Undocumented Cisco Commands
The following list was scavenged from the web at the following site: http://www.elemental.net/~lf/undoc/
I’ve found this list extremely useful and have chosen to store it here for my own use.
| Command Name | Configuration Mode | Platform / Software |
| [no] ip spd queue {min-threshold | max-threshold} <n> | config | IOS |
| Sets lower and upper ip process-level queue thresholds for SPD. With SSE based SPD, lower precedence packets are randomly dropped when the queue size hits min-threshold. The drop probability increases linearly with the queue size until max-threshold is reached, at which point all lower precedence packets are dropped. For regular SPD, lower precedence packets are dropped when the queue size reaches min-threshold. Defaults are 50 and 75, respectively. These values were not based on real life experience and may need some tuning. | ||
| Reference: Cisco ISP Esssentials | ||
| [no] spd enable | config | IOS |
| Enable or disable the selective packet discard (SPD) feature. Command is called “ip spd enable” in 11.1CC. | ||
| Reference: Cisco ISP Esssentials, CSCdk31898 | ||
| aaa accounting delay-start | config | IOS |
| If you want to see IP addresses in the AAA start records, then you will want “aaa accounting delay-start” which is hidden but universally used. | ||
| Reference: | ||
| aaa authorization console | config | IOS (>= 12.1(10.6)) |
| This hidden commands enables authorization for the console port. Otherwise authorization on the console ports always succeeds. Aaron Leonard submitted CSCdp33836 and CSCdp33841 to get this command documented. | ||
| Reference: Dennis Peng <dpe...@cisco.com>, <2001...@sj-cse-320.cisco.com> and Aaron Leonard <aar...@cisco.com>, <2001...@sj-cse-320.cisco.com> on cisco-nas, as well as CSCdi82030 | ||
| aaa pod server [port <port number>] [auth-type {any | all | session-key}] server-key <string> | config | IOS (>= 11.3(7)AA) |
Syntax Description
This command is now documented as of 12.2(8)T. |
||
| Reference: | ||
| ais-enable | config-if | IOS |
| IOS version 12.0(7.1) includes a hidden command to enable generation of AIS alarm on tx line when LOS is detected on rx line. This is a kludge to workaround other vendor’s ATM switches (Newbridge) that don’t generate F4/F5 OAM AIS cells when F3 RDI is received. This command is only supported on the PA-A3 port adapter. The hidden interface command “ais-enable” will enable AIS alarm assertion when an LOS alarm occurs. | ||
| Reference: CSCdm37634 | ||
| arap logging debug-extensions | config | IOS |
| This DDTS adds a hidden command, “arap logging debug-extensions” which effectively negates the changes from CSCdi57713. Messages that re-appear:
Modem CD dropped unexpectedly. |
||
| Reference: CSCdi68276, CSCdi57713 | ||
| bgp common-administration | config-router bgp | IOS |
| Reference: | ||
| bgp maxas-limit <1 – 2000> | config-router bgp | IOS |
| This command should be used in router configuration mode; by default there is no limit. If the number of ASes in the AS_PATH exceeds the limit, the UPDATE will be stored in the BGP table, but not used in the bestpath selection or propagated. | ||
| Reference: CSCdr54230, CSCdu00679 | ||
| bgp redistribute-internal | config-router bgp | IOS |
| Normally redistributing BGP into another protocol only redistributes EBGP routes. Using this command will also redistribute IBGP routes. Hidden in IOS versions prior to 12.1. | ||
| Reference: | ||
| bridge-group <bridge-num> subscriber-loop-control | config-if | IOS |
| Bridge between two machines on the same subinterface. | ||
| Reference: | ||
| clear ip eigrp [<as>] events | privileged exec | IOS |
| Clear IP EIGRP event logs. | ||
| Reference: | ||
| clear ip eigrp [<as>] logging | privileged exec | IOS |
| Stop IP EIGRP event logging. | ||
| Reference: | ||
| clock source free-running|line primary | config-controller | IOS |
| Generate or sample clock rate from the line. | ||
| Reference: | ||
| csim | exec | IOS |
| With the command csim you can emulate a voice call. It’s like sombody calls the specified number. Usefull, if you don’t have physically access to the telephone:
Sucessfull call: wg1r1#csim start 089150 Call to an undefined number: wg1r1#csim start 089151 csim err:csim_do_test Error peer not found |
||
| Reference: | ||
| debug buffer | privileged exec | IOS |
| Debug buffer management. | ||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| debug crypto isakmp detail | privileged exec | IOS |
| Crypto ISAKMP internals debugging.
Example output during ISAKMP SA establishment: 6w3d: ISAKMP cookie gen for src 62.245.147.66 dst 195.244.119.2 |
||
| Reference: | ||
| debug crypto isakmp packet | privileged exec | IOS |
| Crypto ISAKMP packet debugging.
Example output during ISAKMP SA establishment: 6w3d: -Traceback= 80A36FE0 80A3A5C0 80A3D41C 809F0880 809F8A34 |
||
| Reference: | ||
| debug dialer detailed | privileged exec | IOS |
| Enable some additional debugging for the DDR subsystem. | ||
| Reference: | ||
| debug dialer holdq | privileged exec | IOS |
| Activate debugging output for dialer hold queue events.
Jan 13 14:56:03.240: Se0/1:15 DDR: Creating holdq 626B1B9C |
||
| Reference: | ||
| debug ip ospf monitor | privileged exec | IOS |
| OSPF SPF monitoring debugging. Hmm, seems to show synchronization between OSPF routing process and routing table. Furthermore it shows LSA changes and so can be used to debug why a link marked as OSPF demand circuit is brought up for example. | ||
| Reference: | ||
| debug ip packet [detail] [<access-list>] dump | privileged exec | IOS |
| Dumps packets contents for process switched packets. | ||
| Reference: | ||
| debug isdn q931 l3 | privileged exec | IOS |
| This command will show additional information on ISDN Layer 3, i.e. the corresponding call reference number in all ISDN messages. | ||
| Reference: Project DOTU | ||
| debug mica {tx|rx} <slot>/<port> | privileged exec | IOS |
| Dump data from a MICA digital modem. Probably only supported on the Cisco Access Server series (e.g. AS5300). | ||
| Reference: | ||
| debug modem csm | privileged exec | IOS |
| Modem Management Call Switching Module debugging. | ||
| Reference: | ||
| debug oir | privileged exec | IOS |
| Activate OIR debugging.
ctalkb#debug oir |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| debug parser mode | privileged exec | IOS |
| Aug 7 21:58:44.207 MEST: Look up of parser mode ‘route-map’ succeeded Aug 7 21:58:45.923 MEST: Look up of parser mode ‘configure’ succeeded |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| debug sanity | privileged exec | IOS |
| With this command every buffer that is used in the system is sanity-checked when it is allocated and when it is freed. This can sometimes be used to pinpoint memory corruption problems when analyzing a core dump which was generated with this debug option in effect. | ||
| Reference: | ||
| dialer disable-multiencaps | config-if | IOS |
| Revert to premultiencapsulation on the dialer profile. | ||
| Reference: CSCdp95164 | ||
| dialer mult-map-same-name | config-if | IOS |
| If distinct dialer maps to different destinations share the same remote name, traffic will fail to pass on the 2nd and subsequent sessions. This ability is implemented 1n 12.0T as a hidden command. dialer mult-map-same-name allows 2 users to dial in to the dialer with the same ppp user_name. It’s behaviour with other dialer features is currently unpredictable and should be used with caution. | ||
| Reference: CSCdk28459 – allow multi users w/ same name | ||
| eigrp event-log-site <n> | config-router eigrp | IOS |
| Set size of event log. Setting it to zero deletes event log buffers. Default log buffer size is 500 events. | ||
| Reference: | ||
| eigrp event-logging | config-router eigrp | IOS |
| Controls logging of EIGRP events. | ||
| Reference: | ||
| eigrp kill-everyone | config-router eigrp | IOS |
| Kill all adjacencies on an SIA or a neighbor down event. | ||
| Reference: | ||
| eigrp log-event-type [dual] [xmit] [transport] | config-router eigrp | IOS |
| Configure the set of EIGRP event types to log. | ||
| Reference: | ||
| enable engineer | exec | XDI/CatOS |
| Catalyst 5000 series with Supervisor Engine I:
You will be prompted for a password. It has the following format:
That is, the VTY password followed by the VTY password again, followed by the hardware version, followed by the software version(no spaces, do not type the dots in the versions). Catalyst 5000 series with Supervisor-Engine II and III and Catalyst 6000 series with Supervisor I and II: Format for the password is:
That is, the VTY password followed by the VTY password again, followed by the hardware version, followed by the software version (no spaces, do not type the dots in the versions). |
||
| Reference: | ||
| frame-relay fecn-create | config-map-class | IOS |
| This hidden command enables setting the FECN bit in all outgoing packets that have been delayed due to traffic shaping. | ||
| Reference: | ||
| gdb {kernel | pid <pid-num> | {examine | debug} <pid-num>} | privileged exec | IOS |
| Seems to activate some internal debugger. Maybe for access via remote gdb. Probably only useful with a symbol table and an IOS image compiled for debugging. | ||
| Reference: Phrack, Volume 0xa, Issue 0×38; Project DOTU | ||
| h323 h245 tunnel defer | voice service voip | IOS |
| Reference: | ||
| if-console <slot-num> [console|debug] | privileged exec | 7000/7500 Series, IOS |
| Open connection to the VIP console. Lots of useful commands there, especially showing memory and cpu usage. | ||
| Reference: | ||
| ip cache-ager <secs-between-runs> <fraction-low-memory> <fraction> | config | IOS (>=10.3(8) and >=11.0(3)) |
It’s hidden, and you have to configure “service internal” in order to bring it into existence.
Configures the ager of the fast switching cache. Aaron Leonard <Aar...@cisco.com> recommended “20 3 3″ on cisco-nas in the light of recent CodeRed attacks, i.e. make the ager more aggressive to prevent excessive cache growth. |
||
| Reference: <01K7...@Cisco.COM> and http://www.cisco.com/warp/public/63/ts_codred_worm.shtml | ||
| ip cache-invalidate-delay <minimum-delay> <maximum-delay> <quit-interval> | config | IOS (>=10.3(8) and >=11.0(3)) |
Requires “service internal”.
Use “no ip cache-invalidate-delay” to disable the delay altogether. See this posting from cisco-nas: Date: Fri, 28 Apr 2000 10:07:03 -0700 (PDT) It’s hidden, and you have to configure “service internal” in order as5300-1(config)#service internal It’s generally recommended for systems running 12.0T/12.1 code if |
||
| Reference: <01JO...@Cisco.COM> and http://www.cisco.com/warp/public/63/ts_codred_worm.shtml | ||
| ip ospf interface-retry <retries> | config-if | IOS |
| From Cisco DE (slightly edited):
The motivation for this command is a timing problem where OSPF fails to determine the state of an interface. The solution was for OSPF to poll the interface for a while to verify its state. The hidden command allows us to lengthen the polling period on routers that have a large number of interfaces. The polls occur every 10 seconds and the command controls the number of polls that will be done. With a setting of 0 retries there will be no extra polling. Default number of retries is 10. |
||
| Reference: | ||
| ip route profile | config | IOS |
| As disclosed by Aaron Leonard from Cisco on cisco-nas:
Date: Thu, 11 Sep 2003 09:34:53 -0700 (PDT) [...] “ip route profile” was implemented way back in late ‘96 by CSCdi76662. Introduction The Route Table Profiling feature was developed to assist network engineers The Route Table Profiling feature is an undocumented and unsupported Configuration |
||
| Reference: CSCdi76662 | ||
| ipc-console <slot-num> <cpu> | privileged exec | Catalyst 6000/6500 Series, IOS |
| Open connection to the FlexWAN console. FlexWANs contain two CPUs so you can connect to either CPU 0 or CPU 1. | ||
| Reference: | ||
| ipx sap-interval {<n>|passive} | config-if | IOS (>=11.2) |
| Set the IPX SAP advertising interval to n or to passive mode. | ||
| Reference: | ||
| ipx server-split-horizon-on-server-paths | config | IOS |
| This global configuratiom command specifies that split horizon SAP occurs on server paths.
This command is documented in DDTS CSCdm12190. From the release note: By default, split horizon blocks information about periodic SAPs from being advertised by a router to the same interface on which the best route to that SAP is learned. But in the case where the SAP may be learned from interfaces other than (or in addition to) the interface on which the best route to that SAP is learned, enabling “ipx server-split-horizon-on-server-paths” will reduce unnecessary periodic SAP updates as that SAP will not be advertised to the interface(s) where it was learned from; this will also prevent potential “SAP loop” in the network. |
||
| Reference: CSCdm12190 | ||
| ipx update interval {rip | sap} passive | config | IOS (>=11.3(1.3)) |
| The undocumented passive keyword specifies to listen but not send normal periodic SAP or RIP updates nor flash update caused by changes. Queries will still be replied to. The update interval is set to the same interval as changes-only.
See also “ipx sap-interval”. |
||
| Reference: CSCdj59918 | ||
| isdn incoming progress [validate|accept] | config-if | IOS (>= 12.1(3.3)T) |
| Controls whether IOS sends an INVALID information element message when it receives an invalid PROGRESS IE. | ||
| Reference: CSCdt12611 | ||
| modem-mgmt csm debug rbs | privileged exec | IOS |
| Debug RBS trunks. Only available if “service internal” configured. Equivalent to “debug cas” on later IOS versions (>= 12.0(7)T). | ||
| Reference: | ||
| mpls traffic-eng multicast-intact | config-router | IOS |
| Use hop-by-hop routing instead of MPLS TE tunnels to transport multicast traffic. See CSCdm63234 for details. | ||
| Reference: CSCdm63234 | ||
| multilink queuing bypass-fifo | config-if | IOS |
| Reference: | ||
| neighbor <ip-address> don’t-capability-negotiate | config-router bgp | IOS |
| Turns off CAPABILITY parameters in BGP Open message. | ||
| Reference: | ||
| no logging snmp-authfail | config | IOS |
| Turn off the %SNMP-3-AUTHFAIL message.
See CSCdv04268 for availability information. |
||
| Reference: CSCdv04268 | ||
| no ppp microcode | config-if | IOS |
| On a cisco 805, “ip tcp header-compression” configured on the serial async interface and on the dialer interface linked to it, results in VERY long response time for TCP sessions. Workaround: Remove “ip tcp header-compression” or enable the hidden command “no ppp microcode” on the serial interface or configure IP directly on the serial interface (no dialer interface). | ||
| Reference: CSCdp32980 | ||
| no snmp-server sparse-tables | config | IOS |
| Fully populate all SNMP tables even if an object id is not applicable in a specific case. | ||
| Reference: | ||
| ppp dnis <number> [<number> ...] | config-if | IOS |
| Skip authentication entirely for PPP per DNIS. | ||
| Reference: CSCdk45054 | ||
| ppp ipcp accept-address | config-if | IOS |
| It is possible to revert to the previous operation using the hidden interface command ppp ipcp accept-address. When enabled the peer IP address will be accepted but is still subject to AAA verification, it will have precedence over any local address pool however. | ||
| Reference: CSCdj04128 | ||
| ppp ipcp dns|wins {accept | a.b.c.d [e.f.g.h] [accept]} | config-if | IOS |
| Reference: CSCdm62097, CSCdk01128 | ||
| ppp ipcp ignore-map | config-if | IOS |
| Don’t assign same IP address to peers with the same name. Instead get a fresh address. | ||
| Reference: CSCdm18764 – don’t assign peer IP addr from map | ||
| ppp ipcp unique-address | config-if | IOS |
| Assigns a unique IP address even if the same user (identified by the username) has multiple links open. Standard behaviour is to assigned the same IP address. See “dialer mult-map-same-name”, too. | ||
| Reference: | ||
| ppp max-configure <num> | config-if | IOS |
| Maximum number if configure requests to send. | ||
| Reference: | ||
| priv | ROMMON | |
| Enable private commands in the ROMMON. Sometimes a password is required. | ||
| Reference: | ||
| ps -c | privileged exec | XDI/CatOS |
| Show process listing and CPU usage. | ||
| Reference: | ||
| radius send service-type call-check | config | IOS (>= 12.1(4)T) |
| From: Dennis Peng <dpe...@cisco.com> To: “scott.list” <scot...@mlec.net> Cc: cisc...@external.cisco.com Message-ID: <2001...@sj-cse-320.cisco.com> I assume you have preauthentication already configured? By default, we The command “radius send service-type call-check” is hidden. This |
||
| Reference: CSCdt85947 | ||
| radius-server authorization default Framed-Protocol ppp | config | IOS |
| This hidden command assumes that the RADIUS Framed-Protocol attribute is PPP when no Framed-Protocol attribute is present in a RADIUS server reply packet. | ||
| Reference: Dennis Peng <dpe...@cisco.com>, <2002...@sj-cse-320.cisco.com> on cisco-nas | ||
| radius-server authorization permit missing Service-Type | config | IOS |
| This hidden command seems to allow RADIUS server replies in which the Service-Type attribute is missing. | ||
| Reference: Dennis Peng <dpe...@cisco.com>, <2002...@sj-cse-320.cisco.com> on cisco-nas | ||
| radius-server unique-ident | config | IOS |
| Directly from the DDTS release note:
The hidden command “radius-server unique-ident” can be used to try to ensure that RADIUS session IDs are unique across IOS boots. It will have the side effect of automatically writing the IOS configuration to NVRAM some time after booting. When the router parses the command “radius-server unique-ident” it sets the unique-ident variable to (n+1) and all accouting records have a prefix of (n+1). When you look at the configuration or write the configuration to NVRAM, it is also shows “radius-server unique-ident”. If the box is reloaded, upon booting the router will parse “radius-server unique-ident” and then set the unique-ident variable to (n+2) and all accounting records have a prefix of (n+2). When you look at the configuration or write the configuration to NVRAM, is will show “radius-server unique-ident”. |
||
| Reference: CSCdu77149 | ||
| service download-fl | config | GSR IOS |
| Force the GRP to download its own version of the Fabric Downloader to the line card before attempting to start Cisco IOS. | ||
| Reference: http://www.cisco.com/warp/public/63/17.html | ||
| service internal | config | IOS |
| Activate some Cisco commands normally used for internal testing. | ||
| Reference: | ||
| service log backtrace | config | IOS |
| Supply a backtrace with every messaged logged. Probably to find out where a certain message is generated. | ||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| service unsupported-transceiver | config | IOS |
| Enables the use of third-party SFP or GBIC modules on Cisco switches but note the warning below.
Example output: Switch(config)#service unsupported-transceiver |
||
| Reference: Saku Ytti on cisco-nsp | ||
| service-policy classify-per-feature | config | IOS |
| From CSCds43683:
Packets should be treated consistently on all platforms for a given configuration. This fix addresses the consistency issue when QoS Mod CLI is configured via the “service-policy” command on the 7500 vs the other IOS platforms. After this fix, each packet will be matched for a matching class under the policy-map until a match is found. Matching terminates at the first matching class and all features configured under the class act on the packet. In the current IOS releases, matching happens across all classes under a policy until the first matching class is found for every configured QoS feature. To maintain backward compatibility a hidden knob called “service-policy classify-per-feature” knob is introduced. When configured, the behaviour reverts to the current existing behaviour. By way of this fix, the default behaviour will be common for all platforms. This fix is going to affect 7200 and other non-distributed platforms only. |
||
| Reference: CSCds43683 | ||
| set trace <category> <level> | privileged exec | XID/CatOS |
| Enable tracing of the specified subsystem.
Possible category names (most certainly depending on CatOS version): acct, acl, all, bdd, cdp, config, dhcp, diag, dns, dot1x, drip, dtp, dupflash, dupnvram, dynvlan, earl, envmon, eobc, epld, essr, evmgr, fabric, fcp, fddi, fib, filesys, fpoe, garp, gvrp, hamgr, http, inband, ipc, kerberos, l3age, l3sup, lane, ld, llc, ltl, mbuf, mcast, mdg, memdbg, mls, mlsm, modport, ntp, nvsync, oob, pagp, protfilt, pruning, privatevlan, qde, qos, radius, redundancy, rsfc, rsvp, rtios, rtipc, rticc, runtimecfg, scp, security, slp, snmp, span, spantree, ssh, syncmgr, synfig, syslog, tacacs, test, tftp, tftpd, udld, verb, vlanmgr, vmps, vtp.
A level of 6 is normally a good start. Warning: Can produce losts of output depending on your configuration and the level chosen. |
||
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| set trace monitor {enable|disable} | privileged exec | XID/CatOS |
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| show acl stats | privileged exec | XID/CatOS |
| Comment by Francois on this command:
Displays various statistics about the ACL subsystem and associated hardware components. There are some interesting counters like compilation errors and also usage counters for various tables (different masks, subnets, etc). Useful when you can’t commit your ACL with a TCAM error message. ACL: local stats table Resources Acl engine stats Acl manager stats HA stats |
||
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| show alignment | privileged exec | IOS |
| Displays statistics about spurious memory accesses and aligment errors. Also includes stack tracebacks. | ||
| Reference: | ||
| show banff-reset | privileged exec | XID/CatOS, Catalyst 5000 series with NFFC |
| There is a quiet recall on some Catalyst 5000 series switches that have the EARL 1 chip NFFC and a data rate that exceeds 80MBS across the backplane because of a defect that causes the ECB to reset continuously. Usually users will report a network slowdown.
This command will display the number of times the ECBs have reset since last power on, a number of 1 for each ECB is normal. Numbers in the hundreds or thousands mean you need to call Cisco for replacement boards. |
||
| Reference: From Heinz Ulm’s web site | ||
| show caller | exec | IOS |
| Show a lot of information about calls in a NAS environment. Lots of subcommands here. | ||
| Reference: | ||
| show chunk [summary] | privileged exec | IOS |
| There is the traditional malloc/free memory management in place on the cisco. there is also chunk allocation. the main benefit of chunk allocation over its predecessor is that memory overhead is only paid by the large chunk (which is then carved up into smaller pieces) instead of by each individual malloced block. | ||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show controller switch | exec | Cat 2900XL/3500XL, IOS |
| The show controller switch command provides indicative information regarding the total switch utilization. An example is presented below:
Switch#sh controller switch Device Type : 0×00040273 Switch# The Total Bandwidth Limit varies between different 2900XL and 3500XL models. When the Total Bandwidth reaches the Total Bandwidth Limit value, the switch has reached its full bandwidth capacity and begins to drop packets. The Peak Total Bandwidth is the highest value attained by the Total Bandwidth since the last time the show controller switch command was executed. Note, the values for the above parameters are in hexadecimal. The Congestion Threshold value is used as conservative value for the maximum global buffer utilization. When the buffer utilization noted by Total Allocation reaches this value, the switch may drop frames. The Peak Total Allocation value shows the highest value attained by the Total Allocation since the last time the show controller switch command was executed. It is possible for the Peak Total Allocation and/or the Total Allocation to be greater than Congestion Threshold. If the Total Allocation reaches or is over the Congestion Threshold amount, the switch is experiencing considerable network activity near its full capacity. The global buffer utilization may be adversely effected by several configuration issues, described below: 1.Speed mismatch between an ingress and egress port; for example, several 100 megabit clients transferring files to a server connected to the switch at 10 megabits, half-duplex. 2.Multiple input ports feeding a single output port. 3.Duplex mismatch on multiple ports. 4.Numerous ports that are experiencing collisions and/or output errors due to half-duplex configuration or over-subscription of a slow link. |
||
| Reference: http://www.cisco.com/warp/customer/473/19.html | ||
| show epc … | privileged exec | IOS |
| From a Catalyst 2048G-L3 (also applies to the Catalyst 4908G-L3 and probably in parts to the Catalyst 8500 series):
gepard#show epc ? Some of these commands are documented as part of the Catalyst 8540 documentation but are also useful on the Catalyst 2948G-L3 which seems to be based (at least partly) on the same hardware platform as the Catalyst 8540. See: http://www.cisco.com/univercd/cc/td/doc/product/atm/c8540/12_1/11_ey/trouble/l3_net.htm |
||
| Reference: | ||
| show epc acl lookup {in|out} … | privileged exec | IOS (Cat 2948G-L3, 4908G-L3, 8540) |
| Displays whether the ACL would permit or deny a specific IP packet on a particular interface. | ||
| Reference: http://www.cisco.com/univercd/cc/td/doc/product/l3sw/8540/12_1/lhouse/sw_confg/8500acl.htm | ||
| show epc acl tcam2acl interface <interface> {in|out} | privileged exec | IOS (Cat 2948G-L3, 4908G-L3, 8540) |
| Displays the ACL entries programmed in the TCAM for a particular interface. | ||
| Reference: http://www.cisco.com/univercd/cc/td/doc/product/l3sw/8540/12_1/lhouse/sw_confg/8500acl.htm | ||
| show epc ip-address interface <interface> all-entries | privileged exec | IOS (Cat 2948G-L3) |
| Shows the IP adjacencies installed in the CAM hardware:
gepard#show epc ip-address interface FastEthernet 1 all-entries |
||
| Reference: http://www.cisco.com/warp/public/473/48.html | ||
| show epc patricia <ingress-interface> ipucast detail | privileged exec | IOS |
| Seems to show the FIB stored in the CAM memory of a specific ingress port.
Example output provided by Hank: cs-c2948gl3-13a#sh epc patricia interface FastEthernet 3 ipucast detail |
||
| Reference: Contributed by Hank Nussbacher <h...@att.net.il> | ||
| show epc patricia <interface> mac | privileged exec | IOS (Cat 2948G-L3, 4908G-L3) |
| Layer 2 forwarding table entries for a given MAC address in a bridge group are viewed using the show bridge bridge-group-number command.
However, bridge table entries on the Catalyst 2948G-L3 and 4908G-L3 switches are actually formed internally of at least two entries, one on the source interface (where the device with that MAC resides) and one on each destination interface (the interface where, based on the destination MAC in the frame, the traffic sourced from that MAC is destined). This is because the learning process for populating the bridging tables on the Catalyst 2948G-L3 and 4908G-L3 switches is actually distributed on a per-port basis rather than on a switch-wide basis. gepard#show epc patricia interface FastEthernet 9 mac |
||
| Reference: http://www.cisco.com/warp/public/473/47.html | ||
| show idb | privileged exec | IOS |
| Show list of assigned software und hardware Interface Descriptor Blocks (IDBs). Later IOS versions show the maximum number of software IDBs, too.
vxr15#sh idb Maximum number of IDBs 3000 26 SW IDBs allocated (2368 bytes each) 22 HW IDBs allocated (4064 bytes each) |
||
| Reference: | ||
| show inband | privileged exec | XID/CatOS |
| Comment by Francois:
This command outputs statistics about the internal Catalyst 6000 memory channel (interface between two supervisors in a redundant configuration). Can help to diagnose this kind of error: ‘InbandPingProcessFailure:Module 1 not responding over inband’. Inband FX1000 Control Information General Ctrl Regs: Tx Ctrl Regs: Rx Ctrl Regs: Inband PCI Information DeviceID: 1000 VendorID: 8086 Inband Driver Information Transmit: Inband FX1000 Statistics Transmit: Detail Tx Pkt Info (clear on read) Receive: Detail Rx Pkt Info (clear on read) |
||
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| show interface cable <x>/0 privacy statistic | privileged exec | IOS |
| This hidden command may be used to view statistics on the number of SIDs using baseline privacy on a particular cable interface.
Here is an example output of this command. CMTS# show interface cable 4/0 privacy statistic |
||
| Reference: http://www.cisco.com/warp/public/109/docsis_bpi.shtml | ||
| show interfaces [<interface-name>] stats | exec | IOS |
| Show statistics on the switching path used (per interface or all). | ||
| Reference: | ||
| show interfaces [<interface-name>] switching | exec | IOS |
| Produces detailed output on the switching paths used on a particular interface (or on all interfaces). Also shows SPD statistics. | ||
| Reference: | ||
| show ip cef [<network> [<netmask>]] internal | privileged exec | IOS |
| Especially shows information about the CEF load sharing logic.
router#show ip cef 141.1.0.0 255.255.0.0 internal Recursive load sharing using 194.221.43.80/30 Hash OK Interface Address Packets |
||
| Reference: Project DOTU | ||
| show ip eigrp events [<as-num>] [<start-num>] [<end-num>] | privileged exec | IOS |
| Show history of events for the EIGRP routing process. | ||
| Reference: | ||
| show ip eigrp sia-event | privileged exec | IOS |
| Show SIA (stuck in active) events from the event history. | ||
| Reference: | ||
| show ip eigrp timers [<as-num>] | privileged exec | IOS |
| List of timers associated with a EIGRP routing process. | ||
| Reference: | ||
| show ip ospf bad-checksum | privileged exec | IOS |
| Reference: | ||
| show ip ospf delete-list | privileged exec | IOS |
| Reference: | ||
| show ip ospf events | privileged exec | IOS |
| Show history of events for the OSPF routing process. | ||
| Reference: | ||
| show ip ospf maxage-list | privileged exec | IOS |
| Reference: | ||
| show ip ospf statistic | privileged exec | IOS |
| Show timing statistics about the SPF algorithm. | ||
| Reference: | ||
| show ip route hash | exec | IOS |
| David writes: “The only usefulness of this seems to be to identify the larger hash buckets and hence provide feedback to Cisco if the hash algorithm is producing a particularly bad distribution into some buckets.”
Example output: router#show ip route hash nettable: supernettable: 0 16 Routing table summary: |
||
| Reference: Contributed by David Luyer <davi...@pacific.net.au> | ||
| show ip route profile | privileged exec | IOS |
| See “ip route profile”.
aspen#show ip route profile |
||
| Reference: CSCdi76662 | ||
| show ip spd | config | IOS |
| Shows SPD mode, current and max size of IP process level input queue, and status of external (SSE) SPD. SPD mode will be one of disabled, normal, random drop, or full drop. The priority queue is where high-precedence packets go.
labR4#show ip spd |
||
| Reference: Cisco ISP Esssentials | ||
| show isdn memory detail | exec | IOS |
| Shows additional memory information. | ||
| Reference: | ||
| show isdn service [<dsl> | <interface-name>] detail | exec | IOS |
| Shows additional table named “Source of Service state” and outputs the free channel mask (also shown by show isdn status). | ||
| Reference: Josh Duffek <jduf...@cisco.com> on cisco-nas, <026e01c189a1$b8229a60$4d72...@cisco.com> | ||
| show isdn status detail | exec | IOS |
| Shows additional status information, i.e. call reference id. | ||
| Reference: | ||
| show isis private | privileged exec | IOS |
| ctalkb#sh isis private ISIS: FastPSNP cache (hits/misses): 0/4002 ISIS: LSPIX validations (full/skipped): 216271/490412 ISIS: LSP HT=0 checksum errors received: 0 |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show isis timers | privileged exec | IOS |
| Useful in that it provides a brief overview of execution flow in the IS-IS process. Shows you the frequency of things like L1/L2 hello etc.
ctalkb#sh isis timers Update Process |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show isis tree | privileged exec | IOS |
| Shows path and depth taken to get to other level 1/2 intermediate systems.
ctalkb#sh isis tree |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show list [none] | privileged exec | IOS |
| ctalkb#show list List Manager: 1415 lists known, 1561 lists created ID Address Size/Max Name ID Address Size/Max Name |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show mbuf | privileged exec | XID/CatOS |
| Catalyst 5000: The main issue to observe with this command is whether the switch is being starved for memory. Within the display, “clusters” is the number of buffers that are available for NMP to process incoming packets, which include any broadcast/multicast, management traffic. “clfree” is the number of buffers that are available for the NMP at any given time. If this is zero then this means that NMP has no buffers to process any incoming frames. “lowest clfree” determines the lowest watermark that NMP has hit at any time. If this value is zero but clfree is nonzero, then this means that at one instance NMP ran out of buffers. This can be because of a broadcast of a multicast storm in the management VLAN. | ||
| Reference: | ||
| show memory big | privileged exec | IOS |
| R1#show memory big Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 148364 15428764 4550340 10878424 10832564 10875604 25 largest free blocks in the system (biggest to lowest) 10875604, 1424, 644, 500, 108, 36, 28, 28, 28, 24, 5897388, 52466600, 5743730, 0, 0, 0, 1, -1, 32, 0, 5743730, 1349000, 0, 5897456, 52556446, 52556446. Count of firstfit: 7, bestfit: 2215118, maxout1: 0 maxout2: 0 I/O 4000000 2097152 398396 1698756 1641680 1698588 Count of firstfit: 0, bestfit: 366, maxout1: 0 maxout2: 0 |
||
| Reference: Project DOTU | ||
| show mls nfde | privileged exec | XID/CatOS |
| NDE related info: NDE enable : TRUE Current Export Version : 7 IP address : 192.168.212.65 UDP port: 9996 Flows in nde buffer : 0 Comment by Francois on the output above: This command allows to debug NetFlow data export on Catalyst 6000. ‘Flows in nde buffer’ should grow until a threshold and then get flushed to the collector (’Packets sent’). In this particular case, the Catatyst 6000 series switch is hit by a bug which renders flow exports impossible and so the counter keeps rising. |
||
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| show mls status | exec | Cat 6000 Native IOS |
| Show multilayer switching status. | ||
| Reference: New product training Catalyst 6000 | ||
| show mmc np5400 [config|flows|get|indications|ports|queue|registers|stat|send] [...] | privileged exec | IOS (Cat 2948G-L3, 4908G-L3) |
| Reference: | ||
| show mpls interfaces internal all | privileged exec | IOS |
| Displays detailed information about all of the MPLS interfaces in the router. If the used IOS image supports the MPLS Egress NetFlow Accounting Feature then the output shows if MPLS Egress NetFlow Accounting is enabled on the interface. | ||
| Reference: Contributed by David Luyer <davi...@pacific.net.au> | ||
| show msfc | privileged exec | IOS (Cat 6k hybrid) |
| On a MSFC1:
TORUMSFC1# show msfc Interrupt Registers: RSFC CPU IDPROM: (FRU is ‘MSFC Cat6k daughterboard’) IDPROM image block #0: |
||
| Reference: Contributed by Gerry Murray <Gerr...@computershare.com> | ||
| show msfc | privileged exec | CatOS (Cat 6k hybrid) |
| TORUSW6509 (enable) show msfc MSFC Auto port state: enabled |
||
| Reference: Contributed by Gerry Murray <Gerr...@computershare.com> | ||
| show msfc nvram | privileged exec | IOS (Cat 6k hybrid) |
| Dumps the ROMMON NVRAM portion on a MSFC1.
TORUMSFC1# show msfc nvram |
||
| Reference: Contributed by Gerry Murray <Gerr...@computershare.com> | ||
| show parser modes | privileged exec | IOS |
| ctalkb#show parser modes Parser modes: Name Prompt Top Alias Privilege exec 0×60EFB294TRUE TRUE configure config 0×60EFABACTRUE TRUE interface config-if 0×60EF7AECTRUE TRUE subinterface config-subif 0×60EF7AECTRUE FALSE null-interface config-if 0×60EFB368TRUE TRUE line config-line 0×60EF3F84TRUE TRUE |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show parser unresolved | privileged exec | IOS |
| ctalkb#sh parser un Unresolved parse chains: 40 40 198 198 322 |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| show polaris fibmgr usage | privileged exec | CatOS (Cat 6k hybrid) |
| Displays some useful about the FIB TCAM and the adjacency table when using the PFC2.
Example output: [...] Total adjacencies: 262144 |
||
| Reference: Contributed by Francois Baligant <fran...@be.wanadoo.com> | ||
| show region | privileged exec | IOS |
| Displays how the memory is partitioned into different regions.
From a cisco 7140: maple#show region Start End Size(b) Class Media Name |
||
| Reference: Inside Cisco IOS Software Architectures | ||
| show region address <address> | privileged exec | IOS |
| Show to which region a certain address belongs.
From a cisco 7140: maple#show region address 0×6137A3BF Name : data |
||
| Reference: Inside Cisco IOS Software Architectures | ||
| show slip | exec | IOS |
| alder#show slip Async protocol statistics: Int Local Remote Qd InPack OutPac Inerr Drops MTU Rcvd: 341389 packets, 7115582 bytes |
||
| Reference: | ||
| show snmp chassis | privileged exec | IOS |
| Display SNMP chassis id. | ||
| Reference: | ||
| show snmp community | privileged exec | IOS |
| Shows a list of communities that IOS knows about.
oak#show snmp community |
||
| Reference: | ||
| show snmp host | privileged exec | IOS |
| Show list of host receiving traps. | ||
| Reference: | ||
| show snmp location | privileged exec | IOS |
| Show snmp location. | ||
| Reference: | ||
| show snmp mib | privileged exec | IOS |
| Show list of implemented MIBs. | ||
| Reference: | ||
| show snmp newcom | privileged exec | IOS |
| Reference: | ||
| show snmp notify | privileged exec | IOS |
| router#show snmp notify snmpNotifyName : trap tag: trap type: trap nonvolatile |
||
| Reference: | ||
| show sum | privileged exec | IOS |
| Show current stored image checksum. | ||
| Reference: | ||
| show sum | exec | IOS |
| router>show sum New checksum of 0xEDE08607 matched original checksum |
||
| Reference: | ||
| show tcam … | exec | Cat 6000 Native IOS |
| cosmos#show tcam ? and-or and-or keyword capability-map capability-map keyword detail detail keyword dynamic-entries dynamic entries keyword first first keyword [further arguments required] label label keyword [further arguments required] lou lou keyword redirects redirect indices keyword region region keyword start start keyword statistics statistics keyword type type keyword [further arguments required] vlan vlan keyword [further arguments required] window window keyword [further arguments required] Some of these keywords must or can have further arguments. |
||
| Reference: New product training Catalyst 6000 | ||
| snmp-server priority {low | normal | high} | config | IOS |
| Global configuration command can be used to change the priority of SNMP processes. To avoid extensive polling, the priority should be set to low . All SNMP queries sent to a router are prioritized as either low or medium priority, depending on the version of code run by the route processor. This means that processes with a higher priority than the SNMP process will be serviced before SNMP. So, regardless of SNMP polling intensity, routing processes will generally be processed before SNMP requests because route processes are high priority. | ||
| Reference: | ||
| spd headroom <n> | config | IOS |
| Default value is 100. Specifies how many high-precedence packets we will enqueue over the normal input hold queue limit. This is to reserve room for incoming high precedence packets. Is “ip spd headroom” in 11.1CC. | ||
| Reference: Cisco ISP Esssentials, CSCdk31898 | ||
| tcam priority high|low|medium | config-if | Cat 6000 Native IOS |
| If TCAM is full, interfaces with a higher priority will be prefered when loading access-lists etc. into the TCAM. | ||
| Reference: New product training Catalyst 6000 | ||
| test aaa group radius <username> <password> | privileged exec | IOS |
| Send a test authentication request.
alder#test aaa group radius test test alder#test aaa group radius mon mon Sends the following RADIUS attributes: Wed Aug 1 21:00:19 2001 |
||
| Reference: | ||
| test aim eeprom slot <n> | privileged exec | IOS |
| cisco#test aim eeprom slot 1 AIM Slot [1]: Use NMC93C46 ID EEPROM [y]: AIM Slot 1 eeprom (? for help)[?]: ? d – dump eeprom contents e – erase all locations (to 1) p – primitive access q – exit eeprom test z – zero eeprom ‘c’ rules of radix type-in and display apply. AIM Slot 1 eeprom (? for help)[?]: d |
||
| Reference: Contributed by Damjan Marion <Damj...@iskon.hr> | ||
| test crash | privileged exec | IOS |
| Trigger all kinds of crashes. Test crashinfo functionality. Test RSP failover. | ||
| Reference: | ||
| test mbus power <slot> on|off | privileged exec | GSR IOS |
| Turn power of GSR linecard on or off. | ||
| Reference: | ||
| test ppp echotimeout <interface-name> | privileged exec | IOS |
| Test PPP LCP echo timeout. Seems to simulate a PPP LCP echo timeout on the router where this command is issued. After this command line protocol changes to down, PPP parameteres are renegotiated and the line comes up again. | ||
| Reference: | ||
| test transmit | privileged exec | IOS |
| ctalkb#test transmit interface: Ethernet3/0 total frame size [100]: 1) To this interface 2) To another interface 9) Ask for everything Choice: 2 Encapsulation Type: 1) Ethertype 2) SAP 3) SNAP 4) SNAP (Cisco OUI) 5) SNAP (EtherV2 OUI) 6) Novell 802.3 Choice: 1 Protocol type: 1) IP 2) XNS 3) IPX 9) Ask for everything Choice: 1 |
||
| Reference: Phrack, Volume 0xa, Issue 0×38 | ||
| tracy_close <module> <port> | exec | XID/CatOS with WS-X6608-T1 or WS-X6608-E1 |
| Stops the tracing output started with “tracy_start”. See “tracy_start”. | ||
| Reference: From Heinz Ulm’s web site, originally from Martin Gagnon, Canada | ||
| tracy_start <module> <port> | exec | XID/CatOS with WS-X6608-T1 or WS-X6608-E1 |
| Displays tracing information useful for debugging the Cisco 6608 Gateway. The output is identical to the one produced by the Dick Tracy debugging tool from Cisco. | ||
| Reference: From Heinz Ulm’s web site, originally from Martin Gagnon, Canada | ||
| traffic-shape fecn-create | config-if | IOS |
| This hidden command enables setting the FECN bit in all outgoing packets that have been delayed due to traffic shaping.
Requirements: GTS must be enabled and the interface has to be set to frame-relay encapsulation. |
||
| Reference: | ||
| ttcp | privileged exec | Cisco 7200/7500, IOS |
| Start a TCP data server/receiver for TCP performance testing between two Cisco 7500 router:
Router#ttcp ttcp-t: buflen=8192, nbuf=2048, align=16384/0, port=5001 tcp -> 1.1.1.1 Router#ttcp ttcp-r: buflen=8192, align=16384/0, port=5001 From the Open Forum: Question: When using the Cisco hidden command ttcp (to generate traffic), what do the following values for this command mean: perform tcp half close [n] Answer: Half close is regarding the tcp syn-ack; send bufflen is the size of the packet to be sent; send nbuf is the number of packets sent; bufalign is create a ”matrix” of sent data in either a linear or non-linear model of testing throughput and pattern analysis; setoffset is the offset of created data in the packet; port is the tcp/udp port the data is sent on, and sinkmode tells the device to ignore other network traffic or not. |
||
| Reference: | ||
| tx-queue-limit | config-if | IOS |
| Hidden command which seems to be an alias for the documented tx-ring-limit command. | ||
| Reference: CSCdk17210 | ||
| virtual-template <template-num> pre-clone <num> | config | IOS |
| Pre-clone specified number of Virtual-Access interfaces. Hidden in 12.1 mainline. Visible in 12.1T.
Where <template-num> is the vtemplate number and <num> is the number of sessions you wish to pre-clone. Please note that with l2tp [by default], if you choose to pre-clone you are limited to the number of sessions you pre-cloned. i.e. if you pre-clone 1000 sessions, you cannot set up more then 1000 sessions for the given virtual-template. |
||
| Reference: | ||
| vpdn ip udp ignore checksum | config | IOS |
| This command tells the router to ignore the checksum on UDP packets used by L2TP/L2F and can be used to temporarily reduce CPU load.
This probably is per the suggestion in RFC 2661, section 8.1: “The default for any L2TP implementation is that UDP checksums MUST be enabled for both control and data messages. An L2TP implementation MAY provide an option to disable UDP checksums for data messages. It is recommended that UDP checksums always be enabled on control packets.” And Dennis Peng from Cisco added the following note (on cisco-nas): Verification of the UDP checksum forces us into the process switching path which will result in increased CPU usage. By default, Cisco LAC’s will not set the UDP checksum, so in a Cisco to Cisco environment, you don’t need this command. But other vendors may set the UDP checksum, so in a multi-vendor environment, it is probably a good idea to include it. One big vendor which sets the UDP checksum is Microsoft, their L2TP client does this. |
||
| Reference: Contributed by Ash Garg <A...@telstra.net> | ||
| vpdn {l2f|l2tp} session table-size <size> | config | IOS |
| This command sets the number of buckets on the hash table used for looking up multiplex IDs (session IDs in L2TP speak; both use a 16-bit namespace) and so finding the session control data structures. Each tunnel has its own MID lookup table. <size> can range from 16 to 2048 but cannot be greater than the number L2F/L2TP interfaces available (which is platform dependent). The default number of buckets is platform dependent. If <size> is not a power of two it is rounded down to the next power of two.
Some performance might be gained by increasing the hash table size and so reducing the number of collisions at the expense of increased memory usage. |
||
| Reference: Credits: Ash Garg <A...@telstra.net>, Dennis Peng <dpe...@cisco.com> |
Pasted from <http://www.elemental.net/~lf/undoc/>
