Table Of Contents
debug ip rtp header-compression
debug ip drp
Use the debug ip drp EXEC command to display Director Response Protocol (DRP) information. The no form of this command disables debugging output.
[no] debug ip drp
Usage Guidelines
The debug ip drp command is used to debug the director response agent used by the Distributed Director product. The Distributed Director can be used to dynamically respond to Domain Name System (DNS) queries with the IP address of the "best" host based on various criteria.
Sample Display
shows sample debug ip drp output. This example shows the packet origination, the IP address that information is routed to, and the route metrics that were returned.
Figure 2-92 Sample Debug IP DRP Output
Router# debug ip drpDRP: received v1 packet from 172.31.232.8, via Ethernet0DRP: RTQUERY for 172.31.58.94 returned internal=0, external=0describes the fields shown in .
debug ip dvmrp
Use the debug ip dvmrp EXEC command to display information on Distance Vector Multiprotocol Routing Protocol (DVMRP) packets received and transmitted. The no form of this command disables debugging output.
[no] debug ip dvmrp [detail [access-list] [in | out]]
Syntax Description
Usage Guidelines
Use the debug ip dvmrp detail command with care. This command generates a great deal of output and can interrupt other activity on the router when it is invoked.
Sample Displays
shows sample debug ip dvmrp output.
Figure 2-93 Sample Debug IP DVMRP Output
Router# debug ip dvmrpDVMRP: Received Report on Ethernet0 from 172.19.244.10DVMRP: Received Report on Ethernet0 from 172.19.244.11DVMRP: Building Report for Ethernet0 224.0.0.4DVMRP: Send Report on Ethernet0 to 224.0.0.4DVMRP: Sending IGMP Reports for known groups on Ethernet0DVMRP: Received Report on Ethernet0 from 172.19.244.10DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Building Report for Tunnel0 224.0.0.4DVMRP: Send Report on Tunnel0 to 192.168.199.254DVMRP: Send Report on Tunnel0 to 192.168.199.254DVMRP: Send Report on Tunnel0 to 192.168.199.254DVMRP: Send Report on Tunnel0 to 192.168.199.254DVMRP: Radix tree walk suspensionDVMRP: Send Report on Tunnel0 to 192.168.199.254Explanations for individual lines of output from follow.
The following lines show that the router received DVMRP routing information and placed it in the mroute table:
DVMRP: Received Report on Ethernet0 from 172.19.244.10DVMRP: Received Report on Ethernet0 from 172.19.244.11The following lines show that the router is creating a report to send to another DVMRP router:
DVMRP: Building Report for Ethernet0 224.0.0.4DVMRP: Send Report on Ethernet0 to 224.0.0.4provides a list of internet multicast addresses supported for host IP implementations.
The following lines show that a protocol update report has been sent to all known multicast groups. Hosts use IGMP reports to communicate with routers and to request to join a multicast group. In this case, the router is sending an IGMP report for every known group to the host, which is running mrouted. The host the responds as though the router was a host on the LAN segment that wants to receive multicast packets for the group.
DVMRP: Sending IGMP Reports for known groups on Ethernet0shows sample debug ip dvmrp detail output.
Figure 2-94 Sample Debug IP DVMRP Detail Output
Router# debug ip dvmrp detailDVMRP: Sending IGMP Reports for known groups on Ethernet0DVMRP: Advertise group 224.2.224.2 on Ethernet0DVMRP: Advertise group 224.2.193.34 on Ethernet0DVMRP: Advertise group 224.2.231.6 on Ethernet0DVMRP: Received Report on Tunnel0 from 192.168.199.254DVMRP: Origin 150.166.53.0/24, metric 13, distance 0DVMRP: Origin 150.166.54.0/24, metric 13, distance 0DVMRP: Origin 150.166.55.0/24, metric 13, distance 0DVMRP: Origin 150.166.56.0/24, metric 13, distance 0DVMRP: Origin 150.166.92.0/24, metric 12, distance 0DVMRP: Origin 150.166.100.0/24, metric 12, distance 0DVMRP: Origin 150.166.101.0/24, metric 12, distance 0DVMRP: Origin 150.166.142.0/24, metric 8, distance 0DVMRP: Origin 150.166.200.0/24, metric 12, distance 0DVMRP: Origin 150.166.237.0/24, metric 12, distance 0DVMRP: Origin 150.203.5.0/24, metric 8, distance 0Explanations for individual lines of output from follow.
The following lines show that this group is available to the DVMRP router. The mrouted process on the host will forward the source and multicast information for this group through the DVMRP cloud to other members.
DVMRP: Advertise group 224.2.224.2 on Ethernet0The following lines show the DVMRP route information:
DVMRP: Origin 150.166.53.0/24, metric 13, distance 0DVMRP: Origin 150.166.54.0/24, metric 13, distance 0The metric is the number of hops the route has covered, and the distance is the administrative distance.
debug ip eigrp
Use the debug ip eigrp EXEC command to display information on Enhanced IGRP protocol packets. The no form of this command disables debugging output.
[no] debug ip eigrp
Usage Guidelines
This command helps you analyze the packets that are sent and received on an interface. Because the debug ip eigrp command generates large amounts of output, only use it when traffic on the network is light.
Sample Display
shows sample debug ip eigrp output.
Figure 2-95 Sample Debug IP EIGRP Output
Router# debug ip eigrpIP-EIGRP: Processing incoming UPDATE packetIP-EIGRP: Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960IP-EIGRP: Ext 192.168.0.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960IP-EIGRP: Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960IP-EIGRP: 172.24.43.0 255.255.255.0, - do advertise out Ethernet0/1IP-EIGRP: Ext 172.24.43.0 255.255.255.0 metric 371200 - 256000 115200IP-EIGRP: 192.135.246.0 255.255.255.0, - do advertise out Ethernet0/1IP-EIGRP: Ext 192.135.246.0 255.255.255.0 metric 46310656 - 45714176 596480IP-EIGRP: 172.24.40.0 255.255.255.0, - do advertise out Ethernet0/1IP-EIGRP: Ext 172.24.40.0 255.255.255.0 metric 2272256 - 1657856 614400IP-EIGRP: 192.135.245.0 255.255.255.0, - do advertise out Ethernet0/1IP-EIGRP: Ext 192.135.245.0 255.255.255.0 metric 40622080 - 40000000 622080IP-EIGRP: 192.135.244.0 255.255.255.0, - do advertise out Ethernet0/1describes significant fields in the debug messages shown in .
debug ip ftp
To activate the debugging option to track the transactions submitted during an FTP session, use the debug ip ftp privileged EXEC command. To disable debugging output, use the no form of this command.
[no] debug ip ftp
Usage Guidelines
The debug ip ftp command is useful for debugging problems associated with File Transfer Protocol (FTP).
Sample Display
The following is an example of the debug ip ftp command:
Router# debug ip ftpFTP transactions debugging is onThe following is sample output from the debug ip ftp command:
FTP: 220 ProFTPD 1.2.0pre8 Server (DFW Nostrum FTP Server) [defiant.dfw.nostrum.com]Dec 27 22:12:09.133: FTP: ---> USER routerDec 27 22:12:09.133: FTP: 331 Password required for router.Dec 27 22:12:09.137: FTP: ---> PASS WQHK5JY2Dec 27 22:12:09.153: FTP: 230 Anonymous access granted, restrictions apply.Dec 27 22:12:09.153: FTP: ---> TYPE IDec 27 22:12:09.157: FTP: 200 Type set to I.Dec 27 22:12:09.157: FTP: ---> PASV..............Dec 27 22:12:09.173: FTP: ---> QUITDec 27 22:12:09.181: FTP: 221 Goodbye.DRP: RTQUERY for 172.31.58.94 returned internal=0, external=0debug ip http authentication
Use the debug ip http authentication privileged EXEC command to troubleshoot HTTP authentication problems. This command displays the authentication method the router attempted and authentication-specific status messages. The no form of this command disables debugging output.
[no] debug ip http authentication
Sample Display
shows sample debug ip http authentication output.
Figure 2-96 Sample Debug IP HTTP Authentication Output
Router# debug ip http authenticationAuthentication for url `/' `/' level 15 privless `/'Authentication username = `local15' priv-level = 15 auth-type = localdescribes the output fields created by the debug ip http authentication command.
Table 2-52 Debug IP HTTP Authentication Descriptions
debug ip http ezsetup
Use the debug ip http ezsetup EXEC command to display the configuration changes that occur during the EZ Setup process. The no form of this command disables debugging output.
[no] debug ip http ezsetup
Usage Guidelines
Use the debug ip http ezsetup command to verify the EZ Setup actions without changing the router's configuration.
EZ Setup is a form you fill out to perform basic router configuration from most Hypertext Markup Language (HTML) browsers.
Sample Display
shows sample debug ip http ezsetup output. This example shows the configuration changes for the router when the EZ Setup form has been submitted.
Figure 2-97 Sample Debug IP HTTP EZ Setup Output
Router# debug ip http ezsetupservice timestamps debugservice timestamps logservice password-encryption!hostname router-name!enable secret router-pwline vty 0 4password router-pw!interface ethernet 0ip address 172.21.52.9 255.255.255.0no shutdownip helper-address 172.31.2.132ip name-server 172.31.2.132isdn switch-type basic-5essusername Remote-name password Remote-chapinterface bri 0ip unnumbered ethernet 0encapsulation pppno shutdowndialer map ip 192.168.254.254 speed 56 name Remote-name Remote-numberisdn spid1 spid1isdn spid2 spid2ppp authentication chap callindialer-group 1!ip classlessaccess-list 101 deny udp any any eq snmpaccess-list 101 deny udp any any eq ntpaccess-list 101 permit ip any anydialer-list 1 list 101ip route 0.0.0.0 0.0.0.0 192.168.254.254ip route 192.168.254.254 255.255.255.255 bri 0logging bufferedsnmp-server community public ROip http serverip classlessip subnet-zero!endRelated Commands
debug ip http token
debug ip http transaction
debug ip http urldebug ip http ssi
Use the debug ip http ssi EXEC command to display information about the HTML SSI EXEC command or HTML SSI ECHO command. The no form of this command disables debugging output.
[no] debug ip http ssi
Sample Display
shows sample debug ip http ssi command output.
Figure 2-98 Sample Debug IP HTTP SSI Output
Router# debug ip http ssiHTML: filtered command `exec cmd="show users"'HTML: SSI command `exec'HTML: SSI tag `cmd' = "show users"HTML: Executing CLI `show users' in mode `exec' doneExplanations for individual lines of output from follow.
The following line shows the contents of the Server Side Include (SSI) EXEC command:
HTML: filtered command `exec cmd="show users"'The following line indicates the type of SSI command that was requested:
HTML: SSI command `exec'The following line shows the argument "show users" assigned to the tag `cmd':
HTML: SSI tag 'cmd' = "show users"The following line indicates that the Cisco IOS show users command is being executed in EXEC mode:
HTML: Executing CLI `show users' in mode `exec' donedebug ip http token
Use the debug ip http token EXEC command to display individual tokens parsed by the Hypertext Transfer Protocol (HTTP) server. The no form of this command disables debugging output.
[no] debug ip http token
Usage Guidelines
Use the debug ip http token command to display what the HTTP server is parsing at a low level. To display what the HTTP server is parsing at a high level, use the debug ip http transaction command.
Sample Display
shows a partial sample of debug ip http token output. In this example, the browser accessed the router's home page http://router-name/. The output gives the token parsed by the HTTP server and its length.
Figure 2-99 Sample Debug IP HTTP Token Output
Router# debug ip http tokenHTTP: token len 3: 'GET'HTTP: token len 1: ' 'HTTP: token len 1: '/'HTTP: token len 1: ' 'HTTP: token len 4: 'HTTP'HTTP: token len 1: '/'HTTP: token len 1: '1'HTTP: token len 1: '.'HTTP: token len 1: '0'HTTP: token len 2: '\15\12'HTTP: token len 7: 'Referer'HTTP: token len 1: ':'HTTP: token len 1: ' 'HTTP: token len 4: 'http'HTTP: token len 1: ':'HTTP: token len 1: '/'HTTP: token len 1: '/'HTTP: token len 3: 'www'HTTP: token len 1: '.'HTTP: token len 3: 'foo'HTTP: token len 1: '.'HTTP: token len 3: 'com'HTTP: token len 1: '/'HTTP: token len 2: '\15\12'HTTP: token len 10: 'Connection'HTTP: token len 1: ':'HTTP: token len 1: ' 'HTTP: token len 4: 'Keep'HTTP: token len 1: '-'HTTP: token len 5: 'Alive'HTTP: token len 2: '\15\12'HTTP: token len 4: 'User'HTTP: token len 1: '-'HTTP: token len 5: 'Agent'HTTP: token len 1: ':'HTTP: token len 1: ' 'HTTP: token len 7: 'Mozilla'HTTP: token len 1: '/'HTTP: token len 1: '2'HTTP: token len 1: '.'...Related Commands
debug ip http ezsetup
debug ip http transaction
debug ip http urldebug ip http transaction
Use the debug ip http transaction EXEC command to display Hypertext Transfer Protocol (HTTP) server transaction processing. The no form of this command disables debugging output.
[no] debug ip http transaction
Usage Guidelines
Use the debug ip http transaction command to display what the HTTP server is parsing at a high level. To display what the HTTP server is parsing at a low level, use the debug ip http token command.
Sample Display
shows sample debug ip http transaction output. In this example, the browser accessed the router's home page http://router-name/.
Figure 2-100 Sample Debug IP HTTP Transaction Output
Router# debug ip http transactionHTTP: parsed uri '/'HTTP: client version 1.0HTTP: parsed extension RefererHTTP: parsed line http://www.foo.com/HTTP: parsed extension ConnectionHTTP: parsed line Keep-AliveHTTP: parsed extension User-AgentHTTP: parsed line Mozilla/2.01 (X11; I; FreeBSD 2.1.0-RELEASE i386)HTTP: parsed extension HostHTTP: parsed line router-nameHTTP: parsed extension AcceptHTTP: parsed line image/gif, image/x-xbitmap, image/jpeg, image/HTTP: parsed extension AuthorizationHTTP: parsed authorization type BasicHTTP: received GET ''lists describes some of the fields in .
Related Commands
debug ip http ezsetup
debug ip http token
debug ip http urldebug ip http url
Use the debug ip http url EXEC command to show the uniform resource locators (URLs) accessed from the router. The no form of this command disables debugging output.
[no] debug ip http url
Usage Guidelines
Use the debug ip http url command to keep track of the URLs that are accessed and to determine from which hosts the URLs are accessed.
Sample Display
shows a partial sample of debug ip http url output. In this example, the HTTP server accessed the URLs / and /exec. The output shows the URL being requested and the IP address of the host requesting the URL.
Figure 2-101 Sample Debug IP HTTP URL Output
Router# debug ip http urlHTTP: processing URL '/' from host 172.31.2.141HTTP: processing URL '/exec' from host 172.31.2.141Related Commands
debug ip http ezsetup
debug ip http token
debug ip http transactiondebug ip icmp
Use the debug ip icmp EXEC command to display information on Internal Control Message Protocol (ICMP) transactions. The no form of this command disables debugging output.
[no] debug ip icmp
Usage Guidelines
This command helps you determine whether the router is sending or receiving ICMP messages. Use it, for example, when you are troubleshooting an end-to-end connection problem.
Note
For more information about the fields in debug ip icmp output, see RFC-792, "Internet Control Message Protocol"; Appendix I of RFC-950, "Internet Standard Subnetting Procedure"; and RFC-1256, "ICMP Router Discovery Messages."
Sample Display
shows sample debug ip icmp output.
Figure 2-102 Sample Debug IP ICMP Output
Router# debug ip icmpICMP: rcvd type 3, code 1, from 10.95.192.4ICMP: src 10.56.0.202, dst 172.16.16.1, echo replyICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15ICMP: src 172.16.12.35, dst 172.16.20.7, echo replyICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15ICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15ICMP: src 10.56.0.202, dst 172.16.16.1, echo replyICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15ICMP: dst (255.255.255.255) protocol unreachable rcv from 10.31.7.21ICMP: dst (10.120.1.0) port unreachable rcv from 10.120.1.15describes significant fields in the first line of debug ip icmp output shown in .
describes significant fields in the second line of debug ip icmp output in .
Other messages that the debug ip icmp command can generate follow.
When an IP router or host sends out an ICMP mask request, the following message is generated when the router sends a mask reply:
ICMP: sending mask reply (255.255.255.0) to 172.21.80.23 via Ethernet0The following two lines are examples of the two forms of this message. The first form is generated when a mask reply comes in after the router sends out a mask request. The second form occurs when the router receives a mask reply with a nonmatching sequence and ID. See Appendix I of RFC 950, "Internet Standard Subnetting Procedures," for details.
ICMP: mask reply 255.255.255.0 from 172.21.80.31ICMP: unexpected mask reply 255.255.255.0 from 172.21.80.32The following output indicates that the router sent a redirect packet to the host at address 172.21.80.31, instructing that host to use the gateway at address 172.21.80.23 in order to reach the host at destination address 172.16.1.111:
ICMP: redirect sent to 172.21.80.31 for dest 172.16.1.111 use gw 172.21.80.23The following message indicates that the router received a redirect packet from the host at address 172.21.80.23, instructing the router to use the gateway at address 172.21.80.28 in order to reach the host at destination address 172.21.81.34:
ICMP: redirect rcvd from 172.21.80.23 -- for 172.21.81.34 use gw 172.21.80.28The following message is displayed when the router sends an ICMP packet to the source address (172.21.94.31 in this case), indicating that the destination address (172.16.13.33 in this case) is unreachable:
ICMP: dst (172.16.13.33) host unreachable sent to 172.21.94.31The following message is displayed when the router receives an ICMP packet from an intermediate address (172.21.98.32 in this case), indicating that the destination address (172.16.13.33 in this case) is unreachable:
ICMP: dst (172.16.13.33) host unreachable rcv from 172.21.98.32Depending on the code received (as describes), any of the unreachable messages can have any of the following "strings" instead of the "host" string in the message:
netprotocolportfrag. needed and DF setsource route failedprohibitedThe following message is displayed when the TTL in the IP header reaches zero and a time exceed ICMP message is sent. The fields are self-explanatory.
ICMP: time exceeded (time to live) send to 10.95.1.4 (dest was 172.16.1.111)The following message is generated when parameters in the IP header are corrupted in some way and the parameter problem ICMP message is sent. The fields are self-explanatory.
ICMP: parameter problem sent to 128.121.1.50 (dest was 172.16.1.111)Based on the preceding information, the remaining output can be easily understood.
ICMP: parameter problem rcvd 172.21.80.32ICMP: source quench rcvd 172.21.80.32ICMP: source quench sent to 128.121.1.50 (dest was 172.16.1.111)ICMP: sending time stamp reply to 172.21.80.45ICMP: sending info reply to 172.21.80.12ICMP: rdp advert rcvd type 9, code 0, from 172.21.80.23ICMP: rdp solicit rcvd type 10, code 0, from 172.21.80.43debug ip igmp
Use the debug ip igmp EXEC command to display Internet Group Management Protocol (IGMP) packets received and transmitted, as well as IGMP-host related events. The no form of this command disables debugging output.
[no] debug ip igmp
Usage Guidelines
This command helps discover whether the IGMP processes are functioning. In general, if IGMP is not working, the router process never discovers that there is another host on the network that is configured to receive multicast packets. In dense mode this means the packets will be delivered intermittently (a few every 3 minutes). In sparse mode they will never be delivered.
Use this command in conjunction with debug ip pim and debug ip mrouting to observe additional multicast activity and to see what is happening to the multicast routing process, or why packets are forwarded out of particular interfaces.
Sample Display
shows sample debug ip igmp output.
Figure 2-103 Sample Debug IP IGMP Output
Router# debug ip igmpIGMP: Received Host-Query from 172.24.37.33 (Ethernet1)IGMP: Received Host-Report from 172.24.37.192 (Ethernet1) for 224.0.255.1IGMP: Received Host-Report from 172.24.37.57 (Ethernet1) for 224.2.127.255IGMP: Received Host-Report from 172.24.37.33 (Ethernet1) for 225.2.2.2The messages displayed by the debug ip igmp command show query and report activity received from other routers and multicast group addresses.
Related Commands
debug ip igrp events
Use the debug ip igrp events EXEC command to display summary information on Interior Gateway Routing Protocol (IGRP) routing messages that indicates the source and destination of each update, as well as the number of routes in each update. Messages are not generated for each route. The no form of this command disables debugging output.
[no] debug ip igrp events [ip-address]
Syntax Description
Usage Guidelines
If the IP address of an IGRP neighbor is specified, the resulting debug ip igrp events output includes messages describing updates from that neighbor and updates that the router broadcasts toward that neighbor.
This command is particularly useful when there are many networks in your routing table. In this case, using debug ip igrp transactions could flood the console and make the router unusable. Use debug ip igrp events instead to display summary routing information.
Sample Display
shows sample debug ip igrp events output.
Figure 2-104 Sample Debug IP IGRP Events Output
shows that the router has sent two updates to the broadcast address 255.255.255.255. The router also received two updates. Three lines of output describe each of these updates.
The first line indicates whether the router sent or received the update packet, the source or destination address, and the interface through which the update was sent or received. If the update was sent, the IP address assigned to this interface is shown (in parentheses).
IGRP: sending update to 255.255.255.255 via Ethernet1 (160.89.33.8)The second line summarizes the number and types of routes described in the update:
IGRP: Update contains 26 interior, 40 system, and 3 exterior routes.The third line indicates the total number of routes described in the update:
IGRP: Total routes in update: 69debug ip igrp transactions
Use the debug ip igrp transactions EXEC command to display transaction information on Interior Gateway Routing Protocol (IGRP) routing transactions. The no form of this command disables debugging output.
[no] debug ip igrp transactions [ip-address]
Syntax Description
Usage Guidelines
If the IP address of an IGRP neighbor is specified, the resulting debug ip igrp transactions output includes messages describing updates from that neighbor and updates that the router broadcasts toward that neighbor.
When there are many networks in your routing table, debug ip igrp transactions can flood the console and make the router unusable. In this case, use debug ip igrp events instead to display summary routing information.
Sample Display
shows sample debug ip igrp transactions output.
Figure 2-105 Sample Debug IP IGRP Transactions Output
shows that the router being debugged has received updates from two other routers on the network. The router at source address 160.89.80.240 sent information about ten destinations in the update; the router at source address 160.89.80.28 sent information about three destinations in its update. The router being debugged also sent updates—in both cases to the broadcast address 255.255.255.255 as the destination address.
The first line in is self-explanatory.
On the second line in , the first field refers to the type of destination information: "subnet" (interior), "network" (system), or "exterior" (exterior). The second field is the Internet address of the destination network. The third field is the metric stored in the routing table and the metric advertised by the neighbor sending the information. "Metric... inaccessible" usually means that the neighbor router has put the destination in holddown.
The entries in show that the router is sending updates that are similar, except that the numbers in parentheses are the source addresses used in the IP header. A metric of 16777215 is inaccessible.
Other examples of output that the debug ip igrp transactions command can produce follow.
The following entry indicates that the routing table was updated and shows the new edition number (97 in this case) to be used in the next IGRP update:
IGRP: edition is now 97Entries such as the following occur on startup or when some event occurs such as an interface transitioning or a user manually clearing the routing table:
IGRP: broadcasting request on Ethernet0IGRP: broadcasting request on Ethernet1The following type of entry can result when routing updates become corrupted between sending and receiving routers:
IGRP: bad checksum from 172.21.64.43An entry such as the following should never appear. If it does, the receiving router has a bug in the software or a problem with the hardware. In either case, contact your technical support representative.
IGRP: system 45 from 172.21.64.234, should be system 109debug ip mcache
Use the debug ip mcache command to display IP multicast fast-switching events. The no form of this command disables debugging output.
[no] debug ip mcache [name | address]
Syntax Description
Usage Guidelines
Use this command when multicast fast-switching appears not to be functioning.
Sample Display
shows sample debug ip mcache output when an IP multicast route is cleared.
Figure 2-106 Sample Debug IP Mcache Output
Router# debug ip mcacheIP multicast fast-switching debugging is onRouter#clear ip mroute *MRC: Build MAC header for (172.31.60.185/32, 224.2.231.173), Ethernet0MRC: Fast-switch flag for (172.31.60.185/32, 224.2.231.173), off -> on, caller ip_mroute_replicate-1MRC: Build MAC header for (172.31.191.10/32, 224.2.127.255), Ethernet0MRC: Build MAC header for (172.31.60.152/32, 224.2.231.173), Ethernet0provides explanations for representative lines of the debug ip mcache output shown in .
Related Commands
debug ip dvmrp
debug ip igmp
debug ip igrp transactions
debug ip mrouting
debug ip sddebug ip mpacket
Use the debug ip mpacket EXEC command to display IP multicast packets received and transmitted.The no form of this command disables debugging output.
[no] debug ip mpacket [detail] [access-list] [group]
Syntax Description
Usage Guidelines
This command displays information for multicast IP packets that are forwarded from this router. By using the access-list or group argument, you can limit the display to multicast packets from sources described by the access list or a specific multicast group.
Use this command with debug ip packet to observe additional packet information.
Note
Sample Display
shows sample debug ip mpacket output.
Figure 2-107 Sample Debug IP Mpacket Output
Router# debug ip mpacket 224.2.0.1IP: s=10.188.34.54 (Ethernet1), d=224.2.0.1 (Tunnel0), len 88, mforwardIP: s=10.188.34.54 (Ethernet1), d=224.2.0.1 (Tunnel0), len 88, mforwardIP: s=10.188.34.54 (Ethernet1), d=224.2.0.1 (Tunnel0), len 88, mforwardIP: s=10.162.3.27 (Ethernet1), d=224.2.0.1 (Tunnel0), len 68, mforward
Related Commands
debug ip dvmrp
debug ip igmp
debug ip mrouting
debug ip packet
debug ip sddebug ip mrouting
Use the debug ip mrouting EXEC command to display changes to the IP multicast routing table. The no form of this command disables debugging output.
[no] debug ip mrouting [group]
Syntax Description
Usage Guidelines
This command tells when the router has made changes to the mroute table. Use the debug ip pim and debug ip mrouting commands at the same time to obtain additional multicast routing information. In addition, use the debug ip igmp command to see why an mroute message is being displayed.
This command generates a large amount of output. Use the optional group to limit the output to a single multicast group.
Sample Display
shows sample debug ip mrouting output.
Figure 2-108 Sample Debug IP Mrouting Output
Router# debug ip mrouting 224.2.0.1MRT: Delete (10.0.0.0/8, 224.2.0.1)MRT: Delete (10.4.0.0/16, 224.2.0.1)MRT: Delete (10.6.0.0/16, 224.2.0.1)MRT: Delete (10.9.0.0/16, 224.2.0.1)MRT: Delete (10.16.0.0/16, 224.2.0.1)MRT: Create (*, 224.2.0.1), if_input NULLMRT: Create (172.24.15.0/24, 225.2.2.4), if_input Ethernet0, RPF nbr 172.16.61.15MRT: Create (172.24.39.0/24, 225.2.2.4), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.0.0.0/8, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.4.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.6.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.9.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.16.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0Explanations for individual lines of output from follow.
The following lines show that multicast IP routes were deleted from the routing table:
MRT: Delete (10.0.0.0/8, 224.2.0.1)MRT: Delete (10.4.0.0/16, 224.2.0.1)MRT: Delete (10.6.0.0/16, 224.2.0.1)The *,G entry in the following line is always null since it is a *,G. The *,G entries are generally created by receipt of an IGMP host-report from a group member on the directly connected LAN or by a PIM join message (in sparse mode) which this router receives from a router that is sending joins toward the RP. This router will in turn, send a join toward the RP which creates the shared tree (or RP tree).
MRT: Create (*, 224.2.0.1), if_input NULLThe following lines are an example of creating an S,G entry that show a mpacket was received on E0. The second line shows a route being created for a source that is on a directly connected LAN. The RPF means "reverse path forwarding," whereby the router looks up the source address of the multicast packet in the unicast routing table and asks which interface will be used to send a packet to that source.
MRT: Create (172.24.15.0/24, 225.2.2.4), if_input Ethernet0, RPF nbr 172.16.61.15MRT: Create (172.24.39.0/24, 225.2.2.4), if_input Ethernet1, RPF nbr 0.0.0.0The following lines show that multicast IP routes were added to the routing table. Note the 0.0.0.0 as the RPF, which means the route was created by a source that is directly connected to this router.
MRT: Create (10.9.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0MRT: Create (10.16.0.0/16, 224.2.0.1), if_input Ethernet1, RPF nbr 0.0.0.0If the source is not directly connected, the nbr address shown in these lines will be the address of the router that forwarded the packet to this router.
The shortest path tree state maintained in routers consists of source (S), multicast address (G), outgoing interface (OIF), and incoming interface (IIF). The forwarding information is referred to as the multicast forwarding entry for (S,G).
An entry for a shared tree can match packets from any source for its associated group if the packets come through the proper incoming interface as determined by the RPF lookup. Such an entry is denoted as (*,G). A (*,G) entry keeps the same information a (S,G) entry keeps, except that it saves the rendezvous point (RP) address in place of the source address in sparse mode or 0.0.0.0 in dense mode.
Related Commands
debug ip dvmrp
debug ip igmp
debug ip pim
debug ip packet
debug ip sddebug ip nat
Use the debug ip nat EXEC command to display information about IP packets translated by the IP network address translation (NAT) feature. The no form of this command disables debugging output.
[no] debug ip nat [access-list | detailed]
Syntax Description
Usage Guidelines
The NAT feature reduces the need for unique, registered IP addresses. It can also save private network administrators from having to renumber hosts and routers that do not conform to global IP addressing.
Use the debug ip nat command to verify the operation of the NAT feature by displaying information about every packet that is translated by the router. The debug ip nat detailed command generates a description of each packet considered for translation. This command also outputs information about certain errors or exceptional conditions, such as the failure to allocate a global address.
CautionBecause the debug ip nat command generates a significant amount of output, use it only when traffic on the IP network is low, so other activity on the system is not adversely affected.
Sample Displays
shows sample debug ip nat output. In this example, the first two lines show the debugging output that a Domain Name System (DNS) request and reply produced. The remaining lines show the debugging output from a Telnet connection from a host on the inside of the network to a host on the outside of the network. All Telnet packets, except for the first packet, were translated in the fast path, as indicated by the asterisk (*).
Figure 2-109 Sample Debug IP NAT Output
Router# debug ip natNAT: s=192.168.1.95->172.31.233.209, d=172.31.2.132 [6825]NAT: s=172.31.2.132, d=172.31.233.209->192.168.1.95 [21852]NAT: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6826]NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23311]NAT*: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6827]NAT*: s=192.168.1.95->172.31.233.209, d=172.31.1.161 [6828]NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23313]NAT*: s=172.31.1.161, d=172.31.233.209->192.168.1.95 [23325]describes the fields and messages shown in .
shows sample debug ip nat detailed output. In this example, the first two lines show the debugging output that a Domain Name System (DNS) request and reply produced. The remaining lines show the debugging output from a Telnet connection from a host on the inside of the network to a host on the outside of the network. In this example, the inside host 192.168.1.95 was assigned the global address 172.31.233.193.
Figure 2-110 Sample Debug IP NAT Detailed Output
Router# debug ip nat detailedNAT: i: udp (192.168.1.95, 1493) -> (172.31.2.132, 53) [22399]NAT: o: udp (172.31.2.132, 53) -> (172.31.233.193, 1493) [63671]NAT*: i: tcp (192.168.1.95, 1135) -> (172.31.2.75, 23) [22400]NAT*: o: tcp (172.31.2.75, 23) -> (172.31.233.193, 1135) [22002]NAT*: i: tcp (192.168.1.95, 1135) -> (172.31.2.75, 23) [22401]NAT*: i: tcp (192.168.1.95, 1135) -> (172.31.2.75, 23) [22402]NAT*: o: tcp (172.31.2.75, 23) -> (172.31.233.193, 1135) [22060]NAT*: o: tcp (172.31.2.75, 23) -> (172.31.233.193, 1135) [22071]describes the fields and messages shown in .
debug ip ospf events
Use the debug ip ospf events EXEC command to display information on Open Shortest Path First (OSPF)-related events, such as adjacencies, flooding information, designated router selection, and shortest path first (SPF) calculation. The no form of this command disables debugging output.
[no] debug ip ospf events
Sample Display
shows sample debug ip ospf events output.
Figure 2-111 Sample Debug IP OSPF Events Output
Router# debug ip ospf eventsOSPF:hello with invalid timers on interface Ethernet0hello interval received 10 configured 10net mask received 255.255.255.0 configured 255.255.255.0dead interval received 40 configured 30The debug ip ospf events output shown in might appear if any of the following occurs:
•
•
•
If a router configured for OSPF routing is not seeing an OSPF neighbor on an attached network, do the following:
•
•
In the following example line, the neighbor and this router are not part of a stub area (that is, one is a part of a transit area and the other is a part of a stub area, as explained in RFC 1247):
OSPF: hello packet with mismatched E bitRelated Command
debug ip ospf packet
debug ip ospf packet
Use the debug ip ospf packet EXEC command to display information about each Open Shortest Path First (OSPF) packet received. The no form of this command disables debugging output.
[no] debug ip ospf packet
Sample Display
shows sample debug ip ospf packet output.
Figure 2-112 Sample Debug IP OSPF Packet Output
Router# debug ip ospf packetOSPF: rcv. v:2 t:1 l:48 rid:200.0.0.117aid:0.0.0.0 chk:6AB2 aut:0 auk:The debug ip ospf packet command produces one set of information for each packet received. The output varies slightly depending on which authentication is used. shows sample debug ip ospf packet output when MD5 authentication is used.
Figure 2-113 Sample Debug IP OSPF Packet Output—MD5 Authentication
Router# debug ip ospf packetOSPF: rcv. v:2 t:1 l:48 rid:200.0.0.116aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x0describes the fields shown in and .
Related Command
debug ip ospf events
debug ip packet
Use the debug ip packet EXEC command to display general IP debugging information and IP security option (IPSO) security transactions. The no form of this command disables debugging output.
[no] debug ip packet [access-list-number]
Syntax Description
access-list-number
(Optional) IP access list number that you can specify. If the datagram is not permitted by that access list, the related debugging output is suppressed.
Usage Guidelines
If a communication session is closing when it should not be, an end-to-end connection problem can be the cause. The debug ip packet command is useful for analyzing the messages traveling between the local and remote hosts.
IP debugging information includes packets received, generated, and forwarded. Fast-switched packets do not generate messages.
IPSO security transactions include messages that describe the cause of failure each time a datagram fails a security test in the system. This information is also sent to the sending host when the router configuration allows it.
Note
Sample Display
shows sample debug ip packet output.
Figure 2-114 Sample Debug IP Packet Output
Router# debug ip packetIP: s=172.16.13.44 (Fddi0), d=10.125.254.1 (Serial2), g=172.16.16.2, forwardIP: s=172.16.1.57 (Ethernet4), d=10.36.125.2 (Serial2), g=172.16.16.2, forwardIP: s=172.16.1.6 (Ethernet4), d=255.255.255.255, rcvd 2IP: s=172.16.1.55 (Ethernet4), d=172.16.2.42 (Fddi0), g=172.16.13.6, forwardIP: s=172.16.89.33 (Ethernet2), d=10.130.2.156 (Serial2), g=172.16.16.2, forwardIP: s=172.16.1.27 (Ethernet4), d=172.16.43.126 (Fddi1), g=172.16.23.5, forwardIP: s=172.16.1.27 (Ethernet4), d=172.16.43.126 (Fddi0), g=172.16.13.6, forwardIP: s=172.16.20.32 (Ethernet2), d=255.255.255.255, rcvd 2IP: s=172.16.1.57 (Ethernet4), d=10.36.125.2 (Serial2), g=172.16.16.2, access deniedshows two types of messages that the debug ip packet command can produce; the first line of output describes an IP packet that the router forwards, and the third line of output describes a packet that is destined for the router. In the third line of output, "rcvd 2" indicates that the router decided to receive the packet.
describes the fields shown in the first line of .
The calculation on whether to send a security error message can be somewhat confusing. It depends upon both the security label in the datagram and the label of the incoming interface. First, the label contained in the datagram is examined for anything obviously wrong. If nothing is wrong, assume it to be correct. If there is something wrong, the datagram is treated as unclassified genser. Then the label is compared with the interface range, and the appropriate action is taken as describes.
The security code can only generate a few types of ICMP error messages. The only possible error messages and their meanings follow:
•
•
•
•
Note
When an IP packet is rejected due to an IP security failure, an audit message is sent via DNSIX NAT. Also, any debug ip packet output is appended to include a description of the reason for rejection. This description can be any of the following:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
debug ip pim
Use the debug ip pim EXEC command to display Protocol Independent Multicast (PIM) packets received and transmitted as well as PIM related events.The no form of this command disables debugging output.
[no] debug ip pim [group]
Syntax Description
Usage Guidelines
PIM uses IGMP packets to communicate between routers and advertise reachability information.
Use this command with debug ip igmp and debug ip mrouting to observe additional multicast routing information.
Sample Display
shows sample debug ip pim output.
Figure 2-115 Sample Debug IP PIM Output
Router# debug ip pim 224.2.0.1PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received Join/Prune on Tunnel0 from 10.3.84.1PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received RP-Reachable on Ethernet1 from 172.16.20.31PIM: Update RP expiration timer for 224.2.0.1PIM: Forward RP-reachability packet for 224.2.0.1 on Tunnel0PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Prune-list (10.221.196.51/32, 224.2.0.1)PIM: Set join delay timer to 2 seconds for (10.221.0.0/16, 224.2.0.1) on Ethernet1PIM: Received Join/Prune on Ethernet1 from 172.24.37.6PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received Join/Prune on Tunnel0 from 10.3.84.1PIM: Join-list: (*, 224.2.0.1) RP 172.16.20.31PIM: Add Tunnel0 to (*, 224.2.0.1), Forward statePIM: Join-list: (10.0.0.0/8, 224.2.0.1)PIM: Add Tunnel0 to (10.0.0.0/8, 224.2.0.1), Forward statePIM: Join-list: (10.4.0.0/16, 224.2.0.1)PIM: Prune-list (172.24.84.16/28, 224.2.0.1) RP-bit set RP 172.24.84.16PIM: Send Prune on Ethernet1 to 172.24.37.6 for (172.24.84.16/28, 224.2.0.1), RPPIM: For RP, Prune-list: 10.9.0.0/16PIM: For RP, Prune-list: 10.16.0.0/16PIM: For RP, Prune-list: 10.49.0.0/16PIM: For RP, Prune-list: 10.84.0.0/16PIM: For RP, Prune-list: 10.146.0.0/16PIM: For 10.3.84.1, Join-list: 172.24.84.16/28PIM: Send periodic Join/Prune to RP via 172.24.37.6 (Ethernet1)Explanations for individual lines of output from follow.
The following lines appear periodically when PIM is running in sparse mode and indicate to this router which multicast groups and multicast sources other routers are interested in:
PIM: Received Join/Prune on Ethernet1 from 172.24.37.33PIM: Received Join/Prune on Ethernet1 from 172.24.37.33The following lines appear when a rendezvous point (RP) message is received and the RP timer is reset. The expiration timer sets a checkpoint to make sure the RP still exists; otherwise a new RP must be discovered.
PIM: Received RP-Reachable on Ethernet1 from 172.16.20.31PIM: Update RP expiration timer for 224.2.0.1PIM: Forward RP-reachability packet for 224.2.0.1 on Tunnel0The prune-list message in the following line states that this router is not interested in the source address information. The prune message tells an upstream router to stop forwarding multicast packets from this source.
PIM: Prune-list (10.221.196.51/32, 224.2.0.1)In the following line, a second router on the network wants to override the prune message that the upstream router just received. The timer is set at a random value so that if there are additional routers on the network that still want to receive multicast packets for the group, only one will actually send the message. The other routers will receive the join message and then suppress sending their own message.
PIM: Set join delay timer to 2 seconds for (10.221.0.0/16, 224.2.0.1) on Ethernet1In the following line, a join message is sent towards the RP for all sources:
PIM: Join-list: (*, 224.2.0.1) RP 172.16.20.31In the following lines, the interface is being added to the outgoing interface (OIF) of the *,G and S,G mroute table entry so that packets from the source will be forwarded out that particular interface:
PIM: Add Tunnel0 to (*, 224.2.0.1), Forward statePIM: Add Tunnel0 to (10.0.0.0/8, 224.2.0.1), Forward stateThe following line appears in sparse mode only. There are two trees on which data may be received: the RP tree and the source tree. In dense mode there is no RP. After the source and the receiver have discovered one another at the RP, the first-hop router for the receiver will usually join to the source tree rather than the RP tree.
PIM: Prune-list (172.24.84.16/28, 224.2.0.1) RP-bit set RP 172.24.84.16The Send Prune message in the next line shows that a router is sending a message to a second router saying that the first router no longer wants to receive multicast packets for the S,G. The "RP" at the end of the message indicates that the router is pruning the RP tree and is most likely joining the source tree, although the router may not have downstream members for the group or downstream routers with members of the group. The output shows which specific sources this router no longer wants to receive multicast from.
PIM: Send Prune on Ethernet1 to 172.24.37.6 for (172.24.84.16/28, 224.2.0.1), RPThe following lines indicate a prune message is sent toward the RP so that router can join the source tree rather than the RP tree:
PIM: For RP, Prune-list: 10.9.0.0/16PIM: For RP, Prune-list: 10.16.0.0/16PIM: For RP, Prune-list: 10.49.0.0/16In the following line, a periodic message is sent towards the RP. The default period is once per minute. Prune and join messages are sent toward the RP or source rather than directly to the RP or source. It is the responsibility of the next-hop router to take proper action with this message, such as continuing to forward it to the next router in the tree.
PIM: Send periodic Join/Prune to RP via 172.24.37.6 (Ethernet1)Related Commands
debug ip dvmrp
debug ip igmp
debug ip igrp transactions
debug ip mrouting
debug ip sddebug ip pim atm
To log PIM ATM signaling activity, use the debug ip pim atm EXEC command. To disable debugging output, use the no form of this command.
[no] debug ip pim atm
Sample Displays
The sample display in shows a new group being created and the router toward the RP opening a new VC. Since there are now two groups on this router, there are two virtual circuits open, as reflected by the "current count."
shows sample debug ip pim atm output.
Figure 2-116 Sample Debug IP PIM ATM Output
Router# debug ip pim atmJan 28 19:05:51: PIM-ATM: Max VCs 200, current count 1Jan 28 19:05:51: PIM-ATM: Send SETUP on ATM2/0 for 239.254.254.253/171.69.214.43Jan 28 19:05:51: PIM-ATM: Received CONNECT on ATM2/0 for 239.254.254.253, vcd 19Jan 28 19:06:35: PIM-ATM: Max VCs 200, current count 2describes the significant fields in .
The resulting show ip mroute output follows:
Router# show ip mroute 239.254.254.253IP Multicast Routing TableFlags: D - Dense, S - Sparse, C - Connected, L - Local, P - PrunedR - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPTTimers: Uptime/ExpiresInterface state: Interface, Next-Hop or VCD, State/Mode(*, 239.254.254.253), 00:00:04/00:02:53, RP 171.69.214.50, flags: SIncoming interface: Ethernet1/1, RPF nbr 171.69.214.50Outgoing interface list:ATM2/0, VCD 19, Forward/Sparse-Dense, 00:00:04/00:02:52debug ip pim auto-rp
Use the debug ip pim auto-rp EXEC command to display the contents of each Protocol Independent Multicast (PIM) packet used in the automatic discovery of group-to-rendezvous point (RP) mapping as well as the actions taken on the address-to-RP mapping database. The no form of this command disables debugging output.
[no] debug ip pim auto-rp
Sample Displays
shows sample debug ip pim auto-rp output.
Figure 2-117 Sample Debug IP PIM Auto-RP Output
Router# debug ip pim auto-rpAuto-RP: Received RP-announce, from 172.31.214.66, RP_cnt 1, holdtime 180 secsAuto-RP: update (192.168.248.0/24, RP:172.31.214.66)Auto-RP: Build RP-Discovery packetAuto-RP: Build mapping (192.168.248.0/24, RP:172.31.214.66),Auto-RP: Build mapping (192.168.250.0/24, RP:172.31.214.26).Auto-RP: Build mapping (192.168.254.0/24, RP:172.31.214.2).Auto-RP: Send RP-discovery packet (3 RP entries)Auto-RP: Build RP-Announce packet for 172.31.214.2Auto-RP: Build announce entry for (192.168.254.0/24)Auto-RP: Send RP-Announce packet, IP source 172.31.214.2, ttl 8Explanations for individual lines of output from follow.
The first two lines show a packet received from 172.31.214.66 announcing that it is the rendezvous point (RP) for the groups in 192.168.248.0/24. This announcement contains one RP address and is valid for 180 seconds. The RP-mapping agent then updates its mapping database to include the new information.
Auto-RP: Received RP-announce, from 172.31.214.66, RP_cnt 1, holdtime 180 secsAuto-RP: update (192.168.248.0/24, RP:172.31.214.66)In the next five lines, the router creates an RP-discovery packet containing three RP mapping entries. The packet is sent to the well-known CISCO-RP-DISCOVERY group address (224.0.1.40).
Auto-RP: Build RP-Discovery packetAuto-RP: Build mapping (192.168.248.0/24, RP:172.31.214.66),Auto-RP: Build mapping (192.168.250.0/24, RP:172.31.214.26).Auto-RP: Build mapping (192.168.254.0/24, RP:172.31.214.2).Auto-RP: Send RP-discovery packet (3 RP entries)The final three lines show the router announcing that it intends to be an RP for the groups in 192.168.254.0/24. Only routers inside the scope ttl 8 receive the advertisement and use the RP for these groups.
Auto-RP: Build RP-Announce packet for 172.31.214.2Auto-RP: Build announce entry for (192.168.254.0/24)Auto-RP: Send RP-Announce packet, IP source 172.31.214.2, ttl 8shows sample debug ip pim auto-rp output when a router receives an update. In this example, the packet contains three group-to-RP mappings, which are valid for 180 seconds. The RP-mapping agent then updates its mapping database to include the new information.
Figure 2-118 Sample Debug IP PIM Auto-RP Output—Router Receiving Update
Router# debug ip pim auto-rpAuto-RP: Received RP-discovery, from 172.31.214.17, RP_cnt 3, holdtime 180 secsAuto-RP: update (192.168.248.0/24, RP:172.31.214.66)Auto-RP: update (192.168.250.0/24, RP:172.31.214.26)Auto-RP: update (192.168.254.0/24, RP:172.31172.31.214.2)debug ip policy
Use the debug ip policy EXEC command to display IP policy routing packet activity. The no form of this command disables debugging output.
[no] debug ip policy
Usage Guidelines
After you configure IP policy routing with the ip policy and route map commands, use the debug ip policy command to ensure that the IP policy is configured correctly.
Policy routing looks at various parts of the packet and then routes the packet based on certain user-defined attributes in the packet.
The debug ip policy command helps you determine what policy routing is doing. It displays information about whether a packet matches the criteria, and if so, the resulting routing information for the packet.
CautionBecause the debug ip policy command generates a significant amount of output, use it only when traffic on the IP network is low, so other activity on the system is not adversely affected.
You can also use the show ip local policy command to obtain additional information.
Sample Display
shows sample debug ip policy output. Line 1 indicates that a packet with the given source and destination addresses matched a policy. Line 2 indicates the clause in the route map that the packet matched. In this case, the packet matches clause 20 in the route map. Line 3 indicates that a second packet did not match the policy.
Figure 2-119 Sample Debug IP Policy Output
Router# debug ip policyIP: s=172.16.232.150 (local), d=172.16.2.75, len 100, policy matchIP: route map equal, item 20, permitIP: s=172.16.232.150 (local), d=172.16.2.75, len 200, policy rejected -- normal forwardingdebug ip rip
Use the debug ip rip EXEC command to display information on RIP routing transactions. The no form of this command disables debugging output.
[no] debug ip rip
Sample Display
shows sample debug ip rip output.
Figure 2-120 Sample Debug IP RIP Output
shows that the router being debugged has received updates from one router at source address 160.89.80.28. That router sent information about five destinations in the routing table update. Notice that the fourth destination address in the update—131.108.0.0—is inaccessible because it is more than 15 hops away from the router sending the update. The router being debugged also sent updates, in both cases to broadcast address 255.255.255.255 as the destination.
The first line in is self-explanatory.
The second line in is an example of a routing table update. It shows how many hops a given Internet address is from the router.
The entries in show that the router is sending updates that are similar, except that the number in parentheses is the source address encapsulated into the IP header.
Examples of additional output that the debug ip rip command can generate follow.
Entries such as the following appear at startup or when an event occurs such as an interface transitioning or a user manually clearing the routing table:
RIP: broadcasting general request on Ethernet0RIP: broadcasting general request on Ethernet1The following line is self-explanatory:
RIP: received request from 160.89.80.207 on Ethernet0An entry such as the following is most likely caused by a malformed packet from the transmitter:
RIP: bad version 128 from 160.89.80.43debug ip routing
Use the debug ip routing EXEC command to display information on Routing Information Protocol (RIP) routing table updates and route-cache updates. The no form of this command disables debugging output.
[no] debug ip routing
Sample Display
shows sample debug ip routing output.
Figure 2-121 Sample Debug IP Routing Output
Router# debug ip routingRT: add 172.25.168.0 255.255.255.0 via 172.24.76.30, igrp metric [100/3020]RT: metric change to 172.25.168.0 via 172.24.76.30, igrp metric [100/3020]new metric [100/2930]IP: cache invalidation from 0x115248 0x1378A, new version 5736RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/16200]RT: metric change to 172.26.219.0 via 172.24.76.30, igrp metric [100/16200]new metric [100/10816]RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]RT: no routes to 172.26.219.0, entering holddownIP: cache invalidation from 0x115248 0x1378A, new version 5737RT: 172.26.219.0 came out of holddownRT: garbage collecting entry for 172.26.219.0IP: cache invalidation from 0x115248 0x1378A, new version 5738RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/10816]RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]RT: no routes to 172.26.219.0, entering holddownIP: cache invalidation from 0x115248 0x1378A, new version 5739RT: 172.26.219.0 came out of holddownRT: garbage collecting entry for 172.26.219.0IP: cache invalidation from 0x115248 0x1378A, new version 5740RT: add 172.26.219.0 255.255.255.0 via 172.24.76.30, igrp metric [100/16200]RT: metric change to 172.26.219.0 via 172.24.76.30, igrp metric [100/16200]new metric [100/10816]RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]RT: no routes to 172.26.219.0, entering holddownIP: cache invalidation from 0x115248 0x1378A, new version 5741Explanations for representative lines of output in follow.
In the following lines, a newly created entry has been added to the IP routing table. The "metric change" indicates that this entry existed previously, but its metric changed and the change was reported by means of IGRP. The metric could also be reported via RIP, OSPF, or another IP routing protocol. The numbers inside the brackets report the administrative distance and the actual metric.
RT: add 172.25.168.0 255.255.255.0 via 172.24.76.30, igrp metric [100/3020]RT: metric change to 172.25.168.0 via 172.24.76.30, igrp metric [100/3020]new metric [100/2930]IP: cache invalidation from 0x115248 0x1378A, new version 5736"Cache invalidation" means that the fast switching cache was invalidated due to a routing table change. "New version" is the version number of the routing table. When the routing table changes, this number is incremented. The hexadecimal numbers are internal numbers that vary from version to version and software load to software load.
In the following output, the "holddown" and "cache invalidation" lines are displayed. Most of the distance vector routing protocols use "holddown" to avoid typical problems like counting to infinity and routing loops. If you look at the output of show ip protocols you will see what the timer values are for "holddown" and "cache invalidation." "Cache invalidation" corresponds to "came out of holddown." "Delete route" is triggered when a better path comes along. It gets rid of the old inferior path.
RT: delete route to 172.26.219.0 via 172.24.76.30, igrp metric [100/10816]RT: no routes to 172.26.219.0, entering holddownIP: cache invalidation from 0x115248 0x1378A, new version 5737RT: 172.26.219.0 came out of holddowndebug ip rsvp
Use the debug ip rsvp EXEC command to enable logging of significant Resource Reservation Protocol (RSVP) events. The no form of this command disables debugging output.
[no] debug ip rsvp [detail [access-list]]
Syntax Description
Usage Guidelines
The RSVP protocol permits end systems to request quality of service (QOS) guarantees from the network.
The debug ip rsvp command displays recognition of new senders, subsequent discontinuation of senders, and installation and removal of reservations.
The detail option displays recognition of new senders, subsequent discontinuation of senders, installation and removal of reservations, and messages sent and received that are permitted by the specified access list, or all messages if no access list is specified. The output from detail option is the same as the debug ip rsvp command but it also includes a hexadecimal-dump of the contents of the messages.
Sample Displays
In the following message, the router received a path message for destination 192.168.253.10 on interface Ethernet 0/2. The message was sent by 172.31.215.9—this indicates the previous hop and not the source.
RSVP: PATH message for 192.168.253.10(Ethernet0/2) from 172.31.215.9In the following two messages, the router is sending a path message to destination 192.168.253.10 on interface Ethernet 0/0. The second message is a reassurance that the packet is sent.
RSVP: send path multicast about 192.168.253.10 on Ethernet0/0RSVP: IP to 192.168.253.10 length=52 checksum=720C Ethernet0/0In the following message, the router received an reservation (RESV) message for destination 192.168.253.10 on interface serial 0. The message was sent by 172.31.215.113, which is the next hop toward the destination.
RSVP: RESV message for 192.168.253.10(Serial0) from 172.31.215.113In the following messages, the router is removing the sender state for destination 1.1.1.1. The destination port is (1234), the source is 172.31.215.11, and the protocol and source port are (17:1234). Removing the sender state triggers a teardown message to be sent toward destination 1.1.1.1 on interface Ethernet 0/2 (located in the routing table).
RSVP: remove Ethernet0/1 PATH 1.1.1.1(1234) <- 172.31.215.11(17:1234)RSVP: send path teardown multicast about 1.1.1.1 on Ethernet0/2The following messages occur when a reservation (RESV) message is received but no sender state (path message) exists that matches it. In this case, the router drops the reservation and sends a reservation error message to destination 192.168.253.10.
RSVP: RESV message for 192.168.253.10(Serial0) from 172.31.215.113RSVP: send reservation error to 172.31.215.113 about 192.168.253.10RSVP: IP to 172.31.215.113 length=40 checksum=1A84 if Serial0RSVP RESV: no path information for 192.168.253.10In the following messages, the router tears down a reservation because it received a teardown message or because the message timed out. Tearing down a reservation triggers the removal of the existing installed reservation, as shown in the second message. The teardown also triggers the removal of this reservation from upstream routers. After the router removes the reservation, an RESV teardown message is sent to the source to tear down the reservation on the next hop, as shown in the fourth message. This process continues until the source is reached.
RSVP: RESV TEAR message for 192.168.253.10(Ethernet0/0) from 172.31.215.98RSVP: remove Ethernet0/0 RESV 192.168.253.10(18004) <- 172.31.60.189(17:18004)RSVP: remove Ethernet0/2 RESV request 192.168.253.10(18004) <- 172.31.60.189(17:18004)RSVP: send reservation teardown to 172.31.215.9 about 192.168.253.10In the following messages, the router received and accepted a new reservation request. This request triggers the router to send a reservation request message to the source.
RSVP: Reservation is newRSVP: start requesting 30 kbps SE reservation for 172.31.60.189(18004) UDP-> 192.168.253.10(18004) on Ethernet0 neighbor 172.31.215.97In the following message, the router received an RSVP message on an interface with the RSVP feature disabled:
RSVP: Input packet while RSVP disabled on Serial2/0debug ip rtp header-compression
Use the debug ip rtp header-compression EXEC command to display events specific to RTP header compression. Use the no form of this command to disable debugging output.
[no] debug ip rtp header-compression
Sample Display
shows sample debug ip rtp header-compression output.
Figure 2-122 Sample Debug IP RTP Header-Compression Output
Router# debug ip rtp header-compressionRHC BRI0: rcv compressed rtp packetRHC BRI0: context0: expected sequence 0, received sequence 0RHC BRI0: rcv compressed rtp packetRHC BRI0: context0: expected sequence 1, received sequence 1RHC BRI0: rcv compressed rtp packetRHC BRI0: context0: expected sequence 2, received sequence 2RHC BRI0: rcv compressed rtp packetRHC BRI0: context0: expected sequence 3, received sequence 3describes the significant fields in .
Related Command
debug ip rtp packets
Use the debug ip rtp packets EXEC command to display a detailed dump of packets specific to RTP header compression. Use the no form of this command to disable debugging output.
[no] debug ip rtp packets
Sample Display
shows sample debug ip rtp packets output.
Figure 2-123 Sample Debug IP RTP Packets Output
Router# debug ip rtp packetsRTP packet dump:IP: source: 171.68.8.10, destination: 224.2.197.169, id: 0x249B, ttl: 9,TOS: 0 prot: 17,UDP: source port: 1034, destination port: 27404, checksum: 0xB429,len: 152RTP: version: 2, padding: 0, extension: 0, marker: 0,payload: 3, ssrc 2369713968,sequence: 2468, timestamp: 85187180, csrc count: 0describes the significant fields in .
Table 2-65 Debug IP RTP Packets Field Descriptions
id
IP identification.
ttl
IP time to live (TTL).
len
Total UDP length.
Related Command
debug ip rtp header-compression
debug ip sd
Use the debug ip sd command to display all session directory (SD) announcements received. The no form of this command disables debugging output.
[no] debug ip sd
Usage Guidelines
This command shows session directory announcements for multicast IP. Use it to observe multicast activity.
Sample Display
shows sample debug ip sd output.
Figure 2-124 Sample Debug IP SD Output
Router# debug ip sdSD: Announcement from 172.31.58.81 on Serial0.1, 146 bytess=*cisco: CBONE Audioi=cisco internal-only audio conferenceo=dino@dino-ss20.cisco.comc=224.0.255.1 16 2891478496 2892688096m=audio 31372 1700SD: Announcement from 172.22.246.68 on Serial0.1, 147 bytess=IMS: U.S. Senatei=U.S. Senate at http://town.hall.org/radio/live.htmlo=carl@also.radio.comc=224.2.252.231 95 0 0m=audio 36572 2642a=fmt:gsmprovides explanations for representative lines of the debug ip sd output shown in .
Related Commands
debug ip dvmrp
debug ip igmp
debug ip mcache
debug ip mrouting
debug ip pimdebug ip security
Use the debug ip security EXEC command to display IP security option processing. The no form of this command disables debugging output.
[no] debug ip security
Usage Guidelines
The debug ip security command displays information for both basic and extended IP security options. For interfaces where ip security is configured, each IP packet processed for that interface results in debugging output regardless of whether the packet contains IP security options. IP packets processed for other interfaces that also contain IP security information also trigger debugging output. Some additional IP security debugging information is also controlled by the debug ip packet EXEC command.
Note
Sample Display
shows sample debug ip security output.
Figure 2-125 Sample Debug IP Security Output
Router# debug ip securityIP Security: src 172.24.72.52 dst 172.24.72.53, number of BSO 1idb: NULLpak: insert (0xFF) 0x0IP Security: BSO postroute: SECINSERT changed to secret (0x5A) 0x10IP Security: src 172.24.72.53 dst 172.24.72.52, number of BSO 1idb: secret (0x6) 0x10 to secret (0x6) 0x10, no implicitdef secret (0x6) 0x10pak: secret (0x5A) 0x10IP Security: checking BSO 0x10 against [0x10 0x10]IP Security: classified BSO as secret (0x5A) 0x10describes significant fields shown in .
Explanations for representative lines of output in follow.
The following line indicates that the packet was locally generated, and it has been classified with the internally significant security level "insert" (0xff) and authority 0x0:
idb: NULLpak: insert (0xff) 0x0The following line indicates that the packet was received via an interface with dedicated IP security configured. Specifically, the interface is configured at security level "secret" and with authority information of 0x0. The packet itself was classified at level "secret" (0x5a) and authority 0x10.
idb: secret (0x6) 0x10 to secret (0x6) 0x10, no implicitdef secret (0x6) 0x10pak: secret (0x5A) 0x10debug ip socket
Use the debug ip socket EXEC command to display all state change information for all sockets. Use the no form of this command to disable debugging output.
[no] debug ip socket
Usage Guidelines
Use this command to collect information on the socket interface. To get more complete information on a socket/TCP port pair, use this command in conjunction with debug ip tcp transactions.
Because the socket debugging information is state-change oriented, you will not see the debug message on a per packet basis. However, if the connections normally have very short lives (few packet exchanges during the life cycle of a connection), then socket debugging could become expensive because of the state changes involved during connection setup and teardown.
Sample Displays
shows sample debug ip socket output from a server process.
Figure 2-126 Sample Debug IP Socket Output—Server Process
Router# debug ip socketAdded socket 0x60B86228 to process 40SOCKET: set TCP property TCP_PID, socket 0x60B86228, TCB 0x60B85E38Accepted new socket fd 1, TCB 0x60B85E38Added socket 0x60B86798 to process 40SOCKET: set TCP property TCP_PID, socket 0x60B86798, TCB 0x60B877C0SOCKET: set TCP property TCP_BIT_NOTIFY, socket 0x60B86798, TCB 0x60B877C0SOCKET: created new socket to TCP, fd 2, TCB 0x60B877C0SOCKET: bound socket fd 2 to TCB 0x60B877C0SOCKET: set TCP property TCP_WINDOW_SIZE, socket 0x60B86798, TCB 0x60B877C0SOCKET: listen on socket fd 2, TCB 0x60B877C0SOCKET: closing socket 0x60B86228, TCB 0x60B85E38SOCKET: socket event process: socket 0x60B86228, TCB new state --> FINWAIT1socket state: SS_ISCONNECTED SS_CANTSENDMORE SS_ISDISCONNECTINGSOCKET: Removed socket 0x60B86228 from process 40 socket listshows sample debug ip socket output from a client process.
Figure 2-127 Sample Debug IP Socket Output—Client Process
Router# debug ip socketAdded socket 0x60B70220 to process 2SOCKET: set TCP property TCP_PID, socket 0x60B70220, TCB 0x60B6CFDCSOCKET: set TCP property TCP_BIT_NOTIFY, socket 0x60B70220, TCB 0x60B6CFDCSOCKET: created new socket to TCP, fd 0, TCB 0x60B6CFDCSOCKET: socket event process: socket 0x60B70220, TCB new state --> SYNSENTsocket state: SS_ISCONNECTINGSOCKET: socket event process: socket 0x60B70220, TCB new state --> ESTABsocket state: SS_ISCONNECTINGSOCKET: closing socket 0x60B70220, TCB 0x60B6CFDCSOCKET: socket event process: socket 0x60B70220, TCB new state --> FINWAIT1socket state: SS_ISCONNECTED SS_CANTSENDMORE SS_ISDISCONNECTINGSOCKET: Removed socket 0x60B70220 from process 2 socket listdescribes the significant fields in and .
Table 2-68
Debug IP Socket Field Descriptions
Related Command
debug ip tcp driver
Use the debug ip tcp driver EXEC command to display information on Transmission Control Protocol (TCP) driver events; for example, connections opening or closing, or packets being dropped because of full queues. The no form of this command disables debugging output.
[no] debug ip tcp driver
Usage Guidelines
The TCP driver is the process that the router software uses to send packet data over a TCP connection. Remote source-route bridging, STUN (serial tunneling), and X.25 switching currently use the TCP driver.
Using the debug ip tcp driver command together with the debug ip tcp driver-pak command provides the most verbose debugging output concerning TCP driver activity.
Sample Display
shows sample debug ip tcp driver output.
Figure 2-128 Sample Debug IP TCP Driver Output
Router# debug ip tcp driverTCPDRV359CD8: Active open 172.21.80.26:0 --> 172.21.80.25:1996 OK, lport 36628TCPDRV359CD8: enable tcp timeoutsTCPDRV359CD8: 172.21.80.26:36628 --> 172.21.80.25:1996 AbortTCPDRV359CD8: 172.21.80.26:36628 --> 172.21.80.25:1996 DoClose tcp abortExplanations for individual lines of output from follow.
describes the fields in the first line of output in .
The following line indicates that the TCP driver user (remote source-route bridging, in this case) will allow TCP to drop the connection if excessive retransmissions occur:
TCPDRV359CD8: enable tcp timeoutsThe following line indicates that the TCP driver user (in this case, remote source-route bridging) at IP address 172.21.80.26 (and using TCP port number 36628) is requesting that the connection to IP address 172.21.80.25 using TCP port number 1996 be aborted:
TCPDRV359CD8: 172.21.80.26:36628 --> 172.21.80.25:1996 AbortThe following line indicates that this connection was in fact closed due to an abnormal termination:
TCPDRV359CD8: 172.21.80.26:36628 --> 172.21.80.25:1996 DoClose tcp abortdebug ip tcp driver-pak
Use the debug ip tcp driver-pak EXEC command to display information on every operation that the Transmission Control Protocol (TCP) driver performs. The no form of this command disables debugging output.
[no] debug ip tcp driver-pak
Usage Guidelines
This command turns on a verbose debugging by logging at least one debugging message for every packet sent or received on the TCP driver connection.
The TCP driver is the process that the router software uses to send packet data over a TCP connection. Remote source-route bridging, STUN (serial tunneling), and X.25 switching currently use the TCP driver.
To observe the context within which certain debug ip tcp driver-pak messages occur, turn on this command in conjunction with the debug ip tcp driver command.
Note
Sample Display
shows sample debug ip tcp driver-pak output.
Figure 2-129 Sample Debug IP TCP Driver-Pak Output
Router# debug ip tcp driver-pakTCPDRV359CD8: send 2E8CD8 (len 26) queuedTCPDRV359CD8: output pak 2E8CD8 (len 26) (26)TCPDRV359CD8: readf 42 bytes (Thresh 16)TCPDRV359CD8: readf 26 bytes (Thresh 16)TCPDRV359CD8: readf 10 bytes (Thresh 10)TCPDRV359CD8: send 327E40 (len 4502) queuedTCPDRV359CD8: output pak 327E40 (len 4502) (4502)Explanations for individual lines of output from follow.
describes the fields shown in the first line of output of .
The following line indicates that the TCP driver has sent the data that it had received from the TCP driver user, as shown in the previous line of output. The last field in the line (26) indicates that the 26 bytes of data were sent out as a single unit.
TCPDRV359CD8: output pak 2E8CD8 (len 26) (26)The following line indicates that the TCP driver has received 42 bytes of data from the remote IP address. The TCP driver user (in this case, remote source-route bridging) has established an input threshold of 16 bytes for this connection. (The input threshold instructs the TCP driver to transfer data to the TCP driver user only when at least 16 bytes are present.)
TCPDRV359CD8: readf 42 bytes (Thresh 16)debug ip tcp intercept
To display TCP intercept statistics, use the debug ip tcp intercept EXEC command. The no form of this command disables debugging output.
[no] debug ip tcp intercept
Sample Display
illustrates a scenario in which a router configured with TCP intercept operates between a client and a server.
Figure 2-130 TCP Intercept Debug Scenario
shows sample debug ip tcp intercept output, with interspersed commentary. The sample output is based on .
Figure 2-131 Sample Debug IP TCP Intercept Output
Router# debug ip tcp interceptA connection attempt arrives.
INTERCEPT: new connection (172.19.160.17:61774) => (10.1.1.30:23)INTERCEPT: 172.19.160.17:61774 <- ACK+SYN (10.1.1.30:61774)A second connection attempt arrives.
INTERCEPT: new connection (172.19.160.17:62030) => (10.1.1.30:23)INTERCEPT: 172.19.160.17:62030 <- ACK+SYN (10.1.1.30:62030)The router retransmitts to both apparent clients.
INTERCEPT: retransmit 2 (172.19.160.17:61774) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 2 (172.19.160.17:62030) <- (10.1.1.30:23) SYNRCVDA third connection attempt arrives.
INTERCEPT: new connection (171.69.232.23:1048) => (10.1.1.30:23)INTERCEPT: 171.69.232.23:1048 <- ACK+SYN (10.1.1.30:1048)The router sends more retransmissions trying to establish connections with the apparent clients.
INTERCEPT: retransmit 4 (172.19.160.17:61774) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 4 (172.19.160.17:62030) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 2 (171.69.232.23:1048) <- (10.1.1.30:23) SYNRCVDThe router establishes the connection with the third client and retransmits to the server.
INTERCEPT: 1st half of connection is established (171.69.232.23:1048) => (10.1.1.30:23)INTERCEPT: (171.69.232.23:1048) SYN -> 10.1.1.30:23INTERCEPT: retransmit 2 (171.69.232.23:1048) -> (10.1.1.30:23) SYNSENTThe server responds; the connection is established.
INTERCEPT: 2nd half of connection established (171.69.232.23:1048) => (10.1.1.30:23)INTERCEPT: (171.69.232.23:1048) ACK -> 10.1.1.30:23The router retransmits to the first two apparent clients, times out, and sends resets.
INTERCEPT: retransmit 8 (172.19.160.17:61774) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 8 (172.19.160.17:62030) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 16 (172.19.160.17:61774) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmit 16 (172.19.160.17:62030) <- (10.1.1.30:23) SYNRCVDINTERCEPT: retransmitting too long (172.19.160.17:61774) => (10.1.1.30:23) SYNRCVDINTERCEPT: 172.19.160.17:61774 <- RST (10.1.1.30:23)INTERCEPT: retransmitting too long (172.19.160.17:62030) => (10.1.1.30:23) SYNRCVDINTERCEPT: 172.19.160.17:62030 <- RST (10.1.1.30:23)debug ip tcp transactions
Use the debug ip tcp transactions EXEC command to display information on significant Transmission Control Protocol (TCP) transactions such as state changes, retransmissions, and duplicate packets. The no form of this command disables debugging output.
[no] debug ip tcp transactions
Usage Guidelines
This command is particularly useful for debugging a performance problem on a TCP/IP network that you have isolated above the data link layer.
The debug ip tcp transactions command displays output for packets the router sends and receives, but does not display output for packets it forwards.
Sample Display
shows sample debug ip tcp transactions output.
Figure 2-132 Sample Debug IP TCP Output
Router# debug ip tcp transactionsTCP: sending SYN, seq 168108, ack 88655553TCP0: Connection to 10.9.0.13:22530, advertising MSS 966TCP0: state was LISTEN -> SYNRCVD [23 -> 10.9.0.13(22530)]TCP0: state was SYNSENT -> SYNRCVD [23 -> 10.9.0.13(22530)]TCP0: Connection to 10.9.0.13:22530, received MSS 956TCP0: restart retransmission in 5996TCP0: state was SYNRCVD -> ESTAB [23 -> 10.9.0.13(22530)]TCP2: restart retransmission in 10689TCP2: restart retransmission in 10641TCP2: restart retransmission in 10633TCP2: restart retransmission in 13384 -> 10.0.0.13(16151)]TCP0: restart retransmission in 5996 [23 -> 10.0.0.13(16151)]describes significant fields shown in .
