root bridge for: none
EtherChannel misconfiguration guard is enabled
Extended system ID   is enabled
Portfast             is disabled by default
PortFast BPDU Guard  is disabled by default
Portfast BPDU Filter is disabled by default
Loopguard            is disabled by default
UplinkFast           is disabled
BackboneFast         is disabled
Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001                     0         0        0          2          2
VLAN0002                     0         0        0          2          2
VLAN0003                     0         0        0          2          2
VLAN0004                     0         0        0          2          2
---------------------- -------- --------- -------- ---------- ----------
4 vlans                      0         0        0          8          8

Related Commands

Command
Description

spanning-tree backbonefast

Enables the BackboneFast feature.

spanning-tree bpdufilter

Prevents a port from sending or receiving bridge protocol data units (BPDUs).

spanning-tree bpduguard

Puts a port in the error-disabled state when it receives a BPDU.

spanning-tree cost

Sets the path cost for spanning-tree calculations.

spanning-tree extend system-id

Enables the extended system ID feature.

spanning-tree guard

Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface.

spanning-tree link-type

Overrides the default link-type setting for rapid spanning-tree transitions to the forwarding state.

spanning-tree loopguard default

Prevents alternate or root ports from becoming the designated port because of a failure that leads to a unidirectional link.

spanning-tree port-priority

Configures an interface priority.

spanning-tree portfast (global configuration)

Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.

spanning-tree portfast (interface configuration)

Enables the Port Fast feature on an interface and all its associated VLANs.

spanning-tree uplinkfast

Accelerates the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself.

spanning-tree vlan

Configures spanning tree on a per-VLAN basis.


show storm-control

Use the show storm-control user EXEC command to display the packet-storm control information. This command also displays the action that the switch takes when the thresholds are reached.

show storm-control [interface-id] [{broadcast | history | multicast | unicast }] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) Port for which information is to be displayed.

broadcast

(Optional) Display broadcast storm information.

history

(Optional) Display storm history on a per-port basis.

multicast

(Optional) Display multicast storm information.

unicast

(Optional) Display unicast storm information.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If the variable interface-id is omitted, the show storm-control command displays storm-control settings for all ports on the switch.

You can display broadcast, multicast, or unicast packet-storm information by using the corresponding keyword. When no option is specified, the default is to display broadcast storm-control information.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show storm-control broadcast command:

Switch> show storm-control broadcast

Interface  Filter State   Trap State     Upper    Lower    Current  Traps Sent
---------  -------------  -------------  -------  -------  -------  ----------
Fa0/1      <inactive>     <inactive>     100.00%  100.00%    0.00%           0
Fa0/2      <inactive>     <inactive>     100.00%  100.00%    0.00%           0
Fa0/3      <inactive>     <inactive>     100.00%  100.00%    0.00%           0
Fa0/4      Forwarding     Below rising    30.00%   20.00% 20.32%            17
. . . .

Table 2-14 lists the show storm-control field descriptions.

Table 2-14 show storm-control Field Descriptions 

Field
Description

Interface

Displays the ID of the interface.

Filter State

Displays the status of the filter:

Blocking—Storm control is enabled, action is filter, and a storm has occurred.

Forwarding—Storm control is enabled, and a storm has not occurred.

Inactive—Storm control is disabled.

Shutdown—Storm control is enabled, the action is to shut down, and a storm has occurred.

Note If an interface is disabled by a broadcast, multicast, or unicast storm, the filter state for all traffic types is shutdown.

Trap State

Displays the status of the SNMP trap:

Above rising—Storm control is enabled, and a storm has occurred.

Below rising—Storm control is enabled, and a storm has not occurred.

Inactive—The trap option is not enabled.

Upper

Displays the rising suppression level as a percentage of total available bandwidth.

Lower

Displays the falling suppression level as a percentage of total available bandwidth.

Current

Displays the bandwidth utilization of a specific traffic type as a percentage of total available bandwidth. This field is valid only when storm control is enabled.

Traps Sent

Displays the number traps sent on an interface for a specific traffic type.


This is an example of output from the show storm-control fastethernet0/4 history command, which displays the ten most recent storm events for an interface.

Switch> show storm-control fastethernet0/4 history

 Interface Fa0/4 Storm Event History 

 Event Type          Event Start Time  Duration (seconds)
 ------------------  ----------------  ------------------
 Unicast             04:58:18          206      
 Broadcast           05:01:54          n/a
 Multicast           05:01:54          n/a
 Unicast             05:01:54          108      
 Broadcast           05:05:00          n/a
 Multicast           05:05:00          n/a
 Unicast             05:06:00          n/a
 Broadcast           05:09:39          n/a
 Multicast           05:09:39          n/a
 Broadcast           05:11:32          172      


Note The duration field could be n/a when a storm is still present or when a new storm of a different type occurs before the current storm ends.


Related Commands

Command
Description

storm-control

Enables broadcast, multicast, or unicast storm control on a port.


show system mtu

Use the show system mtu privileged EXEC command to display the global maximum packet size or maximum transmission unit (MTU) set for the switch.

show system mtu [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

Privileged EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show system mtu command:

Switch# show system mtu
System MTU size is 1500 bytes

Related Commands

Command
Description

system mtu

Sets the MTU size for the switch.


show udld

Use the show udld user EXEC command to display UniDirectional Link Detection (UDLD) status for all ports or the specified port.

show udld [interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface-id

(Optional) ID of the interface and port number. Valid interfaces include physical ports and VLANs. The VLAN range is 1 to 1001.

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If you do not enter an interface-id, the administrative and the operational UDLD status for all interfaces appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show udld gigabitethernet0/1 command. In this example, UDLD is enabled on both ends of the link, and UDLD detects that the link is bidirectional. Table 2-15 describes the fields in this example.

Switch> show udld gigabitethernet0/1
Interface gi0/1
---
Port enable administrative configuration setting: Follows device default
Port enable operational state: Enabled
Current bidirectional state: Bidirectional
Current operational state: Advertisement - Single Neighbor detected
Message interval: 60
Time out interval: 5
    Entry 1
    Expiration time: 146
    Device ID: 1
    Current neighbor state: Bidirectional
    Device name: 0050e2826000  
    Port ID: Gi0/2
    Neighbor echo 1 device: SAD03160954
    Neighbor echo 1 port: Gi0/1 
    Message interval: 5
    CDP Device name: 066527791

Table 2-15 show udld Field Descriptions 

Field
Description

Interface

The interface on the local device configured for UDLD.

Port enable administrative configuration setting

How UDLD is configured on the port. If UDLD is enabled or disabled, the port enable configuration setting is the same as the operational enable state. Otherwise, the enable operational setting depends on the global enable setting.

Port enable operational state

Operational state that shows whether UDLD is actually running on this port.

Current bidirectional state

The bidirectional state of the link. An unknown state appears if the link is down or if it is connected to an UDLD-incapable device. A bidirectional state appears if the link is a normal two-way connection to a UDLD-capable device. All other values mean miswiring.

Current operational state

The phase of the UDLD state machine. For a normal bidirectional link, the state machine is usually in the Advertisement phase.

Message interval

How often advertisement messages are sent from the local device. Measured in seconds.

Time out interval

The time period, in seconds, that UDLD waits for echoes from a neighbor device during the detection window.

Entry 1

Information from the first cache entry, which contains a copy of echo information received from the neighbor.

Expiration time

The amount of time in seconds remaining before this cache entry is aged out.

Device ID

The neighbor device identification.

Current neighbor state

The neighbor's state. If both the local and neighbor devices are running UDLD, the neighbor state and the local state is bidirectional. If the link is down or the neighbor is not UDLD-capable, no cache entries appear.

Device name

The neighbor MAC address.

Port ID

The neighbor port ID enabled for UDLD.

Neighbor echo 1 device

The MAC address of the neighbors' neighbor from which the echo originated.

Neighbor echo 1 port

The port number ID of the neighbor from which the echo originated.

Message interval

The rate, in seconds, at which the neighbor is sending advertisement messages.

CDP1 device name

CDP name of the device.

1 CDP = Cisco Discovery Protocol


This is an example of output from the show udld interface configuration command when the aggressive mode is configured:

Switch# show udld gigabitethernet0/1
Interface Gi0/1
---
Port enable administrative configuration setting:Enabled / in aggressive mode
Port enable operational state:Enabled / in aggressive mode
Current bidirectional state:Unknown
Current operational state:Link down
Message interval:7
Time out interval:5

No neighbor cache information stored

Related Commands

Command
Description

traceroute mac

Enables UDLD on all ports on the switch.

udld (interface configuration)

Enables UDLD on a port.

udld reset

Resets any interface that was shut down by UDLD.


show version

Use the show version user EXEC command to display version information for the hardware and firmware.

show version [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show version command:

Switch> show version

Cisco Internetwork Operating System Software 
IOS (tm) C2940 Software (C2940-I6Q4L2-M), Version 12.1(13)AY
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Wed 02-Apr-03 09:51 by antonino
Image text-base: 0x80010000, data-base: 0x805B6000

ROM: Bootstrap program is C2940 boot loader

Switch uptime is 6 days, 17 hours, 56 minutes
System returned to ROM by power-on
System image file is "flash:c2940-i6q4l2-mz.121-0.0.9.AY.bin"

cisco WS-C2940-8TT-S (RC32300) processor with 20799K bytes of memory.
Last reset from system-reset
Running Standard Image
8 FastEthernet/IEEE 802.3 interface(s)
1 Gigabit Ethernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:03:FD:62:91:80
Configuration register is 0xF

show vlan

Use the show vlan user EXEC command to display the parameters for all configured VLANs or one VLAN (if the VLAN ID or name is specified) on the switch.

show vlan [brief | id vlan-id | name vlan-name] [ | {begin | exclude | include} expression]

Syntax Description

brief

(Optional) Display one line for each VLAN with the VLAN name, status, and its ports.

id vlan-id

(Optional) Display information about a single VLAN identified by VLAN ID number or a range of VLANs. For vlan-id, the range is 1 to 1005.

name vlan-name

(Optional) Display information about a single VLAN identified by VLAN name. The VLAN name is an ASCII string from 1 to 32 characters.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Syntax Description

Syntax DescriptionN


Note Though visible in the command-line help string, the ifindex, private vlan, and remote-span keywords are not supported.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show vlan command. Table 2-16 describes each field in the display.

Switch> show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/3, Fa0/4, Fa0/5
                                                Fa0/7, Fa0/8, Fa0/9, Gi0/1
2    VLAN0002                         active    
3    VLAN0003                         active    
4    VLAN0004                         active    
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active    

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0   
2    enet  100002     1500  -      -      -        -    -        0      0   
3    enet  100003     1500  -      -      -        -    -        0      0   
4    enet  100004     1500  -      -      -        -    -        0      0   
1002 fddi  101002     1500  -      -      -        -    -        0      0   
1003 tr    101003     1500  -      -      -        -    -        0      0   
1004 fdnet 101004     1500  -      -      -        ieee -        0      0   
1005 trnet 101005     1500  -      -      -        ibm  -        0      0   

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

Table 2-16 show vlan Command Output Fields 

Field
Description

VLAN

VLAN number.

Name

Name, if configured, of the VLAN.

Status

Status of the VLAN (active or suspend).

Ports

Ports that belong to the VLAN.

Type

Media type of the VLAN.

SAID

Security association ID value for the VLAN.

MTU

Maximum transmission unit size for the VLAN.

Parent

Parent VLAN, if one exists.

RingNo

Ring number for the VLAN, if applicable.

BrdgNo

Bridge number for the VLAN, if applicable.

Stp

Spanning Tree Protocol type used on the VLAN.

BrdgMode

Bridging mode for this VLAN—possible values are source-route bridging (SRB) and source-route transparent (SRT); the default is SRB.

Trans1

Translation bridge 1.

Trans2

Translation bridge 2.

AREHops

Maximum number of hops for All-Routes Explorer frames—possible values are 1 through 13; the default is 7.

STEHops

Maximum number of hops for Spanning-Tree Explorer frames—possible values are 1 through 13; the default is 7.

Backup CRF

Status of whether or not the Token Ring concentrator relay function (TrCRF) is a backup path for traffic.


This is an example of output from the show vlan brief command:

Switch> show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/3, Fa0/4, Fa0/5
                                                Fa0/7, Fa0/8, Fa0/9, Gi0/1
2    VLAN0002                         active    
3    VLAN0003                         active    
4    VLAN0004                         active    
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active 

This is an example of output from the show vlan id command. The specified VLAN is in the extended VLAN range.

Switch# show vlan id 1005

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1005 trnet-default                    active    Fa0/2, Po1

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1005 trnet 101005     1500  -      -      -        ibm  -        0      0   

Remote SPAN VLAN
----------------
Disabled

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

Related Commands

Command
Description

switchport mode

Configures the VLAN membership mode of a port.

vlan (global configuration)

Enables config-vlan mode where you can configure VLANs 1 to 1005.

vlan (VLAN configuration)

Configures VLAN characteristics in the VLAN database. Only available for normal-range VLANs (VLAN IDs 1 to 1005). Do not enter leading zeros.


show vmps

Use the show vmps user EXEC command without keywords to display the VLAN Query Protocol (VQP) version, reconfirmation interval, retry count, VLAN Membership Policy Server (VMPS) IP addresses, and the current and primary servers, or use the statistics keyword to display client-side statistics.

show vmps [statistics] [ | {begin | exclude | include} expression]

Syntax Description

statistics

(Optional) Display VQP client-side statistics and counters.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vmps command:

Switch> show vmps
VQP Client Status:
--------------------
VMPS VQP Version:   1
Reconfirm Interval: 60 min
Server Retry Count: 3
VMPS domain server:

Reconfirmation status
---------------------
VMPS Action:         other

This is an example of output from the show vmps statistics command. Table 2-17 describes each field in the example.

Switch> show vmps statistics
VMPS Client Statistics
----------------------
VQP  Queries:               0
VQP  Responses:             0
VMPS Changes:               0
VQP  Shutdowns:             0
VQP  Denied:                0
VQP  Wrong Domain:          0
VQP  Wrong Version:         0
VQP  Insufficient Resource: 0 

Table 2-17 show vmps statistics Field Descriptions 

Field
Description

VQP Queries

Number of queries sent by the client to the VMPS.

VQP Responses

Number of responses sent to the client from the VMPS.

VMPS Changes

Number of times that the VMPS changed from one server to another.

VQP Shutdowns

Number of times the VMPS sent a response to shut down the port. The client disables the port and removes all dynamic addresses on this port from the address table. You must administratively re-enable the port to restore connectivity.

VQP Denied

Number of times the VMPS denied the client request for security reasons. When the VMPS response denies an address, no frame is forwarded to or from the workstation with that address. (Broadcast or multicast frames are delivered to the workstation if the port on the switch has been assigned to a VLAN.) The client keeps the denied address in the address table as a blocked address to prevent further queries from being sent to the VMPS for each new packet received from this workstation. The client ages the address if no new packets are received from this workstation on this port within the aging time period.

VQP Wrong Domain

Number of times the management domain in the request does not match the one for the VMPS. Any previous VLAN assignments of the port are not changed. This response means that the server and the client have not been configured with the same VTP management domain.

VQP Wrong Version

Number of times the version field in the query packet contains a value that is higher than the version supported by the VMPS. The previous VLAN assignment of the port is not changed. The switches send only VMPS version 1 requests.

VQP Insufficient Resource

Number of times the VMPS is unable to answer the request because of a resource availability problem. If the retry limit has not yet been reached, the client repeats the request with the same server or with the next alternate server, depending on whether the per-server retry count has been reached.


Related Commands

Command
Description

clear vmps statistics

Clears the statistics maintained by the VQP client.

vmps reconfirm (global configuration)

Sends VQP queries to reconfirm all dynamic VLAN assignments with the VMPS.

vmps retry

Configures the per-server retry count for the VQP client.

vmps server

Configures the primary VMPS and up to three secondary servers.


show vtp

Use the show vtp user EXEC command to display general information about the VLAN Trunking Protocol (VTP) management domain, status, and counters.

show vtp {counters | status} [ | {begin | exclude | include} expression]

Syntax Description

counters

Display the VTP statistics for the switch.

status

Display general information about the VTP management domain status.

| begin

(Optional) Display begins with the line that matches the expression.

| exclude

(Optional) Display excludes lines that match the expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show vtp counters command. Table 2-18 describes each field in the display.

Switch> show vtp counters

VTP statistics:
Summary advertisements received    : 241
Subset advertisements received     : 0
Request advertisements received    : 0
Summary advertisements transmitted : 225
Subset advertisements transmitted  : 0
Request advertisements transmitted : 0
Number of config revision errors   : 0
Number of config digest errors     : 0
Number of V1 summary errors        : 0


VTP pruning statistics:

Trunk            Join Transmitted Join Received    Summary advts received from
                                                   non-pruning-capable device
---------------- ---------------- ---------------- ---------------------------
Fa0/2               0                0                0        
Po1                 0                0                0 

Table 2-18 show vtp counters Field Descriptions 

Field
Description

Summary advertisements received

Number of summary advertisements received by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.

Subset advertisements received

Number of subset advertisements received by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.

Request advertisements received

Number of advertisement requests received by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.

Summary advertisements transmitted

Number of summary advertisements sent by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.

Subset advertisements transmitted

Number of subset advertisements sent by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.

Request advertisements transmitted

Number of advertisement requests sent by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.

Number of configuration revision errors

Number of revision errors.

Whenever you define a new VLAN, delete an existing one, suspend or resume an existing VLAN, or modify the parameters on an existing VLAN, the configuration revision number of the switch increments.

Revision errors increment whenever the switch receives an advertisement whose revision number matches the revision number of the switch, but the MD5 digest values do not match. This error means that the VTP password in the two switches is different or that the switches have different configurations.

These errors means that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.

Number of configuration digest errors

Number of MD5 digest errors.

Digest errors increment whenever the MD5 digest in the summary packet and the MD5 digest of the received advertisement calculated by the switch do not match. This error usually means that the VTP password in the two switches is different. To solve this problem, make sure the VTP password on all switches is the same.

These errors mean that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.

Number of V1 summary errors

Number of version 1 errors.

Version 1 summary errors increment whenever a switch in VTP V2 mode receives a VTP version 1 frame. These errors mean that at least one neighboring switch is either running VTP version 1 or VTP version 2 with V2-mode disabled. To solve this problem, change the configuration of the switches in VTP V2-mode to disabled.

Join Transmitted

Number of VTP pruning messages sent on the trunk.

Join Received

Number of VTP pruning messages received on the trunk.

Summary Advts Received from non-pruning-capable device

Number of VTP summary messages received on the trunk from devices that do not support pruning.


This is an example of output from the show vtp status command. Table 2-19 describes each field in the display.

Switch> show vtp status
VTP Version                     : 2
Configuration Revision          : 363
Maximum VLANs supported locally : 8
Number of existing VLANs        : 8
VTP Operating Mode              : Server
VTP Domain Name                 : perd-group
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xEC 0xA2 0x3C 0x18 0xB2 0xCE 0x86 0xD8 
Configuration last modified by 172.20.139.142 at 3-6-93 16:04:29
Local updater ID is 172.20.139.142 on interface Vl1 (lowest numbered VLAN inter)

Table 2-19 show vtp status Field Descriptions 

Field
Description

VTP Version

Displays the VTP version operating on the switch. By default, the switch implements version 1 but can be set to version 2.

Configuration Revision

Current configuration revision number on this switch.

Maximum VLANs Supported Locally

Maximum number of VLANs supported locally.

Number of Existing VLANs

Number of existing VLANs.

VTP Operating Mode

Displays the VTP operating mode, which can be server, client, or transparent.

Server: a switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch guarantees that it can recover all the VLAN information in the current VTP database from nonvolatile RAM (NVRAM) after reboot. By default, every switch is a VTP server.

Note The switch automatically changes from VTP server mode to VTP client mode if it detects a failure while writing the configuration to NVRAM and cannot return to server mode until the NVRAM is functioning.

Client: a switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not send VTP advertisements until it receives advertisements to initialize its VLAN database.

Transparent: a switch in VTP transparent mode is disabled for VTP, does not send or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received.

VTP Domain Name

Name that identifies the administrative domain for the switch.

VTP Pruning Mode

Displays whether pruning is enabled or disabled. Enabling pruning on a VTP server enables pruning for the entire management domain. Pruning restricts flooded traffic to those trunk links that the traffic must use to access the appropriate network devices.

VTP V2 Mode

Displays if VTP version 2 mode is enabled. By default, all VTP version 2 switches operate in version 1 mode. Each VTP switch automatically detects the capabilities of all the other VTP devices. A network of VTP devices should be configured to version 2 only if all VTP switches in the network can operate in version 2 mode.

VTP Traps Generation

Displays whether VTP traps are sent to a network management station.

MD5 Digest

A 16-byte checksum of the VTP configuration.

Configuration Last Modified

Displays the date and time of the last configuration modification. Displays the IP address of the switch that caused the configuration change to the database.


Related Commands

Command
Description

clear vtp counters

Clears the VTP and pruning counters.

vtp (global configuration)

Configures the VTP filename, interface name, domain name, and mode. You can save configuration resulting from this command in the switch configuration file.

vtp (VLAN configuration)

Configures the VTP domain name, password, pruning, and mode.


show wrr-queue bandwidth

Use the show wrr-queue bandwidth user EXEC command to display the weighted round-robin (WRR) bandwidth allocation for the four class of service (CoS) priority queues.

show wrr-queue bandwidth [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show wrr-queue bandwidth command:

Switch> show wrr-queue bandwidth 

WRR Queue  :   1   2   3   4

Bandwidth  :  10  20  30  40 

Related Commands

Command
Description

show wrr-queue cos-map

Displays the mapping of the CoS to the priority queues.

wrr-queue bandwidth

Assigns WRR weights to the four CoS priority queues.

wrr-queue cos-map

Assigns CoS values to the CoS priority queues.


show wrr-queue cos-map

Use the show wrr-queue cos-map user EXEC command to display the mapping of the class of service (CoS) priority queues.

show wrr-queue cos-map [ | {begin | exclude | include} expression]

Syntax Description

| begin

(Optional) Display begins with the line that matches the specified expression.

| exclude

(Optional) Display excludes lines that match the specified expression.

| include

(Optional) Display includes lines that match the specified expression.

expression

Expression in the output to use as a reference point.


Command Modes

User EXEC

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show wrr-queue cos-map command:

Switch> show wrr-queue cos-map 

CoS Value      :  0  1  2  3  4  5  6  7

Priority Queue :  1  1  2  2  3  3  4  4 

Related Commands

Command
Description

show wrr-queue bandwidth

Displays the WRR bandwidth allocation for the four CoS priority queues.

wrr-queue bandwidth

Assigns weighted round-robin (WRR) weights to the four CoS priority queues.

wrr-queue cos-map

Assigns CoS values to the CoS priority queues.


shutdown

Use the shutdown interface configuration command to disable a port and to shut down the management VLAN. Use the no form of this command to enable a disabled port or to activate the management VLAN.

shutdown

no shutdown

Syntax Description

This command has no arguments or keywords.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The shutdown command for a port causes it to stop forwarding. You can enable the port with the no shutdown command.

The no shutdown command has no effect if the port is a static-access port assigned to a VLAN that has been deleted, suspended, or shut down. The port must first be a member of an active VLAN before it can be re-enabled.

Only one management VLAN interface can be active at a time. The remaining VLANs are shut down. In the show running-config command, the active management VLAN interface is the one without the shutdown command displayed.

Examples

This example shows how to disable fixed Fast Ethernet port 0/8 and how to re-enable it:

Switch(config)# interface fastethernet0/8
Switch(config-if)# shutdown

Switch(config-if)# no shutdown

You can verify your settings by entering the show interfaces privileged EXEC command.

shutdown vlan

Use the shutdown vlan global configuration command to shut down (suspend) local traffic on the specified VLAN. Use the no form of this command to restart local traffic on the VLAN.

shutdown vlan vlan-id

no shutdown vlan vlan-id

Syntax Description

vlan-id

ID of the VLAN to be locally shut down. Valid IDs are from 2 to 1001. VLANs defined as default VLANs under the VLAN Trunking Protocol (VTP) cannot be shut down. The default VLANs are 1 and 1005.


Defaults

No default is defined.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The shutdown vlan command does not change the VLAN information in the VTP database. It shuts down traffic locally, but the switch still advertises VTP information.

Examples

This example shows how to shutdown traffic on VLAN 2:

Switch(config)# shutdown vlan 2

You can verify your setting by entering the show vlan privileged EXEC command.

Related Commands

Command
Description

shutdown (config-vlan mode)

Shuts down local traffic on the VLAN when in config-VLAN mode (accessed by the vlan vlan-id global configuration command).

vlan (global configuration)

Enables config-vlan mode.

vlan database

Enters VLAN configuration mode.


snmp-server enable traps

Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notification for various trap types to the network management system (NMS). Use the no form of this command to return to the default setting.

snmp-server enable traps [bridge | c2900 | cluster | config | entity | envmon [fan | shutdown | supply | temperature | voltage] | hsrp | mac-notification | port-security [trap-rate] | rtr | snmp [ authentication | coldstart | linkup | linkdown | warmstart ] | syslog | vlan-membership | vtp]

no snmp-server enable traps [bridge | c2900 | cluster | config | entity | envmon [fan | shutdown | supply | temperature | voltage] | hsrp | mac-notification | port-security [trap-rate] | rtr | snmp [ authentication | coldstart | linkup | linkdown | warmstart ] | syslog | vlan-membership | vtp]


Note Though visible in the command-line help strings, the snmp-server enable informs command is not supported. To enable sending SNMP inform notifications, use the snmp-server enable traps command combined with the snmp-server host host-addr informs command.


Syntax Description

authentication

(Optional) Enable authentication trap.

bridge

(Optional) Enable SNMP STP Bridge MIB traps.

c2900

(Optional) Enable SNMP configuration traps.

cluster

(Optional) Enable cluster traps.

coldstart

(Optional) Enable coldStart trap.

config

(Optional) Enable SNMP configuration traps.

entity

(Optional) Enable SNMP entity traps.

envmon

(Optional) Enable environmental monitor (EnvMon) management information base (MIB).

fan

(Optional) Enable SNMP EnvMon fan traps.

hsrp

(Optional) Enable Hot Standby Router Protocol (HSRP) traps.

linkdown

(Optional) Enable linkDown trap.

linkup

(Optional) Enable linkUp trap.

mac-notification

(Optional) Enable MAC address notification traps.

port-security

(Optional) Enable port security traps.

rtr

(Optional) Enable SNMP Response Time Reporter traps.

shutdown

(Optional) SNMP EnvMon monitor shutdown traps.

snmp

(Optional) Enable SNMP traps.

supply

(Optional) Enable SNMP power supply traps.

syslog

(Optional) Enable SNMP syslog traps.

temperature

(Optional) Enable SNMP EnvMon temperature traps.

trap-rate

(Optional) Enter the port security trap-rate. The range is 0 to 1000 seconds, the default is 0.

vlan-membership

(Optional) Enable SNMP VLAN membership traps.

vlancreate

(Optional) Enable SNMP VLAN created traps.

vlandelete

(Optional) Enable SNMP VLAN deleted traps.

voltage

(Optional) Enable SNMP EnvMon voltage traps.

vtp

(Optional) Enable VLAN Trunking Protocol (VTP) traps.

warmstart

(Optional) Enable warmStart trap.


Defaults

The sending of SNMP traps is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.

Use the snmp-server enable traps command to enable sending of traps or informs, when supported.


Note Informs are not supported in SNMPv1.


To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.

Examples

This example shows how to send EnvMon traps to the NMS:

Switch(config)# snmp-server enable traps envmon fan 

This example shows how to send VTP traps to the NMS:

Switch(config)# snmp-server enable traps vtp

You can verify your setting by entering the show vtp status privileged EXEC or the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

snmp-server host

Specifies the host that receives SNMP traps.


snmp-server host

Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.

snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 | auth | noauth}] community-string [bridge | c2900 | cluster | config | entity | envmon | hsrp | mac-notification | port-security | rtr | snmp | syslog | tty | udp-port | vlan-membership | vlancreate | vlandelete | vtp]

no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 | auth | noauth}] community-string [bridge | c2900 | cluster | config | entity | envmon | hsrp | mac-notification | port-security | rtr | snmp | syslog | tty | udp-port | vlan-membership | vlancreate | vlandelete | vtp]

Syntax Description

host-addr

Name or Internet address of the host (the targeted recipient).

informs | traps

(Optional) Send SNMP traps or informs to this host.

version 1 | 2c | 3

(Optional ) Version of SNMP used to send the traps.

These keywords are supported:

1—SNMPv1. This option is not available with informs.

2c—SNMPv2C.

3—SNMPv3. These optional keywords can follow the version 3 keyword:

auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication.

noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth] keyword is not specified.

community-string

Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command.

bridge

(Optional) Allow SNMP STP Bridge MIB traps.

c2900

(Optional) Send SNMP switch traps.

cluster

(Optional) Send cluster member status traps.

config

(Optional) Send SNMP configuration traps.

entity

(Optional) Send SNMP entity traps.

envmon

(Optional) Send enviromental monitor (EnvMon) traps.

hsrp

(Optional) Send Hot Standby Router Protocol (HSRP) traps.

mac-notification

(Optional) Send MAC notification traps.

port-security

(Optional) Send port security traps.

rtr

(Optional) Send SNMP Response Time Reporter traps.

snmp

(Optional) Send SNMP-type traps.

syslog

(Optional) Allow SNMP syslog traps.

tty

(Optional) Send Transmission Control Protocol (TCP) connection traps.

udp-port

(Optional) Send notification host's User Datagram Protocol (UDP) port number.

vlan-membership

(Optional) Send SNMP VLAN membership traps.

vlancreate

(Optional) Allow SNMP VLAN created traps.

vlandelete

(Optional) Allow SNMP VLAN deleted traps.

vtp

(Optional) Send VLAN Trunking Protocol (VTP) traps.


Defaults

This command is disabled. No notifications are sent.

If you enter this command with no keywords, the default is to send all trap types to the host. No informs are sent to this host.

If no version keyword is present, the default is version 1.


Note If the community-string is not defined by using the snmp-server community global configuration command before using this command, the default form of the snmp-server community command is automatically inserted into the configuration. The password (community-string) used for this automatic configuration of the snmp-server community will be the same as that specified in the snmp-server host command.


Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.

The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.

The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.

Examples

This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:

Switch(config)# snmp-server community comaccess ro 10
Switch(config)# snmp-server host 172.20.2.160 comaccess
Switch(config)# access-list 10 deny any

This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:

Switch(config)# snmp-server enable traps
Switch(config)# snmp-server host myhost.cisco.com comaccess snmp 

This example shows how to enable the switch to send all traps to the host myhost.cisco.com using the community string public:

Switch(config)# snmp-server enable traps
Switch(config)# snmp-server host myhost.cisco.com public

This example shows how to enable the switch to send EnvMon traps to the host myhost.cisco.com using the community string public:

Switch(config)# snmp-server host myhost.cisco.com version 2c public envmon

Related Commands

Command
Description

show running-config

Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

snmp-server enable traps

Enables SNMP notification for various trap types.


snmp trap mac-notification

Use the snmp trap mac-notification interface configuration command to enable the MAC notification traps on a port. Use the no form of this command to disable the traps and to return the port to default settings.

snmp trap mac-notification [added | removed]

no snmp trap mac-notification [added | removed]

Syntax Description

added

(Optional) Enable MAC notification traps when a MAC address is added to a port.

removed

(Optional) Enable MAC notification traps when a MAC address is removed from a port.


Defaults

The Simple Network Management Protocol (SNMP) address-addition and address-removal traps are disabled.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Even though you enable the notification trap for a specific interface by using the snmp trap mac-notification command, the trap is generated only when you enter the snmp-server enable traps mac-notification and the mac address-table notification global configuration commands.

Examples

This example shows how to enable an address-addition trap on a port:

Switch(config-if)# snmp trap mac-notification added

This example shows how to enable an address-removal trap on a port:

Switch(config-if)# snmp trap mac-notification removed

You can verify your settings by entering the show mac address-table notification privileged EXEC command.

Related Commands

Command
Description

clear mac address-table notification

Clears the MAC address notification global counters.

mac address-table notification

Enables the MAC notification feature on a switch.

show mac address-table notification

Displays MAC notification parameters.

snmp-server enable traps

Enables SNMP notification for various trap types.


spanning-tree backbonefast

Use the spanning-tree backbonefast global configuration command to enable the BackboneFast feature. Use the no form of this command to return to the default setting.

spanning-tree backbonefast

no spanning-tree backbonefast

Syntax Description

This command has no arguments or keywords.

Defaults

BackboneFast is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The BackboneFast feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+).

BackboneFast is started when a root port or blocked port on a switch receives inferior bridge protocol data units (BPDUs) from its designated bridge. An inferior BPDU identifies one switch as both the root bridge and the designated bridge. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated bridge has lost its connection to the root switch). If there are alternate paths to the root switch, BackboneFast causes the maximum aging time on the ports on which it received the inferior BPDU to expire and allows a blocked port to move immediately to the listening state. BackboneFast then transitions the interface to the forwarding state. For more information, refer to the software configuration guide for this release.

Enable BackboneFast on all supported switches to allow the detection of indirect link failures and to start the spanning-tree reconfiguration sooner.

Examples

This example shows how to enable BackboneFast on the switch:

Switch(config)# spanning-tree backbonefast

You can verify your setting by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command
Description

show spanning-tree summary

Displays a summary of the spanning-tree port states.


spanning-tree bpdufilter

Use the spanning-tree bpdufilter interface configuration command to prevent a port from sending or receiving bridge protocol data units (BPDUs). Use the no form of this command to return to the default setting.

spanning-tree bpdufilter {disable | enable}

no spanning-tree bpdufilter

Syntax Description

disable

Disable BPDU filtering on the specified interface.

enable

Enable BPDU filtering on the specified interface.


Defaults

BPDU filtering is disabled.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enable the BPDU filtering feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+) mode.


Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

You can globally enable BPDU filtering on all Port Fast-enabled ports by using the spanning-tree portfast bpdufilter default global configuration command.

You can use the spanning-tree bpdufilter interface configuration command to override the setting of the spanning-tree portfast bpdufilter default global configuration command.

Examples

This example shows how to enable the BPDU filtering feature on a port:

Switch(config)# interface fastethernet0/1
Switch(config-if)# spanning-tree bpdufilter enable

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree portfast (global configuration)

Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.

spanning-tree portfast (interface configuration)

Enables the Port Fast feature on an interface and all its associated VLANs.


spanning-tree bpduguard

Use the spanning-tree bpduguard interface configuration command to put a port in the error-disabled state when it receives a bridge protocol data unit (BPDU). Use the no form of this command to return to the default setting.

spanning-tree bpduguard {disable | enable}

no spanning-tree bpduguard

Syntax Description

disable

Disable BPDU guard on the specified interface.

enable

Enable BPDU guard on the specified interface.


Defaults

BPDU guard is disabled.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent a port from being included in the spanning-tree topology.

You can enable the BPDU guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+) mode.

You can globally enable BPDU guard on all Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command.

You can use the spanning-tree bpduguard interface configuration command to override the setting of the spanning-tree portfast bpduguard default global configuration command.

Examples

This example shows how to enable the BPDU guard feature on a port:

Switch(config)# interface fastethernet0/1
Switch(config-if)# spanning-tree bpduguard enable

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree portfast (global configuration)

Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports, or enables the Port Fast feature on all nontrunking ports.

spanning-tree portfast (interface configuration)

Enables the Port Fast feature on an interface and all its associated VLANs.


spanning-tree cost

Use the spanning-tree cost interface configuration command to set the path cost for spanning-tree calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to place in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree [vlan vlan-id] cost cost

no spanning-tree [vlan vlan-id] cost

Syntax Description

vlan vlan-id

(Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 1005.

cost

Path cost can range from 1 to 200000000, with higher values meaning higher costs.


Defaults

The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values:

10 Mbps—100

100 Mbps—19

155 Mbps—14

1000 Mbps—4

1 Gbps—4

10 Gbps—2

Speeds greater than 10 Gbps—1

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

When you configure the cost, higher values represent higher costs.

You can set a cost on a VLAN that does not exist. The setting takes effect when the VLAN exists.

If you configure an interface with both the spanning-tree vlan vlan-id cost cost command and the spanning-tree cost cost command, the spanning-tree vlan vlan-id cost cost command takes effect.

Examples

This example shows how to set a path cost of 250 on an interface:

Switch(config)# interface fastethernet0/4
Switch(config-if)# spanning-tree cost 250

This example shows how to set a path cost of 300 for VLANs 10, 12 to 15, and 20:

Switch(config-if)# spanning-tree vlan 10,12-15,20 cost 300

You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command.

Related Commands

Command
Description

show spanning-tree interface interface-id

Displays spanning-tree information for the specified interface.

spanning-tree port-priority

Configures an interface priority.

spanning-tree vlan priority

Sets the switch priority for the specified spanning-tree instance.


spanning-tree etherchannel guard misconfig

Use the spanning-tree etherchannel guard misconfig global configuration command to display an error message when the switch detects a loop that occurred because of an EtherChannel misconfiguration. Use the no form of this command to disable the feature.

spanning-tree etherchannel guard misconfig

no spanning-tree etherchannel guard misconfig

Syntax Description

This command has no arguments or keywords.

Defaults

EtherChannel guard is enabled on the switch.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

When the switch detects a loop that is caused by an EtherChannel misconfiguration, this error message appears:

PM-4-ERR_DISABLE: Channel-misconfig error detected on [chars], putting [chars] in 
err-disable state.

To determine which switch ports are in the misconfigured EtherChannel, use the show interfaces status err-disabled privileged EXEC command. To verify the EtherChannel configuration on a remote device, use the show etherchannel summary privileged EXEC command on the remote device.

When a port is in the error-disabled state because of an EtherChannel misconfiguration, you can bring it out of this state by entering the errdisable recovery cause channel-misconfig global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Examples

This example shows how to enable the EtherChannel guard misconfiguration feature:

Switch(config)# spanning-tree etherchannel guard misconfig

You can verify your settings by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command
Description

errdisable recovery cause channel-misconfig

Enables the timer to recover from the EtherChannel misconfiguration error-disable state.

show etherchannel summary

Displays EtherChannel information for a channel as a one-line summary per channel-group.

show interfaces status err-disabled

Displays the interfaces in the error-disabled state.


spanning-tree extend system-id

Use the spanning-tree extend system-id global configuration command to enable the extended system ID feature.

spanning-tree extend system-id


Note Though visible in the command-line help strings, the no version of this command is not supported. You cannot disable the extended system ID feature.


Syntax Description

This command has no arguments or keywords.

Defaults

The extended system ID is enabled.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Catalyst 2940 switches support the 802.1T spanning-tree extensions; some of the bits are used for the extended system ID (VLAN identifier for the per-VLAN spanning-tree plus [PVST+]).

The spanning tree uses the extended system ID, the switch priority, and the allocated spanning-tree MAC address to make the bridge ID unique for each VLAN or multiple spanning-tree instance.

Support for the extended system ID affects how you manually configure the root switch, the secondary root switch, and the switch priority of a VLAN. For more information, see the "spanning-tree vlan" section.

If your network consists of switches that do not support the extended system ID and switches that do support it, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches running older software.

Related Commands

Command
Description

show spanning-tree summary

Displays a summary of spanning-tree port states.

spanning-tree vlan priority

Sets the switch priority for the specified spanning-tree instance.


spanning-tree guard

Use the spanning-tree guard interface configuration command to enable root guard or loop guard on all the VLANs associated with the selected interface. Root guard restricts which interface is allowed to be the spanning-tree root port or the path-to-the root for the switch. Loop guard prevents alternate or root ports from becoming designated ports when a failure creates a unidirectional link. Use the no form of this command to return to the default setting.

spanning-tree guard {loop | none | root}

no spanning-tree guard

Syntax Description

loop

Enable loop guard.

none

Disable root guard or loop guard.

root

Enable root guard.


Defaults

Root guard is disabled.

Loop guard is configured according to the spanning-tree loopguard default global configuration command (globally disabled).

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enable root guard or loop guard when the switch is operating in the per-VLAN spanning-tree plus (PVST+) mode.

When root guard is enabled, if spanning-tree calculations cause a port to be selected as the root port, the port transitions to the root-inconsistent (blocked) state to prevent the customer's switch from becoming the root switch or being in the path to the root. The root port provides the best path from the switch to the root switch.

When the no spanning-tree guard or the no spanning-tree guard none command is entered, root guard is disabled for all VLANs on the selected interface. If this interface is in the root-inconsistent (blocked) state, it automatically transitions to the listening state.

Do not enable root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state.

Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST + mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports.

To disable root guard or loop guard, use the spanning-tree guard none interface configuration command. You cannot enable both root guard and loop guard at the same time.

You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command.

Examples

This example shows how to enable root guard on all the VLANs associated with the specified interface:

Switch(config)# interface fastethernet0/3
Switch(config-if)# spanning-tree guard root

This example shows how to enable loop guard on all the VLANs associated with the specified interface:

Switch(config)# interface fastethernet0/3
Switch(config-if)# spanning-tree guard loop

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree cost

Sets the path cost for spanning-tree calculations.

spanning-tree loopguard default

Prevents alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link.

spanning-tree port-priority

Configures an interface priority.

spanning-tree vlan priority

Sets the switch priority for the specified spanning-tree instance.


spanning-tree link-type

Use the spanning-tree link-type interface configuration command to override the default link-type setting, which is determined by the duplex mode of the port. Use the no form of this command to return to the default setting.

spanning-tree link-type {point-to-point | shared}

no spanning-tree link-type

Syntax Description

point-to-point

Specify that the link type of a port is point-to-point.

shared

Specify that the link type of a port is shared.


Defaults

The switch derives the link type of a port from the duplex mode. A full-duplex port is considered a point-to-point link, and a half-duplex port is considered a shared link.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can override the default setting of the link type by using the spanning-tree link-type command.

Examples

This example shows how to specify the link type as shared (regardless of the duplex setting):

Switch(config-if)# spanning-tree link-type shared

You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command.

spanning-tree loopguard default

Use the spanning-tree loopguard default global configuration command to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. Use the no form of this command to return to the default setting.

spanning-tree loopguard default

no spanning-tree loopguard default

Syntax Description

This command has no arguments or keywords.

Defaults

Loop guard is disabled.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enable the loop guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+) mode.

Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports.

Loop guard operates only on ports that are considered point-to-point by the spanning tree.

You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command.

Examples

This example shows how to globally enable loop guard:

Switch(config)# spanning-tree loopguard default

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree guard loop

Enables the loop guard feature on all the VLANs associated with the specified interface.


spanning-tree mode

Use the spanning-tree mode global configuration command to enable per-VLAN spanning-tree plus (PVST+) on your switch.

spanning-tree mode pvst

no spanning-tree mode


Note Because PVST+ is the only STP mode supported on the Catalyst 2940 switch, the no form of this command is not used.


Syntax Description

pvst

Enable PVST+.


Defaults

The default mode is PVST+.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The switch must run all STP instances in PVST+ mode.

Examples

This example shows how to enable PVST+ on the switch:

Switch(config)# spanning-tree mode pvst

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.


spanning-tree port-priority

Use the spanning-tree port-priority interface configuration command to configure an interface priority. If a loop occurs, spanning tree can determine which interface to put in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree [vlan vlan-id] port-priority priority

no spanning-tree [vlan vlan-id] port-priority

Syntax Description

vlan vlan-id

(Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 1005.

priority

The range is 0 to 240 in increments of 16. Valid priority values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority.


Defaults

The default is 128.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

If the variable vlan-id is omitted, the command applies to the spanning-tree instance associated with VLAN 1.

You can set the priority on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign the interface to the VLAN.

If you configure an interface with both the spanning-tree vlan vlan-id port-priority priority command and the spanning-tree port-priority priority command, the spanning-tree vlan vlan-id port-priority priority command takes effect only on the range of VLANs specified by that command. On the VLANs that are not specified by the spanning-tree vlan vlan-id port-priority priority command, the spanning-tree port-priority priority command takes effect.

Examples

This example shows how to increase the likelihood that the Fast Ethernet interface 0/2 will be put in the forwarding state if a loop occurs:

Switch(config)# interface fastethernet0/2
Switch(config-if)# spanning-tree vlan 20 port-priority 0

You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command.

Related Commands

Command
Description

show spanning-tree interface interface-id

Displays spanning-tree information for the specified interface.

spanning-tree cost

Sets the path cost for spanning-tree calculations.

spanning-tree vlan priority

Sets the switch priority for the specified spanning-tree instance.


spanning-tree portfast (global configuration)

Use the spanning-tree portfast global configuration command to globally enable bridge protocol data unit (BPDU) filtering on Port Fast-enabled ports, the BPDU guard feature on Port Fast-enabled ports, or the Port Fast feature on all nontrunking ports. The BPDU filtering feature prevents the switch port from sending or receiving BPDUs. The BPDU guard feature puts Port Fast-enabled ports that receive BPDUs in an error-disabled state. Use the no form of this command to return to the default setting.

spanning-tree portfast {bpdufilter default | bpduguard default | default}

no spanning-tree portfast {bpdufilter default | bpduguard default | default}

Syntax Description

bpdufilter default

Globally enable BPDU filtering on Port Fast-enabled ports and prevent the switch port connected to end stations from sending or receiving BPDUs.

bpduguard default

Globally enable the BPDU guard feature on Port Fast-enabled ports and place the ports that receive BPDUs in an error-disabled state.

default

Globally enable the Port Fast feature on all nontrunking ports. When the Port Fast feature is enabled, the port changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes.


Defaults

The BPDU filtering, the BPDU guard, and the Port Fast features are disabled on all ports unless they are individually configured.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You can enable these features when the switch is operating in the per-VLAN spanning-tree plus (PVST+).

Use the spanning-tree portfast bpdufilter default global configuration command to globally enable BPDU filtering on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state). The ports still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to switch ports do not receive BPDUs. If a BPDU is received on a Port Fast-enabled port, the port loses its Port Fast-operational status and BPDU filtering is disabled.

You can override the spanning-tree portfast bpdufilter default global configuration command by using the spanning-tree bdpufilter interface configuration command.


Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

Use the spanning-tree portfast bpduguard default global configuration command to globally enable BPDU guard on ports that are in a Port Fast-operational state. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree.

You can override the spanning-tree portfast bpduguard default global configuration command by using the spanning-tree bdpuguard interface configuration command.

Use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking ports. Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. A Port Fast-enabled port moves directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-delay time.

You can override the spanning-tree portfast default global configuration command by using the spanning-tree portfast interface configuration command. You can use the no spanning-tree portfast default global configuration command to disable Port Fast on all ports unless they are individually configured with the spanning-tree portfast interface configuration command.

Examples

This example shows how to globally enable the BPDU filtering feature:

Switch(config)# spanning-tree portfast bpdufilter default

This example shows how to globally enable the BPDU guard feature:

Switch(config)# spanning-tree portfast bpduguard default

This example shows how to globally enable the Port Fast feature on all nontrunking ports:

Switch(config)# spanning-tree portfast default

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree bpdufilter

Prevents a port from sending or receiving BPDUs.

spanning-tree bpduguard

Puts a port in the error-disabled state when it receives a BPDU.

spanning-tree portfast (interface configuration)

Enables the Port Fast feature on an interface in all its associated VLANs.


spanning-tree portfast (interface configuration)

Use the spanning-tree portfast interface configuration command to enable the Port Fast feature on an interface in all its associated VLANs. When the Port Fast feature is enabled, the interface changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes. Use the no form of this command to return to the default setting.

spanning-tree portfast [disable | trunk]

no spanning-tree portfast

Syntax Description

disable

(Optional) Disable the Port Fast feature on the specified interface.

trunk

(Optional) Enable the Port Fast feature on a trunking interface.


Defaults

The Port Fast feature is disabled on all interfaces; however, it is automatically enabled on dynamic-access ports.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use this feature only on interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation.

You can enable this feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+) mode.

This feature affects all VLANs on the interface.

A port with the Port Fast feature enabled is moved directly to the spanning-tree forwarding state without waiting the standard forward-time delay.

You can use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking interfaces. However, the spanning-tree portfast interface configuration command can override the global setting.

If you configure the spanning-tree portfast default global configuration command, you can disable Port Fast on a port that is not a trunk port by using the no spanning-tree portfast interface configuration command.

The no spanning-tree portfast interface configuration command is the same as the spanning-tree portfast disable interface configuration command.

Examples

This example shows how to enable the Port Fast feature on an interface:

Switch(config)# interface fastethernet0/2
Switch(config-if)# spanning-tree portfast

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree bpdufilter

Prevents a port from sending or receiving bridge protocol data units (BPDUs).

spanning-tree bpduguard

Puts a port in the error-disabled state when it receives a BPDU.

spanning-tree portfast (global configuration)

Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.


spanning-tree stack-port

Use the spanning-tree stack-port interface configuration command to enable cross-stack UplinkFast (CSUF) on an interface and to accelerate the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself. Use the no form of this command to return to the default setting.

spanning-tree stack-port

no spanning-tree stack-port

Syntax Description

This command has no arguments or keywords.

Defaults

CSUF is disabled on all interfaces.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

This command is effective only if you enable the UplinkFast feature by using the spanning-tree uplinkfast global configuration command.

Use this command only on access switches.

The CSUF feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+). If CSUF is already enabled on an interface and you try to enable it on another interface, you receive an error message. You must disable CSUF on the first interface before enabling it on a new interface.

Examples

This example shows how to enable CSUF on a Fast Ethernet interface:

Switch(config)# interface fastethernet0/1
Switch(config-if)# spanning-tree stack-port 

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.

spanning-tree uplinkfast

Accelerates the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself.


spanning-tree uplinkfast

Use the spanning-tree uplinkfast global configuration command to accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. Use the no form of this command to return to the default setting.

spanning-tree uplinkfast [max-update-rate pkts-per-second]

no spanning-tree uplinkfast [max-update-rate]

Syntax Description

max-update-rate pkts-per-second

(Optional) The number of packets per second at which update packets are sent. The range is 0 to 32000.


Defaults

UplinkFast is disabled.

The update rate is 150 packets per second.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use this command only on access switches.

The UplinkFast feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+). When you enable UplinkFast, it is enabled for the entire switch and cannot be enabled for individual VLANs.

When UplinkFast is enabled, the switch priority of all VLANs is set to 49152. If you change the path cost to a value less than 3000 and you enable UplinkFast or UplinkFast is already enabled, the path cost of all interfaces and VLAN trunks is increased by 3000 (if you change the path cost to 3000 or above, the path cost is not altered). The changes to the switch priority and the path cost reduces the chance that the switch will become the root switch.

When UplinkFast is disabled, the switch priorities of all VLANs and path costs of all interfaces are set to default values if you did not modify them from their defaults.

When spanning tree detects that the root port has failed, UplinkFast immediately switches over to an alternate root port, changing the new root port directly to FORWARDING state. During this time, a topology change notification is sent.

Do not enable the root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state.

If you set the max-update-rate to 0, station-learning frames are not generated, so the spanning-tree topology converges more slowly after a loss of connectivity.

Examples

This example shows how to enable UplinkFast:

Switch(config)# spanning-tree uplinkfast 

You can verify your setting by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command
Description

show spanning-tree summary

Displays a summary of the spanning-tree port states.

spanning-tree stack-port

Enables cross-stack UplinkFast (CSUF) on an interface and accelerates the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself.

spanning-tree vlan root primary

Forces this switch to be the root switch.


spanning-tree vlan

Use the spanning-tree vlan global configuration command to configure spanning tree on a per-VLAN basis. Use the no form of this command to return to the default setting.

spanning-tree vlan vlan-id {forward-time seconds | hello-time seconds | max-age seconds |
priority priority | {root {primary | secondary} [diameter net-diameter
[hello-time seconds]]}}

no spanning-tree vlan vlan-id [forward-time | hello-time | max-age | priority | root]

Syntax Description

vlan-id

VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 1005.

forward-time seconds

Set the forward-delay time for the specified spanning-tree instance. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. The range is 4 to 30 seconds.

hello-time seconds

Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds.

max-age seconds

Set the interval between messages the spanning tree receives from the root switch. If a switch does not receive a BPDU message from the root switch within this interval, it recomputes the spanning-tree topology. The range is 6 to 40 seconds.

priority priority

Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that the switch is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch.

The range is 0 to 61440 in increments of 4096. Valid priority values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected.

root primary

Force this switch to be the root switch.

root secondary

Set this switch to be the root switch should the primary root switch fail.

diameter net-diameter

Set the maximum number of switches between any two end stations. The range is 2 to 7.


Defaults

Spanning tree is enabled on all VLANs.

The forward-delay time is 15 seconds.

The hello time is 2 seconds.

The max-age is 20 seconds.

The primary root switch priority is 24576.

The secondary root switch priority is 28672.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Disabling the STP causes the VLAN to stop participating in the spanning-tree topology. Interfaces that are administratively down remain down. Received BPDUs are forwarded like other multicast frames. The switch does not detect and prevent loops in a VLAN if STP is disabled for that VLAN.

You can disable the STP on a VLAN that is not currently active and verify the change by using the show running-config or the show spanning-tree vlan vlan-id privileged EXEC command. The setting takes effect when the VLAN is activated.

When disabling or re-enabling the STP, you can specify a range of VLANs that you want to disable or enable.

When the STP is disabled and then enabled, all assigned VLANs continue to be its members. However, all spanning-tree bridge parameters are returned to their previous settings (the last setting before the VLAN was disabled).

You can enable spanning-tree options on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign interfaces to it.

When setting the max-age seconds, if a switch does not receive BPDUs from the root switch within the specified interval, it recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting.

The spanning-tree vlan vlan-id root command should be used only on backbone switches.

When you enter the spanning-tree vlan vlan-id root command, the software checks the switch priority of the current root switch for each VLAN. Because of the extended system ID support, the switch sets the switch priority for the specified VLAN to 24576 if this value will cause this switch to become the root for the specified VLAN. If any root switch for the specified VLAN has a switch priority lower than 24576, the switch sets its own priority for the specified VLAN to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.)

When you enter the spanning-tree vlan vlan-id root primary command, the switch recalculates the forward-time, hello-time, max-age, and priority settings. If you previously configured these parameters, the switch overrides and recalculates them.

When you enter the spanning-tree vlan vlan-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch should fail, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768, and therefore, are unlikely to become the root switch).

Examples

This example shows how to disable the STP on VLAN 5:

Switch(config)# no spanning-tree vlan 5

You can verify your setting by entering the show spanning-tree privileged EXEC command. In this instance, VLAN 5 does not appear in the list.

This example shows how to set the spanning-tree forwarding time to 18 seconds for VLANs 20 and 25:

Switch(config)# spanning-tree vlan 20,25 forward-time 18

This example shows how to set the spanning-tree hello-delay time to 3 seconds for VLANs 20 to 24:

Switch(config)# spanning-tree vlan 20-24 hello-time 3

This example shows how to set spanning-tree max-age to 30 seconds for VLAN 20:

Switch(config)# spanning-tree vlan 20 max-age 30

This example shows how to reset the max-age parameter to the default value for spanning-tree instances 100 and 105 to 108 :

Switch(config)# no spanning-tree vlan 100,105-108 max-age

This example shows how to set the spanning-tree priority to 8192 for VLAN 20:

Switch(config)# spanning-tree vlan 20 priority 8192

This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root primary diameter 4

This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root secondary diameter 4 

You can verify your settings by entering the show spanning-tree vlan vlan-id privileged EXEC command.

Related Commands

Command
Description

show spanning-tree vlan

Displays spanning-tree information.

spanning-tree cost

Sets the path cost for spanning-tree calculations.

spanning-tree guard

Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface.

spanning-tree port-priority

Sets an interface priority.

spanning-tree portfast (global configuration)

Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.

spanning-tree portfast (interface configuration)

Enables the Port Fast feature on an interface in all its associated VLANs.

spanning-tree uplinkfast

Enables the UplinkFast feature, which accelerates the choice of a new root port.


speed

Use the speed interface configuration command to specify the speed of a port. Use the no form of this command to return the port to its default value.

speed {10 | 100 | 1000 | auto| nonegotiate}

no speed

Syntax Description

10

Port runs at 10 Mbps.

100

Port runs at 100 Mbps.

1000

Port runs at 1000 Mbps (only valid for Gigabit Ethernet ports).

auto

Port automatically detects whether it should run at 10 or 100 Mbps on
Fast Ethernet ports or at 10, 100, or 1000 Mbps on 10/100/1000 ports.


Defaults

For Fast Ethernet and 10/100/1000 ports, the default is auto.

For 100BASE-FX ports, the default is 100 Mbps.

For SFP ports, the default is 1000 Mbps.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Fast Ethernet ports, except for 100BASE-FX ports, can be configured at 10 or 100 Mbps. The 10/100/1000 ports can be configured at 10, 100, or 1000 Mbps and operate only in the full-duplex mode.

If the speed is set to auto, the switch negotiates with the device at the other end of the link for the speed setting and then forces the speed setting to the negotiated value. The duplex setting remains as configured on each end of the link, which could result in a duplex setting mismatch. If both the speed and duplex are set to specific values, autonegotiation is disabled.

SFP ports only operate at 1000 Mbps, and those with a 1000 BASE-T module installed can only be configured for full-duplex mode.


Note The 100BASE-FX and small-form-factor pluggable (SFP) ports do not support the speed command. These ports operate only at 100 Mbps and in full-duplex mode.



Note For guidelines on setting the switch speed and duplex parameters, refer to "Configuring the Switch Ports" chapter in the Catalyst 2940 Switch Software Configuration Guide.


Examples

This example shows how to set Fast Ethernet port 1 to 100 Mbps:

Switch(config)# interface fastethernet0/1
Switch(config-if)# speed 100

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command
Description

duplex

Specifies the duplex mode of operation for switch ports.

show running-config

Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.


storm-control

Use the storm-control interface configuration command to enable broadcast, multicast, or unicast storm control on a port and to specify the action taken when a storm occurs on a port. Use the no form of this command to disable storm control for broadcast, multicast, or unicast traffic and disable the specified storm-control action.

storm-control {{{broadcast | multicast | unicast} level level [lower level]} | action {shutdown | trap}}

no storm-control {{broadcast | multicast | unicast} level} | action}

Syntax Description

{broadcast | multicast | unicast}

Determines the type of packet-storm suppression.

broadcast—Enable broadcast storm control on the port.

multicast—Enable multicast storm control on the port.

unicast—Enable unicast storm control on the port.

level level [lower level]

Defines the rising and falling suppression levels.

level—Rising suppression level as a percent of total bandwidth, up to two decimal places; valid values are from 0 to 100 percent. Block the flooding of storm packets when the value specified for level is reached.

lower level—(Optional) Falling suppression level as a percent of total bandwidth, up to two decimal places; valid values are from 0 to 100. This value must be less than the rising supression value.

action

Action taken when a storm occurs on a port. The default action is to filter traffic and not send an Simple Network Management Protocol (SNMP) trap.

shutdown

Disables the port during a storm.

trap

Sends an SNMP trap when a storm occurs.


Defaults

Broadcast, multicast, and unicast storm control are disabled.

The default action is to filter traffic and to not send an SNMP trap.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Use the storm-control command to enable or disable broadcast, multicast, or unicast storm control on a port. After a port is disabled during a storm, use the no shutdown interface configuration command to enable the port.

The suppression levels are entered as a percentage of total bandwidth. A suppression value of 100 percent means that no limit is placed on the specified traffic type. This feature is enabled only when the rising suppression level is less than 100 percent. If no other storm-control configuration is specified, the default action is to filter the traffic causing the storm and to send no SNMP trap.

When a storm occurs and the action is to filter traffic, if the falling suppression level is not specified, the switch blocks all traffic until the traffic rate drops below the rising suppression level. If the falling suppression level is specified, the switch blocks traffic until the traffic rate drops below this level.

When a multicast or unicast storm occurs and the action is to filter traffic, the switch blocks all traffic (broadcast, multicast, and unicast traffic) and sends only Spanning Tree Protocol (STP) packets.

When a broadcast storm occurs and the action is to filter traffic, the switch blocks only broadcast traffic.

The trap and shutdown options are independent of each other.

Examples

This example shows how to enable broadcast storm control on a port with a 75.67 percent rising suppression level:

Switch(config-if)# storm-control broadcast level 75.67

This example shows how to enable multicast storm control on a port with a 87 percent rising suppression level and a 65 percent falling suppression level:

Switch(config-if)# storm-control multicast level 87 65

This example shows how to enable the shutdown action on a port:

Switch(config-if)# storm-control action shutdown

This example shows how to enable the trap action on a port:

Switch(config-if)# storm-control action trap

This example shows how to disable the shutdown action on a port:

Switch(config-if)# no storm-control action shutdown

You can verify your settings by entering the show storm-control privileged EXEC command.

Related Commands

Command
Description

show storm-control

Displays the packet-storm control information.


switchport access

Use the switchport access interface configuration command to configure a port as a static-access or dynamic-access port. If the mode is set to access, the port operates as a member of the configured VLAN. If set to dynamic, the port starts discovery of its VLAN assignment based on the incoming packets it receives. Use the no form of this command to reset the access mode to the default VLAN for the switch.

switchport access vlan {vlan-id | dynamic}

no switchport access

Syntax Description

access vlan vlan-id

Configure the interface as a static-access port; valid values are from 1 to 1005.

access vlan dynamic

Specify that the access mode VLAN is dependent on the VLAN Membership Policy Server (VMPS) protocol. The port is assigned to a VLAN based on the source MAC address of a host (or hosts) connected to the port. The switch sends every new MAC address received to the VMPS server to obtain the VLAN name to which the dynamic-access port should be assigned. If the port already has a VLAN assigned and the source has already been approved by the VMPS, the switch forwards the packet to the VLAN.


Defaults

All ports are in static-access mode in VLAN 1 if the port is not connected to a device running Dynamic Trunking Protocol (DTP). The default access VLAN for an access port is VLAN 1.

All ports are dynamic trunk ports.

A dynamic-access port is initially a member of no VLAN and receives its assignment based on the packet it receives.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The no switchport access command resets the access mode VLAN to the appropriate default VLAN for the device.

The port must be in access mode before the switchport access vlan command can take effect. For more information, see the switchport mode command.

An access port can be assigned to only one VLAN.

The VMPS server (such as a Catalyst 6000 series switch) must be configured before a port is configured as dynamic.

These restrictions apply to dynamic-access ports:

The software implements the VLAN Query Protocol (VQP) client, which can query a VMPS such as a Catalyst 6000 series switch. The Catalyst 3550 switches are not VMPS servers. The VMPS server must be configured before a port is configured as dynamic.

Use dynamic-access ports only to connect end stations. Connecting them to switches or routers that use bridging protocols can cause a loss of connectivity.

Configure the network so that Spanning Tree Protocol (STP) does not put the dynamic-access port in an STP blocking state. The Port Fast feature is automatically enabled on dynamic-access ports.

Dynamic-access ports can only be in one VLAN and do not use VLAN tagging.

Dynamic-access ports cannot be configured as:

Members of an EtherChannel port group (dynamic-access ports cannot be grouped with any other port, including other dynamic ports).

Source or destination ports in a static address entry.

Monitor ports.

Examples

This example shows how to assign a port already in access mode to VLAN 2 (instead of the default VLAN 1):

Switch(config-if)# switchport access vlan 2

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows.

Related Commands

Command
Description

show interfaces switchport

Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.

switchport mode

Configures the VLAN membership mode of a port.


switchport mode

Use the switchport mode interface configuration command to configure the VLAN membership mode of a port. Use the no form of this command to reset the mode to the appropriate default for the device.

switchport mode {access | dynamic {auto | desirable} | trunk}

no switchport mode

Syntax Description

access

Set the port to access mode (either static-access or dynamic-access depending on the setting of the switchport access vlan inteface configuration command). The port is set to access unconditionally and operates as a nontrunking, single VLAN interface that transmits and receives nonencapsulated (nontagged) frames. An access port can be assigned to only one VLAN.

dynamic auto

Set the interface trunking mode dynamic parameter to auto to specify that the interface convert the link to a trunk link.

dynamic desirable

Set the interface trunking mode dynamic parameter to desirable to specify that the interface actively attempt to convert the link to a trunk link.

trunk

Set the port to trunk unconditionally. The port is a trunking VLAN Layer 2 interface. The port transmits and receives encapsulated (tagged) frames that identify the VLAN of origination. A trunk is a point-to-point link between two switches or between a switch and a router.


Defaults

The default mode is dynamic desirable.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

Configuration by using the access or trunk keywords takes affect only when you configure the port in the appropriate mode by using the switchport mode command. The static-access and trunk configurations are saved, but only one configuration is active at a time.

If you enter access mode, the interface changes into permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not agree to the change.

If you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode.

If you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

If you enter trunk mode, the interface changes into permanent trunking mode and negotiates to convert the link into a trunk link even if the interface connecting to it does not agree to the change.

The no switchport mode form resets the mode to dynamic desirable.

Trunk ports cannot co-exist on the same switch.

To autonegotiate trunking, the interfaces must be in the same VTP domain. Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a point-to-point protocol. However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations. To avoid this, you should configure interfaces connected to devices that do not support DTP to not forward DTP frames, which turns off DTP.

If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

To enable trunking to a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

Examples

This example shows how to configure a port for access mode:

Switch(config-if)# switchport mode access

This example shows how set the interface to dynamic desirable mode:

Switch(config-if)# switchport mode dynamic desirable

This example shows how to configure a port for trunk mode:

Switch(config-if)# switchport mode trunk

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows.

Related Commands

Command
Description

show interfaces switchport

Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.

switchport access

Configures a port as a static-access port.


switchport nonegotiate

Use the switchport nonegotiate interface configuration command to specify that Dynamic Trunking Protocol (DTP) negotiation packets are not sent on the Layer 2 interface. The switch does not engage in DTP negotiation on this interface. Use the no form of this command to return to the default setting.

switchport nonegotiate

no switchport nonegotiate

Syntax Description

This command has no arguments or keywords.

Defaults

The default is to use DTP negotiation to determine trunking status.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The no form of the switchport nonegotiate command removes nonegotiate status.

This command is valid only when the interface switchport mode is access or trunk (configured by using the switchport mode access or the switchport mode trunk interface configuration command). This command returns an error if you attempt to execute it in dynamic (auto or desirable) mode.

Internetworking devices that do not support DTP might forward DTP frames improperly and cause misconfigurations. To avoid this, you should turn off DTP by using the switchport no negotiate command to configure the interfaces connected to devices that do not support DTP to not forward DTP frames.

When you enter the switchport nonegotiate command, DTP negotiation packets are not sent on the interface. The device does or does not trunk according to the mode parameter given: access or trunk.

If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

To enable trunking on a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

Examples

This example shows how to cause an interface to refrain from negotiating trunking mode and to act as a trunk or access port (depending on the mode set):

Switch(config-if)# switchport nonegotiate

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command
Description

show interfaces switchport

Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.

switchport mode

Configures the VLAN membership mode of a port.


switchport port-security

Use the switchport port-security interface configuration command without keywords to enable port security on an interface. Use the keywords to configure secure MAC addresses, a maximum number of secure MAC addresses, or the violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.

switchport port-security [mac-address mac-address] | [mac-address sticky [mac-address]] | [maximum value] | [violation {protect | restrict | shutdown}]

no switchport port-security [mac-address mac-address] | [mac-address sticky [mac-address]] | [maximum value] | [violation {protect | restrict | shutdown}]

Syntax Description

mac-address mac-address

(Optional) Specify a secure MAC address for the port by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured.

mac-address sticky [mac-address]

(Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses.

Specify a sticky secure MAC address by entering the mac-address sticky mac-address keywords.

Note Although you can specify a sticky secure MAC address by entering the mac-address sticky mac-address keywords, we recommend using the mac-address mac-address interface configuration command to enter static secure MAC addresses.

maximum value

(Optional) Set the maximum number of secure MAC addresses for the interface. The range is from 1 to 132. The default is 1.

violation

(Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.

protect

(Optional) Set the security violation protect mode. When the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred.

restrict

(Optional) Set the security violation restrict mode. When the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. In this mode, you are notified that a security violation has occurred. Specifically, an SNMP trap is sent, a syslog message is logged, and the violation counter increments.

shutdown

(Optional) Set the security violation shutdown mode. In this mode, a port security violation causes the interface to immediately become error-disabled and turns off the port LED. It also sends an SNMP trap, logs a syslog message, and increments the violation counter. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.


Defaults

Port security is disabled.

When port security is enabled, if no keywords are entered, the default maximum number of secure MAC addresses is 1.

Sticky learning is disabled.

The default violation mode is shutdown.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

A secure port can have from 1 to 132 associated secure addresses. The total number of available secure addresses on the switch is 1024.

After you have set the maximum number of secure MAC addresses allowed on a port, you can add secure addresses to the address table by manually configuring them, by allowing the port to dynamically configure them, or by configuring some MAC addresses and allowing the rest to be dynamically configured.

You can delete dynamic secure MAC addresses from the address table by entering the clear port-security dynamic privileged EXEC command.

You can enable sticky learning on an interface by using the switchport port-security mac-address sticky interface configuration command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses. It adds all the sticky secure MAC addresses to the running configuration.

You can delete a sticky secure MAC addresses from the address table by using the clear port-security sticky mac-addr privileged EXEC command. To delete all the sticky addresses on an interface, use the clear port-security sticky interface-id privileged EXEC command.

If you disable sticky learning, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration.

If you save the sticky secure MAC addresses in the configuration file, when the switch restarts or the interface shuts down, the interface does not need to relearn these addresses. If you do not save the configuration, they are lost.

If you specify restrict or shutdown, use the snmp-server host global configuration command to configure the Simple Network Management Protocol (SNMP) trap host to receive traps.

It is a security violation when one of these situations occurs:

The maximum number of secure MAC addresses have been added to the address table, and a station whose MAC address is not in the address table attempts to access the interface.

An address learned or configured on one secure interface is seen on another secure interface in the same VLAN.

When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

A secure port has these limitations:

Port security can only be configured on static access ports.

A secure port cannot be a dynamic port, a dynamic access port or a trunk port.

A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.

You cannot configure static secure or sticky secure MAC addresses on a voice VLAN.

When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to at least two. If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN. You cannot configure port security on a per-VLAN basis.

When a voice VLAN is configured on a secure port that is also configured as a sticky secure port, all addresses detected on the voice VLAN are learned as dynamic secure addresses while all addresses detected on the access VLAN (to which the port belongs) are learned as sticky secure addresses.

To enable port security on an 802.1X port, you must first enable the 802.1X multiple-hosts mode on the port (for switches running the EI software).

The switch does not support port security aging of sticky secure MAC addresses.

Examples

This example shows how to enable port security:

Switch(config-if)# switchport port-security

This example shows how to set the action that the port takes when an address violation occurs:

Switch(config-if)# switchport port-security violation shutdown

This example shows how to set the maximum number of addresses that a port can learn to 20.

Switch(config-if)# switchport port-security maximum 20

This example shows how to enable sticky learning and to enter two sticky secure MAC addresses:

Switch(config-if)# switchport port-security mac-address sticky 
Switch(config-if)# switchport port-security mac-address sticky 0000.0000.4141
Switch(config-if)# switchport port-security mac-address sticky 0000.0000.000f

You can verify your settings by entering the show port-security privileged EXEC command.

Related Commands

Command
Description

clear port-security dynamic

Deletes from the MAC address table a specific dynamic secure address or all the dynamic secure addresses on an interface.

clear port-security sticky

Deletes from the MAC address table a specific sticky secure address, all the sticky secure addresses on an interface, or all the sticky secure addresses on a switch.

show port-security

Displays the port security settings defined for the port.


switchport port-security aging

Use the switchport port-security aging interface configuration command to set the aging time and type for secure address entries or to change the aging behavior for statically configured secure addresses on a particular port. Use the no form of this command to disable port security aging or to set the parameters to their default states.

switchport port-security aging {static | time time | type {absolute | inactivity}}

no switchport port-security aging {static | time | type}

Syntax Description

static

Enable aging for statically configured secure addresses on this port.

time time

Specify the aging time for this port. The valid range is from 0 to 1440
minutes. If the time is 0, aging is disabled for this port.

type absolute

Set the aging type as absolute aging. All the secure addresses on this port age out exactly after the time (minutes) specified and are removed from the secure address list.

type inactivity

Set the aging type as inactivity aging. The secure addresses on this port age out only if there is no data traffic from the secure source address for the specified time period.


Defaults

The port security aging feature is disabled. The default time is 0 minutes.

The default aging type is absolute.

The default static aging behavior is disabled.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

To enable secure address aging for a particular port, set the port aging time to a value other than 0.

To allow limited-time access to particular secure addresses, set the aging type as absolute. When the aging time lapses, the secure addresses are deleted.

To allow continuous access to a limited number of secure addresses, set the aging type as inactivity. This removes the secure address when it becomes inactive, and other addresses can become secure.

To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command.

Examples

This example sets the aging time as 2 hours for absolute aging for all the secure addresses on Fast Ethernet interface 0/1.

Switch(config)# interface fastethernet0/1
Switch(config-if)# switchport port-security aging time 120

This example sets the aging time as 2 minutes for inactivity aging type for configured secure addresses on Fast Ethernet interface 0/2.

Switch(config)# interface fastethernet0/2
Switch(config-if)# switchport port-security aging time 2 
Switch(config-if)# switchport port-security aging type inactivity 
Switch(config-if)# switchport port-security aging static

This example shows how to disable aging for configured secure addresses.

Switch(config-if)# no switchport port-security aging static

Related Commands

Command
Description

show port-security

Displays the port security settings defined for the port.

switchport port-security

Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.


switchport priority extend

Use the switchport priority extend interface configuration command to set a port priority for the incoming untagged frames or the priority of frames received by the IP phone connected to the specified port. Use the no form of this command to return to the default setting.

switchport priority extend {cos value | trust}

no switchport priority extend

Syntax Description

cos value

Set the IP phone port to override the priority received from PC or the attached device.

The class of service (CoS) value is a number from 0 to 7. Seven is the highest priority. The default is 0.

trust

Set the IP phone port to trust the priority received from PC or the attached device.


Defaults

The port priority is not set, and the default value for untagged frames received on the port is 0.

The IP phone connected to the port is set to not trust the priority of incoming traffic and overrides the priority with the CoS value of 0.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

To instruct the IP Phone to not trust the priority, you can use the no switchport priority extend or the switchport priority extend cos 0 interface configuration command.

Examples

This example shows how to configure the IP phone connected to the specified port to trust the received 802.1P priority:

Switch(config-if)# switchport priority extend trust

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command
Description

show interfaces

Displays the administrative and operational status of a switching (nonrouting) port.

switchport voice vlan

Configures the voice VLAN on the port.


switchport protected

Use the switchport protected interface configuration command to isolate unicast, multicast, and broadcast traffic at Layer 2 from other protected ports on the same switch. Use the no form of this command to return to the default setting.

switchport protected

no switchport protected

Syntax Description

This command has no keywords or arguments.

Defaults

No protected port is defined. All ports are nonprotected.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The switchport protection feature is local to the switch; communication between protected ports on the same switch is possible only through a Layer 3 device. To prevent communication between protected ports on different switches, you must configure the protected ports for unique VLANs on each switch and configure a trunk link between the switches. A protected port is different from a secure port.

A protected port does not forward any unicast, multicast, or broadcast traffic to any other protected port. A protected port continues to forward unicast, multicast, and broadcast traffic to unprotected ports and vice versa.

Port monitoring does not work if both the monitor and monitored ports are protected ports.

Examples

This example shows how to enable a protected port on Fast Ethernet interface 0/3:

Switch(config)# interface fastethernet0/3
Switch(config-if)# switchport protected

You can verify your settings by entering the show interfaces switchport privileged EXEC command.

Related Commands

Command
Description

show interfaces switchport

Displays the administrative and operational staus of a switching port.


switchport trunk

Use the switchport trunk interface configuration command to set the trunk characteristics when the interface is in trunking mode. Use the no form of this command to reset all of the trunking characteristics to the defaults. Use the no form with keywords to reset those characteristics to the defaults.

switchport trunk {{allowed vlan vlan-list} | {native vlan vlan-id} | {pruning vlan vlan-list}}

no switchport trunk {{allowed vlan vlan-list} | {native vlan vlan-id} | {pruning vlan vlan-list}}

Syntax Description

allowed vlan vlan-list

Set the list of allowed VLANs that can receive and send traffic on this interface in tagged format when in trunking mode. See the following vlan-list format. The none keyword is not valid. The default is all.

native vlan vlan-id

Set the native VLAN for sending and receiving untagged traffic when the interface is in 802.1Q trunking mode. Valid IDs are from 1 to 1001.

pruning vlan vlan-list

Set the list of VLANs that are enabled for VTP pruning when in trunking mode. The all keyword is not valid.


The vlan-list format is all | none | [add | remove | except] vlan-atom where:

all specifies all VLANs from 1 to 1005. This keyword is not allowed on commands that do not permit all VLANs in the list to be set at the same time.

none means an empty list. This keyword is not allowed on commands that require certain VLANs to be set or at least one VLAN to be set.

add adds the defined list of VLANs to those currently set instead of replacing the list. Valid IDs are from 2 to 1001.

Separate nonconsecutive VLAN IDs with a comma; do not enter a space after the comma. Use a hyphen to designate a range of IDs; do not enter a space before or after the hyphen.

remove removes the defined list of VLANs from those currently set instead of replacing the list. Valid IDs are from 2 to 1001.


Note You cannot remove VLAN 1 or VLANs 1002 to 1005 from the list.


Separate nonconsecutive VLAN IDs with a comma; do not enter a space after the comma. Use a hyphen to designate a range of IDs; do not enter a space before or after the hyphen.

except lists the VLANs that should be calculated by inverting the defined list of VLANs. (VLANs are added except the ones specified.) Valid IDs are from 2 to 1001. Separate nonconsecutive VLAN IDs with a comma; do not enter a space after the comma. Use a hyphen to designate a range of IDs; do not enter a space before or after the hyphen.

vlan-atom is either a single VLAN number from 1 to 1005, a list of nonconsecutive VLANs, or a continuous range of VLANs described by two VLAN numbers, the lower one first, separated by a hyphen.

For a list of nonconsecutive VLAN IDs, separate the VLAN IDs with a comma. Do not enter a space after the comma.

For a continuous range of VLAN IDs, use a hyphen to designate the range. Do not enter a space before or after the hyphen.

These are examples showing how to specify one or more VLANs:

Single VLAN—101

List of nonconsecutive VLANs—10,12,14,16,18

Continuous range of VLANs—10-15

List of VLAN continuous ranges—10-15,20-24

List of nonconsecutive VLANs and VLAN continuous ranges—8,11,20-24,44

Defaults

VLAN 1 is the default native VLAN ID on the port.

The default for all VLAN lists is to include all VLANs.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

A trunk port cannot be a secure port or a monitor port. However, a static-access port can monitor a VLAN on a trunk port. The VLAN monitored is the one associated with the static-access port.

Allowed VLAN:

The no form of the allowed vlan command resets the list to the default list, which allows all VLANs.

You cannot remove VLAN 1 or VLANs 1002 to 1005 from the allowed VLAN list.

Native VLANs:

All untagged traffic received on an 802.1Q trunk port is forwarded with the native VLAN configured for the port.

If a packet has a VLAN ID that is the same as the sending port native VLAN ID, the packet is sent without a tag; otherwise, the switch sends the packet with a tag.

The no form of the native vlan command resets the native mode VLAN to the appropriate default VLAN for the device.

Trunk Pruning:

The pruning-eligible list applies only to trunk ports.

Each trunk port has its own eligibility list.

If you do not want a VLAN to be pruned, remove it from the pruning-eligible list. VLANs that are pruning-ineligible receive flooded traffic.

VLAN 1 and VLANs 1002 to 1005 cannot be pruned.


Note The switch does not support Inter-Switch Link (ISL) trunking.


Examples

This example shows how to configure VLAN 3 as the default port to send all untagged traffic:

Switch(config-if)# switchport trunk native vlan 3

This example shows how to add VLANs 1, 2, 5, and 6 to the allowed list:

Switch(config-if)# switchport trunk allowed vlan add 1,2,5,6

This example shows how to remove VLANs 3 and 10 to 15 from the pruning-eligible list:

Switch(config-if)# switchport trunk pruning vlan remove 3,10-15

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command
Description

show interfaces switchport

Displays the administrative and operational status of a switching (nonrouting) port.

switchport mode

Configures the VLAN membership mode of a port.


switchport voice vlan

Use the switchport voice vlan interface configuration command to configure voice VLAN on the port. Use the no form of this command to return to the default setting.

switchport voice vlan {vlan-id | dot1p | none | untagged}

no switchport voice vlan

Syntax Description

vlan-id

VLAN used for voice traffic. Valid IDs are from 1 to 1001.

dot1p

The telephone uses priority tagging and uses VLAN 0 (the native VLAN). By default, the Cisco IP phone forwards the voice traffic with an 802.1P priority of 5.

none

The telephone is not instructed through the command-line interface (CLI) about the voice VLAN. The telephone uses the configuration from the telephone key pad.

untagged

The telephone does not tag frames and uses VLAN 4095. The default for the telephone is untagged.


Defaults

The switch default is not to automatically configure the telephone (none).

The telephone default is not to tag frames.

Command Modes

Interface configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

You should configure voice VLAN on access ports.

If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you should set the maximum allowed secure addresses on the port to more than 1.

You cannot configure static secure MAC addresses in the voice VLAN.

The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled.

Examples

This example shows how to configure VLAN 2 as the voice VLAN:

Switch(config-if)# switchport voice vlan 2

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command
Description

show interfaces interface-id switchport

Displays the administrative and operational status of a switching (nonrouting) port.

switchport priority extend

Determines how the device connected to the specified port handles priority traffic received on its incoming port.


system mtu

Use the system mtu global configuration command to set the maximum packet size or maximum transmission unit (MTU) size for the switch. Use the no form of this command to restore the global MTU value to its original default value.

system mtu bytes

no system mtu

Syntax Description

bytes

Packet size in bytes. For valid values, see the "Usage Guidelines" section.


Defaults

The default MTU size is 1500 bytes.

Command Modes

Global configuration

Command History

Release
Modification

12.1(13)AY

This command was first introduced.


Usage Guidelines

The size of frames that can be received by the switch CPU is limited to 1500 bytes, no matter what value was entered with the system mtu command. Although frames that are forwarded or routed typically are not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control traffic, Simple Network Management Protocol (SNMP), Telnet, or routing protocols.

If you enter a value that is outside of the range for the switch, the value is not accepted.


Note You cannot set the MTU on a per-interface basis.


Examples

This example shows how to set the maximum packet size to 1500 bytes:

Switch(config)# system mtu 1500
Switch(config)# exit

This example shows the response when you try to set a switch to an out-of-range number:

Switch(config)# system mtu 2000
                                ^
% Invalid input detected at '^' marker.

You can verify your settings by entering the show system mtu privileged EXEC command.

Related Commands

Command
Description

show system mtu

Displays the maximum packet size set for the switch.