Table Of Contents

sdm prefer

service password-recovery

service-policy

set

setup

setup express

show access-lists

show archive status

show auto qos

show boot

show class-map

show cluster

show cluster candidates

show cluster members

show controllers cpu-interface

show controllers ethernet-controller

show controllers switch

show controllers tcam

show controllers utilization

show dot1q-tunnel

show dot1x

show env

show errdisable detect

show errdisable flap-values

show errdisable recovery

show etherchannel

show fallback profile

show flowcontrol

show fm

show fm interface

show fm vlan

show forward

show interfaces

show interfaces counters

show inventory

show arp access-list

show ip arp inspection

show ip dhcp snooping

show ip dhcp snooping binding

show ip dhcp snooping database

show ip dhcp snooping statistics

show ip igmp profile

show ip igmp snooping

show ip igmp snooping groups

show ip igmp snooping mrouter

show ip igmp snooping querier

show ip source binding

show ip verify source

show l2protocol-tunnel

show l2tcam

show l3tcam

show lacp

show mac access-group

show mac address-table

show mac address-table address

show mac address-table aging-time

show mac address-table count

show mac address-table dynamic

show mac address-table interface

show mac address-table multicast

show mac address-table notification

show mac address-table static

show mac address-table vlan

show mls qos

show mls qos aggregate-policer

show mls qos interface

show mls qos maps

show monitor

show mvr

show mvr interface

show mvr members

show pagp

show parser macro

show policy-map

show port-security

show power inline

show running-config vlan

show sdm prefer

show setup express

show spanning-tree

show storm-control

show system mtu

show tcam

show tcam pbr

show tcam qos

show udld

show version

show vlan

show vlan access-map

show vlan filter

show vmps

show vtp

shutdown

shutdown vlan

skip-loopback-test

snmp-server enable traps

snmp-server host

snmp-server ip

snmp trap mac-notification

spanning-tree backbonefast

spanning-tree bpdufilter

spanning-tree bpduguard

spanning-tree cost

spanning-tree etherchannel guard misconfig

spanning-tree extend system-id

spanning-tree guard

spanning-tree link-type

spanning-tree loopguard default

spanning-tree mode

spanning-tree mst configuration

spanning-tree mst cost

spanning-tree mst forward-time

spanning-tree mst hello-time

spanning-tree mst max-age

spanning-tree mst max-hops

spanning-tree mst port-priority

spanning-tree mst pre-standard

spanning-tree mst priority

spanning-tree mst root

spanning-tree port-priority

spanning-tree portfast (global configuration)

spanning-tree portfast (interface configuration)

spanning-tree stack-port

spanning-tree transmit hold-count

spanning-tree uplinkfast

spanning-tree vlan

speed

storm-control

switchcore

switchport

switchport access

switchport backup interface

switchport block

switchport broadcast

switchport host

switchport mode

switchport multicast

switchport nonegotiate

switchport port-security

switchport port-security aging

switchport priority extend

switchport protected

switchport trunk

switchport unicast

switchport voice vlan

system mtu

2

sdm prefer

Use the sdm prefer global configuration command to configure the template used in Switch Database Management (SDM) resource allocation. You use a template to allocate system memory to best support the features being used in your application. Use a template to approximate the maximum number of unicast MAC addresses, Internet Group Management Protocol (IGMP) groups, quality of service (QoS) access control entries (ACEs), security ACEs, unicast routes, multicast routes, subnet VLANs (routed interfaces), and Layer 2 VLANs that can be configured on the switch. Use the no form of this command to return to the default template.

sdm prefer {access [extended-match] | extended-match | routing [extended-match] | vlan}

no sdm prefer

Syntax Description

access	Provide maximum system utilization for multicast traffic, QoS classification ACEs, and security ACEs. You would typically use this template for an access switch at the network edge.
extended-match	Reformat routing-table memory allocation to allow 144-bit Layer 3 ternary content addressable memory (TCAM) with the default template, the access template, or the routing template. Reformatting routing table memory space reduces the number of allowed unicast routes by one half.
routing	Provide maximum system utilization for unicast routing, minimizing QoS classification ACLs and security ACLs. You would typically use this template for a router or aggregator in the middle of a network.
vlan	Provide maximum system utilization for VLANs, with routing disabled. This template maximizes system memory for use as a Layer 2 switch with no routing.

Defaults

The default template provides a balance to all features.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(6)EA1	Template values revised. Templates for Fast Ethernet switches were added.
12.1(8)EA1	Template values for Gigabit Ethernet switches were revised.
12.1(11)EA1	The extended-match keyword was added.

Usage Guidelines

You must reload the switch for the configuration to take effect.

The sdm prefer vlan command disables routing capability in the switch. Any routing configurations are rejected after the reload, and any previously configured routing options might be lost. Use the sdm prefer vlan command only on switches intended for Layer 2 switching with no routing.

Do not use the routing template if you do not have routing enabled on your switch. Entering the sdm prefer routing global configuration command prevents other features from using the memory allocated to unicast and multicast routing in the routing template (approximately 17 K for Fast Ethernet switches and 30 K for Gigabit Ethernet switches).

When running the Web Cache Communication Protocol (WCCP) or multiple Virtual Private Network (VPN) routing/forwarding (multi-VRF) instances in customer edge (CE) devices (multi-VRF CE), extra fields are required in the routing tables stored in TCAM. You must use the extended-match keyword with the default, access, or routing templates to enable the switch to support 144-bit Layer 3 TCAM when using these features. The keyword reformats the memory space allocated for routing, reducing the number of allowed unicast routes by half.

Table 2-12 lists the approximate number of each resource supported in each of the four templates for a Gigabit Ethernet switch. Table 2-13 lists the approximate number supported for a switch with mostly Fast Ethernet ports. The first six rows in the tables (unicast MAC addresses through multicast routes) represent approximate hardware boundaries set when a template is selected. If a section of a hardware resource is full, all processing overflow is sent to the CPU, seriously impacting switch performance.

The last two rows, the total number of routed ports and SVIs and the number of Layer 2 VLANs, are guidelines used to calculate hardware resource consumption related to the other resource parameters.

The number of subnet VLANs (routed ports and SVIs) are not limited by software and can be set to a number higher than indicated in the tables. If the number of subnet VLANs configured is lower or equal to the number in the tables, the number of entries in each category (Unicast addresses, IGMP groups, and so on) for each template will be as indicated. As the number of subnet VLANs is increased, CPU utilization will typically increase. If the number of subnet VLANs is increased beyond the number indicated in the tables, the number of supported entries in each category may decrease depending on features that are enabled. For example, if PIM-DVMRP is enabled with more than 16 subnet VLANs, the number of entries for multicast routes will be in the range of 1K-5K entries for the access template.

Table 2-12 Approximate Number of Feature Resources Allowed by Each Template for Gigabit Ethernet Switches

Resource	Default Template	Access Template	Routing Template	VLAN Template
Unicast MAC addresses	6 K	2 K	6 K	12 K
IGMP groups (managed by Layer 2 multicast features such as MVR or IGMP snooping)	6 K	8 K	6 K	6 K
QoS classification ACEs	2K	2 K	1 K	2 K
Security ACEs	2 K	4 K	1 K	2 K
Unicast routes	12 K or 6 K1	4 K or 2 K1	24 K or 12 K1	0
Multicast routes	6 K	8 K	6 K	0
Routed interfaces (routed ports and SVIs)	16	16	16	16
Layer 2 VLANs	1 K	1 K	1 K	1 K

1 When the extended-match keyword is used with the indicated template. This keyword affects only the number of unicast routes allowed.

Table 2-13 Approximate Number of Feature Resources Allowed by Each Template for Fast Ethernet Switches

Resource	Default Template	Access Template	Routing Template	VLAN Template
Unicast MAC addresses	5 K	1 K	5 K	8 K
IGMP groups (managed by Layer 2 multicast features such as MVR and IGMP snooping)	1 K	2 K	1 K	1 K
QoS ACEs	1 K	1 K	512	1 K
Security ACEs	1 K	2 K	512	1 K
Unicast routes	8 K or 4K1	2 K or 1K1	16 K or 8K1	0
Multicast routes	1 K	2 K	1 K	0
Routed interfaces (routed ports and SVIs)	8	8	8	8
Layer 2 VLANs	1 K	1 K	1 K	1 K

1 When the extended-match keyword is used with the indicated template. This keyword affects only the number of unicast routes allowed.

Examples

This example shows how to configure the routing template on the switch:

Switch(config)# sdm prefer routing

Switch(config)# exit

Switch# reload

This example shows how to configure the routing template with a 144-bit routing table allocation:

Switch(config)# sdm prefer routing extended-match

Switch(config)# exit

Switch# reload

This example shows how to remove the routing template and to use the default template with the standard 72-bit routing table allocation:

Switch(config)# no sdm prefer routing

Switch(config)# exit

Switch# reload

You can verify your settings by entering the show sdm prefer privileged EXEC command.

Related Commands

Command	Description
show sdm prefer	Displays the current SDM template in use or displays the templates that can be used, with approximate resource allocation per feature.

service password-recovery

Use the service password-recovery global configuration command to enable the password-recovery mechanism (the default). Use the no form of this command to disable part of the password-recovery functionality. When the password-recovery mechanism is disabled, interrupting the boot process is allowed only if the user agrees to set the system back to the default configuration.

service password-recovery

no service password-recovery

Syntax Description

This command has no arguments or keywords.

Defaults

The password-recovery mechanism is enabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(6)EA1a	This command was introduced.

Usage Guidelines

This command is valid only on Catalyst 3550 Fast Ethernet switches; it is not available for Gigabit Ethernet switches.

As a system administrator, you can use the no service password-recovery command to disable some of the functionality of the password recovery feature by allowing an end user to reset a password only by agreeing to return to the default configuration.

The password-recovery mechanism has been triggered, but

is currently disabled.  Access to the boot loader prompt

through the password-recovery mechanism is disallowed at

this point.  However, if you agree to let the system be

reset back to the default system configuration, access

to the boot loader prompt can still be allowed.

Would you like to reset the system back to the default configuration (y/n)?

If the user chooses not to reset the system back to the default configuration, the normal boot process continues, as if the Mode button had not been pressed. If you choose to reset the system back to the default configuration, the configuration file in flash memory is deleted, and the VLAN database file, flash:vlan.dat (if present), is deleted.

---

Note If you use the no service password-recovery command to control end user access to passwords, we recommend that you save a copy of the config file in a location away from the switch in case the end user uses the password recovery procedure and sets the system back to default values. Do not keep a backup copy of the config file on the switch.

If the switch is operating in VTP transparent mode, we recommend that you also save a copy of the vlan.dat file in a location away from the switch.

---

You can verify if password recovery is enabled or disabled by entering the show version privileged EXEC command.

Examples

This example shows how to disable password recovery on a switch so that a user can only reset a password by agreeing to return to the default configuration:

Switch(config)# no service-password recovery

Switch(config)# exit

This is an example of the output from the show version privileged EXEC command when password-recovery is disable:

Switch# show version

1w6d: %SYS-5-CONFIG_I: Configured from console by console

Cisco Internetwork Operating System Software

IOS (tm) C3550 Software (C3550-IPSERVICES-M), Version 12.2(25)SEB, RELEASE SOFTWARE (fc1)

Copyright (c) 1986-2005 by cisco Systems, Inc.

Compiled Wed 14-Feb-05 06:20 by antonino

Image text-base: 0x00003000, data-base: 0x004C1864

ROM: Bootstrap program is C3550 boot loader

flam-1-6 uptime is 1 week, 6 days, 3 hours, 59 minutes

System returned to ROM by power-on

System image file is 
"flash:c3550-ipservices-mz.122-25.SEB/c3550-ipservices-mz.122-25.SEB.bin"

cisco WS-C3550-48 (PowerPC) processor with 65526K/8192K bytes of memory.

Last reset from warm-reset

Running Layer2 Switching Only Image

Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 3 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 4 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 5 has 1 Gigabit Ethernet/IEEE 802.3 interface

Ethernet-controller 6 has 1 Gigabit Ethernet/IEEE 802.3 interface

48 FastEthernet/IEEE 802.3 interface(s)

2 Gigabit Ethernet/IEEE 802.3 interface(s)

The password-recovery mechanism is disabled.

32K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: AA:00:0B:2B:02:00

Configuration register is 0x10F

Related Commands

Command	Description
show version	Displays version information for the hardware and firmware.

service-policy

Use the service-policy interface configuration command to apply a policy map defined by the policy-map command to the input or output of a particular interface. Use the no form of this command to remove the policy map and interface association.

service-policy {input policy-map-name | output policy-map-name}

no service-policy {input policy-map-name | output policy-map-name}

Syntax Description

input policy-map-name	Apply the specified policy-map to the input of an interface.
output policy-map-name	Apply the specified policy-map to the output of an interface.

---

Note Though visible in the command-line help strings, the history keyword is not supported, and you should ignore the statistics it gathers.

---

Defaults

No policy maps are attached to the interface.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Only one policy map per interface per direction is supported.

You cannot use the service-policy interface configuration command to attach policy maps that contain these elements to an egress interface:

•set or trust policy-map class configuration commands. Instead, you can use the police policy-map class configuration command to mark down (reduce) the DSCP value at the egress interface.

•Access control list (ACL) classification.

•Per-port per-VLAN classification.

The only match criterion in a policy map that can be attached to an egress interface is the match ip dscp dscp-list class-map configuration command.

A classification that uses a port trust state (for example, mls qos trust [cos | dscp | ip-precedence] and classification that uses a policy map (for example, service-policy input policy-map-name) are mutually exclusive. The last setting configured overwrites the previous configuration.

Examples

This example shows how to apply plcmap1 to an ingress interface:

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# service-policy input plcmap1

This example shows how to apply plcmap2 to an egress interface:

Switch(config)# interface gigabitethernet0/2

Switch(config-if)# service-policy output plcmap2

This example shows how to detach plcmap2 from an interface:

Switch(config)# interface gigabitethernet0/2

Switch(config-if)# no service-policy input plcmap2

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
policy-map	Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.
show policy-map	Displays quality of service (QoS) policy maps.

set

Use the set policy-map class configuration command to classify IP traffic by setting a class of service (CoS), Differentiated Services Code Point (DSCP), or IP-precedence value in the packet. Use the no form of this command to remove the traffic classification.

set {cos new-cos | dscp new-dscp | ip precedence new-precedence}

no set {cos new-cos | dscp new-dscp | ip precedence new-precedence}

---

Note Beginning with Cisco IOS Release 12.2(25)SE, the set dscp new-dscp command replaces the set ip dscp new-dscp command.

---

Syntax Description

cos new-cos	New CoS value assigned to the classified traffic. The range is from 0 to 7.
dscp new-dscp	New DSCP value assigned to the classified traffic. The range is 0 to 63. You also can enter a mnemonic name for a commonly used value.
ip precedence new-precedence	New IP-precedence value assigned to the classified traffic. The range is 0 to 7. You also can enter a mnemonic name for a commonly used value.

Defaults

No traffic classification is defined.

Command Modes

Policy-map class configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(12c)EA1	The cos keyword was added.
12.2(25)SE	The ip dscp new-dscp keyword was changed to dscp new-dscp.

Usage Guidelines

Within the same policy map, you should not use the set command with the trust policy-map class configuration command unless you also use the mls qos cos policy-map global configuration command. For information about using this command, see the "mls qos cos policy-map" section on page 2-247.

You cannot use the service-policy interface configuration command to attach policy maps that contain these elements to an egress interface:

•set or trust policy-map class configuration commands. Instead, you can use the police policy-map class configuration command to mark down (reduce) the DSCP value at the egress interface.

•Access control list (ACL) classification.

•Per-port per-VLAN classification.

The only match criterion in a policy map that can be attached to an egress interface is the match ip dscp dscp-list class-map configuration command.

For the set dscp new-dscp or the set ip precedence new-precedence command, you can enter a mnemonic name for a commonly used value. For example, you can enter the set dscp af11 command, which is the as same entering the set dscp 10 command. You can enter the set ip precedence critical command, which is the same as entering the set ip precedence 5 command. For a list of supported mnemonics, enter the set dscp ? or the set ip precedence ? command to see the command-line help strings.

To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Examples

This example shows how to assign DSCP 10 to all FTP traffic without any policers:

Switch(config)# policy-map policy_ftp

Switch(config-pmap)# class ftp_class

Switch(config-pmap-c)# set dscp 10

Switch(config-pmap)# exit

This example shows how to assign a CoS value in a policy map:

Switch(config)# mls qos cos policy-map

Switch(config)# policy-map policy2

Switch(config-pmap)# class class1

Switch(config-pmap-c)# trust dscp

Switch(config-pmap-c)# set cos 3

Switch(config-pmap-c)# exit

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

Command	Description
police	Defines a policer for classified traffic.
policy-map	Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.
show policy-map	Displays quality of service (QoS) policy maps.
trust	Defines a trust state for traffic classified by the class policy-map configuration command or the class-map global configuration command.

setup

Use the setup privileged EXEC command to configure the switch with its initial configuration.

setup

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

When you use the setup command, make sure that you have this information:

•IP address and network mask

•Password strategy for your environment

•Whether the switch will be used as the command switch in a cluster and the cluster name

When you enter the setup command, an interactive dialog, called the System Configuration Dialog, appears. It guides you through the configuration process and prompts you for information. The values shown in brackets next to each prompt are the default values last set by using either the setup command facility or the configure privileged EXEC command.

Help text is provided for each prompt. To access help text, press the question mark (?) key at a prompt.

To return to the privileged EXEC prompt without making changes and without running through the entire System Configuration Dialog, press Ctrl-C.

When you complete your changes, the setup program shows you the configuration command script that was created during the setup session. You can save the configuration in NVRAM, return to the setup program without saving, or return to the command-line prompt without saving the configuration.

Examples

This is an example of output from the setup command:

Switch# setup

--- System Configuration Dialog ---

Continue with configuration dialog? [yes/no]: yes

At any point you may enter a question mark '?' for help.

Use ctrl-c to abort configuration dialog at any prompt.

Default settings are in square brackets '[]'.

Basic management setup configures only enough connectivity

for management of the system, extended setup will ask you

to configure each interface on the system.

Would you like to enter basic management setup? [yes/no]: yes

Configuring global parameters:

Enter host name [Switch]:host-name

  The enable secret is a password used to protect access to

  privileged EXEC and configuration modes. This password, after

  entered, becomes encrypted in the configuration.

  Enter enable secret: enable-secret-password

  The enable password is used when you do not specify an

  enable secret password, with some older software versions, and

  some boot images.

  Enter enable password: enable-password

  The virtual terminal password is used to protect

  access to the router over a network interface.

  Enter virtual terminal password: terminal-password

  Configure SNMP Network Management? [no]: yes

  Community string [public]: 

Current interface summary

Any interface listed with OK? value "NO" does not have a valid configuration

Interface                  IP-Address      OK? Method Status                Protocol

Vlan1                      172.20.135.202  YES NVRAM  up                    up

GigabitEthernet0/1         unassigned      YES unset  up                    up

GigabitEthernet0/2         unassigned      YES unset  up                    down

<output truncated>

Port-channel1              unassigned      YES unset  up                    down

Enter interface name used to connect to the

management network from the above interface summary: vlan1

Configuring interface vlan1:

Configure IP on this interface? [yes]: yes 

IP address for this interface: ip_address

Subnet mask for this interface [255.0.0.0]: subnet_mask

Would you like to enable as a cluster command switch? [yes/no]: yes

Enter cluster name: cluster-name

The following configuration command script was created:

hostname host-name

enable secret 5 $1$LiBw$0Xc1wyT.PXPkuhFwqyhVi0

enable password enable-password

line vty 0 15

password terminal-password

snmp-server community public

!

no ip routing

!

interface GigabitEthernet0/1

no ip address

!

interface GigabitEthernet0/2

no ip address

! 

<output truncated>

cluster enable cluster-name

!

end

Use this configuration? [yes/no]: yes

!

[0] Go to the IOS command prompt without saving this config.

[1] Return back to the setup without saving this config.

[2] Save this configuration to nvram and exit.

Enter your selection [2]:

Related Commands

Command	Description
show running-config	Displays the running configuration on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
show version	Displays version information for the hardware and firmware.

setup express

Use the setup express global configuration command to enable Express Setup mode on the switch. This is the default setting. Use the no form of this command to disable Express Setup mode.

setup express

no setup express

Syntax Description

This command has no arguments or keywords.

Defaults

Express Setup is enabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(14)EA1	This command was introduced.

Usage Guidelines

When Express Setup is enabled on a new (unconfigured) switch, pressing the Mode button for 2 seconds activates Express Setup. You can access the switch through an Ethernet port by using the IP address 10.0.0.1 and then can configure the switch with the web-based Express Setup program or the command-line interface (CLI)-based setup program.

When you press the Mode button for 2 seconds on a configured switch, the mode LEDs start blinking. If you press the Mode button for a total of 10 seconds, the switch configuration is deleted, and the switch reboots. The switch can then be configured like a new switch, either through the web-based Express Setup program or the CLI-based setup program.

---

Note As soon as you make any change to the switch configuration (including entering no at the beginning of the CLI-based setup program), configuration by Express Setup is no longer available. You can only run Express Setup again by pressing the Mode button for 10 seconds. This deletes the switch configuration and reboots the switch.

---

If Express Setup is active on the switch, entering the write memory or copy running-configuration startup-configuration privileged EXEC commands deactivates Express Setup. The IP address 10.0.0.1 is no longer valid on the switch, and your connection using this IP address ends.

The primary purpose of the no setup express command is to prevent someone from deleting the switch configuration by pressing the Mode button for 10 seconds.

Examples

This example shows how to enable Express Setup mode:

Switch(config)# setup express

You can verify that Express Setup mode is enabled by pressing the Mode button:

•On an unconfigured switch, the mode LEDs begin blinking green after 2 seconds.

•On a configured switch, the mode LEDs turn solid green after a total of 10 seconds.

---

Caution If you hold the Mode button down for a total of 10 seconds, the configuration is deleted, and the switch reboots.

---

This example shows how to disable Express Setup mode:

Switch(config)# no setup express

You can verify that Express Setup mode is disabled by pressing the Mode button. The mode LEDs only turn solid green or begin blinking green if Express Setup mode is enabled on the switch.

Related Commands

Command	Description
show setup express	Displays if Express Setup mode is active on the switch.

show access-lists

Use the show access-lists privileged EXEC command to display access control lists (ACLs) configured on the switch.

show access-lists [name | number | hardware counters] [ | {begin | exclude | include} expression]

Syntax Description

name	(Optional) Name of the ACL.
number	(Optional) ACL number. The range is from 1 to 2699.
hardware counters	(Optional) Display global hardware ACL statistics for switched and routed packets.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The switch supports only IP standard and extended access lists. Therefore, the allowed numbers are only 1 to 199 and 1300 to 2699.

This command also displays the MAC ACLs that are configured.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show access-lists command:

Switch# show access-lists

Standard IP access list 13

    10 permit any

Standard IP access list permit Any

    10 permit any

Extended IP access list 101

    10 permit icmp any any conversion-error

    20 permit 234 host 172.30.40.1 host 123.23.23.2

Extended IP access list 102

    10 permit esp any any

    20 permit eigrp any any tos min-monetary-cost

Extended IP access list 103

    10 permit icmp any any 40 60

Extended IP access list CMP-NAT-ACL

    10 Dynamic Cluster-NAT permit ip any any

Extended MAC access list abc2

    10 permit host 1100.bb00.00cc host 2234.0123.2345     

This is an example of output from the show access-lists hardware counters command:

Switch# show access-lists hardware counters

Input Drops:             0 matches (0 bytes)

Output Drops:            0 matches (0 bytes)

Input Forwarded:         234781 matches (19942889 bytes)

Output Forwarded:        0 matches (0 bytes)

Input Bridge Only:       0 matches (0 bytes)

Bridge and Route in CPU: 0 matches (0 bytes)

Route in CPU:            160 matches (10344 bytes)

Related Commands

Command	Description
access-list	Configures a standard or extended numbered access list on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2 > IP Services Commands.
ip access list	Configures a named IP access list on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2 > IP Services Commands.
mac access-list extended	Configures a named or numbered MAC access list on the switch.

show archive status

Use the show archive status privileged EXEC command to display the status of a new image being downloaded to a switch with the HTTP or TFTP protocol.

show archive status [{begin | exclude | include} expression]

Syntax Description

begin	(Optional) Display begins with the line that matches the expression.
exclude	(Optional) Display excludes lines that match the expression.
include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.2(25)SE	This command was introduced.

Usage Guidelines

If you use the archive download-sw privileged EXEC command to download an image to a TFTP server, the output of the archive download-sw command shows the status of the download.

If you do not have a TFTP server, you can use Network Assistant or the embedded device manager to download the image by using the HTTP protocol. The show archive status command shows the progress of the download.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

These are examples of output from the show archive status command:

Switch# show archive status

IDLE: No upgrade in progress

Switch# show archive status

LOADING: Upgrade in progress

Switch# show archive status

EXTRACT: Extracting the image

Switch# show archive status

VERIFY: Verifying software

Switch# show archive status

RELOAD: Upgrade completed. Reload pending

Related Commands

Command	Description
archive download-sw	Downloads a new image from a TFTP server to the switch.

show auto qos

Use the show auto qos user EXEC command to display the quality of service (QoS) commands entered on the interfaces on which automatic QoS (auto-QoS) configuration is enabled.

show auto qos [interface [interface-id]

Syntax Description

interface [interface-id]

(Optional) Display auto-QoS information for the specified interface or for all interfaces. Valid interfaces include physical ports.

Command Modes

User EXEC

Command History

Release	Modification
12.1(12c)EA1	This command was introduced.
12.1(20)EA2	The information in the command output changed, and the user guidelines were updated.

Usage Guidelines

In releases earlier than Cisco IOS Release 12.1(20)EA2, the show auto qos [interface [interface-id]] command output shows the initial generated auto-QoS configuration.

In Cisco IOS Release 12.1(20)EA2 or later, the show auto qos command output shows only the auto-QoS commands entered on each interface. The show auto qos interface interface-id command output shows the auto-QoS command entered on a specific interface.

Use the show running-config privileged EXEC command to display the auto-QoS configuration and the user modifications.

To display information about the QoS configuration that might be affected by auto-QoS, use one of these commands:

•show mls qos

•show mls qos map cos-dscp

•show mls qos interface [interface-id] [buffers | queueing]

•show running-config

Examples

This is an example of output from the show auto qos command after the auto qos voip cisco-phone and the auto qos voip cisco-softphone interface configuration commands are entered:

Switch> show auto qos 

FastEthernet0/1

auto qos voip cisco-softphone

FastEthernet0/2

auto qos voip cisco-phone

FastEthernet0/4

auto qos voip cisco-softphone

This is an example of output from the show auto qos interface interface-id command when 
the auto qos voip cisco-phone interface configuration command is entered:

Switch> show auto qos interface fastethernet0/2

FastEthernet0/2

auto qos voip cisco-phone

This is an example of output from the show running-config privileged EXEC command when the auto qos voip cisco-phone and the auto qos voip cisco-softphone interface configuration commands are entered on 10/100 Ethernet interfaces:

Switch# show running-config

Building configuration...

...

mls qos map policed-dscp  24 26 46 to 0

mls qos map cos-dscp 0 8 16 26 32 46 48 56

mls qos min-reserve 5 170

mls qos min-reserve 6 85

mls qos min-reserve 7 51

mls qos min-reserve 8 34

mls qos

!

class-map match-all AutoQoS-VoIP-RTP-Trust

  match ip dscp 46

class-map match-all AutoQoS-VoIP-Control-Trust

  match ip dscp 24 26

!

!

policy-map AutoQoS-Police-SoftPhone

  class AutoQoS-VoIP-RTP-Trust

    set dscp 46

    police 320000 8000 exceed-action policed-dscp-transmit

  class AutoQoS-VoIP-Control-Trust

    set dscp 24

    police 32000 8000 exceed-action policed-dscp-transmit

!

...

interface FastEthernet0/6

 switchport mode dynamic desirable

 mls qos trust device cisco-phone

 mls qos trust cos

 auto qos voip cisco-phone

 wrr-queue bandwidth 10 20 70 1

 wrr-queue min-reserve 1 5

 wrr-queue min-reserve 2 6

 wrr-queue min-reserve 3 7

 wrr-queue min-reserve 4 8

 wrr-queue cos-map 1 0 1

 wrr-queue cos-map 2 2 4

 wrr-queue cos-map 3 3 6 7

 wrr-queue cos-map 4 5

 priority-queue out

!

interface FastEthernet0/7

 switchport mode dynamic desirable

!

interface FastEthernet0/8

 switchport mode dynamic desirable

 mls qos trust device cisco-phone

 mls qos trust cos

 auto qos voip cisco-phone

 wrr-queue bandwidth 10 20 70 1

 wrr-queue min-reserve 1 5

 wrr-queue min-reserve 2 6

 wrr-queue min-reserve 3 7

 wrr-queue min-reserve 4 8

 wrr-queue cos-map 1 0 1

 wrr-queue cos-map 2 2 4

 wrr-queue cos-map 3 3 6 7

 wrr-queue cos-map 4 5

 priority-queue out

!

<output truncated>

These are examples of output from the show auto qos command when auto-QoS is disabled on the switch:

Switch> show auto qos

AutoQoS not enabled on any interface

These are examples of output from the show auto qos interface interface-id command when auto-QoS is disabled on an interface:

Switch> show auto qos interface fastethernet0/1

AutoQoS is disabled

Related Commands

Command	Description
auto qos voip	Automatically configures QoS for VoIP within a QoS domain.

show boot

Use the show boot privileged EXEC command to display the settings of the boot environment variables.

show boot [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The Private Config file field description was added.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

---

Note Only the Cisco IOS software can read and write a copy of the private configuration file. You cannot read, write, delete, or display a copy of this file.

---

Examples

This is an example of output from the show boot command. Table 2-14 describes each field in the display.

Switch# show boot

BOOT path-list:      
flash:c3550-ipservices-mz-122-25.SEB/c3550-ipservices-mz-122-25.SEB.bin

Config file:         flash:config.text

Private Config file: flash:private-config.text

Enable Break:        no

Manual Boot:         yes

HELPER path-list:

NVRAM/Config file

      buffer size:   32768 

Table 2-14 show boot Field Descriptions

Field	Description
BOOT path-list	Displays a semicolon separated list of executable files to try to load and execute when automatically booting. If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the flash file system.
Config file	Displays the filename that Cisco IOS uses to read and write a nonvolatile copy of the system configuration.
Private Config file	Displays the filename that Cisco IOS uses to read and write a nonvolatile copy of the private configuration. Note Only the Cisco IOS software can read and write a copy of the private configuration file. You cannot read, write, delete, or display a copy of this file.
Enable Break	Displays whether a break during booting is enabled or disabled. If it is set to yes, on, or 1, you can interrupt the automatic boot process by pressing the Break key on the console after the flash file system is initialized.
Manual Boot	Displays whether the switch automatically or manually boots. If it is set to no or 0, the boot loader attempts to automatically boot the system. If it is set to anything else, you must manually boot the switch from the boot loader mode.
Helper path-list	Displays a semicolon separated list of loadable files to dynamically load during the boot loader initialization. Helper files extend or patch the functionality of the boot loader.
NVRAM/Config file buffer size	Displays the buffer size that Cisco IOS uses to hold a copy of the configuration file in memory. The configuration file cannot be larger than the buffer size allocation.

Related Commands

Command	Description
boot buffersize	Specifies the size of the file system-simulated NVRAM in flash memory.
boot config-file	Specifies the filename that Cisco IOS uses to read and write a nonvolatile copy of the system configuration.
boot enable-break	Enables interrupting the automatic boot process.
boot manual	Enables manually booting the switch during the next boot cycle.
boot private-config-file	Specifies the filename that Cisco IOS uses to read and write a nonvolatile copy of the private configuration.
boot system	Specifies the Cisco IOS image to load during the next boot cycle.

show class-map

Use the show class-map user EXEC command to display quality of service (QoS) class maps, which define the match criteria to classify traffic.

show class-map [class-map-name] [ | {begin | exclude | include} expression]

Syntax Description

class-map-name	(Optional) Display the contents of the specified class map.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show class-map command:

Switch> show class-map 

 Class Map match-any dscp_class 

   Match ip dscp 9 

Class Map match-all vlan_class

  Match vlan 10 20-30 40

  Match class-map dscp_class

Related Commands

Command	Description
class-map	Creates a class map to be used for matching packets to the class whose name you specify.
match (class-map configuration)	Defines the match criteria to classify traffic.

show cluster

Use the show cluster user EXEC command to display the cluster status and a summary of the cluster to which the switch belongs. This command can be entered on command and member switches.

show cluster [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If the switch is not a command switch or a member switch, the command displays an empty line at the prompt.

On a member switch, this command displays the identity of the command switch, the switch member number, and the state of its connectivity with the command switch.

On a command switch, this command displays the cluster name, and the total number of members. It also shows the cluster status and time since the status changed. If redundancy is enabled, it displays the primary and secondary command-switch information.

If you enter this command on a switch that is not a cluster member, the error message Not a management cluster member appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output when the show cluster command is entered on the active command switch:

Switch> show cluster

Command switch for cluster "Ajang"

        Total number of members:        7

        Status:                         1 members are unreachable

        Time since last status change:  0 days, 0 hours, 2 minutes

        Redundancy:                     Enabled

                Standby command switch: Member 1

                Standby Group:          Ajang_standby

                Standby Group Number:   110

        Heartbeat interval:             8

        Heartbeat hold-time:            80

        Extended discovery hop count:   3 

This is an example of output when the show cluster command is entered on a member switch:

Switch1> show cluster

Member switch for cluster "hapuna"

        Member number:                  3

        Management IP address:          192.192.192.192

        Command switch mac address:     0000.0c07.ac14

        Heartbeat interval:             8

        Heartbeat hold-time:            80 

This is an example of output when the show cluster command is entered on a member switch that is configured as the standby command switch:

Switch> show cluster

Member switch for cluster "hapuna"

        Member number:                  3 (Standby command switch)

        Management IP address:          192.192.192.192

        Command switch mac address:     0000.0c07.ac14

        Heartbeat interval:             8

        Heartbeat hold-time:            80 

This is an example of output when the show cluster command is entered on the command switch that has lost connectivity with member 1:

Switch> show cluster

Command switch for cluster "Ajang"

        Total number of members:        7

        Status:                         1 members are unreachable

        Time since last status change:  0 days, 0 hours, 5 minutes

        Redundancy:                     Disabled

        Heartbeat interval:             8

        Heartbeat hold-time:            80

        Extended discovery hop count:   3 

This is an example of output when the show cluster command is entered on a member switch that has lost connectivity with the command switch:

Switch> show cluster

Member switch for cluster "hapuna"

        Member number:                  <UNKNOWN>

        Management IP address:          192.192.192.192

        Command switch mac address:     0000.0c07.ac14

        Heartbeat interval:             8

        Heartbeat hold-time:            80 

Related Commands

Command	Description
cluster enable	Enables a command-capable switch as the cluster command switch, assigns a cluster name, and optionally assigns a member number to it.
show cluster candidates	Displays a list of candidate switches.
show cluster members	Displays information about the cluster members.

show cluster candidates

Use the show cluster candidates privileged EXEC command on the command switch to display a list of candidate switches.

show cluster candidates [detail | mac-address H.H.H.] [ | {begin | exclude | include} expression]

Syntax Description

detail	(Optional) Display detailed information for all candidates.
mac-address H.H.H.	(Optional) MAC address of the cluster candidate.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Enter this command only on a command switch.

If the switch is not a command switch, the command returns an empty line at the prompt.

The SN in the display means switch member number. If E appears in the SN column, it means that the switch is discovered through extended discovery. If E does not appear in the SN column, it means that the switch member number is the upstream neighbor of the candidate switch. The hop count is the number of devices the candidate is from the command switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show cluster candidates command:

Switch> show cluster candidates

                                                             |---Upstream---|

MAC Address    Name         Device Type      PortIf  FEC Hops SN PortIf  FEC

00d0.7961.c4c0 StLouis-2    WS-C3550-12T     Gi0/1        2   1  Fa0/11 

00d0.bbf5.e900 ldf-dist-128 WS-C3524-XL      Fa0/7        1   0  Fa0/24      

00e0.1e7e.be80 1900_Switch  1900             3        0   1   0  Fa0/11      

00e0.1e9f.7a00 Surfers-24   WS-C2924-XL      Fa0/5        1   0  Fa0/3       

00e0.1e9f.8c00 Surfers-12-2 WS-C2912-XL      Fa0/4        1   0  Fa0/7       

00e0.1e9f.8c40 Surfers-12-1 WS-C2912-XL      Fa0/1        1   0  Fa0/9       

This is an example of output from the show cluster candidates command that uses the MAC address of a member switch directly connected to the command switch:

Switch> show cluster candidates mac-address 00d0.7961.c4c0

Device 'Tahiti-12' with mac address number 00d0.7961.c4c0

        Device type:            cisco WS-C3512-XL

        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 0)

        Local port:             Fa0/3   FEC number: 

        Upstream port:          Fa0/13  FEC Number: 

        Hops from cluster edge: 1

        Hops from command device: 1

This is an example of output from the show cluster candidates command that uses the MAC address of a member switch three hops from the cluster edge:

Switch> show cluster candidates mac-address 0010.7bb6.1cc0

Device 'Ventura' with mac address number 0010.7bb6.1cc0

        Device type:            cisco WS-C2912MF-XL

        Upstream MAC address:   0010.7bb6.1cd4

        Local port:             Fa2/1   FEC number: 

        Upstream port:          Fa0/24  FEC Number: 

        Hops from cluster edge: 3

        Hops from command device: -

This is an example of output from the show cluster candidates detail command:

Switch> show cluster candidates detail

Device 'Tahiti-12' with mac address number 00d0.7961.c4c0

        Device type:            cisco WS-C3512-XL

        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 1)

        Local port:             Fa0/3   FEC number: 

        Upstream port:          Fa0/13  FEC Number: 

        Hops from cluster edge: 1

        Hops from command device: 2

	Device '1900_Switch' with mac address number 00e0.1e7e.be80

        Device type:            cisco 1900

        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 2)

        Local port:             3       FEC number: 0

        Upstream port:          Fa0/11  FEC Number: 

        Hops from cluster edge: 1

        Hops from command device: 2

Device 'Surfers-24' with mac address number 00e0.1e9f.7a00

        Device type:            cisco WS-C2924-XL

        Upstream MAC address:   00d0.796d.2f00 (Cluster Member 3)

        Local port:             Fa0/5   FEC number: 

        Upstream port:          Fa0/3   FEC Number: 

        Hops from cluster edge: 1

        Hops from command device: 2

Related Commands

Command	Description
show cluster	Displays the cluster status and a summary of the cluster to which the switch belongs.
show cluster members	Displays information about the cluster members.

show cluster members

Use the show cluster members privileged EXEC command on the command switch to display information about the cluster members.

show cluster members [n | detail] [ | {begin | exclude | include} expression]

Syntax Description

n	(Optional) Number that identifies a cluster member. The range is from 0 to 15.
detail	(Optional) Display detailed information for all cluster members.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

You should enter this command only on a command switch.

If the cluster has no members, this command displays an empty line at the prompt.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show cluster members command. The SN in the display means switch number.

Switch# show cluster members

                                                |---Upstream---|

SN MAC Address    Name         PortIf FEC Hops   SN PortIf  FEC  State

0  0002.4b29.2e00 StLouis1                 0                    Up   (Cmdr)

1  0030.946c.d740 tal-switch-1 Fa0/13      1     0  Gi0/1       Up

2  0002.b922.7180 nms-2820     10      0   2     1  Fa0/18      Up

3  0002.4b29.4400 SanJuan2     Gi0/1       2     1  Fa0/11      Up

4  0002.4b28.c480 GenieTest    Gi0/2       2     1  Fa0/9       Up

This is an example of output from the show cluster members for cluster member 3:

Switch# show cluster members 3

Device 'SanJuan2' with member number 3

        Device type:            cisco WS-C3550-12T

        MAC address:            0002.4b29.4400

        Upstream MAC address:   0030.946c.d740 (Cluster member 1)

        Local port:             Gi0/1   FEC number:

        Upstream port:          Fa0/11  FEC Number:

        Hops from command device: 2    

This is an example of output from the show cluster members detail command:

Switch# show cluster members detail

Device 'StLouis1' with member number 0 (Command Switch)

        Device type:            cisco WS-C3550-12T

        MAC address:            0002.4b29.2e00

        Upstream MAC address:

        Local port:                     FEC number:

        Upstream port:                  FEC Number:

        Hops from command device: 0                 

Device 'tal-switch-14' with member number 1

        Device type:            cisco WS-C3548-XL

        MAC address:            0030.946c.d740

        Upstream MAC address:   0002.4b29.2e00 (Cluster member 0)

        Local port:             Fa0/13  FEC number:

        Upstream port:          Gi0/1   FEC Number:

        Hops from command device: 1                   

Device 'nms-2820' with member number 2

        Device type:            cisco 2820

        MAC address:            0002.b922.7180

        Upstream MAC address:   0030.946c.d740 (Cluster member 1)

        Local port:             10      FEC number: 0

        Upstream port:          Fa0/18  FEC Number:

        Hops from command device: 2                        

Device 'SanJuan2' with member number 3

        Device type:            cisco WS-C3550-12T

        MAC address:            0002.4b29.4400

        Upstream MAC address:   0030.946c.d740 (Cluster member 1)

        Local port:             Gi0/1   FEC number:

        Upstream port:          Fa0/11  FEC Number:

        Hops from command device: 2

Device 'GenieTest' with member number 4

        Device type:            cisco SeaHorse

        MAC address:            0002.4b28.c480

        Upstream MAC address:   0030.946c.d740 (Cluster member 1)

        Local port:             Gi0/2   FEC number:

        Upstream port:          Fa0/9   FEC Number:

        Hops from command device: 2

Device 'Palpatine' with member number 5

        Device type:            cisco WS-C2924M-XL

        MAC address:            00b0.6404.f8c0

        Upstream MAC address:   0002.4b29.2e00 (Cluster member 0)

        Local port:             Gi2/1   FEC number:

        Upstream port:          Gi0/7   FEC Number:

        Hops from command device: 1                            

Related Commands

Command	Description
show cluster	Displays the cluster status and a summary of the cluster to which the switch belongs.
show cluster candidates	Displays a list of candidate switches.

show controllers cpu-interface

Use the show controllers cpu-interface privileged EXEC command to display the state of the CPU network interface application-specific integrated circuit (ASIC) and the send and receive statistics for packets reaching the CPU.

show controllers cpu-interface [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is a partial output example from the show controllers cpu- interface command:

Switch# show controllers cpu-interface

stp packets :950454 retrieved, 0 dropped

ram access packets :18944680 retrieved, 0 dropped

routing protocol packets :170334 retrieved, 0 dropped

forwarding packets :0 retrieved, 0 dropped

routing packets :249 retrieved, 0 dropped

L2 protocol packets :95025 retrieved, 0 dropped

igmp snooping protocol packets :746 retrieved, 0 dropped

queue7 :0 retrieved, 0 dropped

icmp redirect packets :0 retrieved, 0 dropped

icmp unreachable packets :0 retrieved, 0 dropped

logging packets :0 retrieved, 0 dropped

addr learning packets :0 retrieved, 0 dropped

rpffail packets :0 retrieved, 0 dropped

queue13 :50 retrieved, 0 dropped

queue14 :0 retrieved, 0 dropped

queue15 :0 retrieved, 0 dropped

RAM Access:

   11375600 sends   18944688 read replies       2829 write replies

   11375597 completed          0 retries          0 failures

          0 nomem          0 nobuffers          0 errors

          0 expedite toggles          0 fa-lost          0 fa-passives

SCInstance = 0xD9D558

SCInstance fields:fs_notify_failed = 0, no_fsd_space = 0

           invalid_frames = 0, unexpected_valid_frames = 0

           too_large_frames = 0

           Aged frames from notify queues and unexpected retrieves:

               aged_frames[0] = 0, unexpected_retrieves[0] = 0

               aged_frames[1] = 0, unexpected_retrieves[1] = 0

               aged_frames[2] = 0, unexpected_retrieves[2] = 0

               aged_frames[3] = 0, unexpected_retrieves[3] = 0

<output truncated>

               aged_frames[14] = 0, unexpected_retrieves[14] = 0

               aged_frames[15] = 0, unexpected_retrieves[15] = 0

           sc_cpu_buffer = 0x80000000, sc_regs = 0x81000000

           sc_notify_ram = 0x81010000

CPU Interface registers:

    0x810004A4:storage_congestion_time = 0x10

    0x810004A8:channel_number = 0x102

    0x810004AC:cpu_buffer_control = 0x1

    0x810004B0:current_time = 0x0

<output truncated>

    0x810004FC:notify_overrun_count = 0x0

    0x81000500:notify_ring_control = 0x85

    0x81000504:pci_control = 0x2A00002

<output truncated>

Related Commands

Command	Description
show controllers ethernet-controller	Displays per-interface send and receive statistics read from the hardware or the interface internal registers.
show interfaces	Displays the administrative and operational status of all interfaces or a specified interface.

show controllers ethernet-controller

Use the show controllers ethernet-controller privileged EXEC command without keywords to display per-interface send and receive statistics read from the hardware. Use with keywords to display the interface internal registers.

show controllers ethernet-controller interface-id [asic | phy] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	The physical interface.
asic	(Optional) Display the state of the internal registers on the forwarding application-specific integrated circuit (ASIC) for the interface.
phy	(Optional) Display the status of the internal registers on the switch physical layer device (PHY) for the interface.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC (only supported with the interface-id keywords in user EXEC mode)

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This display without keywords provides traffic statistics, basically the RMON statistics for the interface.

When you enter the asic or phy keyword, the displayed information is useful primarily for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show controllers ethernet-controller command. Table 2-15 describes the Transmit fields, and Table 2-16 describes the Receive fields.

Switch# show controllers ethernet-controller gigabitethernet0/2

Transmit GigabitEthernet0/2        Receive

3617834078 Bytes                 39726165 Bytes

    419261 Unicast frames          161535 Unicast frames

  82798461 Multicast frames        146421 Multicast frames

     12718 Broadcast frames             1 Broadcast frames

         0 Discarded frames             0 No dest, unicast

         0 Too old frames              43 No dest, multicast

         0 Deferred frames              0 No dest, broadcast

         0  1 collision frames

         0  2 collision frames          0 FCS errors

         0  3 collision frames          0 Oversize frames

         0  4 collision frames          0 Undersize frames

         0  5 collision frames          0 Collision fragments

         0  6 collision frames

         0  7 collision frames     220108 Minimum size frames

         0  8 collision frames     60959  65 to 127 byte frames

         0  9 collision frames          0 128 to 255 byte frames

         0 10 collision frames      26931 256 to 511 byte frames

         0 11 collision frames          0 512 to 1023 byte frames

         0 12 collision frames          0 1024 to 1518 byte frames

         0 13 collision frames

         0 14 collision frames          0 Flooded frames

         0 15 collision frames          0 Overrun frames

         0 Excessive collisions        16 VLAN filtered frames

         0 Late collisions              0 Source routed frames

         0 Good (1 coll) frames         0 Valid oversize frames

         0 Good(>1 coll) frames         0 Pause frames

         0 Pause frames                 0 Symbol error frames

         0 VLAN discard frames          0 Invalid frames, too large

         0 Excess defer frames          0 Valid frames, too large

         0 Too large frames             0 Invalid frames, too small

  80469577 64 byte frames               3 Valid frames, too small

   2605574 127 byte frames

     58711 255 byte frames

     26956 511 byte frames

     70222 1023 byte frames

         0 1518 byte frames

Table 2-15 Transmit Field Descriptions 

Field	Description
Bytes	The total number of bytes sent on an interface.
Unicast frames	The total number of frames sent to unicast addresses.
Multicast frames	The total number of frames sent to multicast addresses.
Broadcast frames	The total number of frames sent to broadcast addresses.
Discarded frames	The number of frames dropped on an interface.
Too old frames	The number of frames dropped on the egress port because the packet aged out.
Deferred frames	The number of frames that are not sent after the time exceeds 2*maximum-packet time.
1 collision frames	The number of frames that are successfully sent on an interface after one collision occurs.
2 collision frames	The number of frames that are successfully sent on an interface after two collisions occur.
3 collision frames	The number of frames that are successfully sent on an interface after three collisions occur.
4 collision frames	The number of frames that are successfully sent on an interface after four collisions occur.
5 collision frames	The number of frames that are successfully sent on an interface after five collisions occur.
6 collision frames	The number of frames that are successfully sent on an interface after six collisions occur.
7 collision frames	The number of frames that are successfully sent on an interface after seven collisions occur.
8 collision frames	The number of frames that are successfully sent on an interface after eight collisions occur.
9 collision frames	The number of frames that are successfully sent on an interface after nine collisions occur.
10 collision frames	The number of frames that are successfully sent on an interface after ten collisions occur.
11 collision frames	The number of frames that are successfully sent on an interface after 11 collisions occur.
12 collision frames	The number of frames that are successfully sent on an interface after 12 collisions occur.
13 collision frames	The number of frames that are successfully sent on an interface after 13 collisions occur.
14 collision frames	The number of frames that are successfully sent on an interface after 14 collisions occur.
15 collision frames	The number of frames that are successfully sent on an interface after 15 collisions occur.
Excessive collisions	The number of frames that could not be sent on an interface after 16 collisions occur.
Late collisions	After a frame is sent, the number of frames dropped because late collisions were detected while the frame was sent.
Good (1 coll) frames	The number of frames that are successfully sent on an interface after one collision occurs. This value does not include the number of frames that are not successfully sent after one collision occurs.
Good (>1 coll) frames	The number of frames that are successfully sent on an interface after more than one but less than 15 collisions occur. This value does not include the number of frames that are not successfully sent after more than one collision occurs.
Pause frames	The number of pause frames sent on an interface.
VLAN discard frames	The number of frames dropped on an interface because the CFI1 bit is set.
Excess defer frames	The number of frames that are not sent after the time exceeds the maximum-packet time.
Too large frames	The number of frames sent on an interface that are larger than the maximum allowed frame size.
64 byte frames	The total number of frames sent on an interface that are 64 bytes.
127 byte frames	The total number of frames sent on an interface that are from 65 to 127 bytes.
255 byte frames	The total number of frames sent on an interface that are from 128 to 255 bytes.
511 byte frames	The total number of frames sent on an interface that are from 256 to 511 bytes.
1023 byte frames	The total number of frames sent on an interface that are from 512 to 1023 bytes.
1518 byte frames	The total number of frames sent on an interface that are from 1024 to 1518 bytes.

1 CFI = Canonical Format Indicator

Table 2-16 Receive Field Descriptions 

Field	Description
Bytes	The total amount of memory (in bytes) used by frames received on an interface, including the FCS1 value and the incorrectly formed frames. This value excludes the frame header bits.
Unicast Frames	The total number of frames successfully received on the interface that are forwarded to unicast addresses.
Multicast frames	The total number of frames successfully received on the interface that are forwarded to multicast addresses.
Broadcast frames	The total number of frames successfully received on an interface that are forwarded to broadcast addresses.
No dest, unicast	The total number of frames received with a unicast destination address that cannot be forwarded.
No dest, multicast	The total number of frames received with a multicast destination address that cannot be forwarded.
No dest, broadcast	The total number of frames received with a broadcast destination address that cannot be forwarded.
FCS errors	The total number of frames received on an interface that have a valid length (in bytes) but do not have the correct FCS values.
Oversize frames	The number of frames received on an interface that are larger than the maximum allowed frame size.
Undersize frames	The number of frames received on an interface that are smaller than 64 bytes.
Collision fragments	The number of collision fragments received on an interface.
Minimum size frames	The total number of frames that are the minimum frame size.
65 to 127 byte frames	The total number of frames that are from 65 to 127 bytes.
128 to 255 byte frames	The total number of frames that are from 128 to 255 bytes.
256 to 511 byte frames	The total number of frames that are from 256 to 511 bytes.
512 to 1023 byte frames	The total number of frames that are from 512 to 1023 bytes.
1024 to 1518 byte frames	The total number of frames that are from 1024 to 1518 bytes.
Flooded frames	The total number of flooded frames received on an interface.
Overrun frames	The total number of overrun frames received on an interface.
VLAN filtered frames	The total number of frames that are filtered because of the VLAN information in the frame, such as an IEEE 802.1Q tag or a VLAN ID other than the IDs configured on the interface. This value does not include frames that are smaller than 64 bytes or larger than the maximum frame size
Source routed frames	The total number of frames received on an interface that are dropped because the source route bit is set in the source address of the native frame. This value includes frames that have a valid FCS value and are between 64 bytes and the maximum allowed frame size.
Valid oversize frames	The number of frames received on an interface that are larger than the maximum allowed frame size and have valid FCS values. The frame size includes the FCS value but does not include the VLAN tag.
Pause frames	The number of pause frames received on an interface.
Symbol error frames	The number of frames received on an interface that have symbol errors.
Invalid frames, too large	The number of frames received that were larger than maximum allowed MTU2 size (including the FCS bits and excluding the frame header) and that have either an FCS error or an alignment error.
Valid frames, too large	The number of frames received on an interface that are larger than the maximum allowed frame size.
Invalid frames, too small	The number of frames received that are smaller than 64 bytes (including the FCS bits and excluding the frame header) and that have either an FCS error or an alignment error.
Valid frames, too small	The number of frames received on an interface that are smaller than 64 bytes (or 68 bytes for VLAN-tagged frames) and have valid FCS values. The frame size includes the FCS bits but excludes the frame header bits.

1 FCS = frame check sequence 2 MTU = maximum transmission unit

Related Commands

Command	Description
show controllers cpu-interface	Displays the state of the CPU network ASIC and send and receive statistics for packets reaching the CPU.
show interfaces	Displays the administrative and operational status of all interfaces or a specified interface.

show controllers switch

Use the show controllers switch privileged user command to display the settings of the resource-allocation priority or the wirespeed-store feature.

show controllers switch {resource-allocation priority | wirespeed-store} [ | {begin | exclude | include} expression]

Syntax Description

resource-allocation priority	Display the resource-allocation priority setting.
wirespeed-store	Display the wirespeed setting.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(6)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show controllers switch resource-allocation priority command:

Switch> show controllers resource-allocation priority

Switch Priority Resource Allocation is enabled.

Related Commands

Command	Description
switchcore resource-allocation priority switchcore wirespeed-store	Reserves switch resources for high-priority traffic or gives buffer storage more priority than packet retrieval.

show controllers tcam

Use the show controllers tcam privileged EXEC command to display the state of the registers for all ternary content addressable memory (TCAM) in the system and for all TCAM interface application-specific integrated circuits (ASICs) that are CAM controllers.

show controllers tcam [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show controllers tcam command:

Switch# show controllers tcam

CAM Controller 1:

  Revision: 5A5A5A00, Control: 0000025F, Status: 00000000.

  CAM 1:

    Revision: 00 00000000 00B30101

    Size: 00 00000000 00080040

    Device ID: 00 00000000 00000000

    Config: 00 00000000 88000002

    ReplyID[0]: 00 00000000 00000000

    ReplyID[1]: 00 00000000 00000000

    ReplyID[2]: 00 00000000 00000000

    ReplyID[3]: 00 00000000 00000000

    Hit Result[0]: 00 00000000 00000000

    Hit Result[1]: 00 00000000 00000000

    Hit Result[2]: 00 00000000 00000000

    Hit Result[3]: 00 00000000 00000000

    Hit Result[4]: 00 00000000 00000000

    Hit Result[5]: 00 00000000 00000000

    Hit Result[6]: 00 00000000 00000000

    Hit Result[7]: 00 E00004E8 40001A63

    Global Mask[10]: FF FFFFFFFF FFFFFFFF

    Global Mask[11]: FF FFFFFFFF FFFFFFFF

    Global Mask[12]: FF FFFFFFFF FFFFFFFF

    Global Mask[13]: FF FFFFFFFF FFFFFFFF

    Global Mask[14]: FF FFFFFFFF FFFFFFFF

    Global Mask[15]: FF FFFFFFFF FFFFFFFF

    Global Mask[16]: FF FFFFFFFF FFFFFFFF

    Global Mask[20]: FF FFFFFFFF FFFFFFFF

    Global Mask[21]: FF FFFFFFFF FFFFFFFF

    Global Mask[22]: FF FFFFFFFF FFFFFFFF

    Global Mask[23]: FF FFFFFFFF FFFFFFFF

    Global Mask[24]: FF FFFFFFFF FFFFFFFF

    Global Mask[25]: FF FFFFFFFF FFFFFFFF

    Global Mask[26]: FF FFFFFFFF FFFFFFFF

    Global Mask[27]: FF FFFFFFFF FFFFFFFF

    Global Mask[30]: FF FFFFFFFF FFFFFFFF

    Global Mask[31]: FF FFFFFFFF FFFFFFFF

    Global Mask[32]: FF FFFFFFFF FFFFFFFF

    Global Mask[33]: FF FFFFFFFF FFFFFFFF

  CAM 2:

    Revision: 00 00000000 00B30101

    Size: 00 00000000 00080040

    Device ID: 00 00000000 00000001

    Config: 00 00000000 B8000022

    ReplyID[0]: 00 01010101 01010101

    ReplyID[1]: 00 01010101 01010101

   ReplyID[2]: 00 01010101 01010101

   ReplyID[3]: 00 01010101 01010101

   Hit Result[0]: 00 00000000 00000000

   Hit Result[1]: 00 00000000 00000000

   Hit Result[2]: 00 00000000 00000000

   Hit Result[3]: 00 00000000 00000000

   Hit Result[4]: 00 00000000 00000000

   Hit Result[5]: 00 00000000 00000000

   Hit Result[6]: 00 00000000 00000000

   Hit Result[7]: 00 60003880 C00011D3

   Global Mask[10]: FF FFFFFFFF FFFFFFFF

   Global Mask[11]: FF FFFFFFFF FFFFFFFF

   Global Mask[12]: FF FFFFFFFF FFFFFFFF

   Global Mask[13]: FF FFFFFFFF FFFFFFFF

   Global Mask[14]: FF FFFFFFFF FFFFFFFF

   Global Mask[15]: FF FFFFFFFF FFFFFFFF

   Global Mask[16]: FF FFFFFFFF FFFFFFFF

   Global Mask[20]: FF FFFFFFFF FFFFFFFF

   Global Mask[21]: FF FFFFFFFF FFFFFFFF

   Global Mask[22]: FF FFFFFFFF FFFFFFFF

<output truncated>

show controllers utilization

Use the show controllers utilization user EXEC command to display bandwidth utilization on the switch or specific ports.

show controllers [interface-id] utilization [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) ID of the switch interface.
| begin	(Optional) Display begins with the line that matches the specified expression.
| exclude	(Optional) Display excludes lines that match the specified expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SE	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show controllers utilization command.

Switch> show controllers utilization

Port       Receive Utilization  Transmit Utilization

Fa0/1              0                    0

Fa0/2              0                    0

<output truncated>

Total Ports : 12

Switch Receive Bandwidth Percentage Utilization  : 0

Switch Transmit Bandwidth Percentage Utilization : 0

Switch Fabric Percentage Utilization : 0

This is an example of output from the show controllers utilization command on a specific port:

Switch> show controllers fastethernet0/1 utilization

Receive Bandwidth Percentage Utilization   : 0

Transmit Bandwidth Percentage Utilization  : 0

Table 2-17 show controllers utilization Field Descriptions

Field	Description
Receive Bandwidth Percentage Utilization	Displays the received bandwidth usage of the switch, which is the sum of the received traffic on all the ports divided by the switch receive capacity.
Transmit Bandwidth Percentage Utilization	Displays the transmitted bandwidth usage of the switch, which is the sum of the transmitted traffic on all the ports divided it by the switch transmit capacity.
Fabric Percentage Utilization	Displays the average of the transmitted and received bandwidth usage of the switch.

Related Commands

Command	Description
show controllers ethernet-controller	Displays the interface internal registers.

show dot1q-tunnel

Use the show dot1q-tunnel user EXEC command to display information about IEEE 802.1Q tunnel ports.

show dot1q-tunnel [interface interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id	(Optional) Specify the interface for which to display IEEE 802.1Q tunneling information. Valid interfaces include physical ports and port channels.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

These are examples of output from the show dot1q-tunnel command:

Switch> show dot1q-tunnel

LAN Port(s)

-----

Gi0/1

Gi0/2

Gi0/3

Gi0/6

Po2

Switch> show dot1q-tunnel interface gigabitethernet0/1 

LAN Port(s)

-----

Gi0/1

Related Commands

Command	Description
show vlan dot1q tag native	Displays IEEE 802.1Q native VLAN tagging status.
switchport mode dot1q-tunnel	Configures an interface as an IEEE 802.1Q tunnel port.

show dot1x

Use the show dot1x user EXEC command to display IEEE 802.1x statistics, administrative status, and operational status for the switch or for the specified interface.

show dot1x [{all [summary] | interface interface-id} [details | statistics]] [ | {begin | exclude | include} expression]

Syntax Description

all [summary]	(Optional) Display the IEEE 802.1x status for all ports.
interface interface-id	(Optional) Display the IEEE 802.1x status for the specified interface.
details	(Optional) Display the IEEE 802.1x interface details.
statistics	(Optional) Display IEEE 802.1x statistics for the specified port.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(8)EA1	This command was introduced.
12.1(14)EA1	The all keyword was added.
12.2(25)SED	The display was expanded to include auth-fail-vlan in the authorization state machine state and port status fields.
12.2(25)SEE	The command syntax was changed, and the command output was modified.

Usage Guidelines

If you do not specify a port, global parameters and a summary appear. If you specify a port, details for that port appear.

If the port control is configured as unidirectional or bidirectional control and this setting conflicts with the switch configuration, the show dot1x {all | interface interface-id} privileged EXEC command output has this information:

ControlDirection          = In (Inactive)

If you do not specify an interface, global parameters and a summary appear. If you specify an interface, details for that interface appear.

If you specify the statistics keyword without the interface interface-id option, statistics appear for all interfaces. If you specify the statistics keyword with the interface interface-id option, statistics appear for the specified interface.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show dot1x user EXEC command:

Switch> show dot1x 

Sysauthcontrol              Enabled

Dot1x Protocol Version            2

Critical Recovery Delay         100

Critical EAPOL             Disabled

This is an example of output from the show dot1x all user EXEC command:

Switch> show dot1x all

Sysauthcontrol              Enabled

Dot1x Protocol Version            2

Critical Recovery Delay         100

Critical EAPOL             Disabled

Dot1x Info for FastEthernet0/1

-----------------------------------

PAE                       = AUTHENTICATOR

PortControl               = AUTO

ControlDirection          = Both

HostMode                  = SINGLE_HOST

ReAuthentication          = Disabled

QuietPeriod               = 60

ServerTimeout             = 30

SuppTimeout               = 30

ReAuthPeriod              = 3600 (Locally configured)

ReAuthMax                 = 2

MaxReq                    = 2

TxPeriod                  = 30

RateLimitPeriod           = 0

<output truncated>

This is an example of output from the show dot1x all summary user EXEC command:

Interface       PAE     Client          Status

--------------------------------------------------------

Fa0/1           AUTH    none            UNAUTHORIZED

Fa0/2           AUTH    00a0.c9b8.0072  AUTHORIZED

Fa0/3           AUTH    none            UNAUTHORIZED

This is an example of output from the show dot1x interface interface-id user EXEC command:

Switch> show dot1x interface fastethernet0/2

Dot1x Info for FastEthernet0/2

-----------------------------------

PAE                       = AUTHENTICATOR

PortControl               = AUTO

ControlDirection          = In

HostMode                  = SINGLE_HOST

ReAuthentication          = Disabled

QuietPeriod               = 60

ServerTimeout             = 30

SuppTimeout               = 30

ReAuthPeriod              = 3600 (Locally configured)

ReAuthMax                 = 2

MaxReq                    = 2

TxPeriod                  = 30

RateLimitPeriod           = 0

This is an example of output from the show dot1x interface interface-id details user EXEC commmand:

Switch# show dot1x interface fastethernet0/2 details

Dot1x Info for FastEthernet0/2

-----------------------------------

PAE                       = AUTHENTICATOR

PortControl               = AUTO

ControlDirection          = Both

HostMode                  = SINGLE_HOST

ReAuthentication          = Disabled

QuietPeriod               = 60

ServerTimeout             = 30

SuppTimeout               = 30

ReAuthPeriod              = 3600 (Locally configured)

ReAuthMax                 = 2

MaxReq                    = 2

TxPeriod                  = 30

RateLimitPeriod           = 0

Dot1x Authenticator Client List Empty

This is an example of output from the show dot1x interface interface-id details command when a port is assigned to a guest VLAN and the host mode changes to multiple-hosts mode:

Switch# show dot1x interface fastethernet0/1 details

Dot1x Info for FastEthernet0/1

-----------------------------------

PAE                       = AUTHENTICATOR

PortControl               = AUTO

ControlDirection          = Both 

HostMode                  = SINGLE_HOST

ReAuthentication          = Enabled

QuietPeriod               = 60

ServerTimeout             = 30

SuppTimeout               = 30

ReAuthPeriod              = 3600 (Locally configured)

ReAuthMax                 = 2

MaxReq                    = 2

TxPeriod                  = 30

RateLimitPeriod           = 0

Guest-Vlan                = 182

Dot1x Authenticator Client List Empty

Port Status               = AUTHORIZED

Authorized By             = Guest-Vlan

Operational HostMode      = MULTI_HOST 

Vlan Policy               = 182

This is an example of output from the show dot1x interface interface-id statistics command. Table 2-18 describes the fields in the display.

Switch> show dot1x interface fastethernet0/2 statistics

Dot1x Authenticator Port Statistics for FastEthernet0/2

--------------------------------------------

RxStart = 0     RxLogoff = 0    RxResp = 1      RxRespID = 1

RxInvalid = 0   RxLenErr = 0    RxTotal = 2

TxReq = 2       TxReqID = 132   TxTotal = 134

RxVersion = 2   LastRxSrcMAC = 00a0.c9b8.0072

Table 2-18 show dot1x statistics Field Descriptions 

Field	Description
RxStart	Number of valid EAPOL-start frames that have been received.
RxLogoff	Number of EAPOL-logoff frames that have been received.
RxResp	Number of valid EAP-response frames (other than response/identity frames) that have been received.
RxRespID	Number of EAP-response/identity frames that have been received.
RxInvalid	Number of EAPOL frames that have been received and have an unrecognized frame type.
RxLenError	Number of EAPOL frames that have been received in which the packet body length field is invalid.
RxTotal	Number of valid EAPOL frames of any type that have been received.
TxReq	Number of EAP-request frames (other than request/identity frames) that have been sent.
TxReqId	Number of Extensible Authentication Protocol (EAP)-request/identity frames that have been sent.
TxTotal	Number of Extensible Authentication Protocol over LAN (EAPOL) frames of any type that have been sent.
RxVersion	Number of received packets in the IEEE 802.1x Version 1 format.
LastRxSrcMac	Source MAC address carried in the most recently received EAPOL frame.

Related Commands

Command	Description
dot1x control-direction	Resets the configurable IEEE 802.1x parameters to their default values.

show env

Use the show env user EXEC command to display fan, temperature, and power information for the switch.

show env {all | fan | power | rps | temperature} [ | {begin | exclude | include} expression]

Syntax Description

all	Display both fan and temperature environmental status.
fan	Display the switch fan status.
power	Display the switch power status.
rps	Display the Redundant Power System (RPS) status.
temperature	Display the switch temperature status.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The power and rps keywords were added.
12.1(12c)EA1	The fan and power keywords were added.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show env all command:

Switch> show env all

FAN is FAULTY

TEMPERATURE is OK 

This is an example of output from the show env power command:

Switch> show env power

POWER is OK

This is an example of output from the show env rps command:

Switch> show env rps

RPS is NOT PRESENT

show errdisable detect

show errdisable detect [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show errdisable detect command:

Switch> show errdisable detect

ErrDisable Reason    Detection status

-----------------    ----------------

udld                 Enabled

bpduguard            Enabled

security-violatio    Enabled

channel-misconfig    Enabled

psecure-violation    Enabled

vmps                 Enabled

loopback             Enabled

unicast-flood        Enabled

pagp-flap            Enabled

dtp-flap             Enabled

link-flap            Enabled

l2ptguard            Enabled

gbic-invalid         Enabled

dhcp-rate-limit      Enabled

unicast-flood        Enabled

storm-control        Enabled

ilpower              Enabled

arp-inspection       Enabled

---

Note Though visible in the output, the arp-inspection, ilpower, storm-control, and unicast-flood fields are not valid.

---

Related Commands

Command	Description
errdisable detect cause	Enables error-disable detection for a specific cause or all causes.
show errdisable flap-values	Displays error condition recognition information.
show errdisable recovery	Displays error-disable recovery timer information.
show interfaces status	Displays interface status or a list of interfaces in error-disabled state.

show errdisable flap-values

Use the show errdisable flap-values user EXEC command to display conditions that cause an error to be recognized for a cause.

show errdisable flap-values [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The Flaps column in the display shows how many changes to the state within the specified time interval will cause an error to be detected and a port to be disabled. For example, the display shows that an error will be assumed and the port shut down if three Dynamic Trunking Protocol (DTP)-state (port mode access/trunk) or Port Aggregation Protocol (PAgP) flap changes occur during a 30-second interval, or if 5 link-state (link up/down) changes occur during a 10-second interval.

ErrDisable Reason    Flaps    Time (sec)

-----------------    ------   ----------

pagp-flap              3       30

dtp-flap               3       30

link-flap              5       10

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show errdisable flap-values command:

Switch> show errdisable flap-values

ErrDisable Reason    Flaps    Time (sec)

-----------------    ------   ----------

pagp-flap              3       30

dtp-flap               3       30

link-flap              5       10

Related Commands

Command	Description
errdisable detect cause	Enables error-disable detection for a specific cause or all causes.
show errdisable detect	Displays error-disable detection status.
show errdisable recovery	Displays error-disable recovery timer information.
show interfaces status	Displays interface status or a list of interfaces in error-disabled state.

show errdisable recovery

Use the show errdisable recovery user EXEC command to display the error-disable recovery timer information.

show errdisable recovery [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show errdisable recovery command:

Switch> show errdisable recovery

ErrDisable Reason    Timer Status

-----------------    --------------

udld                 Disabled

bpduguard            Disabled

security-violatio    Disabled

channel-misconfig    Disabled

vmps                 Disabled

pagp-flap            Disabled

dtp-flap             Disabled

link-flap            Disabled

l2ptguard            Disabled

psecure-violation    Disabled

gbic-invalid         Disabled

dhcp-rate-limit      Disabled

unicast-flood        Disabled

storm-control        Disabled

arp-inspection       Disabled

loopback             Disabled

Timer interval:300 seconds

Interfaces that will be enabled at the next timeout:

Interface    Errdisable reason    Time left(sec)

---------    -----------------    --------------

Gi0/4           link-flap             279 

---

Note Though visible in the output, the unicast-flood field is not valid.

---

Related Commands

Command	Description
errdisable recovery	Configures the recover mechanism variables.
show errdisable detect	Displays error disable detection status.
show errdisable flap-values	Displays error condition recognition information.
show interfaces status	Displays interface status or a list of interfaces in error-disabled state.

show etherchannel

Use the show etherchannel user EXEC command to display EtherChannel information for a channel.

show etherchannel [channel-group-number] {detail | load-balance | port | port-channel | summary | protocol} [ | {begin | exclude | include} expression]

Syntax Description

channel-group-number	(Optional) Number of the channel group. The range is 1 to 64.
detail	Display detailed EtherChannel information.
load-balance	Display the load-balance or frame-distribution scheme among ports in the port channel.
port	Display EtherChannel port information.
port-channel	Display port-channel information.
protocol	Display the protocol that is being used in the EtherChannel.
summary	Display a one-line summary per channel-group.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(14)EA1	The brief keyword was removed.

Usage Guidelines

If you do not specify a channel-group, all channel groups appear.

In the output, the Passive port list field appears only for Layer 3 port channels. This field means that the physical interface, which is still not up, is configured to be in the channel group (and indirectly is in the only port channel in the channel group).

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show etherchannel 1 detail command:

Switch> show etherchannel 1 detail

Group state = L2 

Ports: 2   Maxports = 8 

Port-channels: 1 Max Port-channels = 1

                Ports in the group:

                -------------------

Port: Gi0/1

------------

Port state    = Up Mstr In-Bndl 

Channel group = 1           Mode = Desirable-Sl     Gcchange = 0

Port-channel  = Po1         GC   = 0x00010001    Pseudo port-channel = Po1

Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.        P - Device learns on physical port.

        d - PAgP is down.

Timers: H - Hello timer is running.        Q - Quit timer is running.

        S - Switching timer is running.    I - Interface timer is running.

Local information:

                                Hello    Partner  PAgP     Learning  Group

Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex

Gi0/1     SC    U6/S7   H       30s      1        128        Any      16

Partner's information:

          Partner              Partner          Partner         Partner Group

Port      Name                 Device ID        Port       Age  Flags   Cap.

Gi0/1     vegas-p2             0002.4b29.4600   Gi0/1        9s SC      10001 

Age of the port in the current state: 00d:00h:07m:52s

Port: Gi0/2

------------

Port state    = Up Mstr In-Bndl 

Channel group = 1           Mode = Desirable-Sl     Gcchange = 0

Port-channel  = Po1         GC   = 0x00010001    Pseudo port-channel = Po1

Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.        P - Device learns on physical port.

        d - PAgP is down.

Timers: H - Hello timer is running.        Q - Quit timer is running.

        S - Switching timer is running.    I - Interface timer is running.

Local information:

                                Hello    Partner  PAgP     Learning  Group

Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex

Gi0/2     SC    U6/S7   H       30s      1        128        Any      16

Partner's information:

          Partner              Partner          Partner         Partner Group

Port      Name                 Device ID        Port       Age  Flags   Cap.

Gi0/2     vegas-p2             0002.4b29.4600   Gi0/2        4s SC      10001 

Age of the port in the current state: 00d:00h:07m:55s

                Port-channels in the group: 

                ----------------------

Port-channel: Po1

------------

Age of the Port-channel   = 00d:00h:08m:28s

Logical slot/port   = 1/0           Number of ports = 2

GC                  = 0x00010001      HotStandBy port = null

Port state          = Port-channel Ag-Inuse 

Ports in the Port-channel: 

Index   Load   Port    EC state

------+------+------+------------

  0     00     Gi0/1    desirable-sl  

  0     00     Gi0/2    desirable-sl  

Time since last port bundled:    00d:00h:07m:56s    Gi0/1

This is an example of output from the show etherchannel 1 protocol command:

Switch# show etherchannel 1 protocol

Protocol:  LACP

This is an example of output from the show etherchannel 1 summary command:

Switch> show etherchannel 1 summary

Flags:  D - down        P - in port-channel

        I - stand-alone s - suspended

        R - Layer3      S - Layer2

        U - port-channel in use

Group Port-channel  Ports

-----+------------+-----------------------------------------------------------

1     Po1(SU)     Gi0/1(P)   Gi0/2(P) 

This is an example of output from the show etherchannel 1 port-channel command:

Switch> show etherchannel 1 port-channel 

Port-channels in the group: 

                ----------------------

Port-channel: Po1

------------

Age of the Port-channel   = 00d:00h:10m:41s

Logical slot/port   = 1/0           Number of ports = 2

GC                  = 0x00010001      HotStandBy port = null

Port state          = Port-channel Ag-Inuse 

Ports in the Port-channel: 

Index   Load   Port    EC state

------+------+------+------------

  0     00     Gi0/1    desirable-sl  

  0     00     Gi0/2    desirable-sl  

Time since last port bundled:    00d:00h:10m:08s    Gi0/1

Related Commands

Command	Description
channel-group	Assigns an Ethernet interface to an EtherChannel group.
interface port-channel	Accesses or creates the port channel.

show fallback profile

Use the show fallback profile privileged EXEC command to display the fallback profiles that are configured on a switch.

show fallback profile [append | begin | exclude | include | {[redirect | tee] url} expression]

Syntax Description

| append	(Optional) Append redirected output to a specified URL
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
| redirect	(Optional) Copy output to a specified URL.
| tee	(Optional) Copy output to a specified URL.
expression	Expression in the output to use as a reference point.
url	Specified URL where output is directed.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.2(35)SE	This command was introduced.

Usage Guidelines

Use the show fallback profile privileged EXEC command to display profiles that are configured on the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show fallback profile command:

switch# show fall profile 

Profile Name: dot1x-www

------------------------------------

Description       : NONE

IP Admission Rule : webauth-fallback

IP Access-Group IN: default-policy

Profile Name: dot1x-www-lpip

------------------------------------

Description       : NONE

IP Admission Rule : web-lpip

IP Access-Group IN: default-policy

Profile Name: profile1

------------------------------------

Description       : NONE

IP Admission Rule : NONE

IP Access-Group IN: NONE

Related Commands

Command	Description
dot1x fallback	Configure a port to use web authentication as a fallback method for clients that do not support IEEE 802.1x authentication.
fallback profile	Create a web authentication fallback profile.
ip admission	Enable web authentication on a switch port
ip admission name proxy http	Enable web authentication globally on a switch
show dot1xnterface interface-id]	Displays IEEE 802.1x status for the specified port.

show flowcontrol

Use the show flowcontrol user EXEC command to display the flow control status and statistics.

show flowcontrol [interface interface-id | module module-number] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id	(Optional) Display the flow control status and statistics for a specific interface.
module module-number	(Optional) Display the flow control status and statistics for all interfaces. The only valid module-slot value is 0.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(14)EA1	This command was introduced.

Usage Guidelines

Use this command to display the flow control status and statistics on the switch or about a specific interface.

Use the show flowcontrol command to display information about all the switch interfaces. The output from the show flowcontrol command is the same as the output from the show flowcontrol module module-number command.

Use the show flowcontrol interface interface-id command to display information about the Gigabit Ethernet interfaces on the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show flowcontrol command:

Switch> show flowcontrol

Port       Send FlowControl  Receive FlowControl  RxPause TxPause

           admin    oper     admin    oper

---------  -------- -------- -------- --------    ------- -------

Gi0/1      Unsupp.  Unsupp.  off      off         0       0

Gi0/2      desired  off      off      off         0       0

<output truncated>

This is an example of output from the show flowcontrol interface interface-id command:

Switch> show flowcontrol gigabitethernet0/2

Port       Send FlowControl  Receive FlowControl  RxPause TxPause

           admin    oper     admin    oper

---------  -------- -------- -------- --------    ------- -------

Gi0/2      desired  off      off      off         0       0

Related Commands

Command	Description
flowcontrol	Sets the receive flow-control state for an interface.

show fm

Use the show fm privileged EXEC command to display feature-manager information for a specified port label or VLAN label to list features associated with that label, including if any features were not able to fit in the hardware or if configuration conflicts have occurred. Use the show fm interface or show fm vlan command to determine the port-label or vlan-label number.

show fm {{port-label label-id} | {vlan-label label-id}} [ | {begin | exclude | include} expression]

Syntax Description

port-label label-id	Port labels are used features configured on a port, such as port ACLs. The range is 0 to 127.
vlan-label label-id	VLAN labels are used for features configured on VLANs, such as router ACLs and VLAN maps. The range is 0 to 255.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The label keyword was replaced by the port-label and vlan-label keywords.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

When the output shows Conflicts exist with other access groups, there is a configuration conflict with access control lists (ACLs) on the switch. You are trying to apply a port ACL to a switch that already has VLAN maps or input router ACLs applied; or you are trying to apply an input router ACL or VLAN map to a switch that has port ACLs applied.

When the output shows an unloaded indicator or no number following the Loaded into CAM(s): entry, the feature was not loaded in the hardware. To allocate more system resources to maximize the number of security ACLs that can fit in the hardware, you can use the sdm prefer access global configuration command to set the Switch Database Management feature to the access template.

If the output shows a merge failure, the sdm prefer access global configuration command has no effect.

Examples

You can enter the show fm interface privileged EXEC command for an interface to learn the port-label number for the port. You can then enter the show fm port-label privileged EXEC command to display more details, as shown in this example:

Switch# show fm interface gigabitethernet0/1

Conflicts exist with layer 3 access groups.

Input Port Label:2

Switch# show fm port-label 2

Conflicts exist with layer 3 access groups.

Needed in CAM(s):1

Loaded into CAM(s):1

Sent to CPU by CAM(s):

Interfaces: Gi0/1

IP Access Group:ip3 0 VMRs

DHCP Broadcast Suppression Disabled.

MAC Access Group:(None) 0 VMRs

This example of the show fm port-label 3 output shows that there was not enough room in hardware to load an ACL. Label 3 is needed in CAM 1 but is not loaded in CAM 1; instead, it is sent to the CPU.

Switch# show fm port-label 3

Needed in CAM(s):1

Loaded into CAM(s):

Sent to CPU by CAM(s):1

Interfaces: Gi0/3

IP Access Group:100 3400 VMRs

DHCP Broadcast Suppression Disabled.

MAC Access Group:(None) 2 VMRs

This is an example of output from the show fm vlan-label command when there has been a merge failure on an input access-group:

Switch# show fm vlan-label 1

Unloaded due to merge failure or lack of space:

  InputAccessGroup 

  Merge Fail:input

Input Features:

  Interfaces or VLANs: Vl1

  Priority:normal

  Vlan Map:(none)

  Access Group:131, 6788 VMRs

  Multicast Boundary:(none), 0 VMRs

Output Features:

  Interfaces or VLANs:

  Priority:low

  Bridge Group Member:no

  Vlan Map:(none)

  Access Group:(none), 0 VMRs

This is an example of output from the show fm vlan-label command when there was not enough room for an input access group in the hardware:

Switch# show fm vlan-label 1

Unloaded due to merge failure or lack of space:

  InputAccessGroup 

Input Features:

  Interfaces or VLANs: Vl1

  Priority:normal

  Vlan Map:(none)

  Access Group:bigone, 11 VMRs

  Multicast Boundary:(none), 0 VMRs

Output Features:

  Interfaces or VLANs:

  Priority:low

  Bridge Group Member:no

  Vlan Map:(none)

  Access Group:(none), 0 VMRs

This is an example of output from the show fm vlan-label command when there was not enough room for the input access group or the output access group on the label. Note that the access groups were configured on two different interfaces. Labels are assigned independently for input and output.

Switch# show fm vlan-label 1

Unloaded due to merge failure or lack of space:

  InputAccessGroup OutputAccessGroup 

Input Features:

  Interfaces or VLANs: Vl1

  Priority:normal

  Vlan Map:(none)

  Access Group:bigone, 11 VMRs

  Multicast Boundary:(none), 0 VMRs

Output Features:

  Interfaces or VLANs: Vl2

  Priority:normal

  Bridge Group Member:no

  Vlan Map:(none)

  Access Group:bigtwo, 11 VMRs

Related Commands

Command	Description
show fm interface	Displays per-interface feature manager information.
show fm vlan	Displays per-VLAN feature manager information.

show fm interface

Use the show fm interface privileged EXEC command to display per-interface feature-manager information. Use it with the show fm port-label privileged EXEC command to get information about features applied to the interface.

show fm interface interface-id [ | {begin | exclude | include} expression]

Syntax Description

interface-id	Specify an interface; valid interfaces include: •physical interface—type and port number. •port channel—port-channel port-channel-number (1 to 64). •null—null 0. •VLAN—vlan vlan-id (1 to 4094; do not enter leading zeros). VLAN interfaces are VLANs that have a switch virtual interface (SVI) assigned.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(13)EA1	This command was modified to include policy-based routing (PBR) information.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show fm interface gigabitethernet0/1 command:

Switch# show fm interface gigabitethernet0/1

  Conflicts exist with layer 3 access groups.

  Input Port Label:2

You can then use the show fm port-label 2 privileged EXEC command to view more detail.

This is an example of output from the show fm interface vlan 1 command with PBR enabled on the interface.

Switch# show fm interface vlan 1

Input VLAN Label: 1

Output VLAN Label: 0 (default)

Policy Label: 9

Priority: normal

Related Commands

Command	Description
show fm	Displays feature-manager information for a specified label and lists configuration conflicts or features associated with that label that were not able to fit into the hardware.
show fm vlan	Displays per-VLAN feature manager information.

show fm vlan

Use the show fm vlan privileged EXEC command to display per-VLAN feature-manager information. Use with the show fm vlan-label privileged EXEC command to get information about features applied to the VLAN.

show fm vlan vlan-id [ | {begin | exclude | include} expression]

Syntax Description

vlan-id	Any VLAN ID, whether or not a switch virtual interface (SVI) has been assigned. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show fm vlan 1 command that shows an ACL configuration conflict. It displays the VLAN label used in hardware for VLAN feature configuration.

Switch# show fm vlan 1

Conflicts exist with layer 2 access groups.

Input VLAN Label:1

Output VLAN Label:0 (default)

Priority:normal

Related Commands

Command	Description
show fm interface	Displays per-interface feature manager information.
show fm	Displays feature-manager information for a specified label and lists configuration conflicts or features associated with that label that were not able to fit into the hardware.

show forward

Use the show forward privileged EXEC command for an interface to determine how the hardware would forward a frame that matches the specified parameters.

show forward interface-id [vlan vlan-id] src-mac dst-mac [ex-class] [ex-l4op] [ex-qos] [ex-sig] [ | {begin | exclude | include} expression]

show forward interface-id [vlan vlan-id] src-mac dst-mac [ip src-ip dst-ip [protocol-num] [adjacency adjacency_index] [dscp dscp] [frag fragment] [option] | {icmp icmp-type icmp-code} | {igmp igmp-version igmp-type} | {tcp src-port dst-port flags} | {udp src-port dst-port}}] [ex-class] [ex-l4op] [ex-qos] [ex-sig] [ | {begin | exclude | include} expression]

show forward interface-id [vlan vlan-id] src-mac dst-mac sap lsap [cos cos] [ex-class] [ex-l4op] [ex-qos] [ex-sig] [ | {begin | exclude | include} expression]

show forward interface-id [vlan vlan-id] src-mac dst-mac [arpa ethertype | snap snap_type] [cos cos] [ex-class] [ex-l4op] [ex-qos] [ex-sig] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	The input physical interface.
vlan vlan-id	(Optional) Input VLAN ID. The range is 1 to 4094. If not specified, and the input interface is not a routed port, the default is 1. You should specify the input VLAN even for access ports.
src-mac	48-bit source MAC address.
dst-mac	48-bit destination MAC address.
ex-class	(Optional) Display detailed packet processing information related to classification.
ex-l4op	(Optional) Display detailed packet processing information related to Layer 4 operations.
ex-qos	(Optional) Display detailed packet processing information related to quality of service (QoS).
ex-sig	(Optional) Display detailed packet processing information related to the part of the hardware that recognizes frame formats (signature tables).
ip src-ip dst-ip	(Optional) Source and destination IP addresses in dotted decimal notation.
protocol-num	The numeric value of the protocol field in the IP header. The range is 0 to 255. For example, 47 is generic routing encapsulation (GRE), 89 is Open Shortest Path First (OSPF). If is TCP, UDP, ICMP, or IGMP, you should use the appropriate keyword instead of a numeric value.
adjacency adjacency_index	(Optional) Hardware adjacency to be used when a route has more than one adjacency as with multipath routes. The range is from 0 to 7.
dscp dscp	(Optional) Differentiated services code point (DSCP) field in the IP header. The range is 0 to 63.
frag fragment	(Optional) Two-byte IP fragment field in the IP header. This field includes the Don't Fragment bit (0x4000), the More Fragments bit (0x2000), and the Fragment Offset (0x0 through 0x1FFF). The default is 0x0 (unfragmented packet).
option	(Optional) Keyword signifying IP options are present in the packet.
icmp icmp-type icmp-code	Internet Control Message Protocol (ICMP) parameters. The icmp-type and icmp-code ranges are 0 to 255.
igmp igmp-version igmp-type	Internet Group Management Protocol (IGMP) parameters. The igmp-version and igmp-type ranges are 0 to 255.
tcp src-port dst-port flags	TCP parameters: TCP source port, destination port, and the numeric value of the TCP flags byte. The src-port and dst-port ranges are 0 to 65535.
udp src-port dst-port	User Datagram Protocol (UDP) parameters. The src-port and dst-port ranges are 0 to 65535.
cos cos	(Optional) Class of service (CoS) value of the frame. The range is 0 to 1024.
arpa ethertype	(Optional) Address Resolution Protocol (ARP) Ethernet II encapsulation type and the Ethertype field. The range is 0 to 65535.
snap snap_type	(Optional) Subnetwork Access Protocol (SNAP) encapsulation type and the Ethertype field. The range is 0 to 65535.
sap lsap	(Optional) Service access point (SAP) encapsulation type and the LSAP field. The range is 0 to 65535.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If you enter this command without any arguments, you enter a dialog mode. This mode is not operational in this release.

Because of the many and varied items that go into the forwarding decision, this command requires detailed information about the frame in order to correctly indicate how the hardware would forward the frame.

This command has limited ability to account for QoS settings. It does not take into account any packet arrival rates, so if the system has been configured to mark down or police traffic based on data arrival rates, the command will display inaccurate information for traffic that exceeds the configured rates.

If QoS or ACLs are not configured, and if no port-channel interfaces are present, the most important parameters to specify are source interface, source VLAN, destination MAC address, and destination IP address (if applicable). The output is likely to be accurate, even if other parameters are missing or estimated.

If port channel interfaces are present, it is important to specify the source MAC address and IP address correctly.

If ACLs are present, all keywords in the command could be important to the forwarding decision.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

Following are three examples of outputs from the show forward command. Table 2-19 describes the major sections in the output display.

In this example, the destination MAC address is the router's MAC address and routing lookups are performed:

Switch# show forward fastethernet0/1 vlan 8 0000.1111.2222 0022.3355.8800 ip 8.8.8.10 
4.4.4.33 255

signature:00000007, comparison ind:10, control info:2000941A control map:00000000

vlan:8, vlanid entry:000C0012 00000000 00000000 04400000

adjptr:D  adjacency:E0002409 00000404 04210000

vlan:1033, vlanid entry:0004000A 00000000 00000000 00000000

vlan:1033, vlanid entry:0004000A 00000000 00000000 00000000

lookup  key                                   bk adata    rawoff secoff sec

qos     960808080A04040421 800000000000FF0000 0  00000000 006304 004064  4

acl     960808080A04040421 800000000000FF0000 1  00000082 045408 002016  1

route   420808080A04040421 000000000000000000 0  3FFF800D 006361 000025  3

learn   187008000011112222 901208000004040421 0  80010003 002176 002176  0

forw    187008000011112222 901208000004040421 1  40020000 043328 010560  5

outacli A60808080A04040421 800000000000FF0000 0  00000083 012448 002016  2

bridgeDestMap:  00000000 00000000 0000FFFF FFFFFFC7

vlanMask:       00000000 00000000 0000FFFF EFFFFFFF

sourceMask:     00000000 00000000 00000000 00000000

globalMap:      00000000 00000000 00000000 00000000

globalMask:     00000000 00000000 0002FFFF EFFFFC03

forwMap:        00000000 00000000 00000000 10000000

frame notifies:

src u_dat vlan fl q-map

2   00    8    01 00000000 00000000 00000000 10000000

Egress q 44

signature:00000007, comparison ind:10, control info:2000941A control map:00000000

vlan:8, vlanid entry:000C0012 00000000 00000000 00000000

adjptr:D  adjacency:E0002409 00000404 04210000

vlan:1033, vlanid entry:0004000A 00000000 88000000 00000000

lookup  key                                   bk adata    rawoff secoff sec

route   420808080A04040421 000000000000000000 0  3FFF800D 006361 000025  3

GigabitEthernet0/1 vlan 1033, dst 0000.0404.0421 src 0022.3355.8800, cos 0x0, dscp 0x0

In this example, the destination MAC address is not the router's MAC address. No routing lookups are performed:

Switch# show forward fastethernet0/1 vlan 8 0000.1111.2222 0022.3355.9800 ip 8.8.8.10 
4.4.4.33 255

signature:00000007, comparison ind:10, control info:2000941A control map:00000000

vlan:8, vlanid entry:000C0012 00000000 00000000 04620000

vlan:8, vlanid entry:000C0012 00000000 00000000 04620000

lookup  key                                   bk adata    rawoff secoff sec

qos     940808080A04040421 800000000000FF0000 0  00000000 006304 004064  4

acl     940808080A04040421 800000000000FF0000 1  00000082 045408 002016  1

learn   187008000011112222 801008002233559800 0  80010003 002176 002176  0

forw    187008000011112222 801008002233559800 1  40020000 043328 010560  5

bridgeDestMap:  00000000 00000000 0000FFFF FFFFFFC7

vlanMask:       00000000 00000000 0000FFFF FFFFFE7F

portMask:       00000000 00000000 00000000 00000080

sourceMask:     00000000 00000000 00000000 00000000

globalMap:      00000000 00000000 00000000 00000000

globalMask:     00000000 00000000 0002FFFF EFFFFC03

forwMap:        00000000 00000000 00000000 00000100

frame notifies:

src u_dat vlan fl q-map

2   00    8    00 00000000 00000000 00000000 00000100

Egress q 8

signature:00000007, comparison ind:10, control info:2000941A control map:00000000

vlan:8, vlanid entry:000C0012 00000000 00000000 04620000

FastEthernet0/2 vlan 8, dst 0022.3355.9800 src 0000.1111.2222, cos 0x0, dscp 0x0

This is an example of the display that results if one of the destinations for the packet is the switch CPU. Note that in this case the section after the frame notifies section is labeled Cpu q and that a queue name appears:

Switch# show forward fastethernet0/1 vlan 7 0000.1111.2222 0022.3355.8800 ip 1.1.1.1 
7.7.7.1 255

signature:00000007, comparison ind:11, control info:2000941A control map:00000000

vlan:7, vlanid entry:000C0011 00000000 00318C60 88000000

adjptr:0  adjacency:00000000 00000000 0000C000

vlan:7, vlanid entry:000C0011 00000000 00318C60 88000000

lookup  key                                   bk adata    rawoff secoff sec

qos     960101010107070701 800000000000FF0000 0  00000000 006304 004064  4

acl     960101010107070701 800000000000FF0000 1  00000082 045408 002016  1

route   420101010107070701 000000000000000000 0  00048000 006345 000009  3

learn   186007000011112222 800E08002233558800 0  80010003 002176 002176  0

forw    186007000011112222 800E08002233558800 1  40090000 033000 000232  5

bridgeDestMap:  00000000 00000000 00000000 00000000

routeDestMap:   00000000 00000000 00100000 00000000

sourceMask:     00000000 00000000 00000000 00000000

globalMap:      00000000 00000000 00000000 00000000

globalMask:     00000000 00000000 0002FFFF EFBFFC03

forwMap:        00000000 00000000 00100000 00000000

frame notifies:

src u_dat vlan fl q-map

2   00    7    01 00000000 00000000 00100000 00000000

Cpu q:100 - routing queue

Table 2-19 show forward Output Description  

Output Section	Description
General (no heading) Includes the first few lines of the display.	Displays lookup results for several tables in the input portion of the hardware. The output includes packet formats, the configuration of the input VLAN, and other information.
lookup section	Describes TCAM lookups performed during the input forwarding decision and the results of these lookups.
Bitmaps and masks	Displays maps and masks used to calculate the final set of forwarding destinations.
frame notifies section	Contains the bitmap that results from combining the maps and masks from the bitmaps section. If SPAN is configured, there might be additional bitmaps displayed.
Egress q <nn> section	There is an egress section for each separate destination port. The output is varied, but the important information is in the line containing the name of an output interface, output VLAN ID, and rewritten destination MAC address for the frame. If the output interface is a trunk port that needs to send multiple copies of the frame on different VLANs (for example, for IP multicast frames), several lines might contain the same output interface name, but a different output VLANs. If output security ACLs are present, it is possible that one or more of these egress q sections will not contain a line listing an output port. This happens when the output ACL denies the packet.
Cpu q <nn> <name> section	When the CPU is one of the destinations for a packet, this section appears, followed by a queue name. This name should correspond to one of the queue names in the output from the show controllers cpu-interface privileged EXEC command, where statistics appear for the number of packets received at each queue.

show interfaces

Use the show interfaces privileged EXEC command to display the administrative and operational status of all interfaces or a specified interface.

show interfaces [interface-id | vlan vlan-id] [accounting | capabilities [module {module-number}] | counters | description | etherchannel | flowcontrol | pruning | stats | status [err-disabled] | switchport [backup | module {module-number}] | trunk] | [transceiver properties | detail] [module {module-number} | trunk] | [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) Valid interfaces include physical ports (including type, module, and port number) and port channels. The port-channel range is 1 to 48.
vlan vlan-id	(Optional) VLAN identification. The range is 1 to 4094.
accounting	(Optional) Display accounting information on the interface, including active protocols and input and output packets and octets. Note The display shows only packets processed in software; hardware-switched packets do not appear.
capabilities	(Optional) Display the capabilities of all interfaces or the specified interface, including the features and options that you can configure on the interface. Though visible in the command line help, this option is not available for VLAN IDs.
module module-number	(Optional) Display capabilities, switchport configuration, or transceiver characteristics (depending on preceding keyword) of all interfaces on the The range is 1 to 9. This option is not available if you entered a specific interface ID.
counters	(Optional) See the show interfaces counters command.
description	(Optional) Display the administrative status and description set for an interface.
etherchannel	(Optional) Display interface EtherChannel information.
flowcontrol	(Optional) Display interface flowcontrol information
pruning	(Optional) Display interface trunk VTP pruning information.
stats	(Optional) Display the input and output packets by switching path for the interface.
status	(Optional) Display the status of the interface. A status of unsupported in the Type field means that a non-Cisco small form-factor pluggable (SFP) module is inserted in the module slot.
err-disabled	(Optional) Display interfaces in error-disabled state.
switchport	(Optional) Display the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
backup	(Optional) Display Flex Link backup interface configuration and status for the specified interface.
transceiver [detail | properties]	(Optional) Display the physical properties of a CWDM1 or DWDM2 small form-factor (SFP) module interface. The keywords have these meanings: •detail—(Optional) Display calibration properties, including high and low numbers and any alarm information. •properties—(Optional) Display speed, duplex, and inline power settings on an interface.
trunk	Display interface trunk information. If you do not specify an interface, only information for active trunking ports appears.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

1 coarse wavelength-division multiplexer 2 dense wavelength-division multiplexer

---

Note Though visible in the command-line help strings, the crb, fair-queue, irb, mac-accounting, precedence, private-vlan mapping, random-detect, rate-limit, and shape keywords are not supported.

---

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(12c)EA1	The capabilities keyword was added.
12.1(22)EA1	The transceiver and properties keywords were added.
12.2(22)SEE	The counters, backup, detail, and trunk keywords were added.

Usage Guidelines

The show interfaces capabilities command with different keywords has these results:

•Use the show interface capabilities module number command to display the capabilities of all interfaces on that switch. If there is no switch with that module number, there is no output.

•Use the show interfaces interface-id capabilities to display the capabilities of the specified interface.

•Use the show interfaces capabilities (with no module number or interface ID) to display the capabilities of all interfaces.

•Use the show interface switchport module number command to display the switch port characteristics of all interfaces on that switch. If there is no switch with that module number, there is no output.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show interfaces gigabitethernet0/1 command:

Switch# show interfaces gigabitethernet0/1 

GigabitEthernet0/1 is up, line protocol is up

  Hardware is Gigabit Ethernet, address is 0002.4b29.4401 (bia 0002.4b29.4401)

  MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Half-duplex, 100Mb/s

  input flow-control is off, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 00:00:00, output 00:00:08, output hang never

  Last clearing of "show interface" counters never

  Queueing strategy: fifo

  Output queue 0/40, 0 drops; input queue 0/75, 0 drops

  5 minute input rate 1000 bits/sec, 2 packets/sec

  5 minute output rate 0 bits/sec, 0 packets/sec

     7122 packets input, 783062 bytes, 0 no buffer

     Received 5137 broadcasts, 0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 input packets with dribble condition detected

     9222 packets output, 2188728 bytes, 0 underruns

     0 output errors, 0 collisions, 2 interface resets

     0 babbles, 0 late collision, 1 deferred

     0 lost carrier, 0 no carrier

     0 output buffer failures, 0 output buffers swapped out 

This is an example of output from the show interfaces accounting command:

Switch# show interfaces accounting

Vlan1

                Protocol    Pkts In   Chars In   Pkts Out  Chars Out

                      IP       1073      69828        325      31868

                     ARP          6        384          2        120

Vlan10

                Protocol    Pkts In   Chars In   Pkts Out  Chars Out

No traffic sent or received on this interface.

GigabitEthernet0/1

                Protocol    Pkts In   Chars In   Pkts Out  Chars Out

           Spanning Tree          8        480        326      19560

                     CDP         28      10920         29      11513

GigabitEthernet0/2

                Protocol    Pkts In   Chars In   Pkts Out  Chars Out

No traffic sent or received on this interface.

GigabitEthernet0/3

                Protocol    Pkts In   Chars In   Pkts Out  Chars Out

No traffic sent or received on this interface.

<output truncated> 

This is an example of output from the show interfaces capabilities command:

Switch# show interfaces fastethernet0/1 capabilities 

FastEthernet0/1

  Model:                 WS-C3550G-48-EI

  Type:                  10/100BaseTX

  Speed:                 10,100,auto

  Duplex:                half,full,auto

  UDLD:                  yes

  Trunk encap. type:     802.1Q

  Trunk mode:            on,off,desirable,nonegotiate

  Channel:               yes

  Broadcast suppression: percentage(0-100)

  Flowcontrol:           rx-(none),tx-(none)

  Fast Start:            yes

  CoS rewrite:           yes

  ToS rewrite:           yes

  Inline power:          no

  SPAN:                  source/destination

  PortSecure:            Yes

  Dot1x:                 Yes

This is an example of output from the show interfaces gigabitethernet0/4 description command when the interface has been described as Connects to Marketing by using the description interface configuration command:

Switch# show interfaces gigabitethernet0/4 description

Interface Status         Protocol Description

G10/4     up             down     Connects to Marketing

This is an example of output from the show interfaces interface description command when the interface has been described as Connects to Marketing by using the description interface configuration command.

Switch# show interfaces gigabitethernet1/0/2 description

Interface Status         Protocol Description

Gi1/0/2     up             down     Connects to Marketing

This is an example of output from the show interfaces etherchannel command when port channels are configured on the switch:

Switch# show interfaces etherchannel

----

GigabitEthernet0/9:

Port state    = Down Not-in-Bndl

Channel group = 6           Mode = Desirable-Sl     Gcchange = 0

Port-channel  = null        GC   = 0x00000000    Pseudo port-channel = Po6

Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.        P - Device learns on physical port.

        d - PAgP is down.

Timers: H - Hello timer is running.        Q - Quit timer is running.

        S - Switching timer is running.    I - Interface timer is running.

Local information:

                                Hello    Partner  PAgP     Learning  Group

Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex

Gi0/9     d     U1/S1           1s       0        128        Any      0

Age of the port in the current state: 14d:12h:32m:05s

----

GigabitEthernet0/10:

Port state    = Up Sngl-port-Bndl Mstr Not-in-Bndl

Channel group = 10          Mode = Desirable-Sl     Gcchange = 0

Port-channel  = null        GC   = 0x000A0001    Pseudo port-channel = Po10

Port index    = 0           Load = 0x00

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.        P - Device learns on physical port.

        d - PAgP is down.

Timers: H - Hello timer is running.        Q - Quit timer is running.

        S - Switching timer is running.    I - Interface timer is running.

Local information:

                                Hello    Partner  PAgP     Learning  Group

Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex

Gi0/10          U4/S4   H       30s      0        128        Any      0

Age of the port in the current state: 01d:06h:05m:59s

----

Port-channel6:

Age of the Port-channel   = 01d:06h:05m:38s

Logical slot/port   = 1/1           Number of ports = 0

GC                  = 0x00000000      HotStandBy port = null

Port state          = Port-channel Ag-Not-Inuse

----

Port-channel10:

Age of the Port-channel   = 01d:06h:06m:15s

Logical slot/port   = 1/0           Number of ports = 0

GC                  = 0x00000000      HotStandBy port = null

Port state          = Port-channel Ag-Not-Inuse

This is an example of output from the show interfaces flowcontrol command. Table 2-20 lists the fields in this display.

Switch# show interfaces flowcontrol

Port    Send FlowControl  Receive FlowControl  RxPause TxPause

        admin    oper     admin    oper

-----   -------- -------- -------- --------    ------- -------

Fa0/1   Unsupp.  Unsupp.  off      off         0       0

Fa0/2   Unsupp.  Unsupp.  off      off         0       0

<output truncated>

Gi0/1   desired  off      off      off         0       0

Gi0/2   desired  off      off      off         0       0

Po1     Unsupp.  Unsupp.  off      off         0       0

Po2     Unsupp.  Unsupp.  off      off         0       0

Po59    Unsupp.  Unsupp.  off      off         0       0

Po60    Unsupp.  Unsupp.  off      off         0       0

Po63    Unsupp.  Unsupp.  off      off         0       0

Po64    Unsupp.  Unsupp.  off      off         0       0

Table 2-20 show interfaces flowcontrol Field Descriptions 

Field	Description
Port	Displays the port name.
Send FlowControl
Admin	Displays the administrative (configured) setting for the flow control send mode.
Oper	Displays the operational (running) setting for the flow control send mode.
Receive FlowControl
Admin	Displays the administrative (configured) setting for the flow control receive mode.
Oper	Displays the operational (running) setting for the flow control receive mode.
RxPause	Displays the number of pause frames received.
TxPause	Displays the number of pause frames sent.
On	Flow control is enabled.
Off	Flow control is disabled.
Desired	Flow control is enabled if the other end supports it.
Unsupp.	Flow control is not supported.

This is an example of output from the show interfaces gigabitethernet0/1 pruning command when pruning is enabled in the VTP domain:

Switch# show interfaces gigibitethernet0/1 pruning

Port    Vlans pruned for lack of request by neighbor

Gi0/1   3,4

Port    Vlans traffic requested of neighbor

Gi0/1   1-3

This is an example of output from the show interfaces stats command for a specified interface:

Switch# show interface gigabitethernet0/1 stats

GigabitEthernet0/1

Switching path    Pkts In   Chars In   Pkts Out  Chars Out

Processor            7790    1122034         23       1938

Route cache             0          0          0          0

Total                7790    1122034         23       1938

This is an example of output from the show interfaces status command. It displays the status of all interfaces.

Switch# show interfaces status

Port    Name               Status       Vlan       Duplex  Speed Type

Gi0/1   CubeA              connected    1          a-full  a-100 10/100/1000Base TX

Gi0/2   CubeC              notconnect   1            auto   auto 10/100/1000Base TX

Gi0/3   CubeE              disabled     1            auto   auto 10/100/1000Base TX

Gi0/4   CubeG              notconnect   1            auto   auto 10/100/1000Base TX

Gi0/5   CubeI              notconnect   routed       auto   auto 10/100/1000Base TX

Gi0/6   CubeK              notconnect   routed       auto   auto 10/100/1000Base TX

Gi0/7   CubeM              notconnect   1            auto   auto 10/100/1000Base TX

This is an example of output from the show interfaces status err-disabled command. It displays the status of interfaces in error-disabled state.

Switch# show interfaces status err-disabled 

Port    Name               Status       Reason

Gi0/4                      notconnect   link-flap

informational error message when the timer expires on a cause

--------------------------------------------------------------

5d04h:%PM-SP-4-ERR_RECOVER:Attempting to recover from link-flap err-disable state on Gi0/4

This is an example of output from the show interfaces switchport command for a single interface. Table 2-21 describes the fields in the display.

Switch# show interfaces gigabitethernet1/0/1 switchport

Name: Gi1/0/1

Switchport: Enabled

Administrative Mode: dynamic auto

Operational Mode: static access

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: On

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Voice VLAN: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Protected: false

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Voice VLAN: none (Inactive)

Appliance trust: none

Table 2-21 show interfaces switchport Field Descriptions 

Field	Description
Name	Displays the port name.
Switchport	Displays the administrative and operational status of the port. In this display, the port is in switchport mode.
Administrative Mode Operational Mode	Displays the administrative and operational modes.
Administrative Trunking Encapsulation Operational Trunking Encapsulation Negotiation of Trunking	Displays the administrative and operational encapsulation method and whether trunking negotiation is enabled.
Access Mode VLAN	Displays the VLAN ID to which the port is configured.
Trunking Native Mode VLAN Trunking VLANs Enabled Trunking VLANs Active	Lists the VLAN ID of the trunk that is in native mode. Lists the allowed VLANs on the trunk. Lists the active VLANs on the trunk.
Pruning VLANs Enabled	Lists the VLANs that are pruning-eligible.
Protected	Displays whether or not protected port is enabled (True) or disabled (False) on the interface.
Unknown unicast blocked Unknown multicast blocked	Displays whether or not unknown multicast and unknown unicast traffic is blocked on the interface.
Voice VLAN	Displays the VLAN ID on which voice VLAN is enabled.
Appliance trust	Displays the class of service (CoS) setting of the data packets of the IP phone.

This is an example of output from the show interfaces gigabitethernet0/1 trunk command. It displays trunking information for the interface.

Switch# show interfaces gigabitethernet0/1 trunk

Port      Mode         Encapsulation  Status        Native vlan

Gi0/1     desirable    negotiate      not-trunking  1

Port      Vlans allowed on trunk

Gi0/1     1

Port      Vlans allowed and active in management domain

Gi0/1     1

Port      Vlans in spanning tree forwarding state and not pruned

Gi0/1     1 

This is an example of output from the show interfaces transceiver properties command. If you do not specify an interface, the output of the command shows the status on all switch ports:

Switch# show interfaces transceiver properties

Name : Fa0/1

Administrative Speed: auto 10 100

Administrative Duplex: auto

Administrative Auto-MDIX: N/A 

Administrative Power Inline: enable

Operational Speed: 100

Operational Duplex: full

Operational Auto-MDIX: N/A 

Name : Fa0/2

Administrative Speed: auto 10 

Administrative Duplex: auto

Administrative Auto-MDIX: N/A 

Administrative Power Inline: enable

Operational Speed: auto

Operational Duplex: auto

Operational Auto-MDIX: N/A 

<output truncated> 

This is an example of output from the show interfaces module module-number transceiver properties command for a specific interface:

Switch# show interfaces fastethernet0/1 transceiver properties

Name : Fa0/1

Administrative Speed: auto

Administrative Duplex: auto

Administrative Auto-MDIX: N/A

Administrative Power Inline: disable

Operational Speed: 100

Operational Duplex: full

Operational Auto-MDIX: N/A

This is an example of output from the show interfaces switchport backup command:

Switch# show interfaces switchport backup

Switch Backup Interface Pairs:

     Active Interface    Backup Interface    State

     --------------------------------------------------------------

     Fa1/0/1             Fa1/0/2             Active Up/Backup Standby

     Fa3/0/3             Fa4/0/5             Active Down/Backup Up

     Po1                 Po2                 Active Standby/Backup Up

Related Commands

Command	Description
switchport access	Configures a port as a static-access or dynamic-access port.
switchport block	Blocks unknown unicast or multicast traffic on an interface.
switchport broadcast	Configures the VLAN membership mode of a port.
switchport protected	Isolates unicast, multicast, and broadcast traffic at Layer 2 from other protected ports on the same switch.
switchport trunk pruning	Configures the VLAN pruning-eligible list for ports in trunking mode.

show interfaces counters

Use the show interfaces counters privileged EXEC command to display various counters for the switch or for a specific interface.

show interfaces [interface-id] counters [errors | etherchannel | protocol status | trunk] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) ID of the physical interface, including type and slot and port number.
errors	(Optional) Display error counters.
etherchannel	(Optional) Display EtherChannel counters.
protocol status	(Optional) Display the current status of enabled protocols.
trunk	(Optional) Display trunk counters.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

---

Note Though visible in the command-line help strings, the module and vlan-id keywords are not supported.

---

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.2(25)SE	The etherchannel and protocol status keywords were added and the broadcast, multicast, and unicast keywords were removed.

Usage Guidelines

If you do not enter any keywords, all counters for all interfaces are included.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show interfaces counters command. It displays all counters for the switch.

Switch# show interfaces counters

Port            InOctets   InUcastPkts   InMcastPkts   InBcastPkts

Gi0/1           23324617         10376        185709        126020

Gi0/2                  0             0             0             0

Port           OutOctets  OutUcastPkts  OutMcastPkts  OutBcastPkts

Gi0/1            4990607         28079         21122            10

Gi0/2            1621568         25337             0             0

Switch# show interfaces counters errors

Port        Align-Err    FCS-Err   Xmit-Err    Rcv-Err UnderSize

Gi0/1               0          0          0          0         0

Gi0/2               0          0          0          0         0

Gi0/3               0          0          0          0         0

Gi0/4               0          0          0          0         0

Port      Single-Col Multi-Col  Late-Col Excess-Col Carri-Sen     Runts    Giants

Gi0/1              0         0         0          0         0         0      0

Gi0/2              0         0         0          0         0         0      0

Gi0/3              0         0         0          0         0         0      0

Gi0/4              0         0         0          0         0         0      0

This is an example of output from the show interfaces counters protocol status command for all interfaces.

Switch# show interfaces counters protocol status

Protocols allocated:

 Vlan1: Other, IP

 Vlan1001: Other, IP, ARP

 FastEthernet0/1: Other, IP

 FastEthernet0/2: Other, IP, Spanning Tree, ARP, CDP

 FastEthernet0/3: Other, IP

 FastEthernet0/4: Other, IP

 FastEthernet0/5: Other, IP

 FastEthernet0/6: Other, IP

 FastEthernet0/7: Other, IP

<output truncated>

This is an example of output from the show interfaces counters trunk command. It displays trunk counters for all interfaces.

Switch# show interfaces counters trunk

Port        TrunkFramesTx  TrunkFramesRx  WrongEncap

Gi0/1                   0              0           0

Gi0/2                   0              0           0 

Related Commands

Command	Description
show interfaces	Displays additional interface characteristics.

show inventory

Use the show inventory user EXEC command to display product identification (PID) information for the hardware.

show inventory [entity-name | raw] [ | {begin | exclude | include} expression]

Syntax Description

entity-name	(Optional) Display the specified entity. For example, enter the interface (such as gigabitethernet1/0/1) into which a small form-factor pluggable (SFP) module is installed.
raw	(Optional) Display every entity in the device.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEC	This command was introduced.

Usage Guidelines

The command is case sensitive. With no arguments, the show inventory command produces a compact dump of all identifiable entities that have a product identifier. The compact displays the entity location (slot identity), entity description, and the UDI (PID, VID, and SN) of that entity.

---

Note If there is no PID, no output is displayed when a user enters the show inventory command.

---

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show inventory command:

Switch# show inventory 

NAME: "sw-1-3-f48", DESCR: "Cisco Catalyst 3550 48 10/100 baseT ports + 2 Gig uplinks 
fixed configuration Layer 2/3 Ethernet Switch"

PID: WS-C3550-48      , VID: C0 , SN: CHK0614V09S

show arp access-list

Use the show arp access-list user EXEC command to display detailed information about Address Resolution Protocol (ARP) access control lists (ACLs).

show arp access-list [acl-name] [ | {begin | exclude | include} expression]

This command is available only if your switch is running the IP services image, formerly known as the enhanced multilayer image (EMI).

Syntax Description

acl-name	(Optional) Name of the ACL.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show arp access-list command:

Switch> show arp access-list

ARP access list rose

    permit ip 10.101.1.1 0.0.0.255 mac any

    permit ip 20.3.1.0 0.0.0.255 mac any

Related Commands

Command	Description
arp access-list	Defines an ARP ACL.
deny (ARP access-list configuration)	Denies an ARP packet based on matches against the Dynamic Host Configuration Protocol (DHCP) bindings.
ip arp inspection filter vlan	Permits ARP requests and responses from a host configured with a static IP address.
permit (ARP access-list configuration)	Permits an ARP packet based on matches against the DHCP bindings.

show ip arp inspection

Use the show ip arp inspection privileged EXEC command to display the configuration and the operating state of dynamic Address Resolution Protocol (ARP) inspection or the status of this feature for all VLANs or for the specified interface or VLAN.

show ip arp inspection [interfaces [interface-id] | log | statistics [vlan vlan-range] | vlan vlan-range] [ | {begin | exclude | include} expression]

Syntax Description

interfaces [interface-id]	(Optional) Display the trust state and the rate limit of ARP packets for the specified interface or all interfaces. Valid interfaces include physical ports and port channels.
log	(Optional) Display the configuration and contents of the dynamic ARP inspection log buffer.
statistics [vlan vlan-range]	(Optional) Display statistics for forwarded, dropped, MAC validation failure, IP validation failure, access control list (ACL) permitted and denied, and DHCP permitted and denied packets for the specified VLAN. If no VLANs are specified or if a range is specified, display information only for VLANs with dynamic ARP inspection enabled (active). You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094.
vlan vlan-range	(Optional) Display the configuration and the operating state of dynamic ARP inspection for the specified VLAN. If no VLANs are specified or if a range is specified, display information only for VLANs with dynamic ARP inspection enabled (active). You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

Examples

This is an example of output from the show ip arp inspection interfaces command:

Switch# show ip arp inspection interfaces

 Interface        Trust State     Rate (pps)    Burst Interval

 ---------------  -----------     ----------    --------------

 Gi0/1            Untrusted               15                 1

 Gi0/2            Untrusted               15                 1

 Gi0/3            Untrusted               15                 1

This is an example of output from the show ip arp inspection interfaces interface-id command:

Switch# show ip arp inspection interfaces gigabitethernet0/1

 Interface        Trust State     Rate (pps)    Burst Interval

 ---------------  -----------     ----------    --------------

 Gi0/1            Untrusted               15                 1

This is an example of output from the show ip arp inspection log command. It shows the contents of the log buffer before the buffers are cleared:

Switch# show ip arp inspection log

Total Log Buffer Size : 32

Syslog rate : 10 entries per 300 seconds.

Interface   Vlan  Sender MAC      Sender IP        Num Pkts   Reason       Time

----------  ----  --------------  ---------------  ---------  -----------  ----

Gi0/1       5     0003.0000.d673  192.2.10.4               5  DHCP Deny    19:39:01 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.0000.d774  128.1.9.25               6  DHCP Deny    19:39:02 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.c940.1111  10.10.10.1               7  DHCP Deny    19:39:03 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.c940.1112  10.10.10.2               8  DHCP Deny    19:39:04 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.c940.1114  173.1.1.1               10  DHCP Deny    19:39:06 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.c940.1115  173.1.1.2               11  DHCP Deny    19:39:07 UTC 
Mon Mar 1 1993

Gi0/1       5     0001.c940.1116  173.1.1.3               12  DHCP Deny    19:39:08 UTC 
Mon Mar 1 1993

If the log buffer overflows, it means that a log event does not fit into the log buffer, and the display for the show ip arp inspection log privileged EXEC command is affected. A -- in the display appears in place of all data except the packet count and the time. No other statistics are provided for the entry. If you see this entry in the display, increase the number of entries in the log buffer, or increase the logging rate in the ip arp inspection log-buffer global configuration command.

This is an example of output from the show ip arp inspection statistics command. It shows the statistics for packets that have been processed by dynamic ARP inspection for all active VLANs.

Switch# show ip arp inspection statistics

Vlan       Forwarded        Dropped     DHCP Drops      ACL Drops

 ----      ---------        -------     ----------      ---------

    5              3           4618           4605              4

 2000              0              0              0              0

 Vlan   DHCP Permits    ACL Permits   Source MAC Failures

 ----   ------------    -----------   -------------------

    5              0             12                     0

 2000              0              0                     0

 Vlan   Dest MAC Failures   IP Validation Failures

 ----   -----------------   ----------------------

    5                   0                        9

 2000                   0                        0

For the show ip arp inspection statistics command, the switch increments the number of forwarded packets for each ARP request and response packet on a trusted dynamic ARP inspection port. The switch increments the number of ACL- or DHCP-permitted packets for each packet that is denied by source MAC, destination MAC, or IP validation checks, and the switch increments the appropriate failure count.

This is an example of output from the show ip arp inspection statistics vlan 5 command. It shows statistics for packets that have been processed by dynamic ARP for VLAN 5.

Switch# show ip arp inspection statistics vlan 5

Vlan      Forwarded        Dropped     DHCP Drops      ACL Drops

 ----      ---------        -------     ----------      ---------

    5              3           4618           4605              4

 Vlan   DHCP Permits    ACL Permits   Source MAC Failures

 ----   ------------    -----------   -------------------

    5              0             12                     0

 Vlan   Dest MAC Failures   IP Validation Failures      Invalid Protocol Data

 ----   -----------------   ----------------------      ---------------------

    5                   0                        9                          3

This is an example of output from the show ip arp inspection vlan 5 command. It shows the configuration and the operating state of dynamic ARP inspection for VLAN 5.

Switch# show ip arp inspection vlan 5

Source Mac Validation      :Enabled

Destination Mac Validation :Enabled

IP Address Validation      :Enabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    5     Enabled          Active      second             No

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    5     Acl-Match        All

Related Commands

Command	Description
arp access-list	Defines an ARP ACL.
clear ip arp inspection log	Clears the dynamic ARP inspection log buffer.
clear ip arp inspection statistics	Clears the dynamic ARP inspection statistics.
ip arp inspection log-buffer	Configures the dynamic ARP inspection logging buffer.
ip arp inspection vlan logging	Controls the type of packets that are logged per VLAN.
show arp access-list	Displays detailed information about ARP access lists.

show ip dhcp snooping

Use the show ip dhcp snooping user EXEC command to display the DHCP snooping configuration.

show ip dhcp snooping

Syntax Description

This command has no arguments or keywords.

Command Modes

User EXEC

Command History

Release	Modification
12.1(19)EA1	This command was introduced
12.2(25)SEE	The command output was updated to show the global suboption configuration.

Usage Guidelines

This command displays only the results of global configuration. Therefore, in this example, the circuit ID suboption appears in its default format of vlan-mod-port, even if a string is configured for the circuit ID.

Examples

This is an example of output from the show ip dhcp snooping command.

Switch> show ip dhcp snooping

Switch DHCP snooping is enabled

DHCP snooping is configured on following VLANs:

40-42

Insertion of option 82 is enabled

	circuit-id format: vlan-mod-port

	remote-id format: string

Verification of hwaddr field is enabled

Interface                    Trusted     Rate limit (pps)

------------------------     -------     ----------------

FastEthernet0/5              yes         unlimited

FastEthernet0/7              yes         unlimited

FastEthernet0/3              no          5000     

FastEthernet0/5              yes         unlimited

FastEthernet0/7              yes         unlimited

FastEthernet0/5              yes         unlimited

FastEthernet0/7              yes         unlimited

Related Commands

Command	Description
show ip dhcp snooping binding	Displays the DHCP snooping binding information.
show ip dhcp snooping statistics	Displays the DHCP snooping statistics in summary or detail form.

show ip dhcp snooping binding

Use the show ip dhcp snooping binding user EXEC command to display the DHCP snooping binding table and configuration information for all interfaces on a switch.

show ip dhcp snooping binding [ip-address] [mac-address] [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

ip-address	(Optional) Specify the binding entry IP address.
mac-address	(Optional) Specify the binding entry MAC address.
interface interface-id	(Optional) Specify the binding input interface.
vlan vlan-id	(Optional) Specify the binding entry VLAN.
| begin	Display begins with the line that matches the expression.
| exclude	Display excludes lines that match the expression.
| include	Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(19)EA1	This command was introduced
12.2(25)SE	The dynamic and static keywords were removed.

Usage Guidelines

The show ip dhcp snooping binding command output shows the dynamically configured bindings.

If DHCP snooping is enabled and an interface changes to the down state, the switch does not delete the statically configured bindings.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This example shows how to display the DHCP snooping binding entries for a switch:

Switch> show ip dhcp snooping binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

01:02:03:04:05:06   10.1.2.150       9837        dhcp-snooping  20    GigabitEthernet0/1

00:D0:B7:1B:35:DE   10.1.2.151       237         dhcp-snooping  20    GigabitEthernet0/2

Total number of bindings: 2

This example shows how to display the DHCP snooping binding entries for a specific IP address:

Switch> show ip dhcp snooping binding 10.1.2.150

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

01:02:03:04:05:06   10.1.2.150       9810        dhcp-snooping  20    GigabitEthernet0/1

Total number of bindings: 1

This example shows how to display the DHCP snooping binding entries for a specific MAC address:

Switch> show ip dhcp snooping binding 0102.0304.0506

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

01:02:03:04:05:06   10.1.2.150       9788        dhcp-snooping  20    GigabitEthernet0/2

Total number of bindings: 1

This example shows how to display the DHCP snooping binding entries on an interface:

Switch> show ip dhcp snooping binding interface gigabitethernet0/2

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:30:94:C2:EF:35   10.1.2.151       290         dhcp-snooping  20    GigabitEthernet0/2

Total number of bindings: 1

This example shows how to display the DHCP snooping binding entries on VLAN 20:

Switch> show ip dhcp snooping binding vlan 20

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

01:02:03:04:05:06   10.1.2.150       9747        dhcp-snooping  20    GigabitEthernet0/1

00:00:00:00:00:02   10.1.2.151       65          dhcp-snooping  20    GigabitEthernet0/2

Total number of bindings: 2

Table 2-22 describes the fields in the show ip dhcp snooping binding command output.

Table 2-22 show ip dhcp snooping binding Command Output 

Field	Description
MAC Address	Client hardware MAC address
IP Address	Client IP address assigned from the DHCP server
Lease (seconds)	IP address lease time
Type	Binding type
VLAN	VLAN number of the client interface
Interface	Interface that connects to the DHCP client host
Total number of bindings	Total number of bindings configured on the switch Note The command output might not show the total number of bindings. For example, if 200 bindings are configured on the switch and you stop the display before all the bindings appear, the total number does not change.

Related Commands

Command	Description
show ip dhcp snooping	Displays the DHCP snooping configuration.
show ip dhcp snooping statistics	Displays the DHCP snooping statistics in summary or detail form.

show ip dhcp snooping database

Use the show ip dhcp snooping database user EXEC command to display the status of the DHCP snooping binding database agent.

show ip dhcp snooping database [detail] [ | {begin | exclude | include} expression]

This command is available only if your switch is running the IP services image, formerly known as the enhanced multilayer image (EMI).

Syntax Description

detail	(Optional) Display detailed status and statistics information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Examples

This is an example of output from the show ip dhcp snooping database command:

Switch> show ip dhcp snooping database

Agent URL : 

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : No

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        0   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :        0

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

This is an example of output from the show ip dhcp snooping database detail command:

Switch# show ip dhcp snooping database detail 

Agent URL : tftp://10.1.1.1/directory/file

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : No

Delay Timer Expiry : 7 (00:00:07)

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : 17:14:25 UTC Sat Jul 7 2001

Last Failed Reason : Unable to access URL.

Total Attempts       :       21   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :       21

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :       21

Media Failures       :        0

First successful access: Read

Last ignored bindings counters :

Binding Collisions    :        0   Expired leases    :        0

Invalid interfaces    :        0   Unsupported vlans :        0

Parse failures        :        0

Last Ignored Time : None

Total ignored bindings counters:

Binding Collisions    :        0   Expired leases    :        0

Invalid interfaces    :        0   Unsupported vlans :        0

Parse failures        :        0

Related Commands

Command	Description
ip dhcp snooping	Enables DHCP snooping on a VLAN.
ip dhcp snooping database	Configures the DHCP snooping binding database agent or the binding file.
show ip dhcp snooping	Displays DHCP snooping information.
show ip dhcp snooping statistics	Displays the DHCP snooping statistics in summary or detail form.

show ip dhcp snooping statistics

Use the show ip dhcp snooping statistics user EXEC command to display DHCP snooping statistics in summary or detail form.

show ip dhcp snooping statistics [detail] [ | {begin | exclude | include} expression]

Syntax Description

detail	(Optional) Display detailed statistics information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(37)SE	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

In a switch stack, all statistics are generated on the stack master. If a new stack master is elected, the statistics counters reset.

Examples

This is an example of output from the show ip dhcp snooping statistics command:

Switch> show ip dhcp snooping statistics

 Packets Forwarded                                     = 0

 Packets Dropped                                       = 0

 Packets Dropped From untrusted ports                  = 0

This is an example of output from the show ip dhcp snooping statistics detail command:

Switch> show ip dhcp snooping statistics detail

 Packets Processed by DHCP Snooping                    = 0

 Packets Dropped Because

   IDB not known                                       = 0

   Queue full                                          = 0

   Interface is in errdisabled                         = 0

   Rate limit exceeded                                 = 0

   Received on untrusted ports                         = 0

   Nonzero giaddr                                      = 0

   Source mac not equal to chaddr                      = 0

   Binding mismatch                                    = 0

   Insertion of opt82 fail                             = 0

   Interface Down                                      = 0

   Unknown output interface                            = 0

   Reply output port equal to input port               = 0

   Packet denied by platform                           = 0

Table 2-23 DHCP Snooping Statistics

DHCP Snooping Statistic	Description
Packets Processed by DHCP Snooping	Total number of packets handled by DHCP snooping, including forwarded and dropped packets.
Packets Dropped Because IDB not known	Number of errors when the input interface of the packet cannot be determined.
Queue full	Number of errors when an internal queue used to process the packets is full. This might happen if DHCP packets are received at an excessively high rate and rate limiting is not enabled on the ingress ports.
Interface is in errdisabled	Number of times a packet was received on a port that has been marked as error disabled. This might happen if packets are in the processing queue when a port is put into the error-disabled state and those packets are subsequently processed.
Rate limit exceeded	Number of times the rate limit configured on the port was exceeded and the interface was put into the error-disabled state.
Received on untrusted ports	Number of times a DHCP server packet (OFFER, ACK, NAK, or LEASEQUERY) was received on an untrusted port and was dropped.
Nonzero giaddr	Number of times the relay agent address field (giaddr) in the DHCP packet received on an untrusted port was not zero, or the no ip dhcp snooping information option allow-untrusted global configuration command is not configured and a packet received on an untrusted port contained option-82 data.
Source mac not equal to chaddr	Number of times the client MAC address field of the DHCP packet (chaddr) does not match the packet source MAC address and the ip dhcp snooping verify mac-address global configuration command is configured.
Binding mismatch	Number of times a RELEASE or DECLINE packet was received on a port that is different than the port in the binding for that MAC address-VLAN pair. This indicates someone might be trying to spoof the real client, or it could mean that the client has moved to another port on the switch and issued a RELEASE or DECLINE. The MAC address is taken from the chaddr field of the DHCP packet, not the source MAC address in the Ethernet header.
Insertion of opt82 fail	Number of times the option-82 insertion into a packet failed. The insertion might fail if the packet with the option-82 data exceeds the size of a single physical packet on the internet.
Interface Down	Number of times the packet is a reply to the DHCP relay agent, but the SVI interface for the relay agent is down. This is an unlikely error that occurs if the SVI goes down between sending the client request to the DHCP server and receiving the response.
Unknown output interface	Number of times the output interface for a DHCP reply packet cannot be determined by either option-82 data or a lookup in the MAC address table. The packet is dropped. This can happen if option 82 is not used and the client MAC address has aged out. If IPSG is enabled with the port-security option and option 82 is not enabled, the MAC address of the client is not learned, and the reply packets will be dropped.
Reply output port equal to input port	Number of times the output port for a DHCP reply packet is the same as the input port, causing a possible loop. Indicates a possible network misconfiguration or misuse of trust settings on ports.
Packet denied by platform	Number of times the packet has been denied by a platform-specific registry.

Table 2-23 shows the DHCP snooping statistics and their descriptions:

Related Commands

Command	Description
clear ip dhcp snooping	Clears the DHCP snooping binding database, the DHCP snooping binding database agent statistics, or the DHCP snooping statistics counters.
show ip dhcp snooping statistics	Displays the DHCP snooping statistics in summary or detail form.

show ip igmp profile

Use the show ip igmp profile privileged EXEC command to view all configured Internet Group Management Protocol (IGMP) profiles or a specified IGMP profile.

show ip igmp profile [profile number] [ | {begin | exclude | include} expression]

Syntax Description

profile number	(Optional) The IGMP profile number to be displayed. The range is 1 to 4294967295. If no profile number is entered, all IGMP profiles appear.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(8)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

These are examples of output from the show ip igmp profile privileged EXEC command, with and without specifying a profile number. If no profile number is entered, the display includes all profiles configured on the switch.

Switch# show ip igmp profile 40

IGMP Profile 40

    permit

    range 233.1.1.1 233.255.255.255

Switch# show ip igmp profile

IGMP Profile 3

    range 230.9.9.0 230.9.9.0

IGMP Profile 4

    permit

    range 229.9.9.0 229.255.255.255

Related Commands

Command	Description
ip igmp profile	Configures the specified IGMP profile number.

show ip igmp snooping

Use the show ip igmp snooping user EXEC command to display the Internet Group Management Protocol (IGMP) snooping configuration of the switch or the VLAN.

show ip igmp snooping [groups | mrouter | querier] [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

groups	(Optional) See the show ip igmp snooping groups command.
mrouter	(Optional) See the show ip igmp snooping mrouter command.
querier	(Optional) See the show ip igmp snooping querier command.
vlan vlan-id	(Optional) Specify a VLAN; the range is 1 to 1001 and 1006 to 4094 (available only in privileged EXEC mode).
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(19)EA1	The group and querier keywords were added.
12.2(25)SE	The groups keyword was added, and the group keyword was removed.
12.2(25)SEA	The detail keyword was added.

Usage Guidelines

Use this command to display snooping configuration for the switch or for a specific VLAN.

VLAN IDs 1002 to 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in IGMP snooping.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping command. It shows how to display snooping characteristics for all VLANs on the switch.

Switch> show ip igmp snooping 

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping              : Enabled

IGMPv3 snooping (minimal)  : Enabled

Report suppression         : Enabled

TCN solicit query          : Disabled

TCN flood query count      : 2

Last member query interval : 100

Vlan 1:

--------

IGMP snooping                       :Enabled

Immediate leave                     :Disabled

Multicast router learning mode      :pim-dvmrp

Source only learning age timer      :10

CGMP interoperability mode          :IGMP_ONLY

Last member query interval          : 100

Vlan 2:

--------

IGMP snooping                       :Enabled

Immediate leave                     :Disabled

Multicast router learning mode      :pim-dvmrp

Source only learning age timer      :10

CGMP interoperability mode          :IGMP_ONLY

Last member query interval          : 333

<output truncated>

This is an example of output from the show ip igmp snooping vlan 1 command. It shows how to display snooping characteristics for a specific VLAN.

Switch# show ip igmp snooping vlan 1

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping             : Enabled

IGMPv3 snooping (minimal) : Enabled

Report suppression        : Enabled

TCN solicit query         : Disabled

TCN flood query count     : 2

Vlan 1:

--------

IGMP snooping                       :Enabled

Immediate leave                     :Disabled

Multicast router learning mode      :pim-dvmrp

Source only learning age timer      :10

CGMP interoperability mode          :IGMP_ONLY

This is an example of output from the show ip igmp snooping vlan 1 command. It shows snooping characteristics for a specific VLAN:

Switch# show ip igmp snooping vlan 1

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping             :Enabled

IGMPv3 snooping (minimal) :Enabled

Report suppression        :Enabled

TCN solicit query         :Disabled

TCN flood query count     :2

Last member query interval : 100

Vlan 1:

--------

IGMP snooping                       :Enabled

Immediate leave                     :Disabled

Multicast router learning mode      :pim-dvmrp

Source only learning age timer      :10

CGMP interoperability mode          :IGMP_ONLY

Last member query interval : 100

Related Commands

Command	Description
ip igmp snooping	Enables IGMP snooping on the switch or on a VLAN.
ip igmp snooping last-member-query-interval	Enables the IGMP snooping configurable-leave timer.
ip igmp snooping querier	Enables the IGMP querier function in Layer 2 networks.
ip igmp snooping report-suppression	Enables IGMP report suppression.
ip igmp snooping source-only-learning age-timer	Enables and configures the aging time of the forward-table entries that the switch learns by using the source-only learning method.
ip igmp snooping tcn	Configures the IGMP topology change notification behavior.
ip igmp snooping tcn flood	Specifies multicast flooding as the IGMP spanning-tree topology change notification behavior.
ip igmp snooping vlan immediate-leave	Enables IGMP snooping immediate-leave processing on a VLAN.
ip igmp snooping vlan mrouter	Adds a multicast router port or configures the multicast learning method.
ip igmp snooping vlan static	Statically adds a Layer 2 port as a member of a multicast group.
show ip igmp snooping groups	Displays the IGMP snooping multicast table for the switch.
show ip igmp snooping mrouter	Displays IGMP snooping multicast router ports for the switch or for the specified multicast VLAN.
show ip igmp snooping querier	Displays the configuration and operation information for the IGMP querier configured on a switch.

show ip igmp snooping groups

Use the show ip igmp snooping groups privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping multicast table for the switch or the multicast information. Use with the vlan keyword to display the multicast table for a specified multicast VLAN or specific multicast information.

show ip igmp snooping groups [count | dynamic [count] | user [count]] [ | {begin | exclude | include} expression]

show ip igmp snooping groups vlan vlan-id [ip_address | count | dynamic [count] | user [count]] [ | {begin | exclude | include} expression]

Syntax Description

count	(Optional) Display the total number of entries for the specified command options instead of the actual entries.
dynamic	(Optional) Display entries learned by IGMP snooping.
user	Optional) Display only the user-configured multicast entries.
ip_address	(Optional) Display characteristics of the multicast group with the specified group IP address.
vlan vlan-id	(Optional) Specify a VLAN; the range is 1 to 1001 and 1006 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.2(25)SE	This command was introduced.

Usage Guidelines

Use this command to display multicast information or the multicast table.

VLAN IDs 1002 to 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in IGMP snooping.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping groups command without any keywords. It displays the multicast table for the switch.

Switch# show ip igmp snooping groups

Vlan      Group          Type        Version     Port List

-------------------------------------------------------------

104       224.1.4.2      igmp        v2          Gi0/1, Gi0/2

104       224.1.4.3      igmp        v2          Gi0/1, Gi0/2

This is an example of output from the show ip igmp snooping groups count command. It displays the total number of multicast groups on the switch.

Switch# show ip igmp snooping groups count

Total number of multicast groups: 2

This is an example of output from the show ip igmp snooping groups dynamic command. It shows only the entries learned by IGMP snooping.

Switch# show ip igmp snooping groups vlan 1 dynamic

Vlan      Group          Type        Version     Port List

-------------------------------------------------------------

104       224.1.4.2      igmp        v2          Gi0/1

104       224.1.4.3      igmp        v2          Gi0/1

This is an example of output from the show ip igmp snooping groups vlan vlan-id ip-address command. It shows the entries for the group with the specified IP address.

Switch# show ip igmp snooping groups vlan 104 224.1.4.2

Vlan      Group          Type        Version     Port List

-------------------------------------------------------------

104       224.1.4.2      igmp        v2          Gi0/1

Related Commands

Command	Description
ip igmp snooping	Enables IGMP snooping on the switch or on a VLAN.
ip igmp snooping vlan mrouter	Configures a multicast router port.
ip igmp snooping vlan static	Statically adds a Layer 2 port as a member of a multicast group.
show ip igmp snooping	Displays the IGMP snooping configuration of the switch or the VLAN.
show ip igmp snooping mrouter	Displays IGMP snooping multicast router ports for the switch or for the specified multicast VLAN.

show ip igmp snooping mrouter

Use the show ip igmp snooping mrouter privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping dynamically learned and manually configured multicast router ports for the switch or for the specified multicast VLAN.

show ip igmp snooping mrouter [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

vlan vlan-id	(Optional) Specify a VLAN; the range is 1 to 1001 and 1006 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Use this command to display multicast router ports on the switch or for a specific VLAN.

VLAN IDs 1002 to 1005 are reserved for Token Ring and FDDI VLANs and cannot be used in IGMP snooping.

When multicast VLAN registration (MVR) is enabled, the show ip igmp snooping mrouter command displays MVR multicast router information and IGMP snooping information.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping mrouter command. It shows how to display multicast router ports on the switch.

Switch> show ip igmp snooping mrouter

vlan            ports

-----+----------------------------------------

  1          Gi0/1,Gi0/1, Router

  2          Gi0/3,Gi0/4

This is an example of output from the show ip igmp snooping mrouter vlan 1 command. It shows how to display multicast router ports for a specific VLAN.

Switch# show ip igmp snooping mrouter vlan 1

vlan            ports

-----+----------------------------------------

  1          Gi0/1,Gi0/1, Router

Related Commands

Command	Description
ip igmp snooping	Enables IGMP snooping on the switch or on a VLAN.
ip igmp snooping vlan static	Adds a multicast router port.
show ip igmp snooping	Displays the IGMP snooping configuration of the switch or the VLAN
show ip igmp snooping groups	Displays IGMP snooping multicast information for the switch or for the specified parameter.

show ip igmp snooping querier

Use the show ip igmp snooping querier detail user EXEC command to display the configuration and operation information for the IGMP querier configured on a switch.

show ip igmp snooping querier [detail | vlan vlan-id [detail]] [ | {begin | exclude | include} expression]

Syntax Description

detail	Optional) Display detailed IGMP querier information.
vlan vlan-id [detail]	Optional) Display IGMP querier information for the specified VLAN. The range is 1 to 1001 and 1006 to 4094. Use the detail keyword to display detailed information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Usage Guidelines

Use the show ip igmp snooping querier command to display the IGMP version and the IP address of a detected device, also called a querier, that sends IGMP query messages. A subnet can have multiple multicast routers but has only one IGMP querier. In a subnet running IGMPv2, one of the multicast routers is elected as the querier. The querier can be a Layer 3 switch.

The show ip igmp snooping querier command output also shows the VLAN and the interface on which the querier was detected. If the querier is the switch, the output shows the Port field as Router. If the querier is a router, the output shows the port number on which the querier is learned in the Port field.

The show ip igmp snooping querier detail user EXEC command is similar to the show ip igmp snooping querier command. However, the show ip igmp snooping querier command displays only the device IP address most recently detected by the switch querier.

The show ip igmp snooping querier detail command displays the device IP address most recently detected by the switch querier along with this additional information:

•The elected IGMP querier in the VLAN

•The configuration and operational information pertaining to the switch querier (if any) that is configured in the VLAN

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show ip igmp snooping querier command:

Switch> show ip igmp snooping querier

Vlan      IP Address     IGMP Version        Port

---------------------------------------------------

1         172.20.50.11   v3                  Gi0/1

2         172.20.40.20   v2                  Router

This is an example of output from the show ip igmp snooping querier detail command:

Switch> show ip igmp snooping querier detail

Vlan      IP Address     IGMP Version   Port

-------------------------------------------------------------

1         1.1.1.1        v2             Fa8/0/1 

Global IGMP switch querier status

--------------------------------------------------------

admin state                    : Enabled

admin version                  : 2

source IP address              : 0.0.0.0        

query-interval (sec)           : 60

max-response-time (sec)        : 10

querier-timeout (sec)          : 120

tcn query count                : 2

tcn query interval (sec)       : 10

Vlan 1:   IGMP switch querier status

--------------------------------------------------------

elected querier is 1.1.1.1         on port Fa8/0/1

--------------------------------------------------------

admin state                    : Enabled

admin version                  : 2

source IP address              : 10.1.1.65      

query-interval (sec)           : 60

max-response-time (sec)        : 10

querier-timeout (sec)          : 120

tcn query count                : 2

tcn query interval (sec)       : 10

operational state              : Non-Querier

operational version            : 2

tcn query pending count        : 0

Related Commands

Command	Description
ip igmp snooping	Enables IGMP snooping on the switch or on a VLAN.
ip igmp snooping querier	Enables the IGMP querier function in Layer 2 networks.
show ip igmp snooping	Displays IGMP snooping multicast router ports for the switch or for the specified multicast VLAN.

show ip source binding

Use the show ip source binding user EXEC command to display the IP source bindings on the switch.

show ip source binding [ip-address] [mac-address] [dhcp-snooping | static] [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

ip-address	(Optional) Display IP source bindings for a specific IP address.
mac-address	(Optional) Display IP source bindings for a specific MAC address.
dhcp-snooping	(Optional) Display IP source bindings that were learned by DHCP snooping.
static	(Optional) Display static IP source bindings.
interface interface-id	(Optional) Display IP source bindings on a specific interface.
vlan vlan-id	(Optional) Display IP source bindings on a specific VLAN.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Usage Guidelines

The show ip source binding command output shows the dynamically and statically configured bindings in the Dynamic Host Configuration Protocol (DHCP) snooping binding database. Use the show ip dhcp snooping binding privileged EXEC command to display only the dynamically configured bindings.

Examples

This is an example of output from the show ip source binding command:

Switch> show ip source binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

--------------      ---------------  ----------  -------------  ----  --------------------

00:00:00:0A:00:0B   11.0.0.1         infinite    static         10    GigabitEthernet0/1

00:00:00:0A:00:0A   11.0.0.2         10000       dhcp-snooping  10    GigabitEthernet0/1

Related Commands

Command	Description
ip dhcp snooping binding	Configures the DHCP snooping binding database.
ip source binding	Configures static IP source bindings on the switch.

show ip verify source

Use the show ip verify source user EXEC command to display the IP source guard configuration on the switch or on a specific interface.

show ip verify source [interface interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id	(Optional) Display IP source guard configuration on a specific interface.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.2(25)SEA	This command was introduced.

Examples

This is an example of output from the show ip verify source command:

Switch> show ip verify source

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

Fa0/1      ip           active       10.0.0.1                         10

Fa0/1      ip           active       deny-all                         11-20

Fa0/2      ip           inactive-trust-port

Fa0/3      ip           inactive-no-snooping-vlan

Fa0/4      ip-mac       active       10.0.0.2         aaaa.bbbb.cccc  10

Fa0/4      ip-mac       active       11.0.0.1         aaaa.bbbb.cccd  11

Fa0/4      ip-mac       active       deny-all         deny-all        12-20

Fa0/5      ip-mac       active       10.0.0.3         permit-all      10

Fa0/5      ip-mac       active       deny-all         permit-all      11-20

In the previous example, this is the IP source guard configuration:

•On the Fast Ethernet 0/1 interface, Dynamic Host Configuration Protocol (DHCP) snooping is enabled on VLANs 10 to 20. For VLAN 10, IP source guard with IP address filtering is configured on the interface, and a binding exists on the interface. For VLANs 11 to 20, the second entry shows that a default port access control list (ACL) is applied on the interface for the VLANs on which IP source guard is not configured.

•The Fast Ethernet 0/2 interface is configured as trusted for DHCP snooping.

•On the Fast Ethernet 0/3 interface, DHCP snooping is not enabled on the VLANs to which the interface belongs.

•On the Fast Ethernet 0/4 interface, IP source guard with source IP and MAC address filtering is enabled, and static IP source bindings are configured on VLANs 10 and 11. For VLANs 12 to 20, the default port ACL is applied on the interface for the VLANs on which IP source guard is not configured.

•On the Fast Ethernet 0/5 interface, IP source guard with source IP and MAC address filtering is enabled and configured with a static IP binding, but port security is disabled. The switch cannot filter source MAC addresses.

This is an example of output on an interface on which IP source guard is disabled:

Switch> show ip verify source fastethernet0/6

IP source guard is not configured on the interface fa0/6.

Related Commands

Command	Description
ip verify source	Enables IP source guard on an interface.

show l2protocol-tunnel

Use the show l2protocol-tunnel user EXEC command to display information about Layer 2 protocol tunnel ports. Displays information for interfaces with protocol tunneling enabled.

show l2protocol-tunnel [interface interface-id] [summary] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id	(Optional) Specify the interface for which protocol tunneling information appears. Valid interfaces are physical ports and port channels; the port channel range is 1 to 64.
summary	(Optional) Display only Layer 2 protocol summary information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

After enabling Layer 2 protocol tunneling on an access or IEEE 802.1Q tunnel port by using the l2protocol-tunnel interface configuration command, you can configure some or all of these parameters:

•Protocol type to be tunneled

•Shutdown threshold

•Drop threshold

If you enter the show l2protocol-tunnel [interface interface-id] command, only information about the active ports on which all the parameters are configured appears.

If you enter the show l2protocol-tunnel summary command, only information about the active ports on which some or all of the parameters are configured appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show l2protocol-tunnel command:

Switch> show l2protocol-tunnel

COS for Encapsulated Packets: 5

Port    Protocol Shutdown  Drop      Encapsulation Decapsulation Drop

                 Threshold Threshold Counter       Counter       Counter

------- -------- --------- --------- ------------- ------------- -------------

Fa0/10  ---           ----      ----          ----          ----          ----

        stp           ----      ---- 9847          1866          0

        vtp           ----      ---- 77            12            0

        pagp          ----      ---- 859           860           0

        lacp          ----      ---- 0             0             0

        udld          ----      ---- 219           211           0

Fa0/11  cdp           1100      ---- 2356          2350          0

        stp           1100      ---- 116           13            0

        vtp           1100      ---- 3             67            0

        pagp          ----       900 856           5848          0

        lacp          ----       900 0             0             0

        udld          ----       900 0             0             0

Fa0/12  cdp           ----      ---- 2356          0             0

        stp           ----      ---- 11787         0             0

        vtp           ----      ---- 81            0             0

        pagp          ----      ---- 0             0             0

        lacp          ----      ---- 849           0             0

        udld          ----      ---- 0             0             0

Fa0/13  cdp           ----      ---- 2356          0             0

        stp           ----      ---- 11788         0             0

        vtp           ----      ---- 81            0             0

        pagp          ----      ---- 0             0             0

        lacp          ----      ---- 849           0             0

        udld          ----      ---- 0             0             0

This is an example of output from the show l2protocol-tunnel summary command:

Switch> show l2protocol-tunnel summary

COS for Encapsulated Packets: 5

Port    Protocol    Shutdown         Drop            Status

                    Threshold        Threshold

                    (cdp/stp/vtp)    (cdp/stp/vtp)

                    (pagp/lacp/udld) (pagp/lacp/udld)

------- ----------- ---------------- ---------------- ----------

Fa0/10  --- stp vtp ----/----/----   ----/----/----   up

     pagp lacp udld ----/----/----   ----/----/----

Fa0/11  cdp stp vtp 1100/1100/1100   ----/----/----   up

     pagp lacp udld ----/----/----    900/ 900/ 900

Fa0/12  cdp stp vtp ----/----/----   ----/----/----   up

     pagp lacp udld ----/----/----   ----/----/----

Fa0/13  cdp stp vtp ----/----/----   ----/----/----   up

     pagp lacp udld ----/----/----   ----/----/----

Fa0/14  cdp stp vtp ----/----/----   ----/----/----   down

     pagp ---- udld ----/----/----   ----/----/----

Fa0/15  cdp stp vtp ----/----/----   ----/----/----   down

     pagp ---- udld ----/----/----   ----/----/----

Fa0/16  cdp stp vtp ----/----/----   ----/----/----   down

     pagp lacp udld ----/----/----   ----/----/----

Fa0/17  cdp stp vtp ----/----/----   ----/----/----   down

     pagp lacp udld ----/----/----   ----/----/----

Related Commands

Command	Description
clear l2protocol-tunnel counters	Clears counters for protocol tunneling ports.
l2protocol-tunnel	Enables Layer 2 protocol tunneling for CDP, STP, or VTP packets on an interface.
l2protocol-tunnel cos	Configures a class of service (CoS) value for tunneled Layer 2 protocol packets.

show l2tcam

Use the show l2tcam privileged EXEC command to display information about the portion of the ternary content addressable memory (TCAM) devoted to Layer 2 addresses. Use the keywords to display forwarding (bridging) or learning (MAC address learning) information or to display allocation statistics of MAC address types.

show l2tcam {cam {forwarding [entry-id] learning} | shadow} [ | {begin | exclude | include} expression]

Syntax Description

cam	Display contents and associated information about TCAM Layer 2 contents. This display output is a raw hex dump of information, intended for a Cisco technical support representative.
forwarding	Display TCAM Layer 2 forwarding (bridging) information.
entry-id	Number from 0 to 4294967295 identifying a forwarding entry.
learning	Display TCAM Layer 2 learning (MAC address learning) information.
shadow	Display allocation statistics for various address types of MAC addresses that the software keeps track of. Address types are identified only by number.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show l2tcam cam learning command:

Switch# show l2tcam cam learning

mask 1156  F7 FFFFFFFF FFFFFFFF

mask 1157  F7 FFFFFFFF FFFFFFFF

mask 1158  F7 FFFFFFFF FFFFFFFF

mask 1159  F7 FFFFFFFF FFFFFFFF

9248       00 00000000 00000000     80070000

9249       00 00000000 00000000     80060000

9250       00 00000000 00000000     80070000

9251       18 00010002 4B293A00     80020000

9252       00 00000000 00000000     80060000

9253       00 00000000 00000000     80010000

9254       00 00000000 00000000     80030000

9255       18 00010002 4B296700     80040000

<output truncated>

 9368       FF FFFFFFFF FFFFFFFF     5E731478

9369       FF FFFFFFFF FFFFFFFF     17B195AE

9370       FF FFFFFFFF FFFFFFFF     AB2DECEA

9371       FF FFFFFFFF FFFFFFFF     D821EC4E

9372       FF FFFFFFFF FFFFFFFF     E6E55344

9373       FF FFFFFFFF FFFFFFFF     FBFB0EEE

9374       FF FFFFFFFF FFFFFFFF     2057A03D

9375       FF FFFFFFFF FFFFFFFF     E55FE7C3

This is an example of output from the show l2tcam shadow command:

Switch# show l2tcam shadow

learning table

type  start  end   firstfree  firstfreeentry  flag  used/free

0     0      79    0          0               4        0/640

1     80     83    80         0               4        0/32

2     1159   84    1159       3               2        3/8605

3     1160   1167  1160       0               1        0/64

4     1168   1171  1168       1               1        1/31

forwarding table

type  start  end   firstfree  firstfreeentry  flag  used/free

0     0      0     0          0               12       0/0

1     0      0     0          0               12       0/0

2     0      77    0          0               4        0/624

3     78     83    82         6               1       38/10

4     84     1159  84         3               4        3/8605

5     1287   1160  1275       3               2       99/925

6     1415   1288  1403       3               2       99/925

7     1416   1417  1416       0               1        0/16

8     1801   1418  1801       0               2        0/3072

9     1802   1803  1802       1               1        1/15

10    1804   1805  1804       1               1        1/15

11    1809   1806  1809       0               2        0/32

12    1810   1811  1810       2               1        2/14

Related Commands

Command	Description
show l3tcam	Displays information about the TCAM devoted to Layer 3 forwarding information.
show mac address-table	Displays the MAC address table static and dynamic entries.

show l3tcam

Use the show l3tcam privileged EXEC command to display information about the portion of the ternary content addressable memory (TCAM) devoted to Layer 3 forwarding (IP routing) information.

show l3tcam {cam | shadow} [ | {begin | exclude | include} expression]

Syntax Description

cam	Display contents and associated information about TCAM Layer 3 contents devoted to unicast and multicast IP routing. This display output is a raw hex dump of information, intended for a Cisco technical support representative.
shadow	Display contents and associated information about TCAM Layer 3 contents formatted to display routes and adjacencies associated with each mask, and some overall statistics.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show l3tcam cam command:

Switch# show l3tcam cam

C2 00 00 00 00 00 00 00 00 

Mask(s)

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

F1 00 00 00 00 FF FF FF FF - 80 07 00 00 00 00 00 00 00 

Entries

C2 00 00 00 00 00 00 00 00 - 80 00 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 FF FF FF FF - 80 00 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 00 00 00 00 - 80 01 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 FF FF FF FF - 80 01 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 00 00 00 00 - 80 02 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 FF FF FF FF - 80 02 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 00 08 - 80 00 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 01 08 - 80 01 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 02 08 - 80 02 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 0A 08 - 80 00 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 0B 08 - 80 01 00 00 00 00 00 00 00         ( 00 04 80 00 )

C2 00 00 00 00 08 08 0C 08 - 80 02 00 00 00 00 00 00 00         ( 00 04 80 00 )

<output truncated>

This is an example of output from the show l3tcam shadow command:

Switch# show l3tcam shadow

L3 TCAM:total words = 30720, used words = 194

Prefix 34:Start=0(0) End=15(127) FirstFree=98, NumFree = 30

Offset  Tbl+Flg SA              DA              Lbl Assoc

==============================================================

Mask    0xF1    0.0.0.0         255.255.255.255   7 --

     0  0xC2    0.0.0.0         0.0.0.0           0 0x00048000 (CPU)

     2  0xC2    0.0.0.0         255.255.255.255   0 0x00048000 (CPU)

     4  0xC2    0.0.0.0         0.0.0.0           1 0x00048000 (CPU)

     6  0xC2    0.0.0.0         255.255.255.255   1 0x00048000 (CPU)

     8  0xC2    0.0.0.0         0.0.0.0           2 0x00048000 (CPU)

    10  0xC2    0.0.0.0         255.255.255.255   2 0x00048000 (CPU)

    12  0xC2    0.0.0.0         8.8.0.8           0 0x00048000 (CPU)

    14  0xC2    0.0.0.0         8.8.1.8           1 0x00048000 (CPU)

    16  0xC2    0.0.0.0         8.8.2.8           2 0x00048000 (CPU)

    18  0xC2    0.0.0.0         8.8.10.8          0 0x00048000 (CPU)

    20  0xC2    0.0.0.0         8.8.11.8          1 0x00048000 (CPU)

    22  0xC2    0.0.0.0         8.8.12.8          2 0x00048000 (CPU)

    24  0xC2    0.0.0.0         10.10.10.40       0 0x00048000 (CPU)

    26  0xC2    0.0.0.0         10.10.0.0         0 0x00048000 (CPU)

    28  0xC2    0.0.0.0         10.10.255.255     0 0x00048000 (CPU)

    30  0xC2    0.0.0.0         38.0.0.8          1 0x00048000 (CPU)

<output truncated>

Related Commands

Command	Description
show adjacency	Displays Cisco Express Forwarding (CEF) adjacency table information. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Switching Services Command Reference, Release 12.2.
show arp	Displays the entries in the ARP table. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2.
show ip route	Displays the current state of the routing table. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols, Release 12.2.
show l2tcam	Displays information about the portion of the TCAM devoted to Layer 2 information.

show lacp

Use the show lacp user EXEC command to display Link Aggregation Control Protocol (LACP) channel-group information.

show lacp {channel-group-number {counters | internal | neighbor} | {counters | internal | neighbor | sys-id}} [ | {begin | exclude | include} expression]

Syntax Description

channel-group-number	(Optional) Number of the channel group. The range is 1 to 6.
counters	Display traffic information.
internal	Display internal information.
neighbor	Display neighbor information.
sys-id	Display the system identifier that is being used by LACP. The system identifier is made up of the LACP system priority and a MAC address.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(12c)EA1	This command was introduced.

Usage Guidelines

You can enter any show lacp command to display the active port-channel information. To display the nonactive information, enter the show lacp command with a group number.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show lacp counters command:

Switch> show lacp counters

LACPDUs         Marker      Marker Response    LACPDUs

Port       Sent   Recv     Sent   Recv     Sent   Recv      Pkts Err

---------------------------------------------------------------------

Channel group:1

Fa0/5      19     10       0      0        0      0         0     

Fa0/6      14     6        0      0        0      0         0     

Fa0/7      8      7        0      0        0      0         0 

This is an example of output from the show lacp internal command:

Switch> show lacp 1 internal 

Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs

        A - Device is in Active mode       P - Device is in Passive mode     

Channel group 1

                            LACP port     Admin     Oper    Port     Port

Port      Flags   State     Priority      Key       Key     Number   State

Fa0/5     SP      indep     32768         0x1       0x1     0x4      0x7C  

Fa0/6     SP      indep     32768         0x1       0x1     0x5      0x7C  

Fa0/7     SP      down      32768         0x1       0x1     0x6      0xC 

This is an example of output from the show lacp neighbor command:

Switch> show lacp 1 neighbor

Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs

        A - Device is in Active mode       P - Device is in Passive mode     

Channel group 1 neighbors

Partner's information:

          Partner               Partner                     Partner

Port      System ID             Port Number     Age         Flags

Fa0/5     00000,0000.0000.0000  0x0             85947s        SP

          LACP Partner         Partner         Partner

          Port Priority        Oper Key        Port State

          0                    0x0             0x0 

Partner's information:

          Partner               Partner                     Partner

Port      System ID             Port Number     Age         Flags

Fa0/6     00000,0000.0000.0000  0x0             86056s        SP

          LACP Partner         Partner         Partner

          Port Priority        Oper Key        Port State

          0                    0x0             0x0 

Partner's information:

          Partner               Partner                     Partner

Port      System ID             Port Number     Age         Flags

Fa0/7     00010,0008.a343.b580  0x6             86032s        SA

          LACP Partner         Partner         Partner

          Port Priority        Oper Key        Port State

          32768                0x1             0x35

This is an example of output from the show lacp sys-id command:

Switch> show lacp sys-id 

32765,0002.4b29.3a00

Related Commands

Command	Description
clear lacp	Clears the LACP channel-group information.

show mac access-group

Use the show mac access-group user EXEC command to display the MAC access control lists (ACLs) configured for an interface or a switch.

show mac access-group [interface interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface interface-id	(Optional) Display the MAC ACLs configured on a specific interface. Valid interfaces are physical ports and port channels; the port channel range is 1 to 64.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC; the interface keyword is available only in privileged EXEC mode.

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac-access group user EXEC command. In this display, port 2 has the MAC access list macl_e1 applied; no MAC ACLs are applied to other interfaces.

Switch> show mac access-group 

Interface GigabitEthernet0/1:

   Inbound access-list is not set

Interface GigabitEthernet0/2:

   Inbound access-list is macl_e1

Interface GigabitEthernet0/3:

   Inbound access-list is not set

Interface GigabitEthernet0/4:

   Inbound access-list is not set

Interface GigabitEthernet0/5:

   Inbound access-list is not set

<output truncated>

Interface GigabitEthernet0/10:

   Inbound access-list is not set

Interface GigabitEthernet0/11:

   Inbound access-list is not set

Interface GigabitEthernet0/12:

   Inbound access-list is not set

This is an example of output from the show mac access-group interface gigabitethernet0/2 command:

Switch# show mac access-group interface gigabitethernet0/2

Interface GigabitEthernet0/2:

   Inbound access-list is macl_e1

Related Commands

Command	Description
mac access-group	Applies a MAC access group to an interface.

show mac address-table

Use the show mac address-table user EXEC command with no keywords to display the MAC address table static and dynamic entries.

show mac address-table [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table command replaces the show mac-address-table command (with the hyphen).

---

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table command was replaced by the show mac address-table command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table command:

Switch> show mac address-table

          Mac Address Table

------------------------------------------

Vlan    Mac Address       Type       Ports

----    -----------       ----       -----

All    0000.0000.0001    STATIC     CPU

All    0000.0000.0002    STATIC     CPU

All    0000.0000.0003    STATIC     CPU

All    0000.0000.0009    STATIC     CPU

All    0000.0000.0012    STATIC     CPU

All    0180.c200.000b    STATIC     CPU

All    0180.c200.000c    STATIC     CPU

All    0180.c200.000d    STATIC     CPU

All    0180.c200.0010    STATIC     CPU

   1    0030.9441.6327    DYNAMIC    Fa0/23

Total Mac Addresses for this criterion: 9

Related Commands

Command	Description
clear mac address-table dynamic	Deletes from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table address

Use the show mac address-table address user EXEC command to display MAC address table information for the specified MAC address.

show mac address-table address mac-address [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table address command replaces the show mac-address-table address command (with the hyphen).

---

Syntax Description

mac-address	Specify the 48-bit MAC address; the valid format is H.H.H.
interface interface-id	(Optional) Display information for a specific interface. Valid interfaces include physical ports and port channels.
vlan vlan-id	(Optional) Display entries for the specific VLAN only. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table address command was replaced by the show mac address-table address command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table address command:

Switch> show mac address-table address 0002.4b28.c482

          Mac Address Table

------------------------------------------

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

 All    0002.4b28.c482  STATIC  CPU

Total Mac Addresses for this criterion: 1 

Related Commands

Command	Description
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table aging-time

Use the show mac address-table aging-time user EXEC command to display the aging time in all VLANs or the specified VLAN.

show mac address-table aging-time [vlan vlan-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table aging-time command replaces the show mac-address-table aging-time command (with the hyphen).

---

Syntax Description

vlan vlan-id	(Optional) Display aging time information for a specific VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table aging-time command was replaced by the show mac address-aging-time command.

Usage Guidelines

If no VLAN number is specified, the aging time for all VLANs appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table aging-time command:

Switch> show mac address-table aging-time

Vlan    Aging Time

----    ----------

   1     300 

This is an example of output from the show mac address-table aging-time vlan 10 command:

Switch> show mac address-table aging-time vlan 10

Vlan    Aging Time

----    ----------

  10     300 

Related Commands

Command	Description
mac address-table aging-time	Sets the length of time that a dynamic entry remains in the MAC address table after the entry is used or updated.
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table count

Use the show mac address-table count user EXEC command to display the number of addresses present in all VLANs or the specified VLAN.

show mac address-table count [vlan vlan-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table count command replaces the show mac-address-table count command (with the hyphen).

---

Syntax Description

vlan vlan-id	(Optional) Display the number of addresses for a specific VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table count command was replaced by the show mac address-table count command.

Usage Guidelines

If no VLAN number is specified, the address count for all VLANs appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table count command:

Switch> show mac address-table count

Mac Entries for Vlan   : 1

---------------------------

Dynamic Address Count  : 2

Static  Address Count  : 0

Total Mac Addresses    : 2 

Related Commands

Command	Description
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table dynamic

Use the show mac address-table dynamic user EXEC command to display dynamic MAC address table entries only.

show mac address-table dynamic [address mac-address] [interface interface-id] [vlan vlan-id]
[ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table dynamic command replaces the show mac-address-table dynamic command (with the hyphen).

---

Syntax Description

address mac-address	(Optional) Specify a 48-bit MAC address; the valid format is H.H.H.
interface interface-id	(Optional) Specify an interface to match; valid interfaces include physical ports and port channels.
vlan vlan-id	(Optional) Display entries for a specific VLAN; the range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table dynamic command was replaced by the show mac address-table dynamic command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table dynamic command:

Switch> show mac address-table dynamic

          Mac Address Table

------------------------------------------

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

   1    0030.b635.7862  DYNAMIC Gi0/2

   1    00b0.6496.2741  DYNAMIC Gi0/2

Total Mac Addresses for this criterion: 2 

Related Commands

Command	Description
clear mac address-table dynamic	Deletes from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN.
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table interface

Use the show mac address-table interface user EXEC command to display the MAC address table information for the specified interface in the specified VLAN.

show mac address-table interface interface-id [vlan vlan-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table interface command replaces the show mac-address-table interface command (with the hyphen).

---

Syntax Description

interface-id	Specify an interface type; valid interfaces include physical ports and port channels.
vlan vlan-id	(Optional) Display entries for a specific VLAN; the range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table interface command was replaced by the show mac address-table interface command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table interface command:

Switch> show mac address-table interface gigabitethernet0/2

          Mac Address Table

------------------------------------------

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

   1    0030.b635.7862  DYNAMIC Gi0/2

   1    00b0.6496.2741  DYNAMIC Gi0/2

Total Mac Addresses for this criterion: 2 

Related Commands

Command	Description
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table multicast

Use the show mac address-table multicast user EXEC command to display the Layer 2 multicast entries for all VLANs. Use the command in privileged EXEC mode to display specific multicast entries.

show mac address-table multicast [count] | igmp-snooping [count] | user [count] | vlan [count] | [vlan-id [count] | igmp-snooping [count] | user [count]] [ | {begin | exclude | include} expression]

---

Note The show mac address-table multicast command only shows non-IP multicast addresses. Use the show ip igmp snooping multicast user EXEC command to display IP multicast addresses.

---

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table multicast command replaces the show mac-address-table multicast command (with the hyphen).

---

Syntax Description

count	(Optional) Display the total number of entries for the specified command options instead of the actual entries.
igmp-snooping	(Optional) Display entries learned through Internet Group Management Protocol (IGMP) snooping.
user	(Optional) Display only the user-configured multicast entries.
vlan vlan-id	(Optional) Display addresses for a specific VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table multicast command was replaced by the show mac address-table multicast command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table multicast command. It shows how to display all multicast entries for the switch.

Switch> show mac address-table multicast

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

   1    0100.5e00.0128  IGMP    Gi0/1 

This is an example of output from the show mac address-table multicast count command. It shows how to display a total count of MAC address entries for the switch.

Switch> show mac address-table multicast count

Multicast MAC Entries for all vlans:    10

This is an example of output from the show mac address-table multicast vlan 1 count command. It shows how to display a total count of MAC address entries for a VLAN.

Switch> show mac address-table multicast vlan 1 count

Multicast MAC Entries for vlan 1:    4

This is an example of output from the show mac address-table multicast interface vlan1 command. It shows how to display the user-configured multicast entries for VLAN 1.

Switch> show mac address-table multicast interface vlan1

vlan   mac address     type 	        ports

-----+---------------+--------+---------+---+--------------------------------

  1  0100.5e02.0203    user           Gi0/1,Gi0/2

  1  0100.5e00.0128    user           Gi0/1,Gi0/2

This is an example of output from the show mac address-table multicast vlan 1 igmp-snooping count command. It shows how to display the total number of entries learned through IGMP snooping for VLAN 1:

Switch> show mac address-table multicast vlan 1 igmp-snooping count

Number of IGMP Learned Multicast Addresses:    2

Related Commands

Command	Description
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table notification

Use the show mac address-table notification user EXEC command to display the MAC address notification settings for all interfaces or the specified interface.

show mac address-table notification [interface [interface-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table notification command replaces the show mac-address-table notification command (with the hyphen).

---

Syntax Description

interface	(Optional) Display information for all interfaces. Valid interfaces include physical ports and port channels.
interface-id	(Optional) Display information for the specified interface. Valid interfaces include physical ports and port channels.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(8)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table notification command was replaced by the show mac address-table notification command.

Usage Guidelines

Use the show mac address-table notification command without any keywords to display whether the feature is enabled or disabled, the MAC notification interval, the maximum number of entries allowed in the history table, and the history table contents.

Use the interface keyword to display the flags for all interfaces. If the interface-id is included, only the flags for that interface appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table notification command:

Switch> show mac address-table notification

MAC Notification Feature is Enabled on the switch

Interval between Notification Traps : 60 secs

Number of MAC Addresses Added : 4

Number of MAC Addresses Removed : 4

Number of Notifications sent to NMS : 3

Maximum Number of entries configured in History Table : 100

Current History Table Length : 3

MAC Notification Traps are Enabled

History Table contents

----------------------

History Index 0, Entry Timestamp 1032254, Despatch Timestamp 1032254

MAC Changed Message :

Operation: Added   Vlan: 2     MAC Addr: 0000.0000.0001 Module: 0   Port: 1

History Index 1, Entry Timestamp 1038254, Despatch Timestamp 1038254

MAC Changed Message :

Operation: Added   Vlan: 2     MAC Addr: 0000.0000.0000 Module: 0   Port: 1

Operation: Added   Vlan: 2     MAC Addr: 0000.0000.0002 Module: 0   Port: 1

Operation: Added   Vlan: 2     MAC Addr: 0000.0000.0003 Module: 0   Port: 1

History Index 2, Entry Timestamp 1074254, Despatch Timestamp 1074254

MAC Changed Message :

Operation: Deleted Vlan: 2     MAC Addr: 0000.0000.0000 Module: 0   Port: 1

Operation: Deleted Vlan: 2     MAC Addr: 0000.0000.0001 Module: 0   Port: 1

Operation: Deleted Vlan: 2     MAC Addr: 0000.0000.0002 Module: 0   Port: 1

Operation: Deleted Vlan: 2     MAC Addr: 0000.0000.0003 Module: 0   Port: 1

Related Commands

Command	Description
clear mac address-table notification	Clears the MAC address notification global counters.
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table static	Displays static MAC address table entries only.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table static

Use the show mac address-table static user EXEC command to display static MAC address table entries only.

show mac address-table static [[address mac-address [interface interface-id | vlan vlan-id]] | [interface interface-id [vlan vlan-id]] | vlan vlan-id] [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table static command replaces the show mac-address-table static command (with the hyphen).

---

Syntax Description

address mac-address	(Optional) Specify a 48-bit MAC address; the valid format is H.H.H.
interface interface-id	(Optional) Specify an interface to match; valid interfaces include physical ports and port channels.
vlan vlan-id	(Optional) Display addresses for a specific VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table static command was replaced by the show mac address-table static command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table static command:

Switch> show mac address-table static

          Mac Address Table

------------------------------------------

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

 All    0100.0ccc.cccc  STATIC  CPU

 All    0180.c200.0000  STATIC  CPU

 All    0100.0ccc.cccd  STATIC  CPU

 All    0180.c200.0001  STATIC  CPU

 All    0180.c200.0002  STATIC  CPU

 All    0180.c200.0003  STATIC  CPU

 All    0180.c200.0004  STATIC  CPU

 All    0180.c200.0005  STATIC  CPU

   4    0001.0002.0004  STATIC  Drop

   6    0001.0002.0007  STATIC  Drop

Total Mac Addresses for this criterion: 10 

Related Commands

Command	Description
mac address-table static	Adds static addresses to the MAC address table.
mac address-table static drop	Enables unicast MAC address filtering and configures the switch to drop traffic with a specific source or destination MAC address.
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table vlan	Displays the MAC address table information for the specified VLAN.

show mac address-table vlan

Use the show mac address-table vlan user EXEC command to display the MAC address table information for the specified VLAN.

show mac address-table vlan vlan-id [ | {begin | exclude | include} expression]

---

Note Beginning with Cisco IOS Release 12.1(11)EA1, the show mac address-table vlan command replaces the show mac-address-table vlan command (with the hyphen).

---

Syntax Description

vlan-id	(Optional) Display addresses for a specific VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The show mac-address-table vlan command was replaced by the show mac address-table vlan command.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mac address-table vlan 1 command:

Switch> show mac address-table vlan 1

          Mac Address Table

------------------------------------------

Vlan    Mac Address     Type    Ports

----    -----------     ----    -----

   1    0100.0ccc.cccc  STATIC  CPU

   1    0180.c200.0000  STATIC  CPU

   1    0100.0ccc.cccd  STATIC  CPU

   1    0180.c200.0001  STATIC  CPU

   1    0180.c200.0002  STATIC  CPU

   1    0180.c200.0003  STATIC  CPU

   1    0180.c200.0004  STATIC  CPU

   1    0180.c200.0005  STATIC  CPU

Total Mac Addresses for this criterion: 8 

Related Commands

Command	Description
show mac address-table address	Displays MAC address table information for the specified MAC address.
show mac address-table aging-time	Displays the aging time in all VLANs or the specified VLAN.
show mac address-table count	Displays the number of addresses present in all VLANs or the specified VLAN.
show mac address-table dynamic	Displays dynamic MAC address table entries only.
show mac address-table interface	Displays the MAC address table information for the specified interface.
show mac address-table multicast	Displays the Layer 2 multicast entries for all VLANs or the specified VLAN.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or the specified interface.
show mac address-table static	Displays static MAC address table entries only.

show mls qos

Use the show mls qos user EXEC command to display global quality of service (QoS) configuration information.

show mls qos [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mls qos command:

Switch> show mls qos 

Qos is enabled

Related Commands

Command	Description
mls qos	Enables quality of service (QoS) for the entire switch.

show mls qos aggregate-policer

Use the show mls qos aggregate-policer user EXEC command to display the quality of service (QoS) aggregate policer configuration. A policer defines a maximum permissible rate of transmission, a maximum burst size for transmissions, and an action to take if either maximum is exceeded.

show mls qos aggregate-policer [aggregate-policer-name] [ | {begin | exclude | include} expression]

Syntax Description

aggregate-policer-name	(Optional) Display the policer configuration for the specified name.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mls qos aggregate-policer command:

Switch> show mls qos aggregate-policer policer1

aggregate-policer policer1 88000 2000000 exceed-action drop

Not used by any policy map 

Related Commands

Command	Description
mls qos aggregate-policer	Defines policer parameters that can be shared by multiple classes within a policy map.

show mls qos interface

Use the show mls qos interface user EXEC command to display quality of service (QoS) information at the interface level.

show mls qos interface [interface-id] [buffers | policers | queueing | statistics]
[ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) Display QoS information for the specified interface. Valid interfaces include physical ports.
buffers	(Optional) Display buffer settings of the queues. For Gigabit-capable Ethernet ports, the display includes the queue depth for each of the four queues and the tail drop or Weighted Random Early Detection (WRED) thresholds. For 10/100 Ethernet ports, the display includes the configured minimum-reserve settings.
policers	(Optional) Display all the policers configured on the interface, their settings, and the number of policers that are currently unassigned.
queueing	(Optional) Display queueing strategy (weighted round robin, priority queueing), the weights corresponding to the queues, and the class of service (CoS)-to-egress-queue map.
statistics	(Optional) Display all the Differentiated Services Code Points (DSCPs) for which statistics are maintained and the corresponding ingress and egress statistics, including the number of bytes dropped.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If no keyword is specified with the show mls qos interface command, the display shows the port trusted mode (DSCP trusted, CoS trusted, untrusted, and so forth), the default CoS value, the DSCP-to-DSCP-mutation map (if any) attached to the port, and the policy map (if any) attached to the interface. If a specific interface is not specified, the information for all interfaces appears.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mls qos interface command:

Switch# show mls qos interface fastethernet0/1

FastEthernet0/1

trust state: not trusted

trust mode: trust cos

COS override: dis

default COS: 0

DSCP Mutation Map: Default DSCP Mutation Map

trust device: cisco-phone

This is an example of output from the show mls qos interface gigabitethernet0/1 buffers command:

Switch> show mls qos interface gigabitethernet0/1 buffers

GigabitEthernet0/1

Notify Q depth:

qid-size

 1 - 25

 2 - 25

 3 - 25

 4 - 25

qid WRED thresh1 thresh2

 1  dis   100      100

 2  dis   100      100

 3  dis   100      100

 4  dis   100      100

In the preceding display, the qid-size section shows the weight (the amount of space allocated to each queue) as configured by the wrr-queue queue-limit interface configuration command. The next section of the display shows the settings of the tail-drop thresholds for all four queues. The WRED column shows that it is disabled, which means that tail drop is in effect. Tail-drop thresholds are configured by using the wrr-queue threshold interface configuration command.

This is an example of output from the show mls qos interface fastethernet0/1 buffers command:

Switch> show mls qos interface fastethernet0/1 buffers

FastEthernet0/1

Minimum reserve buffer size:

 100 100 100 100 100 100 100 100

Minimum reserve buffer level select:

 4 2 5 7

This sample shows that the buffer size for all minimum-reserve levels is set to 100 packets. The last line of the display shows that queue 1 selects minimum-reserve level 4, queue 2 selects minimum-reserve level 2, queue 3 selects minimum-reserve level 5, and queue 4 selects minimum-reserve level 7.

This is an example of output from the show mls qos interface gigabitethernet0/1 queueing command:

Switch> show mls qos interface gigabitethernet0/1 queueing

GigabitEthernet0/1

Ingress expedite queue: dis

Egress expedite queue: ena

wrr bandwidth weights:

qid-weights

 1 - 25

 2 - 25

 3 - 25

Dscp-threshold map:

     d1 :  d2 0  1  2  3  4  5  6  7  8  9

     ---------------------------------------

      0 :    01 01 01 01 01 01 01 01 01 01

      1 :    01 01 01 01 01 01 01 01 01 01

      2 :    01 01 01 01 01 01 01 01 01 01

      3 :    01 01 01 01 01 01 01 01 01 01

      4 :    01 01 01 01 01 01 01 01 01 01

      5 :    01 01 01 01 01 01 01 01 01 01

      6 :    01 01 01 01

Cos-queue map:

cos-qid

 0 - 1

 1 - 1

 2 - 2

 3 - 2

 4 - 3

 5 - 3

 6 - 4

 7 - 4 

In the preceding display, the egress expedite queue is enabled. Because of this, the weight of the expedite queue (queue 4) is ignored and not used in the ratio calculation. Only the bandwidth weights for the remaining queues appear. The bandwidth weight of the queues is configured by the wrr-queue bandwidth interface configuration command. The CoS-to-queue map shows the CoS values that are mapped to select a queue; this map is configured by the wrr-queue cos-map interface configuration command.

This is an example of output from the show mls qos interface gigabitethernet0/1 statistics command. Table 2-24 describes the fields in this display.

Switch> show mls qos interface gigabitethernet0/1 statistics

Ingress

  dscp: incoming   no_change  classified policed    dropped (in bytes)

    1 : 0          0          0          0          0

    2 : 0          0          0          0          0

    3 : 0          0          0          0          0

    45: 0          0          0          0          0

    23: 0          0          0          0          0

Others: 203216935  24234242   178982693  0          0

Egress

  dscp: incoming   no_change  classified policed    dropped (in bytes)

   1 : 0             n/a       n/a      0          0

   2 : 0             n/a       n/a      0          0

   3 : 0             n/a       n/a      0          0

   45: 0             n/a       n/a      0          0

   23: 0             n/a       n/a      0          0

Others: 155983       n/a       n/a      0          0 

WRED drop counts:

  qid  thresh1    thresh2   FreeQ

   1 : 0          0         1024

   2 : 0          0         1024

   3 : 0          0         1024

   4 : 0          0         1024

Table 2-24 show mls qos interface statistics Field Descriptions 

	Field	Description
Ingress	incoming	Number of packets or bytes with a specific DSCP entering the ingress QoS process.
	no_change	Number of packets or bytes for which the DSCP value did not change after classification.
	classified	Number of packets or bytes classified to this DSCP value.
	policed	Number of packets or bytes marked down from this DSCP value.
	dropped (in bytes)	Number of packets or bytes dropped by policing.
Egress	incoming	Number of packets or bytes with a specific DSCP entering the egress QoS process.
	no_change	Number of packets with a specific DSCP that did not change.
	classified	Number of packets with a specific DSCP that were classified according to the class map.
	policed	Number of packets or bytes marked down from this DSCP.
	dropped (in bytes)	Number of packets or bytes of this DSCP dropped.
WRED drop counts	qid	Queue number.
	thresh1 and thresh2	Number of DSCPs of a specific value dropped at threshold 1 and threshold 2.
	FreeQ	Amount of free queue space available per queue.

Related Commands

Command	Description
mls qos monitor	Defines up to 16 DSCP values for which byte or packet statistics are gathered by hardware.

show mls qos maps

Use the show mls qos maps user EXEC command to display quality of service (QoS) mapping information. Maps are used to generate an internal Differentiated Services Code Point (DSCP) value, which represents the priority of the traffic.

show mls qos maps [cos-dscp | dscp-cos | dscp-mutation dscp-mutation-name | dscp-switch-priority | ip-prec-dscp | policed-dscp] [ | {begin | exclude | include} expression]

Syntax Description

cos-dscp	(Optional) Display class of service (CoS)-to-DSCP map.
dscp-cos	(Optional) Display DSCP-to-CoS map.
dscp-mutation dscp-mutation-name	(Optional) Display the specified DSCP-to-DSCP-mutation map.
dscp-switch-priority	(Optional) Display the DSCP-to-switch-priority map.
ip-prec-dscp	(Optional) Display the IP-precedence-to-DSCP map.
policed-dscp	(Optional) Display the policed-DSCP map.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mls qos maps command:

Switch> show mls qos maps

Policed-dscp map:

     d1 :  d2 0  1  2  3  4  5  6  7  8  9

     ---------------------------------------

      0 :    00 01 02 03 04 05 06 07 08 09

      1 :    10 11 12 13 14 15 16 17 18 19

      2 :    20 21 22 23 24 25 26 27 28 29

      3 :    30 31 32 33 34 35 36 37 38 39

      4 :    40 41 42 43 44 45 46 47 48 49

      5 :    50 51 52 53 54 55 56 57 58 59

      6 :    60 61 62 63

Dscp-cos map:

     d1 :  d2 0  1  2  3  4  5  6  7  8  9

     ---------------------------------------

      0 :    00 00 00 00 00 00 00 00 01 01

      1 :    01 01 01 01 01 01 02 02 02 02

      2 :    02 02 02 02 03 03 03 03 03 03

      3 :    03 03 04 04 04 04 04 04 04 04

      4 :    05 05 05 05 05 05 05 05 06 06

      5 :    06 06 06 06 06 06 07 07 07 07

      6 :    07 07 07 07

Dscp-switch priority map:

     d1 :  d2 0  1  2  3  4  5  6  7  8  9

     ---------------------------------------

      0 :    00 00 00 00 00 00 00 00 00 00

      1 :    00 00 00 00 00 00 01 01 01 01

      2 :    01 01 01 01 01 01 01 01 01 01

      3 :    01 01 02 02 02 02 02 02 02 02

      4 :    02 02 02 02 02 02 02 02 03 03

      5 :    03 03 03 03 03 03 03 03 03 03

      6 :    03 03 03 03

Cos-dscp map:

        cos:   0  1  2  3  4  5  6  7

     --------------------------------

       dscp:   0  8 16 24 32 40 48 56

IpPrecedence-dscp map:

     ipprec:   0  1  2  3  4  5  6  7

     --------------------------------

       dscp:   0  8 16 24 32 40 48 56

Dscp-dscp mutation map:

   Default DSCP Mutation Map:

     d1 :  d2 0  1  2  3  4  5  6  7  8  9

     ---------------------------------------

      0 :    00 01 02 03 04 05 06 07 08 09

      1 :    10 11 12 13 14 15 16 17 18 19

      2 :    20 21 22 23 24 25 26 27 28 29

      3 :    30 31 32 33 34 35 36 37 38 39

      4 :    40 41 42 43 44 45 46 47 48 49

      5 :    50 51 52 53 54 55 56 57 58 59

      6 :    60 61 62 63 

---

Note The d1 column specifies the most-significant digit in the internal DSCP; the d2 row specifies the least-significant digit in the internal DSCP. The intersection of the d1 and d2 values provides the policed-DSCP, the CoS, the switch priority, or the mutated-DSCP value. For example, in the DSCP-to-CoS map, an internal DSCP value of 43 corresponds to a CoS value of 5.

---

Related Commands

Command	Description
mls qos map	Defines the CoS-to-DSCP map, DSCP-to-CoS map, DSCP-to-DSCP-mutation map, IP-precedence-to-DSCP map, and the policed-DSCP map.

show monitor

Use the show monitor user EXEC command to display Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) session information.

show monitor [session {session_number | all | local | range | remote}] [ | {begin | exclude | include} expression]

Syntax Description

session session_number	(Optional) Specify the number of the SPAN or RSPAN session. The range is 1 to 2.
all	Specify all sessions.
local	Specify local sessions.
range	Specify a range of sessions.
remote	Specify remote sessions.
| begin	Display begins with the line that matches the expression.
| exclude	Display excludes lines that match the expression.
| include	Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(6)EA1	This command was introduced.
12.1(11)EA1	The all, local, and remote keywords were added.
12.1(13)EA1	The range keyword was added.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output for the show monitor privileged EXEC command for SPAN source session 1:

Switch# show monitor session 1

Session 1

---------

Type: Local Source Session

Source Ports:

    RX Only: 		 Fa0/13

    TX Only:       None

    Both:          None

Source VLANs:

    RX Only:       None

    TX Only:       None

    Both:          None

Source RSPAN VLAN: None

Destination Ports: None

	Encapsulation: DOT1Q

	Ingress:	Enabled, default VLAN=5

Reflector Ports:	 None

Filter VLANs:      None

Dest RSPAN VLAN: 	None

Related Commands

Command	Description
monitor session	Starts a new SPAN or RSPAN session, adds or deletes interfaces or VLANs to or from an existing SPAN or RSPAN session, and filters SPAN source traffic to specific source VLANs.

show mvr

Use the show mvr privileged EXEC command without keywords to display the current Multicast VLAN Registration (MVR) global parameter values, including whether or not MVR is enabled, the MVR multicast VLAN, the maximum query response time, the number of multicast groups, and the MVR mode (dynamic or compatible).

show mvr [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr command:

Switch# show mvr

MVR Running: TRUE

MVR multicast vlan: 1

MVR Max Multicast Groups: 256

MVR Current multicast groups: 256

MVR Global query response time: 5 (tenths of sec)

MVR Mode: compatible 

In the preceding display, the maximum number of multicast groups is fixed at 256. The MVR mode is either compatible (for inter-operability with Catalyst 2900 XL and Catalyst 3500 XL switches) or dynamic (where operation is consistent with IGMP snooping operation and dynamic MVR membership on source ports is supported).

Related Commands

Command	Description
mvr (global configuration)	Enables and configures multicast VLAN registration on the switch.
mvr (interface configuration)	Configures MVR ports.
show mvr interface	Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs when the interface and members keywords are appended to the command.
show mvr members	Displays all ports that are members of an MVR multicast group or, if there are no members, means the group is inactive.

show mvr interface

Use the show mvr interface privileged EXEC command without keywords to display the Multicast VLAN Registration (MVR) receiver and source ports. Use the command with keywords to display MVR parameters for a specific receiver port.

show mvr interface [interface-id [members [vlan vlan-id]]] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) Display MVR type, status, and Immediate Leave setting for the interface.
members	(Optional) Display all MVR groups to which the specified interface belongs.
vlan vlan-id	(Optional) Display all MVR group members on this VLAN. The range is from 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If the entered port identification is a non-MVR port or a source port, the command returns an error message. For receiver ports, it displays the port type, per port status, and Immediate-Leave setting.

If you enter the members keyword, all MVR group members on the interface appear. If you enter a VLAN ID, all MVR group members in the VLAN appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr interface command:

Switch# show mvr interface

Port    Type            Status          Immediate Leave

----    ----            -------         ---------------

Gi0/1   SOURCE          ACTIVE/UP       DISABLED

Gi0/2   RECEIVER        ACTIVE/DOWN     DISABLED

Gi0/5   RECEIVER        ACTIVE/UP       ENABLED 

In the preceding display, Status is defined as follows:

•Active means the port is part of a VLAN

•Up/Down means that the port is forwarding/nonforwarding

•Inactive means that the port is not yet part of any VLAN.

This is an example of output from the show mvr interface gigabitethernet0/2 command:

Switch# show mvr interface gigabitethernet0/2

Type: RECEIVER Status: ACTIVE Immediate Leave: DISABLED 

This is an example of output from the show mvr interface gigabitethernet0/1 members command:

Switch# show mvr interface gigabitethernet0/1 members

239.255.0.0     DYNAMIC ACTIVE

239.255.0.1     DYNAMIC ACTIVE

239.255.0.2     DYNAMIC ACTIVE

239.255.0.3     DYNAMIC ACTIVE

239.255.0.4     DYNAMIC ACTIVE

239.255.0.5     DYNAMIC ACTIVE

239.255.0.6     DYNAMIC ACTIVE

239.255.0.7     DYNAMIC ACTIVE

239.255.0.8     DYNAMIC ACTIVE

239.255.0.9     DYNAMIC ACTIVE

Related Commands

Command	Description
mvr (global configuration)	Enables and configures multicast VLAN registration on the switch.
mvr (interface configuration)	Configures MVR ports.
show mvr	Displays the global MVR configuration on the switch.
show mvr members	Displays all receiver ports that are members of an MVR multicast group.

show mvr members

Use the show mvr members privileged EXEC command to display all receiver and source ports that are currently members of an IP multicast group.

show mvr members [ip-address] [ | {begin | exclude | include} expression]

Syntax Description

ip-address	(Optional) The IP multicast address. If the address is entered, all receiver and source ports that are members of the multicast group appear. If no address is entered, all members of all Multicast VLAN Registration (MVR) groups are listed. If a group has no members, the group is listed as Inactive.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The show mvr members command applies to receiver and source ports. For MVR compatible mode, all source ports are members of all multicast groups.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show mvr members command:

Switch# show mvr members

MVR Group IP    Status          Members

------------    ------          -------

239.255.0.1     ACTIVE          Gi0/1(d), Gi0/5(s)

239.255.0.2     INACTIVE        None

239.255.0.3     INACTIVE        None

239.255.0.4     INACTIVE        None

239.255.0.5     INACTIVE        None

239.255.0.6     INACTIVE        None

239.255.0.7     INACTIVE        None

239.255.0.8     INACTIVE        None

239.255.0.9     INACTIVE        None

239.255.0.10    INACTIVE        None

<output truncated>

239.255.0.255   INACTIVE        None

239.255.1.0     INACTIVE        None 

This is an example of output from the show mvr members 239.255.0.2 command. It shows how to view the members of the IP multicast group 239.255.0.2:

Switch# show mvr members 239.255.0.2

239.255.0.2     ACTIVE          Gi0/1(d), Gi0/2(d), Gi0/3(d), 

                                Gi0/4(d), Gi0/5(s)

Related Commands

Command	Description
mvr (global configuration)	Enables and configures multicast VLAN registration on the switch.
mvr (interface configuration)	Configures MVR ports.
show mvr	Displays the global MVR configuration on the switch.
show mvr interface	Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs when the members keyword is appended to the command.

show pagp

Use the show pagp user EXEC command to display Port Aggregation Protocol (PAgP) channel-group information.

show pagp [channel-group-number] {counters | internal | neighbor} [ | {begin | exclude | include} expression]]

Syntax Description

channel-group-number	(Optional) Number of the channel group.The range is 1 to 64.
counters	Display traffic information.
internal	Display internal information.
neighbor	Display neighbor information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

You can enter any show pagp command to display the active port channel information. To display the nonactive information, enter the show pagp command with a group number.

Examples

This is an example of output from the show pagp 1 counters command:

Switch> show pagp 1 counters

           Information        Flush

Port       Sent   Recv     Sent   Recv

--------------------------------------

Channel group: 1

  Gi0/1    45     42       0      0 

  Gi0/2    45     41       0      0 

This is an example of output from the show pagp 1 internal command:

Switch> show pagp 1 internal

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.

Timers: H - Hello timer is running.        Q - Quit timer is running.

        S - Switching timer is running.    I - Interface timer is running.

Channel group 1

                                Hello    Partner  PAgP     Learning  Group

Port      Flags State   Timers  Interval Count   Priority   Method  Ifindex

Gi0/1     SC    U6/S7   H       30s      1        128        Any      16

Gi0/2     SC    U6/S7   H       30s      1        128        Any      16

This is an example of output from the show pagp 1 neighbor command:

Switch> show pagp 1 neighbor

Flags:  S - Device is sending Slow hello.  C - Device is in Consistent state.

        A - Device is in Auto mode.        P - Device learns on physical port.

Channel group 1 neighbors

          Partner              Partner          Partner         Partner Group

Port      Name                 Device ID        Port       Age  Flags   Cap.

Gi0/1     vegas-p2             0002.4b29.4600   Gi0/1        9s SC      10001 

Gi0/2     vegas-p2             0002.4b29.4600   Gi0/2       24s SC      10001 

Related Commands

Command	Description
clear pagp	Clears PAgP channel-group information.

show parser macro

Use the show parser macro user EXEC command to display the parameters for all configured macros or for one macro on the switch.

show parser macro [{brief | description [interface interface-id] | name macro-name}] [ | {begin | exclude | include} expression]

Syntax Description

brief	(Optional) Display the name of each macro.
description [interface interface-id]	(Optional) Display all macro descriptions or the description of a specific interface.
name macro-name	(Optional) Display information about a single macro identified by the macro name.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(19)EA1	The command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is a partial output example from the show parser macro command. The output for the Cisco-default macros varies depending on the switch platform and the software image running on the switch:

Switch# show parser macro

Total number of macros = 6

--------------------------------------------------------------

Macro name : cisco-global

Macro type : default global

# Enable dynamic port error recovery for link state

# failures

errdisable recovery cause link-flap

errdisable recovery interval 60

<output truncated>

--------------------------------------------------------------

Macro name : cisco-desktop

Macro type : default interface

# macro keywords $AVID

# Basic interface - Enable data VLAN only

# Recommended value for access vlan (AVID) should not be 1

switchport access vlan $AVID

switchport mode access

<output truncated>

--------------------------------------------------------------

Macro name : cisco-phone

Macro type : default interface

# Cisco IP phone + desktop template

# macro keywords $AVID $VVID

# VoIP enabled interface - Enable data VLAN

# and voice VLAN (VVID)

# Recommended value for access vlan (AVID) should not be 1

switchport access vlan $AVID

switchport mode access

<output truncated>

--------------------------------------------------------------

Macro name : cisco-switch

Macro type : default interface

# macro keywords $NVID

# Access Uplink to Distribution

# Do not apply to EtherChannel/Port Group

# Define unique Native VLAN on trunk ports

# Recommended value for native vlan (NVID) should not be 1

switchport trunk native vlan $NVID

<output truncated>

--------------------------------------------------------------

Macro name : cisco-router

Macro type : default interface

# macro keywords $NVID

# Access Uplink to Distribution

# Define unique Native VLAN on trunk ports

# Recommended value for native vlan (NVID) should not be 1

switchport trunk native vlan $NVID

<output truncated>

--------------------------------------------------------------

Macro name : snmp

Macro type : customizable

#enable port security, linkup, and linkdown traps

snmp-server enable traps port-security

snmp-server enable traps linkup

snmp-server enable traps linkdown

#set snmp-server host

snmp-server host ADDRESS

#set SNMP trap notifications precedence

snmp-server ip precedence VALUE

--------------------------------------------------------------

This is an example of output from the show parser macro name command:

Switch# show parser macro name standard-switch10

Macro name : standard-switch10

Macro type : customizable

macro description standard-switch10

# Trust QoS settings on VOIP packets

auto qos voip trust

# Allow port channels to be automatically formed

channel-protocol pagp

This is an example of output from the show parser macro brief command:

Switch# show parser macro brief

    default global   : cisco-global

    default interface: cisco-desktop

    default interface: cisco-phone

    default interface: cisco-switch

    default interface: cisco-router

    customizable     : snmp

This is an example of output from the show parser description command:

Switch# show parser macro description 

Global Macro(s): cisco-global

Interface    Macro Description(s)

--------------------------------------------------------------

Fa0/1        standard-switch10

Fa0/2       this is test macro

--------------------------------------------------------------

This is an example of output from the show parser description interface command:

Switch# show parser macro description interface fastethernet0/2

Interface    Macro Description

--------------------------------------------------------------

Fa0/2      this is test macro

--------------------------------------------------------------

Related Commands

Command	Description
macro apply	Applies a macro on an interface or applies and traces a macro on an interface.
macro description	Adds a description about the macros that are applied to an interface.
macro global	Applies a macro on a switch or applies and traces a macro on a switch.
macro global description	Adds a description about the macros that are applied to the switch.
macro name	Creates a macro.
show running-config	Displays the current operating configuration, including defined macros. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.

show policy-map

Use the show policy-map user EXEC command to display quality of service (QoS) policy maps, which define classification criteria for incoming traffic. Policy maps can include policers that specify the bandwidth limitations and the action to take if the limits are exceeded.

show policy-map [policy-map-name [class class-map-name]] [ | {begin | exclude | include} expression]

Syntax Description

policy-map-name	(Optional) Display the specified policy-map name.
class class-map-name	(Optional) Display QoS policy actions for an individual class.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

---

Note Though visible in the command-line help string, the interface keyword is not supported, and the statistics shown in the display should be ignored.

---

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(6)EA1	The class keyword was added.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show policy-map command:

Switch> show policy-map

Policy Map policy1

  class  class1

   set dscp 7

Policy Map policy3

  class  class99

   police 96000 999999 exceed-action drop

  class  class3

   police 8000 98989 exceed-action drop

  class  class20

   police 8000 9090 exceed-action drop

  class  class21

   police 904000 9090909 exceed-action policed-dscp-transmit

  class  class22

   police 904000 9090909 exceed-action policed-dscp-transmit 

Related Commands

Command	Description
mls qos cos policy-map	Defines the class of service (CoS) value of a port in a policy map.
policy-map	Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.

show port-security

Use the show port-security privileged EXEC command to display port-security settings for an interface or for the switch.

show port-security [address] [interface interface-id [address | vlan]] [ | {begin | exclude | include} expression]

Syntax Description

address	(Optional) Display all secure MAC addresses on all ports or a specified port.
interface interface-id	(Optional) Display port security settings for the specified interface.
address	(Optional) Display port security settings for the specified interface and MAC address.
vlan	(Optional) Display port security settings for all VLANs on the specified interface. This keyword is only visible on interfaces that have the switchport mode set to trunk.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(8)EA1	This command was introduced.
12.1(14)EA1	The vlan keyword was added.

Usage Guidelines

If you enter the command without keywords, the output includes the administrative and operational status of all secure ports on the switch.

If you enter an interface-id, the show port-security command displays port security settings for the interface.

If you enter an interface-id and vlan, the show port-security command displays the maximum number of secure addresses for the interface and the VLAN.

If you enter the address keyword, the show port-security address command displays the secure MAC addresses for all interfaces and the aging information for each secure address.

If you enter an interface-id and the address keyword, the show port-security interface interface-id address command displays all the MAC addresses for the interface with aging information for each secure address. You can also use this command to display all the MAC addresses for an interface even if you have not enabled port security on it.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of the output from the show port-security command:

Switch# show port-security

Secure Port      MaxSecureAddr  CurrentAddr  SecurityViolation  Security

Action

                    (Count)        (Count)      (Count)

----------------------------------------------------------------------------

     Fa0/1           11            11            0            Shutdown

     Fa0/5           15            5             0            Restrict

     Fa0/11          5             4             0            Protect

----------------------------------------------------------------------------

Total Addresses in System :21

Max Addresses limit in System :6176

This is an example of output from the show port-security interface fastethernet0/2 command:

Switch# show port-security interface fastethernet0/2

Port Security              : Enabled

Port Status                : Secure-up

Violation Mode             : Shutdown

Aging Time                 : 20 mins

Aging Type                 : Inactivity

SecureStatic Address Aging : Enabled

Maximum MAC Addresses      : 11

Total MAC Addresses        : 11

Configured MAC Addresses   : 3

Sticky MAC Addresses       : 0

Last Source Address        : 0000.0000.0000

Security Violation Count   : 0

This is an example of output from the show port-security address command:

Switch# show port-security address

Secure Mac Address Table

-------------------------------------------------------------------

Vlan    Mac Address       Type                Ports   Remaining Age

                                                         (mins)

----    -----------       ----                -----   -------------

   1    0001.0001.0001    SecureDynamic       Fa0/1      15 (I)

   1    0001.0001.0002    SecureDynamic       Fa0/1      15 (I)

   1    0001.0001.1111    SecureConfigured    Fa0/1      16 (I)

   1    0001.0001.1112    SecureConfigured    Fa0/1      -

   1    0001.0001.1113    SecureConfigured    Fa0/1      -

   1    0005.0005.0001    SecureConfigured    Fa0/5      23

   1    0005.0005.0002    SecureConfigured    Fa0/5      23

   1    0005.0005.0003    SecureConfigured    Fa0/5      23

   1    0011.0011.0001    SecureConfigured    Fa0/11     25 (I)

   1    0011.0011.0002    SecureConfigured    Fa0/11     25 (I)

-------------------------------------------------------------------

Total Addresses in System :10

Max Addresses limit in System :6176

This is an example of output from the show port-security interface fastethernet0/2 vlan command:

Switch# show port-security interface fastethernet0/2 vlan

Default maximum: not set, using 6176

VLAN  Maximum    Current

    1    default          0

    5          5          0

This is an example of output from the show port-security interface fastethernet0/5 address command:

Switch# show port-security interface fastethernet0/5 address

Secure Mac Address Table

-------------------------------------------------------------------

Vlan    Mac Address       Type                Ports   Remaining Age

                                                         (mins)

----    -----------       ----                -----   -------------

   1    0005.0005.0001    SecureConfigured    Fa0/5      19 (I)

   1    0005.0005.0002    SecureConfigured    Fa0/5      19 (I)

   1    0005.0005.0003    SecureConfigured    Fa0/5      19 (I)

-------------------------------------------------------------------

Total Addresses:3

Related Commands

Command	Description
switchport port-security	Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.

show power inline

Use the show power inline user EXEC command to display the power status for the specified Power over Ethernet (PoE) port or for all PoE ports on the Catalyst 3550-24PWR switch.

show power inline [interface-id] | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) ID of the interface.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(12c)EA1	This command was introduced.
12.1(19)EA1	The Class field was added to the output.
12.2(25)SE	The Max field was added to the output.

Usage Guidelines

This command is supported only on PoE-capable ports. PoE ports were previously referred to as inline power ports in earlier versions of the command reference.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show power inline command:

Switch> show power inline

Interface Admin  Oper       Power   Device              Class Max

                            (Watts)                            

--------- ------ ---------- ------- ------------------- ----- ----

Fa0/1     auto   off        0.0     n/a                 n/a   15.4 

Fa0/2     auto   off        0.0     n/a                 n/a   15.4

Fa0/3     auto   on         5.4     Cisco IP phone 7960 n/a   15.4 

Fa0/4     auto   on         15.4    Ieee PD                   15.4 

Fa0/5     auto   off        0.0     n/a                 n/a   15.4 

Fa0/6     auto   off        0.0     n/a                 n/a   15.4 

Fa0/7     auto   off        0.0     n/a                 n/a   15.4 

Fa0/8     auto   off        0.0     n/a                 n/a   15.4 

Fa0/9     auto   off        0.0     n/a                 n/a   15.4 

Fa0/10    auto   off        0.0     n/a                 n/a   15.4 

<output truncated>

Table 2-25 show power inline Command Output Fields

Field	Description
Interface	Interface ID.
Admin	Administrative mode: auto or off.
Oper	Operating mode: •on—the powered device is detected and power is applied. •off—no power is applied. •faulty—device detection or a powered device is in a faulty state. •power-deny—a powered device is detected but no power is available.
Power	The supplied power in watts. A Cisco device shows reported power; a non-Cisco device is shown as an IEEE powered device at 15.4 W.
Device	The device type detected: n/a, unknown, Cisco PD, IEEE PD, <name from CDP>.
Class	The IEEE classification: n/a, Class <0-4>.
Max	The maximum power supported (15.4 W).

Related Commands

Command	Description
power inline	Enables or disables the PoE ports.

show running-config vlan

Use the show running-config vlan privileged EXEC command to display all or a range of VLAN-related configurations on the switch.

show running-config vlan [vlan-ids] [ | {begin | exclude | include} expression]

Syntax Description

vlan-ids	(Optional) Display configuration information for a single VLAN identified by VLAN ID number or a range of VLANs separated by a hyphen. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show running-config vlan command:

Switch# show running-config vlan 900-2005

Building configuration...

Current configuration:

!

vlan 907

!

vlan 920

!

vlan 1025

!

vlan 2000

!

vlan 2001

end

Related Commands

Command	Description
show running-config	Displays the running configuration on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
vlan (global configuration)	Enters config-vlan mode for creating and editing VLANs. When VLAN Trunking Protocol (VTP) mode is transparent, you can use this mode to create extended-range VLANs (VLAN IDs greater than 1005).
vlan database	Enters VLAN configuration mode for creating and editing normal-range VLANs.

show sdm prefer

Use the show sdm prefer privileged EXEC command to display information about the templates that can be used to maximize system resources for a particular feature, or use the command without a keyword to display the template in use.

show sdm prefer [access [extended-match] | default [extended-match] | routing [extended-match] | vlan] [ | {begin | exclude | include} expression]

Syntax Description

access	(Optional) Display the template that maximizes system resources for quality of service (QoS) classification and security access control entries (ACEs).
default	(Optional) Display the template that balances system resources among features.
extended-match	(Optional) Display the extended-match version of the indicated template that enables the switch to support 144-bit Layer 3 TCAM.
routing	(Optional) Display the template that maximizes system resources for routing.
vlan	(Optional) Display the template that maximizes system resources for Layer 2 VLANs.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(11)EA1	The extended-match keyword was added.

Usage Guidelines

If you did not reload the switch after entering the sdm prefer global configuration command, the show sdm prefer privileged EXEC command displays the template currently in use and not the newly configured template.

The numbers displayed for each template represent an approximate maximum number for each feature resource. The actual number might vary, depending on the actual number of other features configured. For example, in the default template if your switch had more than 16 routed interfaces (subnet VLANs), the number of possible unicast MAC addresses might be less than 6000.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show sdm prefer command on a Gigabit Ethernet switch, displaying the template currently in use:

Switch# show sdm prefer

The current template is default template.

 The selected template optimizes the resources in

 the switch to support this level of features for

 16 routed interfaces and 1K VLANs. 

 number of unicast mac addresses:  6K

 number of igmp groups:            6K

 number of qos aces:               2K

 number of security aces:          2K

 number of unicast routes:         12K

 number of multicast routes:       6K

This is an example of output from the show sdm prefer command on a Gigabit Ethernet switch when the default template has the extended-match keyword applied for 144-bit Layer 3 TCAM support:

Switch# show sdm prefer

The current template is the default extended-match template

 The selected template optimizes the resources in

 the switch to support this level of features for

 16 routed interfaces and 1K VLANs.

 number of unicast mac addresses:   6K

 number of igmp groups:             6K

 number of qos aces:                2K

 number of security aces:           2K

 number of unicast routes:          6K

 number of multicast routes:        6K

This is an example of output from the show sdm prefer access command on a Gigabit Ethernet switch, displaying the access template characteristics:

Switch# show sdm prefer access

access template:

 The selected template optimizes the resources in

 the switch to support this level of features for

 16 routed interfaces and 1K VLANs.

 number of unicast mac addresses:  2K

 number of igmp groups:            8K

 number of qos aces:               2K

 number of security aces:          4K

 number of unicast routes:         4K

 number of multicast routes:       8K

Related Commands

Command	Description
sdm prefer	Sets the SDM template to maximize feature resource utilization for QoS classification and security ACEs, routing, or VLANs, or to the default template, or to reformat memory space to support 144-bit Layer 3 TCAM.

show setup express

Use the show setup express privileged EXEC command to show if Express Setup mode is active on the switch.

show setup express

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(14)EA1	This command was introduced.

Examples

This is an example of output from the show setup express command:

Switch# show setup express

express setup mode is active

Related Commands

Command	Description
setup express	Enables Express Setup mode on the switch.

show spanning-tree

Use the show spanning-tree user EXEC command to display spanning-tree state information.

show spanning-tree [bridge-group | active [detail] | backbonefast | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | mst | pathcost method | root | summary [totals] | uplinkfast | vlan vlan-id] [ | {begin | exclude | include} expression]

show spanning-tree bridge-group [active [detail] | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | root | summary] [| {begin | exclude | include} expression]

show spanning-tree vlan vlan-id [active [detail] | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | root | summary] [ | {begin | exclude | include} expression

show spanning-tree {vlan vlan-id | bridge-group} bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol] [ | {begin | exclude | include} expression]

show spanning-tree {vlan vlan-id | bridge-group} root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id] [ | {begin | exclude | include} expression]

show spanning-tree interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state] [ | {begin | exclude | include} expression]

show spanning-tree mst [configuration [digest] | instance-id] [detail | interface interface-id [detail]]
[ | {begin | exclude | include} expression]

Syntax Description

bridge-group	(Optional) Specify the bridge group number. The range is 1 to 255.
active [detail]	(Optional) Display spanning-tree information only on active interfaces (only available in privileged EXEC mode).
backbonefast	(Optional) Display spanning-tree BackboneFast status.
blockedports	(Optional) Display blocked port information (only available in privileged EXEC mode).
bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol]	(Optional) Display status and configuration of this switch (optional keywords only available in privileged EXEC mode).
detail [active]	(Optional) Display a detailed summary of interface information (active keyword only available in privileged EXEC mode).
inconsistentports	(Optional) Display inconsistent port information (only available in privileged EXEC mode).
interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state]	(Optional) Display spanning-tree information for the specified interface (all options except portfast and state only available in privileged EXEC mode). Enter each interface separated by a space. Ranges are not supported. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 64.
mst [configuration | [digest] instance-id] [detail | interface interface-id [detail]]	(Optional) Display the multiple spanning-tree (MST) region configuration and status (all options only available in privileged EXEC mode). •digest—(Optional) Display the MD5 digest included in the current MST configuration identifier (MSTCI). Two separate digests, one for standard and one for prestandard switches, appear (available only in privileged EXEC mode). The terminology was updated for the implementation of the IEEE standard, and the txholdcount field was added. The new master role appears for boundary ports. The word pre-standard or Pre-STD appears when an IEEE standard bridge sends prestandard BPDUs on a port. The word pre-standard (config) or Pre-STD-Cf appears when a port has been configured to transmit prestandard BPDUs and no prestandard BPDU has been received on that port. The word pre-standard (rcvd) or Pre-STD-Rx appears when a prestandard BPDU has been received on a port that has not been configured to transmit prestandard BPDUs. A dispute flag appears when a designated port receives inferior designated information until the port returns to the forwarding state or ceases to be designated. •instance-id—You can specify a single instance ID, a range of IDs separated by a hyphen, or a series of IDs separated by a comma. The range is 1 to 4094. The display shows the number of configured instances. •interface interface-id—(Optional) Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 48. •detail—(Optional) Display detailed information for the instance or interface. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 64.
pathcost method	(Optional) Display the default path cost method (only available in privileged EXEC mode).
root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id]]	(Optional) Display root switch status and configuration (all keywords only available in privileged EXEC mode).
summary [totals]	(Optional) Display a summary of port states or the total lines of the spanning-tree state section. The words IEEE Standard identify the MST version running on a switch.
uplinkfast	(Optional) Display spanning-tree UplinkFast status.
vlan vlan-id [active [detail] | backbonefast | blockedports | bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol]	(Optional) Display spanning-tree information for the specified VLAN (some keywords only available in privileged EXEC mode). The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC; indicated keywords available only in privileged EXEC mode

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The mst keyword and options were added. The brief keyword was removed, and the detail keyword was added.
12.2(25)SEC	The digest keyword was added, and new digest and transmit hold count fields appear.

Usage Guidelines

If the vlan-id variable is omitted, the command applies to the spanning-tree instance for all VLANs.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show spanning-tree active command:

Switch# show spanning-tree active

VLAN0001

  Spanning tree enabled protocol ieee

  Root ID    Priority    20481

             Address     0008.217a.5800

             Cost        38

             Port        1 (GigabitEthernet0/1)

             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)

             Address     0008.205e.6600

             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Gi0/1            Root FWD 19        128.1    P2p

This is an example of output from the show spanning-tree detail command:

Switch> show spanning-tree detail

VLAN0001 is executing the ieee compatible Spanning Tree protocol

  Bridge Identifier has priority 32768, sysid 1, address 0008.205e.6600

  Configured hello time 2, max age 20, forward delay 15

  Current root has priority 20481, address 0008.217a.5800

  Root port is 1 (GigabitEthernet0/1), cost of root path is 38

  Topology change flag not set, detected flag not set

  Number of topology changes 0 last change occurred 3w0d ago

  Times:  hold 1, topology change 35, notification 2

          hello 2, max age 20, forward delay 15

  Timers: hello 0, topology change 0, notification 0, aging 300

 Port 1 (GigabitEthernet0/1) of VLAN0001 is forwarding

   Port path cost 19, Port priority 128, Port Identifier 128.1.

   Designated root has priority 20481, address 0008.217a.5800

   Designated bridge has priority 65535, address 0050.2aed.5c80

   Designated port id is 128.26, designated path cost 19

   Timers: message age 3, forward delay 0, hold 0

   Number of transitions to forwarding state: 1

   Link type is point-to-point by default

   BPDU: sent 0, received 947349

<output truncated>

This is an example of output from the show spanning-tree interface fastethernet0/1 command:

Switch> show spanning-tree interface fastethernet0/1

Vlan             Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

VLAN0001         Root FWD 19        128.1    P2p

This is an example of output from the show spanning-tree summary command:

Switch> show spanning-tree summary

Switch is in pvst mode

Root bridge for: none

EtherChannel misconfiguration guard is enabled

Extended system ID   is enabled

Portfast             is disabled by default

PortFast BPDU Guard  is disabled by default

Portfast BPDU Filter is disabled by default

Loopguard            is disabled by default

UplinkFast           is disabled

BackboneFast         is disabled

Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active

---------------------- -------- --------- -------- ---------- ----------

VLAN0001                     0         0        0          1          1

---------------------- -------- --------- -------- ---------- ----------

1 vlan                       0         0        0          1          1

<output truncated>

This is an example of output from the show spanning-tree mst configuration command:

Switch# show spanning-tree mst configuration

Name      [region1]

Revision  1

Instance  Vlans mapped

--------  ---------------------------------------------------------------------

0         101-4094

1         1-100

-------------------------------------------------------------------------------

This is an example of output from the show spanning-tree mst interface fastethernet0/1 command:

Switch# show spanning-tree mst interface fastethernet0/1

FastEthernet0/1 of MST00 is designated forwarding 

Edge port:no             (default)        port guard :none        (default)

Link type:point-to-point (auto)           bpdu filter:disable     (default)

Boundary :internal                        bpdu guard :disable     (default)

Bpdus sent 84122, received 83933

Instance Role Sts Cost      Prio.Nbr Vlans mapped

-------- ---- --- --------- -------- -------------------------------

0        Desg FWD 200000    128.1    101-4094

1        Root FWD 200000    128.1    1-100

This is an example of output from the show spanning-tree mst 0 command:

Switch# show spanning-tree mst 0

###### MST00        vlans mapped:  101-4094

Bridge      address 0005.7428.1f40  priority  32768 (32768 sysid 0)

Root        address 0001.42e2.cdc6  priority  32768 (32768 sysid 0)

            port    Gi0/2           path cost 200038   

IST master  this switch

Operational hello time 2, forward delay 15, max age 20

Configured  hello time 2, forward delay 15, max age 20, max hops 20

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Gi0/1            Desg FWD 200000    128.1    P2p 

Gi0/2            Root FWD 200000    128.2    P2p Bound(PVST) 

Gi0/5            Desg FWD 200000    128.5    P2p 

Related Commands

Command	Description
clear spanning-tree counters	Clears the spanning-tree counters.
clear spanning-tree detected-protocols	Restarts the protocol migration process.
spanning-tree backbonefast	Enables the BackboneFast feature.
spanning-tree bpdufilter	Prevents a port from sending or receiving bridge protocol data units (BPDUs).
spanning-tree bpduguard	Puts a port in the error-disabled state when it receives a BPDU.
spanning-tree cost	Sets the path cost for spanning-tree calculations.
spanning-tree extend system-id	Enables the extended system ID feature.
spanning-tree guard	Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface.
spanning-tree link-type	Overrides the default link-type setting for rapid spanning-tree transitions to the forwarding state.
spanning-tree loopguard default	Prevents alternate or root ports from becoming the designated port because of a failure that leads to a unidirectional link.
spanning-tree mst configuration	Enters multiple spanning-tree (MST) configuration mode through which the MST region configuration occurs.
spanning-tree mst cost	Sets the path cost for MST calculations.
spanning-tree mst forward-time	Sets the forward-delay time for all MST instances.
spanning-tree mst hello-time	Sets the interval between hello BPDUs sent by root switch configuration messages.
spanning-tree mst max-age	Sets the interval between messages that the spanning tree receives from the root switch.
spanning-tree mst max-hops	Sets the number of hops in an MST region before the BPDU is discarded and the information held for a port is aged.
spanning-tree mst port-priority	Configures an interface priority.
spanning-tree mst priority	Configures the switch priority for the specified spanning-tree instance.
spanning-tree mst root	Configures the MST root switch priority and timers based on the network diameter.
spanning-tree port-priority	Configures an interface priority.
spanning-tree portfast (global configuration)	Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.
spanning-tree portfast (interface configuration)	Enables the Port Fast feature on an interface and all its associated VLANs.
spanning-tree uplinkfast	Accelerates the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself.
spanning-tree vlan	Configures spanning tree on a per-VLAN basis.

show storm-control

Use the show storm-control user EXEC command to display broadcast, multicast, or unicast storm-control settings on the switch or on the specified interface.

show storm-control [interface-id] [broadcast | multicast | unicast] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) Interface ID for the physical port.
broadcast	(Optional) Display broadcast storm information.
multicast	(Optional) Display multicast storm information.
unicast	(Optional) Display unicast storm information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(8)EA1	This command was introduced.

Usage Guidelines

When you enter an interface-id, the storm-control thresholds appear for the specified interface.

If you omit the interface-id and specify a traffic type, settings appear for the specified traffic type for all ports on the switch.

If you do not enter a traffic type, settings appear for broadcast storm control.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show storm-control command. Because no traffic type keyword was entered, the broadcast storm control settings appear.

Switch> show storm-control

Interface  Filter State   Upper       Lower      Current

---------  -------------  ----------  ---------  ---------

Fa0/1      Forwarding     20 pps      10 pps     5 pps

Fa0/2      Forwarding     50.00%      40.00%     0.00%

<output truncated>

This is an example of output from the show storm-control command for a specified interface. Because no traffic type keyword was entered, the broadcast storm control settings appear.

Switch> show storm-control fastethernet0/1

Interface  Filter State   Upper       Lower      Current

---------  -------------  ----------  ---------  ---------

Fa0/1      Forwarding     20 pps      10 pps     5 pps

Table 2-26 describes the fields in the show storm-control display.

Table 2-26 show storm-control Field Descriptions 

Field	Description
Interface	Displays the ID of the interface.
Filter State	Displays the status of the filter: •Blocking—Storm control is enabled, and a storm has occurred. •Forwarding—Storm control is enabled, and no storms have occurred. •Inactive—Storm control is disabled.
Upper	Displays the rising suppression level as a percentage of total available bandwidth or in packets per second.
Lower	Displays the falling suppression level as a percentage of total available bandwidth or in packets per second.
Current	Displays the bandwidth utilization of broadcast traffic or the specified traffic type (broadcast, multicast, or unicast) as a percentage of total available bandwidth or in packets per second. If storm control is disabled, this field displays N/A (not applicable).

Related Commands

Command	Description
storm-control	Configures the broadcast, the multicast, or the unicast storm control with the specified suppression level.

show system mtu

Use the show system mtu privileged EXEC command to display the global maximum transmission unit (MTU) or maximum packet size set for the switch.

show system mtu [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If you have used the system mtu global configuration command to change the MTU setting, the new setting does not take effect until you reset the switch.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show system mtu command:

Switch# show system mtu

System MTU size is 1500 bytes

Related Commands

Command	Description
system mtu	Sets the maximum transmission unit (MTU) size for the switch.

show tcam

Use the show tcam user EXEC command to display information about the input security access control list (ACL) and output security ACL regions of the ternary content addressable memory (TCAM). Use the keywords to display information for a specific TCAM ID or specific characteristics.

show tcam {inacl | outacl} tcam-id {{entries [entry-id]} | {masks [mask-id]} | {port-labels [label-id]} | size |{statistics [entries | hits | labels | masks]} | {vlan-labels [label-id]}}[ | {begin | exclude | include} expression]

Syntax Description

inacl	Display information about the input security ACL TCAM portion.
outacl	Display information about the output security ACL TCAM portion.
tcam-id	(Optional) Display information for a specific TCAM ID. The ID range varies from 1 to 3, depending on the switch model.
entries [entry-id]	Display one or all TCAM ACL entries and associated information. When all entries appear, the mask information also appears. This display output is a raw hex dump of information, intended for a Cisco technical support representative. The range is 0 to 65535.
masks [mask-id]	Display mask information. This display output is a raw hex dump of information, intended for a Cisco technical support representative. The range is 0 to 65535.
port-labels [label-id]	Display entries and associated information for a feature manager port label (see the show fm command). Port labels are used for port ACLs. This display output is a raw hex dump of information, intended for a Cisco technical support representative. The range is 0 to 127.
size	Display the total size of the regions of TCAM in which the ACLs are entered.
statistics [entries | hits | labels | masks]	Display allocation statistics for the input or output ACL TCAM region, including allocated and available masks and entries. (Optional) Display allocation statistics for entries, hits, labels, or masks. The labels keyword returns a total count of all labels present in TCAM.
vlan-labels [label-id]	Display entries and associated information for a feature manager VLAN label (see the show fm command). VLAN labels are used for router ACLs and VLAN maps. This display output is a raw hex dump of information, intended for a Cisco technical support representative. The range is 0 to 255.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The labels [label-id] keywords were replaced by port-labels [label-id] and vlan-labels [label-id]

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

These displays provide information that might be useful for Cisco technical support representatives troubleshooting the switch.

Examples

This is an example of output from the show tcam inacl entries command for TCAM 1:

Switch> show tcam inacl 1 entries

Label Value: 8192(vlan label 0) Number of entries: 12

Ts - timestamp, Tb - TableId, L - L4OpSelect (IP) or lsapValid (MAC)

M - IP (1) or MAC (0), R - routerMacAddress

I - ipOption, S - lookupSize, Pl - Port Label, Vl - VLAN Label

F - fragmentInfo (IP) or IP header checksum error (MAC)

D - DSCP (IP) or IP header error (MAC)

T - tcpPacket (IP) or cos (MAC)

U - udpPacket (IP) or reserved bits (MAC)

MapR - l4MapResult (IP TCP/UDP) or l3 protocol type (MAC)

S-addr - source address, D-addr - destination address

S-pr - l4 source port (IP TCP/UDP) or IP protocol number

D-pr - l4 destination port or version and type (IP IGMP)

or type and code (IP ICMP)

Index Ts Tb L M R I S Pl Vl F D  T U MapR S-addr   S-pr D-addr   D-pr As data

==============================================================================

4     msk F 0 1 0 0 1 00 FF 0 00 1 1 0000 00000000 00FF E0000000 0000

32    1   9 0 1 0 0 1 00 00 0 00 0 0 0000 00000000 0009 E0000000 0000 00260086

5     msk F 0 1 0 1 1 00 FF 2 00 1 1 0000 00000000 0000 E0000000 FFFF

33    4   9 0 1 0 0 1 00 00 0 00 0 1 0000 00000000 0000 E0000000 0208 00260086

6     msk F 0 1 1 0 1 00 FF 0 00 1 1 0000 00000000 00FE 00000000 0000

48    42  9 0 1 1 0 1 00 00 0 00 0 0 0000 00000000 0058 00000000 0000 00260086

7     msk F 0 1 1 0 1 00 FF 0 00 1 1 0000 00000000 00FF 00000000 0000

49    4   9 0 1 1 0 1 00 00 0 00 0 0 0000 00000000 0009 00000000 0000 00260086

7     msk F 0 1 1 0 1 00 FF 0 00 1 1 0000 00000000 00FF 00000000 0000

51    64  9 0 1 1 0 1 00 00 0 00 0 0 0000 00000000 0067 00000000 0000 00260086

8     msk F 0 1 1 1 1 00 FF 2 00 1 1 0000 00000000 FFFF 00000000 0000

64    1   9 0 1 1 0 1 00 00 0 00 1 0 0000 00000000 0001 00000000 0000 00260086

9     msk F 0 1 1 1 1 00 FF 2 00 1 1 0000 00000000 0000 00000000 FFFF

65    4   9 0 1 1 0 1 00 00 0 00 1 0 0000 00000000 0000 00000000 00B3 00260086

9     msk F 0 1 1 1 1 00 FF 2 00 1 1 0000 00000000 0000 00000000 FFFF

67    64  9 0 1 1 0 1 00 00 0 00 0 1 0000 00000000 0000 00000000 0208 00260086

10    msk F 1 1 0 0 1 00 FF 0 00 0 0 FFFF 000000000000  010000000000

80    44  9 0 0 0 0 1 00 00 0 00 0 0 0806 000000000000  010000000000  00260086

11    msk F 1 1 1 0 1 00 FF 0 00 0 0 FFFF 000000000000  000000000000

81    42  9 0 0 1 0 1 00 00 0 00 0 0 0806 000000000000  000000000000  00260086

IP default entry

204   msk F 0 1 0 0 1 00 FF 0 00 0 0 0000 00000000 0000 00000000 0000

1636  42  9 0 1 0 0 1 00 00 0 00 0 0 0000 00000000 0000 00000000 0000 00000082

non-IP default entry

205   msk F 0 1 0 0 1 00 FF 0 00 0 0 0000 000000000000  000000000000

1637  48  9 0 0 0 0 1 00 00 0 00 0 0 0000 000000000000  000000000000  00000082

This is an example of output from the show tcam outacl masks command for TCAM 1:

Switch> show tcam outacl 1 masks

Number of active masks : 6

Mask Index : 0

F0 00 00 00 00 00 00 00 00 80 FF 00 00 00 00 00 00 00

Mask Index : 1

F0 00 00 00 00 00 00 00 00 FF 00 00 00 00 00 00 00 00

Mask Index : 508

F4 00 00 00 00 00 00 00 00 80 FF 00 00 00 00 00 00 00

Mask Index : 509

F4 00 00 00 00 00 00 00 00 80 FF 00 00 00 00 00 00 00

Mask Index : 510

F0 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00

Mask Index : 511

F0 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00

This is an example of output from the show tcam inacl size command for TCAM 1:

Switch# show tcam inacl 1 size

Ingress ACL TCAM Size:6592 Entries

This is an example of output from the show tcam inacl statistics command for TCAM 1:

Switch# show tcam inacl 1 statistics

Ingress ACL TCAM#1:Number of active labels:3

Ingress ACL TCAM#1:Number of masks   allocated:  14, available: 810

Ingress ACL TCAM#1:Number of entries allocated:  17, available:6575

Related Commands

Command	Description
show fm interface	Displays per-interface feature-manager information. Used with the show fm label command to show which features were able to fit into the hardware.
show fm	Displays feature-manager information for a specified label to list features associated with the label that were not able to fit into hardware.

show tcam pbr

Use the show tcam pbr user EXEC command to display the policy-based routing (PBR) region of the specified ternary content addressable memory (TCAM). Use the keywords to display information for a specific TCAM ID or specific characteristics.

show tcam pbr tcam-id {{entries [entry-id]} | {port-labels [label-id]} | {vlan-labels [label-id]} | {masks [mask-id]} | size | {statistics [entries | hits | labels | masks]}} [ | {begin | exclude | include} expression]

Syntax Description

tcam-id	Identify the TCAM ID for displaying PBR TCAM information.
entries [entry-id]	Display one or all TCAM PBR entries and associated information. When all entries appear, the mask information also appears. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 65535.
port-labels [label-id]	Display entries and associated information for a port label. Note Though visible in the command-line help string, the port-labels keyword is not supported for PBR.
vlan-labels [label-id]	Display entries and associated information for a PBR VLAN label. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 255.
masks [mask-id]	Display mask information. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 65535.
size	Display the size of the PBR TCAM region.
statistics [entries | hits | labels | masks]	Display allocation statistics for the PBR TCAM region, including allocated and available masks and entries. (Optional) Display allocation statistics for entries, hits, labels, or masks. The labels keyword returns a total count of all labels present in TCAM.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(13)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

You can use the show tcam pbr tcam-id entries [entry-id] command to display all PBR entries. You can use the show tcam pbr tcam-id vlan-labels [label-id] command to display per-VLAN TCAM entries with the policy label. You can use the show fm interface interface-id command to display the policy label for the interface on which PBR is enabled.

These displays provide information that might be useful for Cisco technical support representatives troubleshooting the switch.

Examples

This is an example of output from the show tcam pbr masks command for TCAM 1:

Switch> show tcam pbr 1 masks

Number of active masks : 2

Mask Index : 0

F1 FF FF FF FF 00 00 00 00 80 FF 00 00 00 00 00 00 00

Mask Index : 1

F1 FF FF FF 00 FF FF FF 00 80 FF 00 00 00 00 00 00 00

This is an example of output from the show tcam pbr entries command for TCAM 1:

Switch> show tcam pbr 1 entries

00:07:11: %SYS-5-CONFIG_I: Configured from console by console

Number of active labels: 1

Label Value :       8201(vlan label 9)

Number of entries : 2

Entry List

----------

Mask Index : 0

F1 FF FF FF FF 00 00 00 00 80 FF 00 00 00 00 00 00 00

Entry Index : 0  Timestamp: 1

C0 0A 01 01 02 00 00 00 00 80 09 00 00 00 00 00 00 00 As Data(hex) : 00078006

Mask Index : 1

F1 FF FF FF 00 FF FF FF 00 80 FF 00 00 00 00 00 00 00

Entry Index : 1  Timestamp: 4

C0 0A 01 02 00 0A 04 05 00 80 09 00 00 00 00 00 00 00 As Data(hex) : 00048000

This is an example of output from the show tcam pbr statistics command for TCAM 1:

Switch> show tcam pbr 1 statistics

PBR TCAM#1: Number of active labels: 1

PBR TCAM#1: Number of masks   allocated:    2

PBR TCAM#1: Number of entries allocated:    2

This is an example of output from the show tcam pbr vlan-label command for TCAM 1:

Switch> show tcam pbr 1 vlan-label 9

Label Value :       8201(vlan label 9)

Number of entries : 2

Entry List

----------

Mask Index : 0

F1 FF FF FF FF 00 00 00 00 80 FF 00 00 00 00 00 00 00

Entry Index : 0  Timestamp: 1

C0 0A 01 01 02 00 00 00 00 80 09 00 00 00 00 00 00 00 As Data(hex) : 00078006

Mask Index : 1

F1 FF FF FF 00 FF FF FF 00 80 FF 00 00 00 00 00 00 00

Entry Index : 1  Timestamp: 4

C0 0A 01 02 00 0A 04 05 00 80 09 00 00 00 00 00 00 00 As Data(hex) : 00048000

show tcam qos

Use the show tcam qos user EXEC command to display about the quality of service (QoS) region of the specified ternary content addressable memory (TCAM). Use the keywords to display information for a specific TCAM ID or specific characteristics.

show tcam qos tcam-id {{entries [entry-id]} | {port-labels [label-id]} | {vlan-labels [label-id]} | {masks [mask-id]} | size | {statistics [entries | hits | labels | masks]}} [ | {begin | exclude | include} expression]

Syntax Description

tcam-id	Identify the TCAM ID for displaying QoS TCAM information. (Optional) Display information for a specific TCAM ID. The ID range varies from 1 to 3, depending on the switch model.
entries [entry-id]	Display one or all TCAM QoS entries and associated information. When all entries appear, the mask information also appears. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 65535.
port-labels [label-id]	Display entries and associated information for a QoS port label. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 255.
vlan-labels [label-id]	Display entries and associated information for a QoS VLAN label. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 255.
masks [mask-id]	Display mask information. This display output is a raw hex dump of information intended for a Cisco technical support representative. The range is 0 to 65535.
size	Display the size of the QoS TCAM region.
statistics [entries | hits | labels | masks]	Display allocation statistics for the QoS TCAM region, including allocated and available masks and entries. (Optional) Display allocation statistics for entries, hits, labels, or masks. The labels keyword returns a total count of all labels present in TCAM.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The labels [label-id] keywords were replaced by port-labels [label-id] and vlan-labels [label-id].

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

You can use the show tcam qos tcam-id entries [entry-id] command to display all QoS entries including per-port per-VLAN QoS information. You also can use the show tcam qos tcam-id port-labels [label-id] vlan-labels [label-id] command to display per-port per-VLAN TCAM entries with both the port label and the VLAN label.

These displays provide information that might be useful for Cisco technical support representatives troubleshooting the switch.

Examples

This is an example of output from the show tcam qos masks command for TCAM 2:

Switch> show tcam qos 2 masks

Number of active masks : 4

Mask Index : 252

F4 00 00 00 00 00 00 00 00 FF 00 00 00 00 00 00 00 00

Mask Index : 253

F4 00 00 00 00 00 00 00 00 FF 00 00 00 00 00 00 00 00

Mask Index : 254

F0 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00

Mask Index : 255

F0 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00

This is an example of output from the show tcam qos entries command for TCAM 1:

Switch> show tcam qos 1 entries

No active labels/entries

This is an example of output from the show tcam qos statistics command for TCAM 1:

Switch> show tcam qos 1 statistics

QoS TCAM#1: Number of active labels: 0

QoS TCAM#1: Number of masks   allocated:    4, available:  412

QoS TCAM#1: Number of entries allocated:    1, available: 3327 

show udld

Use the show udld user EXEC command to display UniDirectional Link Detection (UDLD) administrative and operational status for all ports or the specified port.

show udld [interface-id] [ | {begin | exclude | include} expression]

Syntax Description

interface-id	(Optional) ID of the interface and port number. Valid interfaces include physical ports and VLANs. The VLAN range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

If you do not enter an interface-id, administrative and operational UDLD status for all interfaces appear.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show udld gigabitethernet0/1 command. For this display, UDLD is enabled on both ends of the link, and UDLD detects that the link is bidirectional. Table 2-27 describes the fields in this display.

Switch> show udld gigabitethernet0/1

Interface gi0/1

---

Port enable administrative configuration setting: Follows device default

Port enable operational state: Enabled

Current bidirectional state: Bidirectional

Current operational state: Advertisement - Single Neighbor detected

Message interval: 60

Time out interval: 5

    Entry 1

    Expiration time: 146

    Device ID: 1

    Current neighbor state: Bidirectional

    Device name: Switch-A  

    Port ID: Gi0/2

    Neighbor echo 1 device: Switch-B

    Neighbor echo 1 port: Gi0/1 

    Message interval: 5

    CDP Device name: Switch-A 

Table 2-27 show udld Field Descriptions 

Field	Description
Interface	The interface on the local device configured for UDLD.
Port enable administrative configuration setting	How UDLD is configured on the port. If UDLD is enabled or disabled, the port enable configuration setting is the same as the operational enable state. Otherwise, the enable operational setting depends on the global enable setting.
Port enable operational state	Operational state that shows whether UDLD is actually running on this port.
Current bidirectional state	The bidirectional state of the link. An unknown state appears if the link is down or if it is connected to an UDLD-incapable device. A bidirectional state appears if the link is a normal two-way connection to a UDLD-capable device. All other values mean miswiring.
Current operational state	The current phase of the UDLD state machine. For a normal bidirectional link, the state machine is most often in the Advertisement phase.
Message interval	How often advertisement messages are sent from the local device. Measured in seconds.
Time out interval	The time period, in seconds, that UDLD waits for echoes from a neighbor device during the detection window.
Entry 1	Information from the first cache entry, which contains a copy of echo information received from the neighbor.
Expiration time	The amount of time in seconds remaining before this cache entry is aged out.
Device ID	The neighbor device identification.
Current neighbor state	The neighbor's current state. If both the local and neighbor devices are running UDLD normally, the neighbor state and local state should be bidirectional. If the link is down or the neighbor is not UDLD-capable, no cache entries appear.
Device name	The device name or the system serial number of the neighbor. The system serial number appears if the device name is not set or is set to the default (Switch).
Port ID	The neighbor port ID enabled for UDLD.
Neighbor echo 1 device	The device name of the neighbors' neighbor from which the echo originated.
Neighbor echo 1 port	The port number ID of the neighbor from which the echo originated.
Message interval	The rate, in seconds, at which the neighbor is sending advertisement messages.
CDP device name	The CDP device name or the system serial number. The system serial number appears if the device name is not set or is set to the default (Switch).

This is an example of output from the show udld interface configuration command when the aggressive mode is configured:

Switch# show udld gigabitethernet0/1

Interface Gi0/1

---

Port enable administrative configuration setting:Enabled / in aggressive mode

Port enable operational state:Enabled / in aggressive mode

Current bidirectional state:Unknown

Current operational state:Link down

Message interval:7

Time out interval:5

No neighbor cache information stored

Related Commands

Command	Description
udld	Enables aggressive or normal mode in UDLD or sets the configurable message timer time.
udld port	Enables UDLD on an individual interface or prevents a fiber-optic interface from being enabled by the udld global configuration command.
udld reset	Resets all interfaces shutdown by UDLD and permits traffic to begin passing through them again.

show version

Use the show version user EXEC command to display version information for the hardware and firmware.

show version [ | {begin | exclude | include} expression]

Syntax Description

| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show version command:

---

Note Though visible in the show version output, the configuration register information is not supported on the switch.

---

Switch> show version

Cisco Internetwork Operating System Software

IOS (tm) C3550 Software (C3550-IPSERVICES-M), Version 12.2(25)SEB, RELEASE SOFTWARE 
VERSION

Copyright (c) 1986-2005 by cisco Systems, Inc.

Compiled Tue 15-FEB-05 07:06 by antonino

Image text-base: 0x00003000, data-base: 0x007175BC

ROM: Bootstrap program is C3550 boot loader

tslo-2 uptime is 4 days, 1 hour, 6 minutes

System returned to ROM by power-on

System image file is "flash:c3550-ipservices-mz.122-25.SEB"

cisco WS-C3550-12T (PowerPC) processor with 65526K/8192K bytes of memory.

Last reset from warm-reset

Bridging software.

Running Layer2/3 Switching Image

Target IOS Version 12.2(25)SEB

Ethernet-controller 1 has 1 Gigabit Ethernet/IEEE 802.3 interface<output truncated>

The password-recovery mechanism is enabled.

384K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: 00:02:4B:29:2B:00

Configuration register is 0x10F

show vlan

Use the show vlan user EXEC command to display the parameters for all configured VLANs or one VLAN (if the VLAN ID or name is specified) on the switch.

show vlan [brief | dot1q tag native | id vlan-id | internal usage | name vlan-name | remote-span | summary] [ | {begin | exclude | include} expression]

Syntax Description

brief	(Optional) Display one line for each VLAN with the VLAN name, status, and its ports.
dot1q tag native	(Optional) Display the IEEE 802.1Q native VLAN tagging status.
id vlan-id	(Optional) Display information about a single VLAN identified by VLAN ID number or a range of VLANs. The range is 1 to 4094.
internal usage	(Optional) Display list of VLANs being used internally by the switch. These VLANs are always from the extended range (VLAN IDs 1006 to 4094), and you cannot create VLANs with these IDS by using the vlan global configuration command until you remove them from internal use.
name vlan-name	(Optional) Display information about a single VLAN identified by VLAN name. The VLAN name is an ASCII string from 1 to 32 characters.
remote-span	(Optional) Display information about Remote SPAN (RSPAN) VLANs.
summary	(Optional) Display VLAN summary information.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

---

Note Though visible in the command-line help string, the ifindex and private-vlan keywords are not supported.

---

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The dot1q tag native, internal usage, and summary keywords were added.
12.1(11)EA1	The remote-span keyword was added.
12.1(13)EA1	The value for id vlan-id was changed.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vlan command. Table 2-28 describes each field in the display.

Switch> show vlan

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

1    default                          active    Fa0/1, Fa0/2, Fa0/5, Fa0/7

                                                Fa0/8, Fa0/9, Fa0/11, Fa0/12

                                                Gi0/1, Gi0/2

2    VLAN0002                         active

51   VLAN0051                         active

52   VLAN0052                         active

100  VLAN0100                         suspended Fa0/3

400  VLAN0400                         suspended

1002 fddi-default                     active

1003 token-ring-default               active

1004 fddinet-default                  active

1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1    enet  100001     1500  -      -      -        -    -        1002   1003

2    enet  100002     1500  -      -      -        -    -        0      0

51   enet  100051     1500  -      -      -        -    -        0      0

52   enet  100052     1500  -      -      -        -    -        0      0

100  enet  100100     1500  -      -      -        -    -        0      0

400  enet  100400     1500  -      -      -        -    -        0      0

1002 fddi  101002     1500  -      -      -        -    -        1      1003

1003 tr    101003     1500  1005   3276   -        -    srb      1      1002

1004 fdnet 101004     1500  -      -      1        ieee -        0      0

1005 trnet 101005     1500  -      -      15       ibm  -        0      0

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type              Ports

------- --------- ----------------- ------------------------------------------

Table 2-28 show vlan Command Output Fields 

Field	Description
VLAN	VLAN number.
Name	Name, if configured, of the VLAN.
Status	Status of the VLAN (active or suspend).
Ports	Ports that belong to the VLAN.
Type	Media type of the VLAN.
SAID	Security association ID value for the VLAN.
MTU	Maximum transmission unit size for the VLAN.
Parent	Parent VLAN, if one exists.
RingNo	Ring number for the VLAN, if applicable.
BrdgNo	Bridge number for the VLAN, if applicable.
Stp	Spanning Tree Protocol type used on the VLAN.
BrdgMode	Bridging mode for this VLAN—possible values are source-route bridging (SRB) and source-route transparent (SRT); the default is SRB.
Trans1	Translation bridge 1.
Trans2	Translation bridge 2.
AREHops	Maximum number of hops for All-Routes Explorer frames—possible values are 1 through 13; the default is 7.
STEHops	Maximum number of hops for Spanning-Tree Explorer frames—possible values are 1 through 13; the default is 7.
Backup CRF	Status of whether or not the Token Ring concentrator relay function (TrCRF) is a backup path for traffic.
Remote SPAN VLANs	Identify any RSPAN VLANs that have been configured.

This is an example of output from the show vlan brief command:

Switch> show vlan brief

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4

                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8

                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12

1002 fddi-default                     active

1003 token-ring-default               active

1004 fddinet-default                  active

1005 trnet-default                    active

This is an example of output from the show vlan id command. The specified VLAN is in the extended VLAN range.

Switch# show vlan id 2005

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

2005 VLAN2005                         active    Fa0/2

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

2005 enet  102005     1500  -      -      -        -    -        0      0      

This is an example of output from the show vlan dot1q tag native command:

Switch> show vlan dot1q tag native

dot1q native vlan tagging is disabled

This is an example of output from the show vlan internal usage command. It shows that VLANs 1025 and 1026 are being used as internal VLANs for Fast Ethernet routed ports 23 and 24. If you want to use one of these VLAN IDs, you must first shut down the routed port, which releases the internal VLAN, and then create the extended-range VLAN. When you start up the routed port, another internal VLAN number is assigned to it.

Switch> show vlan internal usage

VLAN Usage

---- -------------

1025 FastEthernet0/23

1026 FastEthernet0/24

This is an example of output from the show vlan summary command:

Switch> show vlan summary

Number of existing VLANs           : 7

 Number of existing VTP VLANs      : 7

 Number of existing extended VLANs : 0

Related Commands

Command	Description
switchport mode	Configures the VLAN membership mode of a port.
vlan (global configuration)	Enables config-vlan mode where you can configure VLANs 1 to 4094.
vlan (VLAN configuration)	Configures VLAN characteristics in the VLAN database. Only available for normal-range VLANs (VLAN IDs 1 to 1005).

show vlan access-map

Use the show vlan access-map privileged EXEC command to display information about a particular VLAN access map or all VLAN access maps.

show vlan access-map [mapname] [ | {begin | exclude | include} expression]

Syntax Description

mapname	(Optional) Name of a specific VLAN access map.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vlan access-map command:

Switch# show vlan access-map

Vlan access-map "map_1" 10

  Match clauses:

     ip address: ip1

  Action:

     drop

Vlan access-map "map_1" 20

  Match clauses:

     mac address: mac1

  Action:

     forward

Vlan access-map "map_1" 30

  Match clauses:

  Action:

     drop

Related Commands

Command	Description
show vlan filter	Displays information about all VLAN filters or about a particular VLAN or VLAN access map.
vlan access-map	Creates a VLAN map entry for VLAN packet filtering.
vlan filter	Applies a VLAN map to one or more VLANs.

show vlan filter

Use the show vlan filter privileged EXEC command to display information about all VLAN filters or about a particular VLAN or VLAN access map.

show vlan filter [access-map name | vlan vlan-id] [ | {begin | exclude | include} expression]

Syntax Description

access-map name	(Optional) Display filtering information for the specified VLAN access map.
vlan vlan-id	(Optional) Display filtering information for the specified VLAN. The range is 1 to 4094.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vlan filter command:

Switch# show vlan filter 

VLAN Map map_1 is filtering VLANs:

  20-22

Related Commands

Command	Description
show vlan access-map	Displays information about a particular VLAN access map or all VLAN access maps.
vlan access-map	Creates a VLAN map entry for VLAN packet filtering.
vlan filter	Applies a VLAN map to one or more VLANs.

show vmps

Use the show vmps user EXEC command without keywords to display the VLAN Query Protocol (VQP) version, reconfirmation interval, retry count, VLAN Membership Policy Server (VMPS) IP addresses, and the current and primary servers, or use the statistics keyword to display client-side statistics.

show vmps [statistics] [ | {begin | exclude | include} expression]

Syntax Description

statistics	(Optional) Display VQP client-side statistics and counters.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vmps command:

Switch> show vmps

VQP Client Status:

--------------------

VMPS VQP Version:   1

Reconfirm Interval: 60 min

Server Retry Count: 3

VMPS domain server:

Reconfirmation status

---------------------

VMPS Action:         other

This is an example of output from the show vmps statistics command. Table 2-29 describes each field in the display.

Switch> show vmps statistics

VMPS Client Statistics

----------------------

VQP  Queries:               0

VQP  Responses:             0

VMPS Changes:               0

VQP  Shutdowns:             0

VQP  Denied:                0

VQP  Wrong Domain:          0

VQP  Wrong Version:         0

VQP  Insufficient Resource: 0 

Table 2-29 show vmps statistics Field Descriptions 

Field	Description
VQP Queries	Number of queries sent by the client to the VMPS.
VQP Responses	Number of responses sent to the client from the VMPS.
VMPS Changes	Number of times that the VMPS changed from one server to another.
VQP Shutdowns	Number of times the VMPS sent a response to shut down the port. The client disables the port and removes all dynamic addresses on this port from the address table. You must administratively re-enable the port to restore connectivity.
VQP Denied	Number of times the VMPS denied the client request for security reasons. When the VMPS response denies an address, no frame is forwarded to or from the workstation with that address (broadcast or multicast frames are delivered to the workstation if the port has been assigned to a VLAN). The client keeps the denied address in the address table as a blocked address to prevent more queries from being sent to the VMPS for each new packet received from this workstation. The client ages the address if no new packets are received from this workstation on this port within the aging time period.
VQP Wrong Domain	Number of times the management domain in the request does not match the one for the VMPS. Any previous VLAN assignments of the port are not changed. This response means that the server and the client have not been configured with the same VTP management domain.
VQP Wrong Version	Number of times the version field in the query packet contains a value that is higher than the version supported by the VMPS. The VLAN assignment of the port is not changed. The switches send only VMPS version 1 requests.
VQP Insufficient Resource	Number of times the VMPS is unable to answer the request because of a resource availability problem. If the retry limit has not yet been reached, the client repeats the request with the same server or with the next alternate server, depending on whether the per-server retry count has been reached.

Related Commands

Command	Description
clear vmps statistics	Clears the statistics maintained by the VQP client.
vmps reconfirm (privileged EXEC)	Sends VQP queries to reconfirm all dynamic VLAN assignments with the VMPS.
vmps retry	Configures the per-server retry count for the VQP client.
vmps server	Configures the primary VMPS and up to three secondary servers.

show vtp

Use the show vtp user EXEC command to display general information about the VLAN Trunking Protocol (VTP) management domain, status, and counters.

show vtp {counters | status} [ | {begin | exclude | include} expression]

Syntax Description

counters	Display the VTP statistics for the switch.
status	Display general information about the VTP management domain status.
| begin	(Optional) Display begins with the line that matches the expression.
| exclude	(Optional) Display excludes lines that match the expression.
| include	(Optional) Display includes lines that match the specified expression.
expression	Expression in the output to use as a reference point.

Command Modes

User EXEC

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.

Examples

This is an example of output from the show vtp counters command. Table 2-30 describes each field in the display.

Switch> show vtp counters

VTP statistics:

Summary advertisements received    : 38

Subset advertisements received     : 0

Request advertisements received    : 0

Summary advertisements transmitted : 13

Subset advertisements transmitted  : 3

Request advertisements transmitted : 0

Number of config revision errors   : 0

Number of config digest errors     : 0

Number of V1 summary errors        : 0

VTP pruning statistics:

Trunk            Join Transmitted Join Received    Summary advts received from

                                                   non-pruning-capable device

---------------- ---------------- ---------------- ---------------------------

Fa0/9               827              824              0

Fa0/10              827              823              0 

Fa0/11              827              823              0

Table 2-30 show vtp counters Field Descriptions 

Field	Description
Summary advertisements received	Number of summary advertisements received by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.
Subset advertisements received	Number of subset advertisements received by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.
Request advertisements received	Number of advertisement requests received by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.
Summary advertisements transmitted	Number of summary advertisements sent by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow.
Subset advertisements transmitted	Number of subset advertisements sent by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs.
Request advertisements transmitted	Number of advertisement requests sent by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs.
Number of configuration revision errors	Number of revision errors. Whenever you define a new VLAN, delete an existing one, suspend or resume an existing VLAN, or modify the parameters on an existing VLAN, the configuration revision number of the switch increments. Revision errors increment whenever the switch receives an advertisement whose revision number matches the revision number of the switch, but the MD5 digest values do not match. This error means that the VTP password in the two switches is different or that the switches have different configurations. These errors means that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.
Number of configuration digest errors	Number of MD5 digest errors. Digest errors increment whenever the MD5 digest in the summary packet and the MD5 digest of the received advertisement calculated by the switch do not match. This error usually means that the VTP password in the two switches is different. To solve this problem, make sure the VTP password on all switches is the same. These errors mean that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.
Number of V1 summary errors	Number of version 1 errors. Version 1 summary errors increment whenever a switch in VTP V2 mode receives a VTP version 1 frame. These errors mean that at least one neighboring switch is either running VTP version 1 or VTP version 2 with V2-mode disabled. To solve this problem, change the configuration of the switches in VTP V2-mode to disabled.
Join Transmitted	Number of VTP pruning messages sent on the trunk.
Join Received	Number of VTP pruning messages received on the trunk.
Summary Advts Received from non-pruning-capable device	Number of VTP summary messages received on the trunk from devices that do not support pruning.

This is an example of output from the show vtp status command. Table 2-31 describes each field in the display.

Switch> show vtp status

VTP Version                     : 2

Configuration Revision          : 0

Maximum VLANs supported locally : 1005

Number of existing VLANs        : 5

VTP Operating Mode              : Server

VTP Domain Name                 :

VTP Pruning Mode                : Disabled

VTP V2 Mode                     : Disabled

VTP Traps Generation            : Disabled

MD5 digest                      : 0xBF 0x86 0x94 0x45 0xFC 0xDF 0xB5 0x70

Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00

Local updater ID is 172.20.135.196 on interface Vl1 (lowest numbered VLAN interface found) 

Table 2-31 show vtp status Field Descriptions 

Field	Description
VTP Version	Displays the VTP version operating on the switch. By default, the switch implements version 1 but can be set to version 2.
Configuration Revision	Current configuration revision number on this switch.
Maximum VLANs Supported Locally	Maximum number of VLANs supported locally.
Number of Existing VLANs	Number of existing VLANs.
VTP Operating Mode	Displays the VTP operating mode, which can be server, client, or transparent. Server: a switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch guarantees that it can recover all the VLAN information in the current VTP database from NVRAM after reboot. By default, every switch is a VTP server. Note The switch automatically changes from VTP server mode to VTP client mode if it detects a failure while writing the configuration to NVRAM; it cannot return to server mode until the NVRAM is functioning. Client: a switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough NVRAM storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not send VTP advertisements until it receives advertisements to initialize its VLAN database. Transparent: a switch in VTP transparent mode is disabled for VTP, does not send or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received
VTP Domain Name	Name that identifies the administrative domain for the switch.
VTP Pruning Mode	Displays whether pruning is enabled or disabled. Enabling pruning on a VTP server enables pruning for the entire management domain. Pruning restricts flooded traffic to those trunk links that the traffic must use to access the appropriate network devices.
VTP V2 Mode	Displays if VTP version 2 mode is enabled. All VTP version 2 switches operate in version 1 mode by default. Each VTP switch automatically detects the capabilities of all the other VTP devices. A network of VTP devices should be configured to version 2 only if all VTP switches in the network can operate in version 2 mode.
VTP Traps Generation	Displays whether VTP traps are sent to a network management station.
MD5 Digest	A 16-byte checksum of the VTP configuration.
Configuration Last Modified	Displays the date and time of the last configuration modification. Displays the IP address of the switch that caused the configuration change to the database.

Related Commands

Command	Description
clear vtp counters	Clears the VTP and pruning counters.
vtp (global configuration)	Configures the VTP filename, interface name, domain name, and mode.
vtp (privileged EXEC)	Configures the VTP password, pruning, and version.
vtp (VLAN configuration)	Configures the VTP domain name, password, pruning, and mode.

shutdown

Use the shutdown interface configuration command to disable an interface. Use the no form of this command to restart a disabled port or a switch virtual interface (SVI).

shutdown

no shutdown

Syntax Description

This command has no arguments or keywords.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The shutdown command for a port causes it to stop forwarding. You can enable the port with the no shutdown command.

The no shutdown command has no effect if the port is a static-access port assigned to a VLAN that has been deleted, suspended, or shut down. The port must first be a member of an active VLAN before it can be re-enabled.

The shutdown command disables all functions on the specified interface.

This command also marks the interface as unavailable. To see if an interface is disabled, use the show interfaces privileged EXEC command. An interface that has been shut down is shown as administratively down in the display.

Examples

These examples show how to disable and re-enable an interface:

Switch(config)# interface gigabitethernet0/2

Switch(config-if)# shutdown

Switch(config)# interface gigabitethernet0/2

Switch(config-if)# no shutdown

You can verify your settings by entering the show interfaces privileged EXEC command.

Related Commands

Command	Description
show interfaces	Displays the statistical information specific to all interfaces or to a specific interface.

shutdown vlan

Use the shutdown vlan global configuration command to shut down (suspend) local traffic on the specified VLAN. Use the no form of this command to restart local traffic on the VLAN.

shutdown vlan vlan-id

no shutdown vlan vlan-id

Syntax Description

vlan-id

ID of the VLAN to be locally shut down. The range is 2 to 1001. VLANs defined as default VLANs under the VLAN Trunking Protocol (VTP), as well as extended-range VLANs (greater than 1005) cannot be shut down. The default VLANs are 1 and 1002 to 1005.

Defaults

No default is defined.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The shutdown vlan command does not change the VLAN information in the VTP database. It shuts down traffic locally, but the switch still advertises VTP information.

Examples

This example shows how to shutdown traffic on VLAN 2:

Switch(config)# shutdown vlan 2

You can verify your setting by entering the show vlan privileged EXEC command.

Related Commands

Command	Description
shutdown (config-vlan mode)	Shuts down local traffic on the VLAN when in config-VLAN mode (accessed by the vlan vlan-id global configuration command).
vlan database	Enters VLAN configuration mode.

skip-loopback-test

Use the skip-loopback-test interface configuration command to configure the switch to omit the loopback test on an interface during the switch power-on self-test (POST).

skip-loopback-test

no skip-loopback-test

Syntax Description

This command has no arguments or keywords.

Defaults

A loopback test is performed on all interfaces during POST.

Command Modes

Interface configuration

Command History

Release	Modification
12.2(37)SE	This command was introduced.

Usage Guidelines

Use this command in rare situations when an interface fails POST but the switch hardware is known to be fully functional as is the case when the Gigabit port of a Catalyst 3550 switch with inline power (WS-C3550-25-PWR) is connected to the Gigabit port of a Catalyst 4000 series switch with Supervisor Model WS-X4516 running Cisco IOS release 12.2(18)EW or 12.2(20)EW. This configuration is known to experience lost loopback packets when the switch boots up and entering this command on the interface allows it to remain up.

snmp-server enable traps

Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting.

snmp-server enable traps [bgp | bridge | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature | voltage] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate value] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate value | stpx | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

no snmp-server enable traps [bgp | bridge | cluster | config | copy-config | entity | envmon | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security | rtr | snmp | storm-control trap-rate | stpx | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

Syntax Description

bgp	(Optional) Enable Border Gateway Protocol (BGP) state change traps. Note This keyword is available only when the enhanced multilayer image is installed.
bridge	(Optional) Enable Spanning Tree Protocol (STP) bridge MIB traps.
cluster	(Optional) Enable cluster traps.
config	(Optional) Enable SNMP configuration traps.
copy-config	(Optional) Enable SNMP copy-configuration traps.
entity	(Optional) Enable SNMP entity traps.
envmon [fan | shutdown | status | supply | temperature | voltage]	(Optional) Enable SNMP environmental traps. The keywords have these meanings: •fan—(Optional) Enable fan traps. •shutdown—(Optional) Enable environmental monitor shutdown traps. •status—(Optional) Enable environmental status-change traps. •supply—(Optional) Enable environmental monitor supply traps. •temperature—(Optional) Enable environmental monitor temperature traps. •voltage—(Optional) Enable environmental monitor voltage traps.
flash	(Optional) Enable SNMP FLASH notifications.
hsrp	(Optional) Enable Hot Standby Router Protocol (HSRP) traps.
ipmulticast	(Optional) Enable IP multicast routing traps.
mac-notification	(Optional) Enable MAC address notification traps.
msdp	(Optional) Enable Multicast Source Discovery Protocol (MSDP) traps.
ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change]	(Optional) Enable Open Shortest Path First (OSPF) traps. The keywords have these meanings: •cisco-specific—(Optional) Enable Cisco-specific traps. •errors—(Optional) Enable error traps. •lsa—(Optional) Enable link-state advertisement (LSA) traps. •rate-limit—(Optional) Enable rate-limit traps. •retransmit—(Optional) Enable packet-retransmit traps. •state-change—(Optional) Enable state-change traps.
pim [invalid-pim-message | neighbor-change | rp-mapping-change]	(Optional) Enable Protocol-Independent Multicast (PIM) traps. The keywords have these meanings: •invalid-pim-message—(Optional) Enable invalid PIM message traps. •neighbor-change—(Optional) Enable PIM neighbor-change traps. •rp-mapping-change—(Optional) Enable rendezvous point (RP)-mapping change traps.
port-security [trap-rate value]	(Optional) Enable port security traps. Use the trap-rate keyword to set the number of traps per second. The range is 0 to 1000 seconds.
rtr	(Optional) Enable SNMP Response Time Reporter traps.
snmp [authentication | coldstart | linkdown | linkup | warmstart]	(Optional) Enable SNMP traps. The keywords have these meanings: •authentication—(Optional) Enable authentication trap. •coldstart—(Optional) Enable cold start trap. •linkdown—(Optional) Enable linkdown trap. •linkup—(Optional) Enable linkup trap. •warmstart—(Optional) Enable warmstart trap.
storm-control trap-rate value	(Optional) Enable storm-control traps. Use the trap-rate keyword to set the maximum number of storm-control traps sent per minute. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence).
stpx	(Optional) Enable SNMP STPX MIB traps.
syslog	(Optional) Enable SNMP syslog traps.
tty	(Optional) Send TCP connection traps. This is enabled by default.
vlan-membership	(Optional) Enable SNMP VLAN membership traps.
vlancreate	(Optional) Enable SNMP VLAN-created traps.
vlandelete	(Optional) Enable SNMP VLAN-deleted traps.
vtp	(Optional) Enable VLAN Trunking Protocol (VTP) traps.

---

Note Though visible in the command-line help strings, the cpu [threshold], flash insertion, and flash removal keywords are not supported. The snmp-server enable informs command is not supported. To enable sending of SNMP inform notifications, use the snmp-server enable traps command combined with the snmp-server host host-addr informs command.

---

Defaults

The sending of SNMP traps is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	The mac-notification keyword was added.
12.1(9)EA1	The vlan-membership keyword was added.
12.1(11)EA1	The bgp keyword was added (enhanced multilayer image only).
12.1(12c)EA1	The envmon [fan| shutdown | status | supply | temperature | voltage] keywords were added.
12.1(13)EA1	The port-security and trap-rate keywords were added.
12.1(14)EA1	The authentication, bridge, coldstart, copy-config, flash, linkdown, linkup, stpx, syslog, vlancreate, vlandelete, and warmstart keywords were added.
12.2(25)SE	The ipmulticast, msdp, ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change], pim [invalid-pim-message | neighbor-change | rp-mapping-change], storm-control trap-rate value, and tty keywords were added.

Usage Guidelines

Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent.

Use the snmp-server enable traps command to enable sending of traps or informs, when supported.

---

Note Informs are not supported in SNMPv1.

---

To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type.

Examples

This example shows how to send VTP traps to the NMS:

Switch(config)# snmp-server enable traps vtp

You can verify your setting by entering the show vtp status or the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the running configuration on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
snmp-server host	Specifies the host that receives SNMP traps.

snmp-server host

Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.

snmp-server host host-addr [udp-port port] [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] {community-string [notification-type]}

no snmp-server host host-addr [udp-port] [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] community-string

Syntax Description

host-addr	Name or Internet address of the host (the targeted recipient).
udp-port port	(Optional) Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is 0 to 65535.
informs | traps	(Optional) Send SNMP traps or informs to this host.
version 1 | 2c | 3	(Optional) Version of the SNMP used to send the traps. These keywords are supported: 1—SNMPv1. This option is not available with informs. 2c—SNMPv2C. 3—SNMPv3. These optional keywords can follow the version 3 keyword: •auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication. •noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth | priv] keyword choice is not specified. •priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the cryptographic (encrypted) software image is installed.
vrf vrf-instance	(Optional) Virtual private network (VPN) routing instance and name for this host.
community-string	Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command. Note The @ symbol is used for delimiting the context information. Avoid using the @ symbol as part of the SNMP community string when configuring this command.
notification-type	(Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the these keywords: •bgp—Send Border Gateway Protocol (BGP) state change traps. This keyword is available only when the enhanced multilayer image is installed on the stack master. •bridge—Send SNMP Spanning Tree Protocol (STP) bridge MIB traps. •cluster—Send cluster member status traps. •config—Send SNMP configuration traps. •copy-config—Send SNMP copy configuration traps. •entity— Send SNMP entity traps. •envmon—Send environmental monitor (EnvMon) traps. •flash—Send SNMP FLASH notifications. •hsrp—Send SNMP Hot Standby Router Protocol (HSRP) traps. •ipmulticast—Send SNMP IP multicast routing traps. •mac-notification—Send SNMP MAC notification traps. •msdp—Send SNMP Multicast Source Discovery Protocol (MSDP) traps. •ospf—Send Open Shortest Path First (OSPF) traps. •pim—Send SNMP Protocol-Independent Multicast (PIM) traps. •port-security—Send SNMP port-security traps. •rtr—Send SNMP Response Time Reporter traps. •snmp—Send SNMP-type traps. •storm-control—Send SNMP storm-control traps. •stpx—Send SNMP STP extended MIB traps. •syslog—Send SNMP syslog traps. •tty—Send TCP connection traps. •vlan-membership— Send SNMP VLAN membership traps. •vlancreate—Send SNMP VLAN-created traps. •vlandelete—Send SNMP VLAN-deleted traps. •vtp—Send SNMP VLAN Trunking Protocol (VTP) traps.

---

Note Though visible in the command-line help strings, the cpu keyword is not supported.

---

Defaults

This command is disabled by default. No notifications are sent.

If you enter this command with no keywords, the default is to send all trap types to the host. No informs are sent to this host.

If no version keyword is present, the default is version 1.

If version 3 is selected and no authentication keyword is entered, the default is the noauth (noAuthNoPriv) security level.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	The mac-notification keyword was added.
12.1(9)EA1	The vlan-membership keyword was added.
12.1(11)EA1	The version 3 option was added, with the auth, noauth, and priv keywords. The bgp keyword was added.
12.1(12c)EA1	The envmon keyword was added.
12.1(13)EA1	The port-security keyword was added.
12.1(14)EA1	The bridge, copy-config, flash, stpx, syslog, vlancreate, and vlandelete keywords were added.
12.2(25)SE	The ipmulticast, msdp, ospf, pim, storm-control trap rate value, and vrf vrf-instance keywords were added.

Usage Guidelines

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.

The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.

The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.

Examples

This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access list 10:

Switch(config)# snmp-server community comaccess ro 10

Switch(config)# snmp-server host 172.20.2.160 comaccess

Switch(config)# access-list 10 deny any

This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com comaccess snmp 

This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:

Switch(config)# snmp-server enable traps

Switch(config)# snmp-server host myhost.cisco.com public

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the running configuration on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
snmp-server enable traps	Enables SNMP notification for various trap types or inform requests.

snmp-server ip

Use the snmp-server ip global configuration command to prioritize Simple Network Management Protocol (SNMP) notifications using either IP precedence or Differentiated Services Code Point (DSCP) marking. Use the no form of this command to return to the default setting.

snmp-server ip {precedence new-precedence | dscp new-dscp}

no snmp-server ip {precedence | dscp}

Syntax Description

precedence new-precedence	Assign a new IP precedence value to outgoing SNMP traffic. The range is 0 to 7.
dscp new-dscp	Assign a new DSCP value to outgoing SNMP traffic. The range is 0 to 63.

Defaults

The default marker is 0 (best effort).

Command Modes

Global configuration

Command History

Release	Modification
12.1(14)EA1	This command was introduced.

Usage Guidelines

You can improve the delivery of SNMP trap notifications by assigning a higher IP precedence or DSCP marker to them. The default marker, 0, forwards SNMP packets as normal traffic. Markers with higher values invoke preferential forwarding that moves the packets through the network more efficiently, even during periods of congestion. The amount of preference increases with the marker value. The highest marker values, 7 for IP precedence and 63 for DSCP, are generally reserved for network control traffic. The marker value that you set with this command applies to all outgoing SNMP notifications.

DSCP has partial backward-compatibility with IP precedence. To use DSCP-like IP precedence, use the following DSCP values: 0, 8, 16, 24, 32, 40, 48, and 56.

Use the snmp-server enable traps command to allow traps or informs to be sent, when supported. Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command.

Examples

This example shows how to set the IP precedence to 5:

Switch(config)# snmp-server ip precedence 5

This example shows how to set the DSCP marking to 40:

Switch(config)# snmp-server ip dscp 40

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the running configuration on the switch. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
snmp-server host	Specifies the host that receives SNMP traps.
snmp-server enable traps	Enables SNMP notification for various trap types or inform requests.

snmp trap mac-notification

Use the snmp trap mac-notification interface configuration command to enable the Simple Network Management Protocol (SNMP) MAC address notification trap on a specific Layer 2 interface. Use the no form of this command to return to the default setting.

snmp trap mac-notification {added | removed}

no snmp trap mac-notification {added | removed}

Syntax Description

added	Enable the MAC notification trap whenever a MAC address is added on this interface.
removed	Enable the MAC notification trap whenever a MAC address is removed from this interface.

Defaults

By default, the traps for both address addition and address removal are disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(8)EA1	This command was introduced.

Usage Guidelines

Even though you enable the notification trap for a specific interface by using the snmp trap mac-notification command, the trap is generated only when you enable the snmp-server enable traps mac-notification and the mac address-table notification global configuration commands.

Examples

This example shows how to enable the MAC notification trap when a MAC address is added to an interface:

Switch(config)# interface fastethernet0/4

Switch(config-if)# snmp trap mac-notification added

You can verify your settings by entering the show mac address-table notification interface privileged EXEC command.

Related Commands

Command	Description
clear mac address-table notification	Clears the MAC address notification global counters.
mac address-table notification	Enables the MAC address notification feature.
show mac address-table notification	Displays the MAC address notification settings for all interfaces or on the specified interface when the interface keyword is appended.
snmp-server enable traps	Sends the SNMP MAC notification traps when the mac-notification keyword is appended.

spanning-tree backbonefast

Use the spanning-tree backbonefast global configuration command to enable the BackboneFast feature. Use the no form of this command to return to the default setting.

spanning-tree backbonefast

no spanning-tree backbonefast

Syntax Description

This command has no arguments or keywords.

Defaults

BackboneFast is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

You can configure BackboneFast feature for rapid PVST+ or for multiple spanning-tree (MST) mode, but the feature remains disabled (inactive) until you change the spanning-tree mode to PVST+.

BackboneFast is started when a root port or blocked port on a switch receives inferior bridge protocol data units (BPDUs) from its designated bridge. An inferior BPDU identifies one switch as both the root bridge and the designated bridge. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated bridge has lost its connection to the root switch). If there are alternate paths to the root switch, BackboneFast causes the maximum aging time on the ports on which it received the inferior BPDU to expire and allows a blocked port to move immediately to the listening state. BackboneFast then transitions the interface to the forwarding state. For more information, see the software configuration guide for this release.

Enable BackboneFast on all supported switches to allow the detection of indirect link failures and to start the spanning-tree reconfiguration sooner.

Examples

This example shows how to enable BackboneFast on the switch:

Switch(config)# spanning-tree backbonefast

You can verify your setting by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command	Description
show spanning-tree summary	Displays a summary of the spanning-tree port states.

spanning-tree bpdufilter

Use the spanning-tree bpdufilter interface configuration command to prevent a port from sending or receiving bridge protocol data units (BPDUs). Use the no form of this command to return to the default setting.

spanning-tree bpdufilter {disable | enable}

no spanning-tree bpdufilter

Syntax Description

disable	Disable BPDU filtering on the specified interface.
enable	Enable BPDU filtering on the specified interface.

Defaults

BPDU filtering is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

You can enable the BPDU filtering feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

---

Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

---

You can globally enable BPDU filtering on all Port Fast-enabled ports by using the spanning-tree portfast bpdufilter default global configuration command.

You can use the spanning-tree bpdufilter interface configuration command to override the setting of the spanning-tree portfast bpdufilter default global configuration command.

When you configure Layer 2 protocol filtering, the spanning-tree BPDU filtering feature is automatically enabled on the port.

Examples

This example shows how to enable the BPDU filtering feature on a port:

Switch(config)# interface fastethernet0/1

Switch(config-if)# spanning-tree bpdufilter enable

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree portfast (global configuration)	Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.
spanning-tree portfast (interface configuration)	Enables the Port Fast feature on an interface and all its associated VLANs.

spanning-tree bpduguard

Use the spanning-tree bpduguard interface configuration command to put a port in the error-disabled state when it receives a bridge protocol data unit (BPDU). Use the no form of this command to return to the default setting.

spanning-tree bpduguard {disable | enable}

no spanning-tree bpduguard

Syntax Description

disable	Disable BPDU guard on the specified interface.
enable	Enable BPDU guard on the specified interface.

Defaults

BPDU guard is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent a port from being included in the spanning-tree topology.

You can enable the BPDU guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

You can globally enable BPDU guard on all Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command.

You can use the spanning-tree bpduguard interface configuration command to override the setting of the spanning-tree portfast bpduguard default global configuration command.

Examples

This example shows how to enable the BPDU guard feature on a port:

Switch(config)# interface fastethernet0/1

Switch(config-if)# spanning-tree bpduguard enable

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree portfast (global configuration)	Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.
spanning-tree portfast (interface configuration)	Enables the Port Fast feature on an interface and all its associated VLANs.

spanning-tree cost

Use the spanning-tree cost interface configuration command to set the path cost for spanning-tree calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to place in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree [vlan vlan-id] cost cost

no spanning-tree [vlan vlan-id] cost

Syntax Description

vlan vlan-id	(Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094.
cost	Path cost can range from 1 to 200000000, with higher values meaning higher costs.

Defaults

The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values:

•1000 Mbps—4

•100 Mbps—19

•10 Mbps—100

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The range for the cost variable increased.
12.1(13)EA1	The value for the vlan-id variable was changed.

Usage Guidelines

When you configure the cost, higher values represent higher costs.

If you configure an interface with both the spanning-tree vlan vlan-id cost cost command and the spanning-tree cost cost command, the spanning-tree vlan vlan-id cost cost command takes effect.

Examples

This example shows how to set a path cost of 250 on an interface:

Switch(config)# interface fastethernet0/4

Switch(config-if)# spanning-tree cost 250

This example shows how to set a path cost of 300 for VLAN 10:

Switch(config-if)# spanning-tree vlan 10 cost 300

This example shows how to set a path cos]t of 300 for VLANs 10, 12 to 15, and 20:

Switch(config-if)# spanning-tree vlan 10,12-15,20 cost 300

You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree interface interface-id	Displays spanning-tree information for the specified interface.
spanning-tree port-priority	Configures an interface priority.
spanning-tree vlan priority	Sets the switch priority for the specified spanning-tree instance.

spanning-tree etherchannel guard misconfig

Use the spanning-tree etherchannel guard misconfig global configuration command to display an error message when the switch detects a loop that occurred because of an EtherChannel misconfiguration. Use the no form of this command to disable the feature.

spanning-tree etherchannel guard misconfig

no spanning-tree etherchannel guard misconfig

Syntax Description

This command has no arguments or keywords.

Defaults

EtherChannel guard is enabled on the switch.

Command Modes

Global configuration

Command History

Release	Modification
12.1(13)EA1	This command was introduced.

Usage Guidelines

When the switch detects a loop that is caused by an EtherChannel misconfiguration, this error message appears:

PM-4-ERR_DISABLE: Channel-misconfig error detected on [chars], putting [chars] in 
err-disable state.

To determine which switch ports are in EtherChannel misconfiguration, use the show interfaces status err-disabled privileged EXEC command. To verify the EtherChannel configuration on a remote device, use the show etherchannel summary privileged EXEC command on the remote device.

When a port is in the error-disabled state because of an EtherChannel misconfiguration, you can bring it out of this state by entering the errdisable recovery cause channel-misconfig global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Examples

This example shows how to enable the EtherChannel guard feature:

Switch(config)# spanning-tree etherchannel guard misconfig

You can verify your settings by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command	Description
errdisable recovery cause channel-misconfig	Enables the timer to recover from the EtherChannel misconfiguration error-disable state.
show etherchannel summary	Displays EtherChannel information for a channel as a one-line summary for each channel group.
show interfaces status err-disabled	Displays the interfaces in the error-disabled state.

spanning-tree extend system-id

Use the spanning-tree extend system-id global configuration command to enable the extended system ID feature.

spanning-tree extend system-id

---

Note Though visible in the command-line help strings, the no version of this command is not supported. You cannot disable the extended system ID feature.

---

Syntax Description

This command has no arguments or keywords.

Defaults

The extended system ID is enabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(8)EA1	This command was introduced.

Usage Guidelines

In Cisco IOS Release 12.1(8)EA1 and later, Catalyst 3550 switches support the IEEE 802.1t spanning-tree extensions, and some of the bits previously used for the switch priority are now used for the extended system ID (VLAN identifier for the per-VLAN spanning-tree plus [PVST+] and rapid PVST+ or an instance identifier for the multiple spanning tree [MST]). In earlier releases, the switch priority is a 16-bit value.

The spanning tree uses the extended system ID, the switch priority, and the allocated spanning-tree MAC address to make the bridge ID unique for each VLAN or multiple spanning-tree instance. With earlier releases, spanning tree used one MAC address per VLAN to make the bridge ID unique for each VLAN.

Support for the extended system ID affects how you manually configure the root switch, the secondary root switch, and the switch priority of a VLAN. For more information, see the "spanning-tree mst root" and the "spanning-tree vlan" sections.

If your network consists of switches that do not support the extended system ID and switches that do support it, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches running older software.

Related Commands

Command	Description
show spanning-tree summary	Displays a summary of spanning-tree port states.
spanning-tree mst root	Configures the multiple spanning-tree (MST) root switch priority and timers based on the network diameter.
spanning-tree vlan priority	Sets the switch priority for the specified spanning-tree instance.

spanning-tree guard

Use the spanning-tree guard interface configuration command to enable root guard or loop guard on all the VLANs associated with the selected interface. Root guard restricts which interface is allowed to be the spanning-tree root port or the path-to-the root for the switch. Loop guard prevents alternate or root ports from becoming designated ports when a failure creates a unidirectional link. Use the no form of this command to return to the default setting.

spanning-tree guard {loop | none | root}

no spanning-tree guard

Syntax Description

loop	Enable loop guard.
none	Disable root guard or loop guard.
root	Enable root guard.

Defaults

Root guard is disabled.

Loop guard is configured according to the spanning-tree loopguard default global configuration command (globally disabled).

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The loop keyword was added.

Usage Guidelines

You can enable root guard or loop guard when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

When root guard is enabled, if spanning-tree calculations cause a port to be selected as the root port, the port transitions to the root-inconsistent (blocked) state to prevent the customer's switch from becoming the root switch or being in the path to the root. The root port provides the best path from the switch to the root switch.

When the no spanning-tree guard or the no spanning-tree guard none command is entered, root guard is disabled for all VLANs on the selected interface. If this interface is in the root-inconsistent (blocked) state, it automatically transitions to the listening state.

Do not enable root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state. The UplinkFast feature is not available when the switch is operating in rapid-PVST+ or MST mode.

Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the port is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the port in all MST instances.

To disable root guard or loop guard, use the spanning-tree guard none interface configuration command.

You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command.

Examples

This example shows how to enable root guard on all the VLANs associated with the specified interface:

Switch(config)# interface fastethernet0/1

Switch(config-if)# spanning-tree guard root

This example shows how to enable loop guard on all the VLANs associated with the specified interface:

Switch(config)# interface fastethernet0/1

Switch(config-if)# spanning-tree guard loop

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree cost	Sets the path cost for spanning-tree calculations.
spanning-tree loopguard default	Prevents alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link.
spanning-tree mst cost	Configures the path cost for MST calculations.
spanning-tree mst port-priority	Configures an interface priority.
spanning-tree mst root	Configures the MST root switch priority and timers based on the network diameter.
spanning-tree port-priority	Configures an interface priority.
spanning-tree vlan priority	Sets the switch priority for the specified spanning-tree instance.

spanning-tree link-type

Use the spanning-tree link-type interface configuration command to override the default link-type setting, which is determined by the duplex mode of the port, and to enable Rapid Spanning-Tree Protocol (RSTP) transitions to the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree link-type {point-to-point | shared}

no spanning-tree link-type

Syntax Description

point-to-point	Specify that the link type of a port is point-to-point.
shared	Specify that the link type of a port is shared.

Defaults

The switch derives the link type of a port from the duplex mode. A full-duplex port is considered a point-to-point link, and a half-duplex port is considered a shared link.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

You can override the default setting of the link type by using the spanning-tree link-type command; for example, a half-duplex link can be physically connected point-to-point to a single port on a remote switch running the Multiple Spanning Tree Protocol (MSTP) or the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol and be enabled for rapid transitions.

Examples

This example shows how to specify the link type as shared (regardless of the duplex setting) and to prevent RSTP rapid transitions to the forwarding state:

Switch(config-if)# spanning-tree link-type shared

You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst interface interface-id	Displays multiple spanning-tree (MST) information for the specified interface.

spanning-tree loopguard default

Use the spanning-tree loopguard default global configuration command to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. Use the no form of this command to return to the default setting.

spanning-tree loopguard default

no spanning-tree loopguard default

Syntax Description

This command has no arguments or keywords.

Defaults

Loop guard is disabled.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

You can enable the loop guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the port is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the port in all MST instances.

Loop guard operates only on ports that are considered point-to-point by the spanning tree.

You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command.

Examples

This example shows how to globally enable loop guard:

Switch(config)# spanning-tree loopguard default

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree guard loop	Enables the loop guard feature on all the VLANs associated with the specified interface.

spanning-tree mode

Use the spanning-tree mode global configuration command to enable per-VLAN spanning-tree plus (PVST+), rapid PVST+, or multiple spanning tree (MST) on your switch. Use the no form of this command to return to the default setting.

spanning-tree mode {mst | pvst | rapid-pvst}

no spanning-tree mode

Syntax Description

mst	Enable MST and Rapid Spanning Tree Protocol (RSTP) (based on IEEE 802.1s and IEEE 802.1w).
pvst	Enable PVST+ (based on IEEE 802.1D).
rapid-pvst	Enable rapid PVST+ (based on IEEE 802.1w).

Defaults

The default mode is PVST+.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The rapid-pvst keyword was added.

Usage Guidelines

The switch must run all STP instances in one of these modes: PVST+, rapid PVST+, or MST. In other words, you cannot run STP in any two modes at the same time.

When you enable the MST mode, RSTP is automatically enabled.

---

Caution Changing spanning-tree modes can disrupt traffic because all spanning-tree instances are stopped for the previous mode and restarted in the new mode.

---

Examples

This example shows to enable MST on the switch:

Switch(config)# spanning-tree mode mst

This example shows to enable rapid PVST+ on the switch:

Switch(config)# spanning-tree mode rapid-pvst

You can verify your setting by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.

spanning-tree mst configuration

Use the spanning-tree mst configuration global configuration command to enter multiple spanning-tree (MST) configuration mode through which you configure the MST region. Use the no form of this command to return to the default settings.

spanning-tree mst configuration

no spanning-tree mst configuration

Syntax Description

This command has no arguments or keywords.

Defaults

The default mapping is that all VLANs are mapped to the common and internal spanning tree (CIST) instance (instance 0).

The default name is an empty string.

The revision number is 0.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.2(25)SEC	The instance-id range changed to 1 to 4094.

Usage Guidelines

Entering the spanning-tree mst configuration command enables the MST configuration mode. These configuration commands are available:

•abort: exits the MST region configuration mode without applying configuration changes.

•exit: exits the MST region configuration mode and applies all configuration changes.

•instance instance-id vlan vlan-range: maps VLANs to an MST instance. The range for the instance-id is 1 to 4094; the range for vlan-range is 1 to 4094. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma.

•name name: sets the configuration name. The name string has a maximum length of 32 characters and is case sensitive.

•no: negates the instance, name, and revision commands or sets them to their defaults.

•private-vlan: Though visible in the command-line help strings, this command is not supported.

•revision version: sets the configuration revision number. The range is 0 to 65535.

•show [current | pending]: displays the current or pending MST region configuration.

In MST mode, the switch supports up to 65 MST instances. The number of VLANs that can be mapped to a particular MST instance is unlimited.

When you map VLANs to an MST instance, the mapping is incremental, and the VLANs specified in the command are added to or removed from the VLANs that were previously mapped. To specify a range, use a hyphen; for example, instance 1 vlan 1-63 maps VLANs 1 to 63 to MST instance 1. To specify a series, use a comma; for example, instance 1 vlan 10, 20, 30 maps VLANs 10, 20, and 30 to MST instance 1.

All VLANs that are not explicitly mapped to an MST instance are mapped to the common and internal spanning tree (CIST) instance (instance 0) and cannot be unmapped from the CIST by using the no form of the command.

For two or more switches to be in the same MST region, they must have the same VLAN mapping, the same configuration revision number, and the same name.

Examples

This example shows how to enter MST configuration mode, map VLAN 10 to 20 to MST instance 1, name the region region1, set the configuration revision to 1, display the pending configuration, apply the changes, and return to global configuration mode:

Switch# spanning-tree mst configuration

Switch(config-mst)# instance 1 vlan 10-20

Switch(config-mst)# name region1

Switch(config-mst)# revision 1

Switch(config-mst)# show pending

Pending MST configuration

Name      [region1]

Revision  1

Instance  Vlans Mapped

--------  ---------------------

0         1-9,21-4094

1         10-20

-------------------------------

Switch(config-mst)# exit

Switch(config)#

This example shows how to add VLANs 1 to 100 to the ones already mapped (if any) to instance 2, to move VLANs 40 to 60 that were previously mapped to instance 2 to the CIST instance, to add VLAN 10 to instance 10, and to remove all the VLANs mapped to instance 2 and map them to the CIST instance:

Switch(config-mst)# instance 2 vlan 1-100

Switch(config-mst)# no instance 2 vlan 40-60

Switch(config-mst)# instance 10 vlan 10

Switch(config-mst)# no instance 2

You can verify your settings by entering the show pending MST configuration command.

Related Commands

Command	Description
show spanning-tree mst configuration	Displays the MST region configuration.

spanning-tree mst cost

Use the spanning-tree mst cost interface configuration command to set the path cost for multiple spanning-tree (MST) calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to put in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree mst instance-id cost cost

no spanning-tree mst instance-id cost

Syntax Description

instance-id	Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 4094.
cost	Path cost is 1 to 200000000, with higher values meaning higher costs.

Defaults

The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values:

•1000 Mbps—20000

•100 Mbps—200000

•10 Mbps—2000000

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The value for the instance-id variable was changed.
12.2(25)SEC	The instance-id range changed to1 to 4094.

Usage Guidelines

When you configure the cost, higher values represent higher costs.

Examples

This example shows how to set a path cost of 250 on an interface associated with instances 2 and 4:

Switch(config)# interface fastethernet0/1

Switch(config-if)# spanning-tree mst 2,4 cost 250

You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst interface interface-id	Displays MST information for the specified interface.
spanning-tree mst port-priority	Configures an interface priority.
spanning-tree mst priority	Configures the switch priority for the specified spanning-tree instance.

spanning-tree mst forward-time

Use the spanning-tree mst forward-time global configuration command to set the forward-delay time for all multiple spanning-tree (MST) instances. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. Use the no form of this command to return to the default setting.

spanning-tree mst forward-time seconds

no spanning-tree mst forward-time

Syntax Description

seconds

Length of the listening and learning states. The range is 4 to 30 seconds.

Defaults

The default is 15 seconds.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

Changing the spanning-tree mst forward-time command affects all spanning-tree instances.

Examples

This example shows how to set the spanning-tree forwarding time to 18 seconds for all MST instances:

Switch(config)# spanning-tree mst forward-time 18

You can verify your settings by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst	Displays MST information.
spanning-tree mst hello-time	Sets the interval between hello bridge protocol data units (BPDUs) sent by root switch configuration messages.
spanning-tree mst max-age	Sets the interval between messages that the spanning tree receives from the root switch.
spanning-tree mst max-hops	Sets the number of hops in a region before the BPDU is discarded.

spanning-tree mst hello-time

Use the spanning-tree mst hello-time global configuration command to set the interval between hello bridge protocol data units (BPDUs) sent by root switch configuration messages. Use the no form of this command to return to the default setting.

spanning-tree mst hello-time seconds

no spanning-tree mst hello-time

Syntax Description

seconds

Interval between hello BPDUs sent by root switch configuration messages. The range is 1 to 10 seconds.

Defaults

The default is 2 seconds.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

After you set the spanning-tree mst max-age seconds global configuration command, if a switch does not receive BPDUs from the root switch within the specified interval, the switch recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting.

Changing the spanning-tree mst hello-time command affects all spanning-tree instances.

Examples

This example shows how to set the spanning-tree hello time to 3 seconds for all MST instances:

Switch(config)# spanning-tree mst hello-time 3

You can verify your settings by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst	Displays multiple spanning-tree (MST) information.
spanning-tree mst forward-time	Sets the forward-delay time for all MST instances.
spanning-tree mst max-age	Sets the interval between messages that the spanning tree receives from the root switch.
spanning-tree mst max-hops	Sets the number of hops in a region before the BPDU is discarded.

spanning-tree mst max-age

Use the spanning-tree mst max-age global configuration command to set the interval between messages that the spanning tree receives from the root switch. If a switch does not receive a bridge protocol data unit (BPDU) message from the root switch within this interval, it recomputes the spanning-tree topology. Use the no form of this command to return to the default setting.

spanning-tree mst max-age seconds

no spanning-tree mst max-age

Syntax Description

seconds

Interval between messages the spanning tree receives from the root switch. If a switch does not receive a BPDU message from the root switch within this interval, it recomputes the spanning-tree topology. The range is 6 to 40 seconds.

Defaults

The default is 20 seconds.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

After you set the spanning-tree mst max-age seconds global configuration command, if a switch does not receive BPDUs from the root switch within the specified interval, the switch recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting.

Changing the spanning-tree mst max-age command affects all spanning-tree instances.

Examples

This example shows how to set the spanning-tree max-age to 30 seconds for all MST instances:

Switch(config)# spanning-tree mst max-age 30

You can verify your settings by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst	Displays multiple spanning-tree (MST) information.
spanning-tree mst forward-time	Sets the forward-delay time for all MST instances.
spanning-tree mst hello-time	Sets the interval between hello BPDUs sent by root switch configuration messages.
spanning-tree mst max-hops	Sets the number of hops in a region before the BPDU is discarded.

spanning-tree mst max-hops

Use the spanning-tree mst max-hops global configuration command to set the number of hops in a region before the bridge protocol data unit (BPDU) is discarded and the information held for a port is aged. Use the no form of this command to return to the default setting.

spanning-tree mst max-hops hop-count

no spanning-tree mst max-hops

Syntax Description

hop-count

Number of hops in a region before the BPDU is discarded. The range is 1 to 255 hops.

Defaults

The default is 20 hops.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.2(25)SEC	The hop-count range changed to 1 to 255.

Usage Guidelines

The root switch of the instance always sends a BPDU (or M-record) with a cost of 0 and the hop count set to the maximum value. When a switch receives this BPDU, it decrements the received remaining hop count by one and propagates the decremented count as the remaining hop count in the generated M-records. A switch discards the BPDU and ages the information held for the port when the count reaches 0.

Changing the spanning-tree mst max-hops command affects all spanning-tree instances.

Examples

This example shows how to set the spanning-tree max-hops to 10 for all MST instances:

Switch(config)# spanning-tree mst max-hops 10

You can verify your settings by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst	Displays multiple spanning-tree (MST) information.
spanning-tree mst forward-time	Sets the forward-delay time for all MST instances.
spanning-tree mst hello-time	Sets the interval between hello BPDUs sent by root switch configuration messages.
spanning-tree mst max-age	Sets the interval between messages that the spanning tree receives from the root switch.

spanning-tree mst port-priority

Use the spanning-tree mst port-priority interface configuration command to configure an interface priority. If a loop occurs, the Multiple Spanning Tree Protocol (MSTP) can determine which interface to put in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree mst instance-id port-priority priority

no spanning-tree mst instance-id port-priority

Syntax Description

instance-id	Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 4094.
priority	The range is 0 to 240 in increments of 16. Valid priority values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority.

Defaults

The default is 128.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The values for the instance-id and the priority variables were changed.
12.2(25)SEC	The instance-id range changed to 1 to 4094.

Usage Guidelines

You can assign higher priority values (lower numerical values) to interfaces that you want selected first and lower priority values (higher numerical values) that you want selected last. If all interfaces have the same priority value, the MST puts the interface with the lowest interface number in the forwarding state and blocks other interfaces.

Examples

This example shows how to increase the likelihood that the interface associated with spanning-tree instance 20 is placed into the forwarding state if a loop occurs:

Switch(config)# interface fastethernet0/2

Switch(config-if)# spanning-tree mst 20 port-priority 0

You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst interface interface-id	Displays MST information for the specified interface.
spanning-tree mst cost	Sets the path cost for MST calculations.
spanning-tree mst priority	Sets the switch priority for the specified spanning-tree instance.

spanning-tree mst pre-standard

Use the spanning-tree mst pre-standard interface configuration command to configure a port to send only prestandard bridge protocol data units (BPDUs).

spanning-tree mst pre-standard

no spanning-tree mst pre-standard

Syntax Description

This command has no arguments or keywords.

Command Default

The default state is automatic detection of prestandard neighbors.

Command Modes

Interface configuration

Command History

Release	Modification
12.2(25)SEC	This command was introduced.

Usage Guidelines

Even with this configuration, the port can accept both prestandard and standard BPDUs. In the case of a mismatch with the neighbor type, only the common and internal spanning tree (CIST) runs on this interface.

---

Note If a switch port is connected to a switch running prestandard Cisco IOS software, you must use the spanning-tree mst pre-standard interface configuration command on the port. If you do not configure the port to send only prestandard BPDUs, the Multiple Spanning-Tree Protocol (MSTP) performance might diminish.

---

When the port is configured to automatically detect prestandard neighb ors, the prestandard flag always appears in the show spanning-tree mst commands.

Examples

This example shows how to configure a port to send only prestandard BPDUs:

Switch(config-if)# spanning-tree mst pre-standard

You can verify your settings by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst instance-id	Displays multiple spanning-tree (MST) information, including the prestandard flag, for the specified interface.

spanning-tree mst priority

Use the spanning-tree mst priority global configuration command to set the switch priority for the specified spanning-tree instance. Use the no form of this command to return to the default setting.

spanning-tree mst instance-id priority priority

no spanning-tree mst instance-id priority

Syntax Description

instance-id

Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 4094.

priority

Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that the switch is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch. The range is 0 to 61440 in increments of 4096. Valid priority values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected.

Defaults

The default is 32768.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The value for the instance-id variable was changed.
12.2(25)SEC	The instance-id range changed to 1 to 4094.

Examples

This example shows how to set the spanning-tree priority to 8192 for multiple spanning-tree instance (MST) 20:

Switch(config)# spanning-tree mst 20 priority 8192

You can verify your settings by entering the show spanning-tree mst instance-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst instance-id	Displays MST information for the specified interface.
spanning-tree mst cost	Sets the path cost for MST calculations.
spanning-tree mst port-priority	Configures an interface priority.

spanning-tree mst root

Use the spanning-tree mst root global configuration command to configure the multiple spanning-tree (MST) root switch priority and timers based on the network diameter. Use the no form of this command to return to the default setting.

spanning-tree mst instance-id root {primary | secondary} [diameter net-diameter
[hello-time seconds]]

no spanning-tree mst instance-id root

Syntax Description

instance-id	Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 4094.
root primary	Force this switch to be the root switch.
root secondary	Set this switch to be the root switch should the primary root switch fail.
diameter net-diameter	(Optional) Set the maximum number of switches between any two end stations. The range is 2 to 7. This keyword is available only for MST instance 0.
hello-time seconds	(Optional) Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds. This keyword is available only for MST instance 0.

Defaults

The primary root switch priority is 24576.

The secondary root switch priority is 28672.

The hello time is 2 seconds.

Command Modes

Global configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The value for the instance-id variable was changed.
12.2(25)SEC	The instance-id range changed to 1 to 4094.

Usage Guidelines

Use the spanning-tree mst instance-id root command used only on backbone switches.

When you enter the spanning-tree mst instance-id root command, the software tries to set a high enough priority to make this switch the root of the spanning-tree instance. Because of the extended system ID support, the switch sets the switch priority for the instance to 24576 if this value will cause this switch to become the root for the specified instance. If any root switch for the specified instance has a switch priority lower than 24576, the switch sets its own priority to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.)

When you enter the spanning-tree mst instance-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch fails, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768 and are therefore unlikely to become the root switch).

Examples

This example shows how to configure the switch as the root switch for instance 10 with a network diameter of 4:

Switch(config)# spanning-tree mst 10 root primary diameter 4

This example shows how to configure the switch as the secondary root switch for instance 10 with a network diameter of 4:

Switch(config)# spanning-tree mst 10 root secondary diameter 4 

You can verify your settings by entering the show spanning-tree mst instance-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst instance-id	Displays MST information for the specified instance.
spanning-tree mst forward-time	Sets the forward-delay time for all MST instances.
spanning-tree mst hello-time	Sets the interval between hello BPDUs sent by root switch configuration messages.
spanning-tree mst max-age	Sets the interval between messages that the spanning tree receives from the root switch.
spanning-tree mst max-hops	Sets the number of hops in a region before the BPDU is discarded.

spanning-tree port-priority

Use the spanning-tree port-priority interface configuration command to configure an interface priority. If a loop occurs, spanning tree can determine which interface to put in the forwarding state. Use the no form of this command to return to the default setting.

spanning-tree [vlan vlan-id] port-priority priority

no spanning-tree [vlan vlan-id] port-priority

Syntax Description

vlan vlan-id	(Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094.
priority	The range is 0 to 240 in increments of 16. Valid priority values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority.

Defaults

The default is 128.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(13)EA1	The values for the vlan-id and the priority variables were changed.

Usage Guidelines

If the variable vlan-id is omitted, the command applies to the spanning-tree instance associated with VLAN 1.

You can set the priority on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign the interface to the VLAN.

If you configure an interface with both the spanning-tree vlan vlan-id port-priority priority command and the spanning-tree port-priority priority command, the spanning-tree vlan vlan-id port-priority priority command takes effect. only on the range of VLANs specified by that command. On the VLANs that are not specified by the spanning-tree vlan vlan-id port-priority priority command, the spanning-tree port-priority priority command takes effect.

Examples

This example shows how to increase the likelihood that the interface will be put in the forwarding state if a loop occurs:

Switch(config)# interface fastethernet0/2

Switch(config-if)# spanning-tree vlan 20 port-priority 0

You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree interface interface-id	Displays spanning-tree information for the specified interface.
spanning-tree cost	Sets the path cost for spanning-tree calculations.
spanning-tree vlan priority	Sets the switch priority for the specified spanning-tree instance.

spanning-tree portfast (global configuration)

Use the spanning-tree portfast global configuration command to globally enable bridge protocol data unit (BPDU) filtering on Port Fast-enabled ports, the BPDU guard feature on Port Fast-enabled ports, or the Port Fast feature on all nontrunking ports. The BPDU filtering feature prevents the switch port from sending or receiving BPDUs. The BPDU guard feature puts Port Fast-enabled ports that receive BPDUs in an error-disabled state. Use the no form of this command to return to the default setting.

spanning-tree portfast {bpdufilter default | bpduguard default | default}

no spanning-tree portfast {bpdufilter default | bpduguard default | default}

Syntax Description

bpdufilter default	Globally enable BPDU filtering on Port Fast-enabled ports and prevent the switch port connected to end stations from sending or receiving BPDUs.
bpduguard default	Globally enable the BPDU guard feature on Port Fast-enabled ports and place the ports that receive BPDUs in an error-disabled state.
default	Globally enable the Port Fast feature on all nontrunking ports. When the Port Fast feature is enabled, the port changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes.

Defaults

The BPDU filtering, the BPDU guard, and the Port Fast features are disabled on all ports unless they are individually configured.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The bpdufilter default and default keywords were added.

Usage Guidelines

You can enable these features when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

Use the spanning-tree portfast bpdufilter default global configuration command to globally enable BPDU filtering on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state). The ports still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to switch ports do not receive BPDUs. If a BPDU is received on a Port Fast-enabled port, the port loses its Port Fast-operational status and BPDU filtering is disabled.

You can override the spanning-tree portfast bpdufilter default global configuration command by using the spanning-tree bdpufilter interface configuration command.

---

Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

---

Use the spanning-tree portfast bpduguard default global configuration command to globally enable BPDU guard on ports that are in a Port Fast-operational state. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree.

You can override the spanning-tree portfast bpduguard default global configuration command by using the spanning-tree bdpuguard interface configuration command.

Use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking ports. Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. A Port Fast-enabled port moves directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-delay time.

You can override the spanning-tree portfast default global configuration command by using the spanning-tree portfast interface configuration command. You can use the no spanning-tree portfast default global configuration command to disable Port Fast on all ports unless they are individually configured with the spanning-tree portfast interface configuration command.

Examples

This example shows how to globally enable the BPDU filtering feature:

Switch(config)# spanning-tree portfast bpdufilter default

This example shows how to globally enable the BPDU guard feature:

Switch(config)# spanning-tree portfast bpduguard default

This example shows how to globally enable the Port Fast feature on all nontrunking ports:

Switch(config)# spanning-tree portfast default

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree bpdufilter	Prevents a port from sending or receiving BPDUs.
spanning-tree bpduguard	Puts a port in the error-disabled state when it receives a BPDU.
spanning-tree portfast (interface configuration)	Enables the Port Fast feature on an interface in all its associated VLANs.

spanning-tree portfast (interface configuration)

Use the spanning-tree portfast interface configuration command to enable the Port Fast feature on an interface in all its associated VLANs. When the Port Fast feature is enabled, the interface changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes. Use the no form of this command to return to the default setting.

spanning-tree portfast [disable | trunk]

no spanning-tree portfast

Syntax Description

disable	(Optional) Disable the Port Fast feature on the specified interface.
trunk	(Optional) Enable the Port Fast feature on a trunking interface.

Defaults

The Port Fast feature is disabled on all interfaces; however, it is automatically enabled on dynamic-access ports.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The disable and trunk keywords were added.

Usage Guidelines

Use this feature only on interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation.

To enable Port Fast on trunk ports, you must use the spanning-tree portfast trunk interface configuration command. The spanning-tree portfast command is not supported on trunk ports.

You can enable this feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode.

This feature affects all VLANs on the interface.

A port with the Port Fast feature enabled is moved directly to the spanning-tree forwarding state without waiting the standard forward-time delay.

You can use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking interfaces. However, the spanning-tree portfast interface configuration command can override the global setting.

If you configure the spanning-tree portfast default global configuration command, you can disable Port Fast on an interface that is not a trunk interface by using the spanning-tree portfast disable interface configuration command.

Examples

This example shows how to enable the Port Fast feature on an interface:

Switch(config)# interface fastethernet0/2

Switch(config-if)# spanning-tree portfast

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree bpdufilter	Prevents a port from sending or receiving bridge protocol data units (BPDUs).
spanning-tree bpduguard	Puts a port in the error-disabled state when it receives a BPDU.
spanning-tree portfast (global configuration)	Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.

spanning-tree stack-port

Use the spanning-tree stack-port interface configuration command to enable cross-stack UplinkFast (CSUF) on an interface and to accelerate the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself. Use the no form of this command to return to the default setting.

spanning-tree stack-port

no spanning-tree stack-port

Syntax Description

This command has no arguments or keywords.

Defaults

CSUF is disabled on all interfaces.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

This command is effective only if you enable the UplinkFast feature by using the spanning-tree uplinkfast global configuration command.

Use this command only on access switches.

The CSUF feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+). It is not supported when the switch is running rapid PVST+ or multiple spanning tree (MST).

You can enable CSUF only on one stack-port Gigabit Interface Converter (GBIC) interface. The stack port connects to the GigaStack GBIC multidrop backbone. If you try to enable CSUF on a Fast Ethernet or a copper-based Gigabit Ethernet port, you receive an error message.

If CSUF is already enabled on an interface and you try to enable it on another interface, you receive an error message. You must disable CSUF on the first interface before enabling it on a new interface.

Examples

This example shows how to enable CSUF on the GBIC interface:

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# spanning-tree stack-port 

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.
spanning-tree uplinkfast	Accelerates the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself.

spanning-tree transmit hold-count

Use the spanning-tree transmit hold-count command to configure the number of bridge protocol data units (BPDUs) sent every second. Use the no form of this command to return to the default setting.

spanning-tree transmit hold-count [value]

no spanning-tree transmit hold-count [value]

Syntax Description

Number of BPDUs sent every second. The range is 1 to 20.

Defaults

The default is 6.

Command Modes

Global configuration

Command History

Release	Modification
12.2(25)SEC	This command was introduced

Usage Guidelines

Increasing the transmit hold-count value can have a significant impact on CPU utilization when the switch is in rapid-per-VLAN spanning-tree plus (rapid-PVST+) mode. Decreasing this value might slow down convergence. We recommend using the default setting.

Examples

This example shows how to set the transmit hold count to 8:

Switch(config)# spanning-tree transmit hold-count8

You can verify your setting by entering the show spanning-tree mst privileged EXEC command.

Related Commands

Command	Description
show spanning-tree mst	Displays the multiple spanning-tree (MST) region configuration and status, including the transmit holdcount.

spanning-tree uplinkfast

Use the spanning-tree uplinkfast global configuration command to accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. Use the no form of this command to return to the default setting.

spanning-tree uplinkfast [max-update-rate pkts-per-second]

no spanning-tree uplinkfast [max-update-rate]

Syntax Description

max-update-rate pkts-per-second

(Optional) The number of packets per second at which update packets are sent. The range is 0 to 32000.

Defaults

UplinkFast is disabled.

The update rate is 150 packets per second.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(13)EA1	The range for the pkts-per-second was changed from 0 to 65535 to 0 to 32000.

Usage Guidelines

Use this command only on access switches.

You can configure UplinkFast feature for rapid PVST+ or for multiple spanning-tree (MST) mode, but the feature remains disabled (inactive) until you change the spanning-tree mode to PVST+.

When you enable UplinkFast, it is enabled for the entire switch and cannot be enabled for individual VLANs.

When UplinkFast is enabled, the switch priority of all VLANs is set to 49152. If you change the path cost to a value less than 3000 and you enable UplinkFast or UplinkFast is already enabled, the path cost of all interfaces and VLAN trunks is increased by 3000 (if you change the path cost to 3000 or above, the path cost is not altered). The changes to the switch priority and the path cost reduces the chance that the switch will become the root switch.

When UplinkFast is disabled, the switch priorities of all VLANs and path costs of all interfaces are set to default values if you did not modify them from their defaults.

When spanning tree detects that the root port has failed, UplinkFast immediately switches over to an alternate root port, changing the new root port directly to FORWARDING state. During this time, a topology change notification is sent.

Do not enable the root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state.

If you set the max-update-rate to 0, station-learning frames are not generated, so the spanning-tree topology converges more slowly after a loss of connectivity.

Examples

This example shows how to enable UplinkFast:

Switch(config)# spanning-tree uplinkfast 

You can verify your setting by entering the show spanning-tree summary privileged EXEC command.

Related Commands

Command	Description
show spanning-tree summary	Displays a summary of the spanning-tree port states.
spanning-tree stack-port	Enables cross-stack UplinkFast (CSUF) on an interface and accelerates the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself.
spanning-tree vlan root primary	Forces this switch to be the root switch.

spanning-tree vlan

Use the spanning-tree vlan global configuration command to configure spanning tree on a per-VLAN basis. Use the no form of this command to return to the default setting.

spanning-tree vlan vlan-id {forward-time seconds | hello-time seconds | max-age seconds |
priority priority | {root {primary | secondary} [diameter net-diameter
[hello-time seconds]]}}

no spanning-tree vlan vlan-id [forward-time | hello-time | max-age | priority | root]

Syntax Description

vlan-id	VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094.
forward-time seconds	Set the forward-delay time for the specified spanning-tree instance. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. The range is 4 to 30 seconds.
hello-time seconds	Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds.
max-age seconds	Set the interval between messages the spanning tree receives from the root switch. If a switch does not receive a BPDU message from the root switch within this interval, it recomputes the spanning-tree topology. The range is 6 to 40 seconds.
priority priority	Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that the switch is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch. The range is 0 to 61440 in increments of 4096. Valid priority values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected.
root primary	Force this switch to be the root switch.
root secondary	Set this switch to be the root switch should the primary root switch fail.
diameter net-diameter	Set the maximum number of switches between any two end stations. The range is 2 to 7.

Defaults

Spanning tree is enabled on all VLANs.

The forward-delay time is 15 seconds.

The hello time is 2 seconds.

The max-age is 20 seconds.

The primary root switch priority is 24576.

The secondary root switch priority is 28672.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	The priority priority range changed from 1 to 65535 to 1 to 61440 (in increments of 4096).
12.1(13)EA1	The value for the vlan-id variable was changed.

Usage Guidelines

Disabling the STP causes the VLAN to stop participating in the spanning-tree topology. Interfaces that are administratively down remain down. Received BPDUs are forwarded like other multicast frames. The switch does not detect and prevent loops in a VLAN if STP is disabled for that VLAN.

You can disable the STP on a VLAN that is not currently active and verify the change by using the show running-config or the show spanning-tree vlan vlan-id privileged EXEC command. The setting takes effect when the VLAN is activated.

When disabling or re-enabling the STP, you can specify a range of VLANs that you want to disable or enable.

When the STP is disabled and then enabled, all assigned VLANs continue to be its members. However, all spanning-tree bridge parameters are returned to their previous settings (the last setting before the VLAN was disabled).

You can enable spanning-tree options on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign interfaces to it.

When setting the max-age seconds, if a switch does not receive BPDUs from the root switch within the specified interval, it recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting.

The spanning-tree vlan vlan-id root command should be used only on backbone switches.

When you enter the spanning-tree vlan vlan-id root command, the software checks the switch priority of the current root switch for each VLAN. Because of the extended system ID support, the switch sets the switch priority for the specified VLAN to 24576 if this value will cause this switch to become the root for the specified VLAN. If any root switch for the specified VLAN has a switch priority lower than 24576, the switch sets its own priority for the specified VLAN to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.)

When you enter the spanning-tree vlan vlan-id root primary command, the switch recalculates the forward-time, hello-time, max-age, and priority settings. If you previously configured these parameters, the switch overrides and recalculates them.

When you enter the spanning-tree vlan vlan-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch should fail, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768, and therefore, are unlikely to become the root switch).

Examples

This example shows how to disable the STP on VLAN 5:

Switch(config)# no spanning-tree vlan 5

You can verify your setting by entering the show spanning-tree privileged EXEC command. In this instance, VLAN 5 does not appear in the list.

This example shows how to set the spanning-tree forwarding time to 18 seconds for VLANs 20 and 25:

Switch(config)# spanning-tree vlan 20,25 forward-time 18

This example shows how to set the spanning-tree hello-delay time to 3 seconds for VLANs 20 to 24:

Switch(config)# spanning-tree vlan 20-24 hello-time 3

This example shows how to set spanning-tree max-age to 30 seconds for VLAN 20:

Switch(config)# spanning-tree vlan 20 max-age 30

This example shows how to reset the max-age parameter to the default value for spanning-tree instance 100 and 105 to 108:

Switch(config)# no spanning-tree vlan 100, 105-108 max-age

This example shows how to set the spanning-tree priority to 8192 for VLAN 20:

Switch(config)# spanning-tree vlan 20 priority 8192

This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root primary diameter 4

This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root secondary diameter 4 

You can verify your settings by entering the show spanning-tree vlan vlan-id privileged EXEC command.

Related Commands

Command	Description
show spanning-tree vlan	Displays spanning-tree information.
spanning-tree cost	Sets the path cost for spanning-tree calculations.
spanning-tree guard	Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface.
spanning-tree port-priority	Sets an interface priority.
spanning-tree portfast (global configuration)	Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.
spanning-tree portfast (interface configuration)	Enables the Port Fast feature on an interface in all its associated VLANs.
spanning-tree uplinkfast	Enables the UplinkFast feature, which accelerates the choice of a new root port.

speed

Use the speed interface configuration command to specify the speed of a 10/100 Mbps or 10/100/1000 Mbps port. Use the no or default form of this command to return the port to its default value.

speed {10 | 100 | 1000 | auto [10 | 100 | 1000] | nonegotiate}

no speed

---

Note You cannot configure speed or duplex mode on Gigabit Interface Converter (GBIC) ports, but for certain types of GBICs, you can configure speed to not negotiate (nonegotiate) if they are connected to a device that does not support autonegotiation.

---

Syntax Description

10	Port runs at 10 Mbps.
100	Port runs at 100 Mbps.
1000	Port runs at 1000 Mbps. This option is valid and visible only on Gigabit Ethernet (Tx) ports.
auto	Port automatically detects the speed it should run at based on the port at the other end of the link. If you use the 10, 100, or 1000 keywords with the auto keyword, the port only autonegotiates at the specified speeds.
nonegotiate	Autonegotiation is disabled and the port runs at 1000 Mbps. This option is valid and visible only on 1000BASE-SX, -LX, and -ZX GBIC ports. Gigastack GBICs and 1000BASE-T GBICs do not support disabling of autonegotiation.

Defaults

The default is auto.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(6)EA1	The 1000 and nonegotiate keywords were added.
12.1(22)EA1	Support for the 10, 100, and 1000 keywords with the auto keyword was added.

Usage Guidelines

You can configure Fast Ethernet port speed to either 10 or 100 Mbps. You can configure Gigabit Ethernet port speed to 10, 100, or 1000 Mbps. You cannot configure speed on Gigabit Interface Converter (GBIC) interfaces, but for 1000BASE-SX, -LX, or -ZX GBICs, you can configure speed to not negotiate (nonegotiate) if connected to a device that does not support autonegotiation.

If the speed is set to auto, the switch negotiates with the device at the other end of the link for the speed setting and then forces the speed setting to the negotiated value. The duplex setting remains as configured on each end of the link, which could result in a duplex setting mismatch.

If the speed is set to auto and the 10, 100, or 1000 keywords are also used, the port only autonegotiates at the specified speeds.

If both ends of the line support autonegotiation, we highly recommend the default autonegotiation settings. If one interface supports autonegotiation and the other end does not, configure duplex and speed on the other side; do use the auto setting on the supported side.

If both the speed and duplex are set to specific values, autonegotiation is disabled.

---

Caution Changing the interface speed and duplex mode configuration might shut down and re-enable the interface during the reconfiguration.

---

---

Note For guidelines on setting the switch speed and duplex parameters, see the software configuration guide for this release.

---

Examples

This example shows how to set the specified interface to 100 Mbps:

Switch(config)# interface fastethernet0/1

Switch(config-if)# speed 100

This example shows how to set a port to autonegotiate at only 10 Mbps:

Switch(config)# interface fastethernet0/1

Switch(config-if)# speed auto 10

This example shows how to set a port to autonegotiate at only 10 or 100 Mbps:

Switch(config)# interface fastethernet0/1

Switch(config-if)# speed auto 10 100

You can verify your settings by entering the show interfaces transceiver properties or the show running-config privileged EXEC command.

You can verify your settings by entering the show interfaces privileged EXEC command.

Related Commands

Command	Description
duplex	Specifies the duplex mode of operation for Fast Ethernet and Gigabit Ethernet ports.
show interfaces	Displays the statistical information specific to all interfaces or to a specific interface

storm-control

Use the storm-control interface configuration command to configure broadcast, multicast, or unicast storm control with a specific suppression-level threshold on an interface. Use the no form of this command to return to the default setting.

storm-control {{broadcast | multicast | unicast} level {level [level-low] | pps pps [pps-low]}} | {action {shutdown | trap}}

no storm-control {{broadcast | multicast | unicast} level} | {action {shutdown | trap}}

Syntax Description

broadcast	Enable broadcast storm control on the interface.
multicast	Enable multicast storm control on the interface.
unicast	Enable unicast storm control on the interface.
level level [level-low]	Specify the rising and falling suppression levels as a percentage of total bandwidth of the port. •level—Rising suppression level, up to two decimal places. The range is 0.00 to 100.00. Block the flooding of storm packets when the value specified for level is reached. •level-low—(Optional) Falling suppression level, up to two decimal places. The range is 0.00 to 100.00. This value must be less than or equal to the rising suppression value. If you do not configure a falling suppression level, it is set to the rising suppression level.
level pps pps [pps-low]	Specify the rising and falling suppression levels as a rate in packets per second at which traffic is received on the port. •pps—Rising suppression level, up to 1 decimal place. The range is 0.0 to 10000000000.0. Block the flooding of storm packets when the value specified for pps is reached. •pps-low—(Optional) Falling suppression level, up to 1 decimal place. The range is 0.0 to 10000000000.0. This value must be equal to or less than the rising suppression value. You can use metric suffixes such as k, m, and g for large number thresholds.
action {shutdown | trap}	Action taken when a storm occurs on a port. The default action is to filter traffic and to not send an Simple Network Management Protocol (SNMP) trap. The keywords have these meanings: •shutdown—Disables the port during a storm. •trap—Sends an SNMP trap when a storm occurs.

Defaults

Broadcast, multicast, and unicast storm control are disabled.

The default action is to filter traffic and to not send an SNMP trap.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(8)EA1	This command was introduced. It replaces the switchport broadcast, switchport multicast, and switchport unicast interface configuration commands.
12.1(22)EA1	The level level [.level] option was replaced with the level level [level-low] option. The pps pps pps-low options were added.
12.2(25)SE	The pps-low option was made an optional parameter, and the range was changed. The action {shutdown | trap} keywords were added.

Usage Guidelines

Storm control is supported only on physical interfaces; it is not supported on EtherChannel port channels, even though it is available in the CLI.

The storm-control suppression level can be entered as a percentage of total bandwidth or as a rate in packets per second at which traffic is received.

When specified as a percentage of total bandwidth, a suppression value of 100 percent means that no limit is placed on the specified traffic type. A value of level 0 0 means that all broadcast, multicast, or unicast traffic on that port is blocked. Storm control is enabled only when the rising suppression level is less than 100 percent. If no other storm-control configuration is specified, the default action is to filter the traffic causing the storm and to send no SNMP traps.

---

Note If a multicast storm control suppression level is exceeded on a switch, all traffic (multicast, unicast, and broadcast) is blocked until the multicast traffic rate drops below the threshold. Only spanning-tree packets are passed. If the broadcast or the unicast storm control suppression level is exceeded, only that type of traffic is blocked until the rate drops below the threshold.

---

The trap and shutdown options are independent of each other.

If you configure the action to be taken as shutdown (the port is error-disabled during a storm) when a packet storm is detected, you must use the no shutdown interface configuration command to bring the interface out of this state. If you do not specify the shutdown action, specify the action as trap (the switch generates a trap when a storm is detected).

When a storm occurs and the action is to filter traffic, if the falling suppression level is not specified, the switch blocks all traffic until the traffic rate drops below the rising suppression level. If the falling suppression level is specified, the switch blocks traffic until the traffic rate drops below this level.

---

Note Storm control is supported on physical interfaces. You can also configure storm control on an EtherChannel. When storm control is configured on an EtherChannel, the storm control settings propagate to the EtherChannel physical interfaces.

---

When a broadcast storm occurs and the action is to filter traffic, the switch blocks only broadcast traffic.

For more information, see the software configuration guide for this release.

Examples

This example shows how to enable broadcast storm control with a 75.5-percent rising suppression level:

Switch(config-if)# storm-control broadcast level 75.5

This example shows how to enable unicast storm control on a port with a 87-percent rising suppression level and a 65-percent falling suppression level:

Switch(config-if)# storm-control unicast level 87 65

This example shows how to enable multicast storm control on a port with a 2000-packets-per-second rising suppression level and a 1000-packets-per-second falling suppression level:

Switch(config-if)# storm-control multicast level pps 2k 1k

This example shows how to enable the shutdown action on a port:

Switch(config-if)# storm-control action shutdown

You can verify your settings by entering the show storm-control privileged EXEC command.

Related Commands

Command	Description
show storm-control	Displays broadcast, multicast, or unicast storm-control settings on all interfaces or on a specified interface.

switchcore

Use the switchcore global configuration command to reserve switch resources for high-priority traffic or to give buffer storage more priority than packet retrieval. Use the no form of this command to return to the default setting.

switchcore {resource-allocation priority | wirespeed-store}

no switchcore {resource-allocation priority | wirespeed-store}

Syntax Description

resource-allocation priority	Reserve switch resources for high-priority traffic. Lower-priority traffic is likely to be rejected during times of congestion.
wirespeed-store	Reserve bandwidth for buffer storage to accommodate broadcast and multicast storms.

Defaults

When quality of service (QoS) is disabled, both the resource-allocation priority and the wirespeed-store options are disabled.

When QoS is enabled, resource-allocation priority is enabled, and wirespeed store is disabled.

Use the resource-allocation priority keywords when you want to reserve some switch buffers for high-priority traffic. Use the wirespeed-store keywords when you want to allocate more switch bandwidth to frame storage than to frame retrieval; this is only needed when you expect lots of broadcast and multicast traffic on the switch, and you want frame retrieval to be the dominant operation.

Command Modes

Global configuration

Command History

Release	Modification
12.1(6)EA1	This command was introduced.

Usage Guidelines

You must globally enable QoS by using the mls qos global configuration command before the switchcore global configuration command takes effect.

Examples

This example shows how to disable resource-allocation priority:

Switch(config)# no switchcore resource-allocation priority

This example shows how to enable QoS and enable the wirespeed-store:

Switch(config)# mls qos

Switch(config)# switchcore wirespeed-store

You can verify your settings by entering the show controllers switch {resource-allocation priority | wirespeed-store} privileged EXEC command.

Related Commands

Command	Description
show controllers switch resource-allocation priority show controllers switch wirespeed-store	Displays the setting of the resource-allocation priority feature or the wirespeed-store.

switchport

Use the switchport interface configuration command with no keywords to put an interface that is in Layer 3 mode into Layer 2 mode for Layer 2 configuration. Use the no form of this command to put an interface in Layer 3 mode.

switchport

no switchport

Use the no switchport command (without parameters) to set the interface to the routed-interface status and to erase all Layer 2 configurations. You must use this command before assigning an IP address to a routed port.

---

Note If an interface is to be configured as a Layer 3 interface, you must first enter the switchport command with no keywords to configure the interface as a Layer 2 port. Then you can enter additional switchport commands with keywords.

---

Syntax Description

This command has no arguments or keywords.

Defaults

By default, all interfaces are in Layer 2 mode.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

Entering the no switchport command shuts the port down and then re-enables it, which might generate messages on the device to which the port is connected.

Examples

This example shows how to cause an interface to cease operating as a Layer 2 port and become a Cisco-routed port:

Switch(config-if)# no switchport

This example shows how to cause the port interface to cease operating as a Cisco-routed port and convert to a Layer 2-switched interface:

Switch(config-if)# switchport

---

Note The switchport command without keywords is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces.

---

You can verify the switchport status of an interface by entering the show running-config privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
show running-config	Displays the current operating configuration. For syntax information, select Cisco IOS Release 12.2 Configuration Guides and Command References > Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 > File Management Commands > Configuration File Management Commands.

switchport access

Use the switchport access interface configuration command to configure a port as a static-access or dynamic-access port. If the mode is set to access, the port operates as a member of the configured VLAN. If set to dynamic, the port starts discovery of VLAN assignment based on the incoming packets it receives. Use the no form of this command to reset the access mode to the default VLAN for the switch.

switchport access vlan {vlan-id | dynamic}

no switchport access vlan

Syntax Description

vlan vlan-id

Configure the interface as a static access port with the VLAN ID of the access mode VLAN; the range is 1 to 4094.

vlan dynamic

Specify that the access mode VLAN is dependent on the VLAN Membership Policy Server (VMPS) protocol. The port is assigned to a VLAN based on the source MAC address of a host (or hosts) connected to the port. The switch sends every new MAC address received to the VMPS server to obtain the VLAN name to which the dynamic-access port should be assigned. If the port already has a VLAN assigned and the source has already been approved by the VMPS, the switch forwards the packet to the VLAN.

Defaults

The default access VLAN and trunk interface native VLAN is a default VLAN corresponding to the platform or interface hardware.

A dynamic-access port is initially a member of no VLAN and receives its assignment based on the packet it receives.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The no switchport access command resets the access mode VLAN to the appropriate default VLAN for the device.

The port must be in access mode before the switchport access vlan command can take effect.

An access port can be assigned to only one VLAN.

The VMPS server (such as a Catalyst 6000 series switch) must be configured before a port is configured as dynamic.

These restrictions apply to dynamic-access ports:

•The software implements the VLAN Query Protocol (VQP) client, which can query a VMPS such as a Catalyst 6000 series switch. The Catalyst 3550 switches are not VMPS servers. The VMPS server must be configured before a port is configured as dynamic.

•Use dynamic-access ports only to connect end stations. Connecting them to switches or routers (that use bridging protocols) can cause a loss of connectivity.

•Configure the network so that STP does not put the dynamic-access port into an STP blocking state. The Port Fast feature is automatically enabled on dynamic-access ports.

•Dynamic-access ports can only be in one VLAN and do not use VLAN tagging.

•Dynamic-access ports cannot be configured as

–Members of an EtherChannel port group (dynamic-access ports cannot be grouped with any other port, including other dynamic ports).

–Source or destination ports in a static address entry.

–Monitor ports.

–Tunnel ports.

Examples

This example shows how to cause a port interface that has already been configured as a switched interface to operate in VLAN 2 instead of the platform's default VLAN when in access mode:

Switch(config-if)# switchport access vlan 2

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
switchport mode	Configures the VLAN membership mode of a port.

switchport backup interface

Use the switchport backup interface interface configuration command on a Layer 2 interface to configure Flex Links, a pair of interfaces that provide backup to each other. Use the no form of this command to remove the Flex Links configuration.

switchport backup interface {interface-id} mmu primary vlan vlan-id

switchport backup interface {interface-id} preemption [forced | bandwidth | off] | [delay delay-time]

no switchport backup interface {interface-id} mmu primary vlan vlan-id

no switchport backup interface {interface-id} preemption [forced | bandwidth | off] | [delay]

Syntax Description

interface-id	Specify the Layer 2 interface to act as a backup link to the interface being configured. The interface can be a physical interface or port channel. The port-channel range is 1 to 48.
mmu	Specifies configuring the mac move update (MMU) for a backup interface pair.
primary vlan vlan-id	The VLAN ID of the private-VLAN primary VLAN; valid range is 1 to 4094.
preemption	Specifies configuring a preemption scheme for a backup interface pair.
forced	(Optional) Specifies the interface always preempts the backup.
bandwidth	(Optional) Specifies the interface with the higher available bandwidth always preempts the backup.
off	(Optional) Specifies no preemption occurs from backup to active.
delay delay-time	(Optional) Specifies a preemption delay; valid values are 1 to 300 seconds.

---

Note Though visible in the command-line help, VLAN interfaces are not supported.

---

Defaults

The default is to have no Flex Links defined.

Preemption mode is off. No preemption occurs.

Preemption delay is set to 35 seconds.

Command Modes

Interface configuration

Command History

Release	Modification
12.2(25)SEE	This command was introduced.

Usage Guidelines

With Flex Links configured, one link acts as the primary interface and forwards traffic, while the other interface is in standby mode, ready to begin forwarding traffic if the primary link shuts down. The interface being configured is referred to as the active link; the specified interface is identified as the backup link. The feature provides an alternative to the Spanning Tree Protocol (STP), allowing users to turn off STP and still retain basic link redundancy.

•This command is available only for Layer 2 interfaces.

•You can configure only one Flex Link backup link for any active link, and it must be a different interface from the active interface.

•An interface can belong to only one Flex Link pair. An interface can be a backup link for only one active link. An active link cannot belong to another Flex Link pair.

•A backup link does not have to be the same type (Fast Ethernet or Gigabit Ethernet, for instance) as the active link. However, you should configure both Flex Links with similar characteristics so that there are no loops or changes in behavior if the standby link takes over traffic forwarding.

•Neither of the links can be a port that belongs to an EtherChannel. However, you can configure two port channels (EtherChannel logical interfaces) as Flex Links, and you can configure a port channel and a physical interface as Flex Links, with either the port channel or the physical interface as the primary link.

•If STP is configured on the switch, Flex Links do not participate in STP in all valid VLANs. If STP is not running, be sure that there are no loops in the configured topology.

Examples

This example shows how to configure two interfaces as Flex Links:

Switch# configure terminal 

Switch(conf)# interface fastethernet1/0/1

Switch(conf-if)# switchport backup interface fastethernet1/0/2

Switch(conf-if)# end

This example shows how to configure the Fast Ethernet interface to always preempt the backup:

Switch# configure terminal 

Switch(conf)# interface fastethernet1/0/1

Switch(conf-if)# switchport backup interface fastethernet1/0/2 preemption forced

Switch(conf-if)# end

This example shows how to configure the Fast Ethernet interface preemption delay time:

Switch# configure terminal 

Switch(conf)# interface fastethernet1/0/1

Switch(conf-if)# switchport backup interface fastethernet1/0/2 preemption delay 150

Switch(conf-if)# end

This example shows how to configure the Fast Ethernet interface as the MMU primary VLAN:

Switch# configure terminal 

Switch(conf)# interface fastethernet1/0/1

Switch(conf-if)# switchport backup interface fastethernet1/0/2 mmu primary vlan 1021

Switch(conf-if)# end

You can verify your setting by entering the show interfaces switchport backup privileged EXEC command.

Related Commands

Command	Description
show interfaces [interface-id] switchport backup	Displays the configured Flex Links and their status on the switch or for the specified interface.

switchport block

Use the switchport block interface configuration command to prevent unknown multicast or unicast packets from being forwarded. Use the no form of this command to return to the default setting.

switchport block {multicast | unicast}

no switchport block {multicast | unicast}

Syntax Description

multicast	Specify that unknown multicast traffic should be blocked.
unicast	Specify that unknown unicast traffic should be blocked.

Defaults

Unknown multicast and unicast traffic are not blocked.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

By default, all traffic with unknown MAC addresses is sent to all ports. You can block unknown multicast or unicast traffic on protected or non-protected ports. If unknown multicast or unicast traffic is not blocked on a protected port, there could be security issues.

Blocking unknown multicast or unicast traffic is not automatically enabled on protected ports; you must explicitly configure it.

---

Note For more information about blocking packets, see the software configuration guide for this release.

---

Examples

This example shows how to block unknown multicast traffic on an interface:

Switch(config-if)# switchport block multicast

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.

switchport broadcast

This is an obsolete command.

In past releases, the switchport broadcast interface configuration command was used to set the broadcast suppression level on the interface. This command is replaced by the storm-control broadcast interface configuration command.

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	This command was replaced by the storm-control command.

Related Commands

Command	Description
show storm-control broadcast	Displays broadcast suppression settings on an interface or on all interfaces.
storm-control	Sets broadcast, multicast, or unicast storm control on an interface with the specified threshold level.
switchport multicast	Obsolete command. Replaced by the storm-control multicast interface configuration command.
switchport unicast	Obsolete command. Replaced by the storm-control unicast interface configuration command.

switchport host

Use the switchport host interface configuration command on the switch to optimize a Layer 2 port for a host connection. The no form of this command has no affect on the system.

switchport host

Syntax Description

This command has no arguments or keywords.

Defaults

The default is for the port to not be optimized for a host connection.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(20)EA1	This command was introduced.

Usage Guidelines

To optimize the port for a host connection, the switchport host command sets the switch port mode to access, enables spanning tree Port Fast, and disables channel grouping. Only an end station can accept this configuration.

Because spanning tree Port Fast is enabled, you should enter the switchport host command only on ports that are connected to a single host. Connecting other switches, hubs, concentrators, or bridges to a fast-start port can cause temporary spanning-tree loops.

Enable the switchport host command to decrease the time to start packet forwarding.

The no switchport host command has no affect. To return an interface to a configuration not optimized as a host connection, you can manually reconfigure switchport mode, spanning-tree Port Fast, and channel grouping. You can also use the default interface interface-id global config command to return the interface to its default state. However, this command also returns other interface configuration to the default.

Examples

This example shows how to optimize the port configuration for a host connection:

Switch(config-if)# switchport host 

switchport mode will be set to access 

spanning-tree portfast will be enabled 

channel group will be disabled 

Switch(config-if)# 

You can verify the effects of the command by entering the show interfaces interface-id switchport or show running-config interface interface-id privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including switchport mode.
show running-config interface interface-id	Displays the running configuration on the interface.

switchport mode

Use the switchport mode interface configuration command to configure the VLAN membership mode of a port. Use the no form of this command to reset the mode to the appropriate default for the device.

switchport mode {access | dot1q-tunnel | dynamic {auto | desirable} | trunk}

no switchport mode {access| dot1q-tunnel | dynamic {auto | desirable} | trunk}

Syntax Description

access	Set the port to access mode (either static-access or dynamic-access depending on the setting of the switchport access vlan interface configuration command). The port is set to access unconditionally and operates as a nontrunking, single VLAN interface that sends and receives nonencapsulated (non-tagged) frames. An access port can be assigned to only one VLAN.
dot1q-tunnel	Set the port as an IEEE 802.1Q tunnel port.
dynamic auto	Set the interface trunking mode dynamic parameter to auto to specify that the interface convert the link to a trunk link.
dynamic desirable	Set the interface trunking mode dynamic parameter to desirable to specify that the interface actively attempt to convert the link to a trunk link.
trunk	Set the port to trunk unconditionally. The port is a trunking VLAN Layer 2 interface. The port sends and receives encapsulated (tagged) frames that identify the VLAN of origination. A trunk is a point-to-point link between two switches or between a switch and a router.

Defaults

The default mode is dynamic desirable.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(9)EA1	The dot1q-tunnel keyword was added.

Usage Guidelines

A configuration that uses the access, trunk, or dot1q-tunnel keywords takes effect only when you configure the port in the appropriate mode by using the switchport mode command. The static-access and trunk configuration are saved, but only one configuration is active at a time.

When you enter access mode, the interface changes to permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not agree to the change.

When you enter trunk mode, the interface changes to permanent trunking mode and negotiates to convert the link into a trunk link even if the interface connecting to it does not agree to the change.

When you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode.

When you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

To autonegotiate trunking, the interfaces must be in the same VTP domain. Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a point-to-point protocol. However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations. To avoid this, you should configure interfaces connected to devices that do not support DTP to not forward DTP frames, which turns off DTP.

•If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

•To enable trunking to a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

•With GigaStack GBICs, dynamic trunking is only supported when two switches are connected by a single GigaStack GBIC link. If trunking is required when more than two switches in a stack are connected by GigaStack GBIC links, you must manually configure trunking in this manner:

–Manually shut down the GigaStack port by using the shutdown interface configuration command.

–Manually configure trunk mode on the GigaStack port by using the switchport mode trunk interface configuration command on both GBIC interfaces to cause the interfaces to become trunks.

–Use the no shutdown interface configuration command to bring up the GigaStack port.

When you enter dot1q-tunnel, the port is set unconditionally as an IEEE 802.1Q tunnel port.

Access port, trunk ports, and tunnel ports are mutually exclusive.

Any IEEE 802.1Q encapsulated IP packets received on a tunnel port can be filtered by MAC ACLs, but not by IP ACLs. This is because the switch does not recognize the protocol inside the IEEE 802.1Q header. This restriction applies to router ACLs, port ACLs and VLAN maps.

The IEEE 802.1x authentication feature interacts with switchport modes in these ways:

•If you try to enable IEEE 802.1x authentication on a trunk port, an error message appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to trunk, the port mode is not changed.

•If you try to enable IEEE 802.1x authentication on a dynamic port, an error message appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to dynamic, the port mode is not changed.

•If you try to enable IEEE 802.1x authentication on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and IEEE 802.1x authentication is not enabled. If you try to change an IEEE 802.1x-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is not changed.

Configuring a port as an IEEE 802IEEE 802.1Q tunnel port has these limitations:

•IP routing and fallback bridging are not supported on tunnel ports.

•Tunnel ports do not support IP access control lists (ACLs).

•If an IP ACL is applied to a trunk port in a VLAN that includes tunnel ports, or if a VLAN map is applied to a VLAN that includes tunnel ports, packets received from the tunnel port are treated as non-IP packets and filtered with MAC access lists.

•Layer 3 QoS ACLs and other QoS features related to Layer 3 information are not supported on tunnel ports.

---

Note For more information about configuring IEEE 802.1Q tunnel ports, see the software configuration guide for this release.

---

Examples

This example shows how to configure a port for access mode:

Switch(config-if)# switchport mode access

This example shows how set the interface to dynamic desirable mode:

Switch(config-if)# switchport mode dynamic desirable

This example shows how to configure a port for trunk mode:

Switch(config-if)# switchport mode trunk

This example shows how to configure a port for as an IEEE 802.1Q tunnel port:

Switch(config-if)# switchport mode dot1q-tunnel 

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows.

Related Commands

Command	Description
show dot1q-tunnel	Displays information about IEEE 802.1Q tunnel ports on the switch.
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
switchport access	Configures a port as a static-access or dynamic-access port.
switchport trunk	Configures the trunk characteristics when an interface is in trunking mode.

switchport multicast

This is an obsolete command.

In past releases, the switchport multicast interface configuration command was used to set the multicast suppression level on the interface. This command is replaced by the storm-control multicast interface configuration command.

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	This command was replaced by the storm-control command.

Related Commands

Command	Description
show storm-control multicast	Displays multicast suppression settings on an interface or on all interfaces.
storm-control	Sets broadcast, multicast, or unicast storm control on an interface with the specified threshold level.
switchport broadcast	Obsolete command. Replaced by the storm-control broadcast interface configuration command.
switchport unicast	Obsolete command. Replaced by the storm-control unicast interface configuration command.

switchport nonegotiate

Use the switchport nonegotiate interface configuration command to specify that Dynamic Trunking Protocol (DTP) negotiation packets are not sent on the Layer 2 interface. The switch does not engage in DTP negotiation on this interface. Use the no form of this command to return to the default setting.

switchport nonegotiate

no switchport nonegotiate

Syntax Description

This command has no arguments or keywords.

Defaults

The default is to use DTP negotiation to determine trunking status.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The no form of the switchport nonegotiate command removes nonegotiate status.

This command is valid only when the interface switchport mode is access or trunk (configured by using the switchport mode access or the switchport mode trunk interface configuration command). This command returns an error if you attempt to execute it in dynamic (auto or desirable) mode.

Internetworking devices that do not support DTP might forward DTP frames improperly and cause misconfigurations. To avoid this, you should turn off DTP by using the switchport no negotiate command to configure the interfaces connected to devices that do not support DTP to not forward DTP frames.

When you enter the switchport nonegotiate command, DTP negotiation packets are not sent on the interface. The device does or does not trunk according to the mode parameter: access or trunk.

•If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

•To enable trunking on a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

Examples

This example shows how to cause a port interface to refrain from negotiating trunking mode and to act as a trunk or access port (depending on the mode set):

Switch(config-if)# switchport nonegotiate

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
switchport mode	Configures the VLAN membership mode of a port.

switchport port-security

Use the switchport port-security interface configuration command without keywords to enable port security on the interface. Use the keywords to configure secure MAC addresses, sticky MAC address learning, a maximum number of secure MAC addresses, or the violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.

switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] | mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan {vlan-list | {access | voice}}]]

no switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] | mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan {vlan-list | {access | voice}}]]

switchport port-security [aging] [violation {protect | restrict | shutdown}]

no switchport port-security [aging] [violation {protect | restrict | shutdown}]

Syntax Description

aging	(Optional) See the switchport port-security aging command.
mac-address mac-address	(Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured.
vlan vlan-id	(Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used.
vlan access	(Optional) On an access port, specify the VLAN as an access VLAN.
vlan voice	(Optional) On an access port, specify the VLAN as a voice VLAN. Note The voice keyword is available only if voice VLAN is configured on a port and if that port is not the access VLAN.
mac-address sticky [mac-address]	(Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses. (Optional) Enter a mac-address to specify a sticky secure MAC address.
maximum value	(Optional) The maximum number of available addresses is determined by the active Switch Database Management (SDM) template. The default is 1.
vlan [vlan-list]	(Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. •vlan—set a per-VLAN maximum value. •vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used.
violation	(Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.
protect	Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit.
restrict	Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments.
shutdown	Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Port security is disabled.

When port security is enabled and no keywords are entered, the default maximum number of secure MAC addresses is 1.

Sticky learning is disabled.

The default violation mode is shutdown.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(8)EA1	This command was introduced.
12.1(11)EA1	The mac-address sticky [mac-address] option was added.
12.1(14)EA1	The vlan vlan-id and vlan vlan-list keywords were added.
12.2(25)SEB	The access and voice keywords were added.

Usage Guidelines

A secure port has these limitations:

•A secure port can be an access port or a trunk port; it cannot be a dynamic access port.

•A secure port cannot be a routed port.

•A secure port cannot be a protected port.

•A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

•A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.

•When you enable port security on an interface that is also configured with a voice VLAN, set the maximum allowed secure addresses on the port to two. When the port is connected to a Cisco IP phone, the Cisco IP phone requires up to two MAC addresses. The Cisco IP phone address is learned on the voice VLAN, but is not learned on the access VLAN. If you connect a single PC to the Cisco IP phone, no additional MAC addresses are required. If you connect more than one PC to the Cisco IP phone, you must configure enough secure addresses to allow one for each PC and one for the phone.

•Voice VLAN is supported only on access ports and not on trunk ports.

•When you enter a maximum secure address value for an interface, if the new value is greater than the previous value, the new value overrides the previously configured value. If the new value is less than the previous value and the number of configured secure addresses on the interface exceeds the new value, the command is rejected.

•The switch does not support port security aging of sticky secure MAC addresses.

A security violation occurs when the maximum number of secure MAC addresses are in the address table and a station whose MAC address is not in the address table attempts to access the interface or when a station whose MAC address is configured as a secure MAC address on another secure port attempts to access the interface.

When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.

Setting a maximum number of addresses to one and configuring the MAC address of an attached device ensures that the device has the full bandwidth of the port.

When you enter a maximum secure address value for an interface, this occurs:

•If the new value is greater than the previous value, the new value overrides the previously configured value.

•If the new value is less than the previous value and the number of configured secure addresses on the interface exceeds the new value, the command is rejected.

Sticky secure MAC addresses have these characteristics:

•When you enable sticky learning on an interface by using the switchport port-security mac-address sticky interface configuration command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses and adds all sticky secure MAC addresses to the running configuration.

•If you disable sticky learning by using the no switchport port-security mac-address sticky interface configuration command, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration. If you remove the sticky MAC addresses from the running configuration, the sticky secure MAC addresses are removed from the running configuration and the address table.

•When you configure sticky secure MAC addresses by using the switchport port-security mac-address sticky mac-address interface configuration command, these addresses are added to the address table and the running configuration. If port security is disabled, the sticky secure MAC addresses remain in the running configuration.

•If you save the sticky secure MAC addresses in the configuration file, when the switch restarts or the interface shuts down, the interface does not need to relearn these addresses. If you do not save the sticky secure addresses, they are lost. If sticky learning is disabled, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration.

•If you disable sticky learning and enter the switchport port-security mac-address sticky mac-address interface configuration command, an error message appears, and the sticky secure MAC address is not added to the running configuration.

Examples

This example shows how to enable port security on a port and to set the maximum number of secure addresses to 5. The violation mode is the default, and no secure MAC addresses are configured.

Switch(config)# interface fastethernet0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport port-security

Switch(config-if)# switchport port-security maximum 5

This example shows how to configure a secure MAC address on a port:

Switch(config)# interface fastethernet0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport port-security

Switch(config-if)# switchport port-security mac-address 1000.2000.3000

This example shows how to enable sticky learning:

Switch(config-if)# switchport port-security mac-address sticky 

This example shows how to configure a secure MAC address on a trunk port:

Switch(config)# interface fastethernet0/1

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport port-security

Switch(config-if)# switchport port-security mac-address 1000.2000.3000 vlan 9

This example shows how to configure a maximum of 5 secure MAC addresses on VLAN 9:

Switch(config)# interface fastethernet0/1

Switch(config-if)# switchport port-security maximum 5 vlan 9

You can verify the settings for all secure ports or the specified port by using the show port-security privileged EXEC command.

Related Commands

Command	Description
clear port-security	Deletes from the MAC address table a specific secure address or all the secure addresses on an interface.

switchport port-security aging

Use the switchport port-security aging interface configuration command to set the aging time and type for secure address entries or to change the aging behavior for statically configured secure addresses on a particular port. Use the no form of this command to return to the default settings.

switchport port-security aging {static | time time | type {absolute | inactivity}}

no switchport port-security aging {static | time | type}

Syntax Description

static	Enable aging for statically configured secure addresses on this port.
time time	Specify the aging time for this port. The range is 0 to 1440 minutes. If the time is 0, aging is disabled for this port.
type absolute	Set the aging type as absolute aging. All the secure addresses on this port age out after the time (minutes) specified and are removed from the secure address list.
type inactivity	Set the aging type as inactivity aging. The secure addresses on this port age out only if there is no data traffic from the secure source address for the specified time period.

Defaults

The port security aging feature is disabled. The default time is 0 minutes.

The default aging type is absolute.

The default static aging behavior is disabled.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

To enable secure address aging for a particular port, set the aging time to a value other than 0 for that port.

To allow limited-time access to specific secure MAC addresses, set the aging type as absolute. When the aging time lapses, the secure addresses are deleted. When the device sends traffic again, the deleted secure addresses are relearned.

---

Note The absolute aging time could vary by 1 minute, depending on the sequence of the system timer.

---

To allow continuous access to a limited number of secure addresses, set the aging type as inactivity. This removes the secure address when it become inactive, and other addresses can become secure.

To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command.

Examples

This example sets the aging time as 2 hours for absolute aging for all the secure addresses on a port:

Switch(config)# interface fastethernet0/1

Switch(config-if)# switchport port-security aging time 120

This example sets the aging time as 2 minutes for inactivity aging type with aging enabled for configured secure addresses on a port:

Switch(config)# interface fastethernet0/2

Switch(config-if)# switchport port-security aging time 2 

Switch(config-if)# switchport port-security aging type inactivity 

Switch(config-if)# switchport port-security aging static

This example shows how to disable aging for configured secure addresses:

Switch(config-if)# no switchport port-security aging static

Related Commands

Command	Description
show port-security	Displays the port security settings defined for the port.
switchport port-security	Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.

switchport priority extend

Use the switchport priority extend interface configuration command to set a port priority for the incoming untagged frames or the priority of frames received by the IP phone connected to the specified port. Use the no form of this command to return to the default setting.

switchport priority extend {cos value | trust}

no switchport priority extend

Syntax Description

cos value	Set the IP phone port to override the priority received from the PC or the attached device. The class of service (CoS) value is a number from 0 to 7. Seven is the highest priority. The default is 0.
trust	Set the IP phone port to trust the priority received from the PC or the attached device.

Defaults

The port priority is not set, and the default value for untagged frames received on the port is 0.

The IP phone connected to the port is set to not trust the priority of incoming traffic and overrides the priority with the CoS value of 0.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.
12.1(13)EA1	The none keyword was removed and was replaced by the trust keyword.

Usage Guidelines

In Cisco IOS Release 12.1(13)EA1 or later, the trust keyword replaces the none keyword. To instruct the IP Phone to not trust the priority, you can use the no switchport priority extend or the switchport priority extend cos 0 interface configuration command. In software releases earlier than Cisco IOS Release 12.1(13)EA1, use the switchport priority extend none interface configuration command.

Examples

This example shows how to configure the IP phone connected to the specified port to trust the received IEEE 802.1p priority:

Switch(config-if)# switchport priority extend trust

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces	Displays the administrative and operational status of a switching (nonrouting) port.
switchport voice vlan	Configures the voice VLAN on the port.

switchport protected

Use the switchport protected interface configuration command to isolate unicast, multicast, and broadcast traffic at Layer 2 from other protected ports on the same switch. Use the no form of this command to return to the default setting.

switchport protected

no switchport protected

Syntax Description

This command has no arguments or keywords.

Defaults

No protected port is defined. All ports are nonprotected.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

The switchport protection feature is local to the switch; communication between protected ports on the same switch is possible only through a Layer 3 device. To prevent communication between protected ports on different switches, you must configure the protected ports for unique VLANs on each switch and configure a trunk link between the switches. A protected port is different from a secure port.

A protected port does not forward any unicast, multicast, or broadcast traffic to any other protected port. A protected port continues to forward unicast, multicast, and broadcast traffic to unprotected ports and vice versa.

Port monitoring does not work if both the monitor and monitored ports are protected ports.

Protected ports are supported on IEEE 802.1Q trunks.

Examples

This example shows how to enable a protected port on an interface:

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# switchport protected

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
switchport block	Prevents unknown multicast or unicast traffic on the interface.

switchport trunk

Use the switchport trunk interface configuration command to set the trunk characteristics when the interface is in trunking mode. Use the no form of this command to reset a trunking characteristic to the default.

switchport trunk {allowed vlan vlan-list} | {encapsulation {dot1q | isl | negotiate}} |
{native vlan vlan-id} | {pruning vlan vlan-list}

no switchport trunk {allowed vlan vlan-list} | {encapsulation {dot1q | isl | negotiate}} |
{native vlan vlan-id} | {pruning vlan vlan-list}

Syntax Description

allowed vlan vlan-list	Set the list of allowed VLANs that can receive and send traffic on this interface in tagged format when in trunking mode. See the following vlan-list format. The none keyword is not valid. The default is all.
encapsulation dot1q	Set the encapsulation format on the trunk port to IEEE 802.1Q. With this format, the switch supports simultaneous tagged and untagged traffic on a port.
encapsulation isl	Set the encapsulation format on the trunk port to Inter-Switch Link (ISL). The switch encapsulates all received and sent packets with an ISL header and filters native frames received from an ISL trunk port.
encapsulation negotiate	Specify that if Dynamic Inter-Switch Link (DISL) and Dynamic Trunking Protocol (DTP) negotiation do not resolve the encapsulation format, ISL is the selected format.
native vlan vlan-id	Set the native VLAN for sending and receiving untagged traffic when the interface is in IEEE 802.1Q trunking mode. The range is 1 to 4094.
pruning vlan vlan-list	Set the list of VLANs that are eligible for VTP pruning when in trunking mode. The all keyword is not valid.

The vlan-list format is all | none | [add | remove | except] vlan-atom [,vlan-atom...] where:

•all specifies all VLANs from 1 to 4094. This keyword is not allowed on commands that do not permit all VLANs in the list to be set at the same time.

•none means an empty list. This keyword is not allowed on commands that require certain VLANs to be set or at least one VLAN to be set.

•add adds the defined list of VLANs to those currently set instead of replacing the list. The range is 1 to 1005; extended-range VLANs (VLAN IDs greater than 1005) are valid in some cases.

---

Note You can add extended-range VLANs to the allowed VLAN list, but not to the pruning-eligible VLAN list.

---

Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs.remove removes the defined list of VLANs from those currently set instead of replacing the list. The range is 1 to 1005; extended-range VLAN IDs are valid in some cases.

---

Note You can remove extended-range VLANs from the allowed VLAN list, but you cannot remove them from the pruning-eligible list.

---

Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs.

•except lists the VLANs that should be calculated by inverting the defined list of VLANs. (VLANs are added except the ones specified.) The range is 1 to 1005. Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs.

•vlan-atom is either a single VLAN number from 1 to 4094 or a continuous range of VLANs described by two VLAN numbers, the lesser one first, separated by a hyphen.

Defaults

The default encapsulation is negotiate.

VLAN 1 is the default native VLAN ID on the port.

The default for all VLAN lists is to include all VLANs.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(14)EA1	The allowed vlan vlan-list add, remove and except keywords were modified to accept the VLAN 1 and VLANs 1002 to 1005 values.

Usage Guidelines

Encapsulation:

•The switchport trunk encapsulation command is supported only for platforms and interface hardware that can support both ISL and IEEE 802.1Q formats.

•You cannot configure one end of the trunk as an IEEE 802.1Q trunk and the other end as an ISL or nontrunk port. However, you can configure one port as an ISL trunk and a different port on the same switch as an IEEE 802.1Q trunk.

•If you enter the negotiate keywords and DTP negotiation does not resolve the encapsulation format, ISL is the selected format. The no form of the command resets the trunk encapsulation format to the default.

•The no form of the encapsulation command resets the encapsulation format to the default.

Native VLANs:

•All untagged traffic received on an IEEE 802.1Q trunk port is forwarded with the native VLAN configured for the port.

•If a packet has a VLAN ID that is the same as the sending-port native VLAN ID, the packet is sent without a tag; otherwise, the switch sends the packet with a tag.

•The no form of the native vlan command resets the native mode VLAN to the appropriate default VLAN for the device.

Allowed VLAN:

•To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. This is known as VLAN 1 minimization. VLAN 1 minimization disables VLAN 1 (the default VLAN on all Cisco switch trunk ports) on an individual VLAN trunk link. As a result, no user traffic, including spanning-tree advertisements, is sent or received on VLAN 1.

When you remove VLAN 1 from a trunk port, the interface continues to send and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), Dynamic Trunking Protocol (DTP), and VLAN Trunking Protocol (VTP) in VLAN 1.

•The no form of the allowed vlan command resets the list to the default list, which allows all VLANs.

Trunk pruning:

•The pruning-eligible list applies only to trunk ports.

•Each trunk port has its own eligibility list.

•If you do not want a VLAN to be pruned, remove it from the pruning-eligible list. VLANs that are pruning-ineligible receive flooded traffic.

•VLAN 1, VLANs 1002 to 1005, and extended-range VLANs (VLANs 1006 to 4094) cannot be pruned.

Examples

This example shows how to cause a port interface configured as a switched interface to encapsulate in IEEE 802.1Q trunking format regardless of its default trunking format in trunking mode:

Switch(config-if)# switchport trunk encapsulation dot1q

This example shows how to configure VLAN 3 as the default port to send all untagged traffic:

Switch(config-if)# switchport trunk native vlan 3

This example shows how to add VLANs 1, 2, 5, and 6 to the allowed list:

Switch(config-if)# switchport trunk allowed vlan add 1,2,5,6

This example shows how to remove VLANs 3 and 10 to 15 from the pruning-eligible list:

Switch(config-if)# switchport trunk pruning vlan remove 3,10-15

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces switchport	Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.
switchport mode	Configures the VLAN membership mode of a port.

switchport unicast

This is an obsolete command.

In past releases, the switchport unicast interface configuration command was used to set the multicast suppression level on the interface. This command is replaced by the storm-control unicast interface configuration command.

Command History

Release	Modification
12.1(4)EA1	This command was introduced.
12.1(8)EA1	This command was replaced by the storm-control command.

Related Commands

Command	Description
show storm-control unicast	Displays unicast suppression settings on an interface or on all interfaces.
storm-control	Sets broadcast, multicast, or unicast storm control on an interface with the specified threshold level.
switchport broadcast	Obsolete command. Replaced by the storm-control broadcast interface configuration command.
switchport multicast	Obsolete command. Replaced by the storm-control multicast interface configuration command.

switchport voice vlan

Use the switchport voice vlan interface configuration command to configure voice VLAN on the port. Use the no form of this command to return to the default setting.

switchport voice vlan {vlan-id | dot1p | none | untagged}

no switchport voice vlan

Syntax Description

vlan-id	VLAN used for voice traffic. The range is 1 to 4094.
dot1p	The telephone uses priority tagging and uses VLAN 0 (the native VLAN). By default, the Cisco IP phone forwards the voice traffic with an IEEE 802.1p priority of 5.
none	The telephone is not instructed through the CLI about the voice VLAN. The telephone uses the configuration from the telephone key pad.
untagged	The telephone does not tag frames and uses VLAN 4095. The default for the telephone is untagged.

Defaults

The switch default is not to automatically configure the telephone (none).

The telephone default is not to tag frames.

Command Modes

Interface configuration

Command History

Release	Modification
12.1(9)EA1	This command was introduced.

Usage Guidelines

You should configure voice VLAN on access ports.

Before you enable voice VLAN, we recommend you enable quality of service (QoS) on the switch by entering the mls qos global configuration command and configure the port trust state to trust by entering the mls qos trust cos interface configuration command.

When you enable port security on an interface that is also configured with a voice VLAN, set the maximum allowed secure addresses on the port to two. When the port is connected to a Cisco IP phone, the IP phone requires one MAC address. The Cisco IP phone address is learned on the voice VLAN, but is not learned on the access VLAN. If you connect a single PC to the Cisco IP phone, no additional MAC addresses are required. If you connect more than one PC to the Cisco IP phone, you must configure enough secure addresses to allow one for each PC and one for the Cisco IP phone.

If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN.

You cannot configure static secure MAC addresses on the voice VLAN.

The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled.

Examples

This example shows how to configure VLAN 2 as the voice VLAN:

Switch(config-if)# switchport voice vlan 2

You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

Command	Description
show interfaces interface-id switchport	Displays the administrative and operational status of a switching (nonrouting) port.
switchport priority extend	Determines how the device connected to the specified port handles priority traffic received on its incoming port.

system mtu

Use the system mtu global configuration command to set the maximum packet size or maximum transmission unit (MTU) size for the switch. Use the no form of this command to return to the default setting.

system mtu bytes

no system mtu

Syntax Description

bytes

Packet size in bytes. The range is 1500 to 2000 bytes for Gigabit Ethernet switches and 1500 to 1546 bytes for Fast Ethernet switches.

Defaults

The default MTU size is 1500 bytes.

Command Modes

Global configuration

Command History

Release	Modification
12.1(4)EA1	This command was introduced.

Usage Guidelines

When you use this command to change the MTU size, you must reset the switch before the new configuration takes effect.

If you enter a value that is outside the range for the specific type of switch, the value is not accepted.

---

Note The switch does not support setting the MTU on a per-interface basis.

---

The size of frames that can be received by the switch CPU is limited to 1500 bytes, no matter what value was entered with the system mtu command. Although frames that are forwarded or routed typically are not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control traffic, SNMP, Telnet, or routing protocols.

Examples

This example shows how to set the maximum packet size for a Gigabit Ethernet switch to 1580 bytes:

Switch(config)# system mtu 1580

Switch(config)# exit

Switch# reload

This example shows the response when you try to set a Fast Ethernet switch to an out-of-range number:

Switch(config)# system mtu 1580

                                ^

% Invalid input detected at '^' marker.

You can verify your settings by entering the show system mtu privileged EXEC command.

Related Commands

Command	Description
show system mtu	Displays the maximum packet size set for the switch.