|
|
The Internet Protocol (IP) is a packet-based protocol used to exchange data over computer networks. IP handles addressing, fragmentation, reassembly, and protocol demultiplexing. It is the foundation on which all other Internet protocols, collectively referred to as the Internet Protocol suite, are built. IP is a network-layer protocol that contains addressing information and some control information that allows data packets to be routed.
The Transmission Control Protocol (TCP) is built upon the IP layer. TCP is a connection-oriented protocol that specifies the format of data and acknowledgments used in the transfer of data. TCP also specifies the procedures that the computers use to ensure that the data arrives correctly. TCP allows multiple applications on a system to communicate concurrently because it handles all demultiplexing of the incoming traffic among the application programs.
Use the commands in this chapter to configure and monitor IP networks. For IP protocol configuration information and examples, refer to the "Configuring IP" chapter of the Network Protocols Configuration Guide, Part 1.
To restrict incoming and outgoing connections between a particular virtual terminal line (into a Cisco device) and the addresses in an access list, use the access-class line configuration command. To remove access restrictions, use the no form of this command.
access-class access-list-number {in | out}| access-list-number | Number of an access list. This is a decimal number from 1 to 199. |
| in | Restricts incoming connections between a particular Cisco device and the addresses in the access list. |
| out | Restricts outgoing connections between a particular Cisco device and the addresses in the access list. |
No access lists are defined.
Line configuration
This command first appeared in Cisco IOS Release 10.0.
Remember to set identical restrictions on all the virtual terminal lines because a user can connect to any of them.
To display the access lists for a particular terminal line, use the show line EXEC command and specify the line number.
The following example defines an access list that permits only hosts on network 192.89.55.0 to connect to the virtual terminal ports on the router:
access-list 12 permit 192.89.55.0 0.0.0.255 line 1 5 access-class 12 in
The following example defines an access list that denies connections to networks other than network 36.0.0.0 on terminal lines 1 through 5:
access-list 10 permit 36.0.0.0 0.255.255.255 line 1 5 access-class 10 out
A dagger (+) indicates that the command is documented outside this chapter.
show line +
To define an extended IP access list, use the extended version of the access-list global configuration command. To remove the access lists, use the no form of this command.
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}For Internet Control Message Protocol (ICMP), you can also use the following syntax:
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}For Internet Group Management Protocol (IGMP), you can also use the following syntax:
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}For TCP, you can also use the following syntax:
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}For User Datagram Protocol (UDP), you can also use the following syntax:
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
Caution Enhancements to
this command are backward compatible; migrating from releases prior to Release
11.1 will convert your access lists automatically. However, releases prior to
Release 11.1 are not upwardly compatible with these enhancements.
Therefore, if you save an access list with these images and then use software
prior to Release 11.1, the resulting access list will not be interpreted
correctly. This could cause you severe security problems. Save your old
configuration file before booting these images.
| access-list-number | Number of an access list. This is a decimal number from 100 to 199. |
| dynamic dynamic-name | (Optional) Identifies this access list as a dynamic access list. Refer to lock-and-key access documented in the "Managing the System" chapter in the Configuration Fundamentals Configuration Guide. |
| timeout minutes | (Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently. Refer to lock-and-key access documented in the "Managing the System" chapter in the Configuration Fundamentals Configuration Guide. |
| deny | Denies access if the conditions are matched. |
| permit | Permits access if the conditions are matched. |
| protocol | Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP) use the keyword ip. Some protocols allow further qualifiers described below. |
| source | Number of the network or host from which the packet is being sent.
There are three alternative ways to specify the source:
|
|
source-wildcard |
Wildcard bits to be applied to source. There are three alternative
ways to specify the source wildcard:
|
|
destination |
Number of the network or host to which the packet is being sent. There
are three alternative ways to specify the destination:
|
|
destination-wildcard |
Wildcard bits to be applied to the destination. There are three
alternative ways to specify the destination wildcard:
|
|
precedence precedence |
(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name as listed in the section "Usage Guidelines." |
| tos tos | (Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name as listed in the section "Usage Guidelines." |
| icmp-type | (Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the section "Usage Guidelines." |
| igmp-type | (Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the section "Usage Guidelines." |
| operator | (Optional) Compares source or destination ports. Possible operands
include lt (less than), gt (greater than), eq
(equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port
number is a number from 0 to 65535. TCP port names are listed in the
section "Usage Guidelines." TCP port names can only be used when filtering
TCP. UDP port names are listed in the section "Usage Guidelines." UDP port
names can only be used when filtering UDP.
TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about
the packet that matches the entry to be sent to the console. (The level of
messages logged to the console is controlled by the logging console
command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
An extended access list defaults to a list that denies everything. An extended access list is terminated by an implicit deny statement.
Global configuration
The UDP form of this command first appeared in Cisco IOS Release 10.0. All other forms of the command, as well as the following arguments and keywords, first appeared in Cisco IOS Release 10.3:
source
source-wildcard
destination
destination-wildcard
precedence
precedence
icmp-type
icm-code
icmp-message
igmp-type
operator
port
established
The following keywords and arguments first appeared in Cisco IOS Release 11.1:
dynamic dynamic-name
timeout minutes
You can use access lists to control the transmission of packets on an interface, control virtual terminal line access, and restrict contents of routing updates. The Cisco IOS software stops checking the extended access list after a match occurs.
Fragmented IP packets, other than the initial fragment, are immediately accepted by any extended IP access list. Extended access lists used to control virtual terminal line access or restrict contents of routing updates must not match against the TCP source port, the type of service value, or the packet's precedence.
The following is a list of precedence names:
The following is a list of type of service (TOS) names:
The following is a list of ICMP message type names and ICMP message type and code names:
The following is a list of IGMP message names:
The following is a list of TCP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
The following is a list of UDP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
In the following example, serial interface 0 is part of a Class B network with the address 128.88.0.0, and the mail host's address is 128.88.1.2. The keyword established is used only for the TCP protocol to indicate an established connection. A match occurs if the TCP datagram has the ACK or RST bits set, which indicate that the packet belongs to an existing connection.
access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.0.0 0.0.255.255 established access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.1.2 0.0.0.0 eq 25 interface serial 0 ip access-group 102 in
The following example also permit Domain Naming System (DNS) packets and ICMP echo and echo reply packets:
access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established access-list 102 permit tcp any host 128.88.1.2 eq smtp access-list 102 permit tcp any any eq domain access-list 102 permit udp any any eq domain access-list 102 permit icmp any any echo access-list 102 permit icmp any any echo-reply
The following examples show how wildcardbits are used to indicate the bits of the prefix or mask that are relevant. They are similar to the bitmasks that are used with normal access-lists. Prefix/mask bits corresponding to wildcard bits set to 1 are ignored during comparisons and prefix/mask bits corresponding to wildcard bits set to 0 are used in comparison.
In the following example, permit 192.108.0.0 255.255.0.0 but deny any more specific routes of 192.108.0.0 (including 192.108.0.0 255.255.255.0).
access-list 101 permit ip 192.108.0.0 0.0.0.0 255.255.0.0 0.0.0.0 access-list 101 deny ip 192.108.0.0 0.0.255.255 255.255.0.0 0.0.255.255
In the following example, permit 131.108.0/24 but deny 131.108/16 and all other subnets of 131.108.0.0.
access-list 101 permit ip 131.108.0.0 0.0.0.0 255.255.255.0 0.0.0.0 accces-list 101 deny ip 131.108.0.0 0.0.255.255 255.255.0.0 0.0.255.255
A dagger (+) indicates that the command is documented outside this chapter.
access-class
access-list
(standard)
clear access-temp +
distribute-list in
+
distribute-list out +
ip
access-group
ip
access-list
logging console +
priority-list
+
queue-list +
show
access-lists
show
ip access-list
To define a standard IP access list, use the standard version of the access-list global configuration command. To remove a standard access lists, use the no form of this command.
access-list access-list-number {deny | permit} source [source-wildcard] Caution Enhancements to this command
are backward compatible; migrating from releases prior to Release 10.3 will
convert your access lists automatically. However, releases prior to
Release 10.3 are not upwardly compatible with these enhancements.
Therefore, if you save an access list with these images and then use software
prior to Release 10.3, the resulting access list will not be interpreted
correctly. This could cause you severe security problems. Save your old
configuration file before booting these images.
| access-list-number | Number of an access list. This is a decimal number from 1 to 99. |
| deny | Denies access if the conditions are matched. |
| permit | Permits access if the conditions are matched. |
| source | Number of the network or host from which the packet is being sent.
There are two alternative ways to specify the source:
|
|
source-wildcard |
(Optional) Wildcard bits to be applied to the source. There are
two alternative ways to specify the source wildcard:
|
The access list defaults to an implicit deny statement for everything. The access list is always terminated by an implicit deny statement for everything.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
Plan your access conditions carefully and be aware of the implicit deny statement at the end of the access list.
You can use access lists to control the transmission of packets on an interface, control virtual terminal line access, and restrict the contents of routing updates.
Use the show access-lists EXEC command to display the contents of all access lists.
Use the show ip access-list EXEC command to display the contents of one access list.
The following example of a standard access list allows access for only those hosts on the three specified networks. The wildcard bits apply to the host portions of the network addresses. Any host with a source address that does not match the access list statements will be rejected.
access-list 1 permit 192.5.34.0 0.0.0.255 access-list 1 permit 128.88.0.0 0.0.255.255 access-list 1 permit 36.0.0.0 0.255.255.255 ! (Note: all other access implicitly denied)
To specify a large number of individual addresses more easily, you can omit the wildcard if it is all zeros. Thus, the following two configuration commands are identical in effect:
access-list 2 permit 36.48.0.3 access-list 2 permit 36.48.0.3 0.0.0.0
A dagger (+) indicates that the command is documented outside this chapter.
access-class
access-list
(extended)
distribute-list in +
distribute-list out
+
ip
access-group
priority-list +
queue-list
+
show
access-lists
show
ip access-list
To add a permanent entry in the Address Resolution Protocol (ARP) cache, use the arp global configuration command. To remove an entry from the ARP cache, use the no form of this command.
arp ip-address hardware-address type [alias]| ip-address | IP address in four-part dotted-decimal format corresponding to the local data link address. |
| hardware-address | Local data link address (a 48-bit address). |
| type | Encapsulation description. For Ethernet interfaces, this is typically the arpa keyword. For Fiber Distributed Data Interface (FDDI) and Token Ring interfaces, this is always snap. |
| alias | (Optional) Indicates that the Cisco IOS software should respond to ARP requests as if it were the owner of the specified address. |
No entries are permanently installed in the ARP cache.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The Cisco IOS software uses ARP cache entries to translate 32-bit IP addresses into 48-bit hardware addresses.
Because most hosts support dynamic resolution, you generally do not need to specify static ARP cache entries.
To remove all nonstatic entries from the ARP cache, use the clear arp-cache privileged EXEC command.
The following is an example of a static ARP entry for a typical Ethernet host:
arp 192.31.7.19 0800.0900.1834 arpa
To control the interface-specific handling of IP address resolution into 48-bit Ethernet, FDDI, and Token Ring hardware addresses, use the arp interface configuration command. To disable an encapsulation type, use the no form of this command.
arp {arpa | probe | snap}| arpa | Standard Ethernet-style ARP (RFC 826). |
| probe | HP Probe protocol for IEEE-802.3 networks. |
| snap | ARP packets conforming to RFC 1042. |
Standard Ethernet-style ARP
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
Unlike most commands that take multiple arguments, arguments to the arp command are not mutually exclusive. Each command enables or disables a specific type of ARP. For example, if you enter the arp arpa command followed by the arp probe command, the Cisco IOS software would send three (two for probe and one for arpa) packets each time it needed to discover a Media Access Control (MAC) address.
The arp probe command allows the software to use the Probe protocol (in addition to ARP) whenever it attempts to resolve an IEEE-802.3 or Ethernet local data link address. The subset of Probe that performs address resolution is called Virtual Address Request and Reply. Using Probe, the software can communicate transparently with Hewlett-Packard IEEE-802.3 hosts that use this type of data encapsulation.
The show interfaces EXEC command displays the type of ARP being used on a particular interface. To remove all nonstatic entries from the ARP cache, use the clear arp-cache privileged EXEC command.
The following example enables probe services:
interface ethernet 0
arp probe
A dagger (+) indicates that the command is documented outside this chapter.
clear
arp-cache
show interfaces +
To configure how long an entry remains in the ARP cache, use the arp timeout interface configuration command. To restore the default value, use the no form of this command.
arp timeout seconds| seconds | Time (in seconds) that an entry remains in the ARP cache. A value of zero means that entries are never cleared from the cache. |
14400 seconds (4 hours)
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
This command is ignored when issued on interfaces that do not use ARP. The show interfaces EXEC command displays the ARP timeout value. The value follows the "Entry Timeout:" heading, as seen in this sample show interfaces display:
ARP type: ARPA, PROBE, Entry Timeout: 14400 sec
The following example sets the ARP timeout to 12000 seconds to allow entries to time out more quickly than the default:
interface ethernet 0 arp timeout 12000
A dagger (+) indicates that the command is documented outside this chapter.
show interfaces +
To clear the counters of an access list, use the clear access-list counters EXEC command.
clear access-list counters {access-list-number | name}| access-list-number | Access list number from 0 to 1199 for which to clear the counters. |
| name | Name of an IP access list. The name cannot contain a space or quotation mark, and must begin with an alphabetic character to avoid ambiguity with numbered access lists. |
EXEC
This command first appeared in Cisco IOS Release 11.0.
Some access lists keep counters that count the number of packets that pass each line of an access list. The show access-lists command displays the counters as a number of matches. Use the clear access-list counters command to restart the counters for a particular access list to 0.
The following example clears the counters for access list 101:
clear access-list counters 101
To delete all dynamic entries from the ARP cache, to clear the fast-switching cache, and to clear the IP route cache, use the clear arp-cache EXEC command.
clear arp-cacheThis command has no arguments or keywords.
EXEC
This command first appeared in IOS Release 10.0.
The following example removes all dynamic entries from the ARP cache and clears the fast-switching cache:
clear arp-cache
To delete entries from the host-name-and-address cache, use the clear host EXEC command.
clear host {name | *}| name | Particular host entry to remove. |
| * | Removes all entries. |
EXEC
This command first appeared in IOS Release 10.0.
The host name entries will not be removed from nonvolatile random-access memory (NVRAM), but will be cleared in running memory.
The following example clears all entries from the host name-and-address cache:
clear host *
To clear the active or checkpointed database when IP accounting is enabled, use the clear ip accounting EXEC command.
clear ip accounting [checkpoint]| checkpoint | (Optional) Clears the checkpointed database. |
EXEC
This command first appeared in Cisco IOS Release 10.0.
You can also clear the checkpointed database by issuing the clear ip accounting command twice in succession.
The following example clears the active database when IP accounting is enabled:
clear ip accounting
ip
accounting
ip
accounting-list
ip
accounting-threshold
ip
accounting-transits
show
ip accounting
To clear dynamic Network Address Translation (NAT) translations from the translation table, use the clear ip nat translation EXEC command.
clear ip nat translation {* | [inside global-ip local-ip][outside local-ip global-ip]}| * | Clears all dynamic translations. |
| inside global-ip | When used without the arguments protocol, global-port, and local-port, clears a simple translation that also contains the specified local-ip address. When used with the arguments protocol, global-port, and local-port, clears an extended translation. |
| local-ip | (Optional) Clears an entry that contains this local IP address and the specified global-ip address. |
| protocol | (Optional) Clears an entry that contains this protocol and the specified global-ip address, local-ip address, global-port, and local-port. |
| global-port | (Optional) Clears an entry that contains this global-port and the specified protocol, global-ip address, local-ip address, and local-port. |
| local-port | (Optional) Clears an entry that contains this local-port and the specified protocol, global-ip address, local-ip address, and global-port. |
EXEC
This command first appeared in Cisco IOS Release 11.2.
Use this command to clear entries from the translation table before they time out.
The following example shows the NAT entries before and after the UDP entry being cleared:
Router#show ip nat translationPro Inside global Inside local Outside local Outside global udp 171.69.233.209:1220 192.168.1.95:1220 171.69.2.132:53 171.69.2.132:53 tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23 171.69.1.220:23 tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23 171.69.1.161:23 Router#clear ip nat trans udp inside 171.69.233.209 1220 192.168.1.95 1220171.69.2.132 53 171.69.2.132 53Router#show ip nat translationPro Inside global Inside local Outside local Outside global tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23 171.69.1.220:23 tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23 171.69.1.161:23
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To clear all dynamic entries from the Next Hop Resolution Protocol (NHRP) cache, use the clear ip nhrp EXEC command.
clear ip nhrpThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 11.0.
This command does not clear any static (configured) IP-to-nonbroadcast multiaccess (NBMA) address mappings from the NHRP cache.
The following example clears all dynamic entries from the NHRP cache for the interface:
clear ip nhrp
show ip nhrp
To delete routes from the IP routing table, use the clear ip route EXEC command.
clear ip route {network [mask] | *}| network | Network or subnet address to remove. |
| mask | (Optional) Subnet address to remove. |
| * | Removes all routing table entries. |
All entries are removed.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following example removes a route to network 132.5.0.0 from the IP routing table:
clear ip route 132.5.0.0
To have the Route Processor recompute the silicon switching engine (SSE) program for IP on the Cisco 7000 series, use the clear ip sse privileged EXEC command.
clear ip sseThis command has no arguments or keywords.
Disabled
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
The SSE is on the Silicon Switch Processor (SSP) board in the Cisco 7000.
This command also updates the SSE cache for IP.
In the following example, the Route Processor recomputes the program for IP:
clear ip sse
To reinitialize the Route Processor on the Cisco 7000 series, use the clear sse EXEC command.
clear sseThis command has no arguments or keywords.
Disabled
EXEC
This command first appeared in ICisco OS Release 10.3.
The silicon switching engine (SSE) is on the Silicon Switch Processor (SSP)
board in the
Cisco 7000.
The following example reinitializes the Route Processor:
clear sse
To set conditions for a named IP access list, use the deny access-list configuration command. To remove a deny condition from an access list, use the no form of this command.
deny source [source-wildcard]For ICMP, you can also use the following syntax:
deny icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] |For IGMP, you can also use the following syntax:
deny igmp source source-wildcard destination destination-wildcard [igmp-type]For TCP, you can also use the following syntax:
deny tcp source source-wildcard [operator port [port]] destination destination-wildcardFor UDP, you can also use the following syntax:
deny udp source source-wildcard [operator port [port]] destination destination-wildcard| source | Number of the network or host from which the packet is being sent.
There are two alternative ways to specify the source:
|
|
source-wildcard |
(Optional) Wildcard bits to be applied to the source. There are
two alternative ways to specify the source wildcard:
|
|
protocol |
Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later. |
| source | Number of the network or host from which the packet is being sent.
There are three alternative ways to specify the source:
|
|
source-wildcard |
Wildcard bits to be applied to source. There are three alternative
ways to specify the source wildcard:
|
|
destination |
Number of the network or host to which the packet is being sent. There
are three alternative ways to specify the destination:
|
|
destination-wildcard |
Wildcard bits to be applied to the destination. There are three
alternative ways to specify the destination wildcard:
|
|
precedence precedence |
(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name as listed in the section "Usage Guidelines." |
| tos tos | (Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name as listed in the "Usage Guidelines" section of the access-list (extended) command. |
| icmp-type | (Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets which are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the "Usage Guidelines" section of the access-list (extended) command. |
| igmp-type | (Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the "Usage Guidelines" section of the access-list (extended) command. |
| operator | (Optional) Compares source or destination ports. Possible operands
include lt (less than), gt (greater than), eq
(equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (extended) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about
the packet that matches the entry to be sent to the console. (The level of
messages logged to the console is controlled by the logging console
command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
There is no specific condition under which a packet is denied passing the named access list.
Access-list configuration
This command first appeared in Cisco IOS Release 11.2.
Use this command following the ip access-list command to specify conditions under which a packet cannot pass the named access list.
The following example of a standard access list named Internetfilter:
ip access-list standard Internetfilter deny 192.5.34.0 0.0.0.255 permit 128.88.0.0 0.0.255.255 permit 36.0.0.0 0.255.255.255 ! (Note: all other access implicitly denied)
ip
access-group
ip
access-list
permit
show
ip access-list
| count | Number of times DMDP will retransmit a message. It can be a decimal integer from 0 to 200. The default is 4 retries, or until acknowledged. |
Retransmits messages up to 4 times, or until acknowledged
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The following example sets the number of times DMDP will attempt to retransmit a message to 150:
dnsix-dmdp retries 150
dnsix-nat authorized-redirection
dnsix-nat primary
dnsix-nat
secondary
dnsix-nat source
dnsix-nat transmit-count
| ip-address | IP address of the host from which redirection requests are permitted. |
An empty list of addresses
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Use multiple dnsix-nat authorized-redirection commands to specify a set of hosts that are authorized to change the destination for audit messages. Redirection requests are checked against the configured list, and if the address is not authorized the request is rejected and an audit message is generated. If no address is specified, no redirection messages are accepted.
The following example specifies that the address of the collection center that is authorized to change the primary and secondary addresses is 193.1.1.1.
dnsix-nat authorization-redirection 193.1.1.1.
| ip-address | IP address for the primary collection center. |
Messages are not sent.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
An IP address must be configured before audit messages can be sent.
The following example configures an IP address as the address of the host to which DNSIX audit messages are sent:
dnsix-nat primary 194.1.1.1
| ip-address | IP address for the secondary collection center. |
No alternate IP address is known.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
When the primary collection center is unreachable, audit messages are sent to the secondary collection center instead.
The following example configures an IP address as the address of an alternate host to which DNSIX audit messages are sent:
dnsix-nat secondary 193.1.1.1
| ip-address | Source IP address for DNSIX audit messages. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
You must issue the dnsix-nat source command before any of the other dnsix-nat commands. The configured IP address is used as the source IP address for DMDP protocol packets sent to any of the collection centers.
The following example enables the audit trail writing module, and specifies that the source IP address for any generated audit messages should be the same as the primary IP address of Ethernet interface 0.
dnsix-nat source 128.105.2.5 interface ethernet 0 ip address 128.105.2.5 255.255.255.0
| count | Number of audit messages to buffer before transmitting to the server. Integer from 1 to 200. |
One message is sent at a time.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
An audit message is sent as soon as the message is generated by the IP packet-processing code. The audit writing module can, instead, buffer up to several audit messages before transmitting to a collection center.
The following example configures the system to buffer five audit messages before transmitting them to a collection center:
dnsix-nat transmit-count 5
To define a named, dynamic, IP access list, use the dynamic access-list configuration command. To remove the access lists, use the no form of this command.
dynamic dynamic-name [timeout minutes]{deny | permit} protocol source source-wildcardFor ICMP, you can also use the following syntax:
dynamic dynamic-name [timeout minutes] {deny | permit} icmp source source-wildcardFor IGMP, you can also use the following syntax:
dynamic dynamic-name [timeout minutes] {deny | permit} igmp source source-wildcardFor TCP, you can also use the following syntax:
dynamic dynamic-name [timeout minutes] {deny | permit} tcp source source-wildcardFor UDP, you can also use the following syntax:
dynamic dynamic-name [timeout minutes] {deny | permit} udp source source-wildcard
Caution Named IP access lists will not be recognized by any software release
prior to Cisco IOS Release 11.2.
| dynamic-name | Identifies this access list as a dynamic access list. Refer to lock-and-key access documented in the "Configuring Traffic Filters" chapter in the Security Configuration Guide. |
| timeout minutes | (Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently. Refer to lock-and-key access documented in the "Configuring Traffic Filters" chapter in the Security Configuration Guide. |
| deny | Denies access if the conditions are matched. |
| permit | Permits access if the conditions are matched. |
| protocol | Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later. |
| source | Number of the network or host from which the packet is being sent.
There are three alternative ways to specify the source:
|
|
source-wildcard |
Wildcard bits to be applied to source. There are three alternative
ways to specify the source wildcard:
|
|
destination |
Number of the network or host to which the packet is being sent. There
are three alternative ways to specify the destination:
|
|
destination-wildcard |
Wildcard bits to be applied to the destination. There are three
alternative ways to specify the destination wildcard:
|
|
precedence precedence |
(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name as listed in the section "Usage Guidelines." |
| tos tos | (Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name as listed in the section "Usage Guidelines." |
| icmp-type | (Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets which are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the section "Usage Guidelines." |
| igmp-type | (Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the section "Usage Guidelines." |
| operator | (Optional) Compares source or destination ports. Possible operands
include lt (less than), gt (greater than), eq
(equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (extended) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about
the packet that matches the entry to be sent to the console. (The level of
messages logged to the console is controlled by the logging console
command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
An extended access list defaults to a list that denies everything. An extended access list is terminated by an implicit deny statement.
Access-list configuration
This command first appeared in Cisco IOS Release 11.2.
You can use named access lists to control the transmission of packets on an interface and restrict contents of routing updates. The Cisco IOS software stops checking the extended access list after a match occurs.
Fragmented IP packets, other than the initial fragment, are immediately accepted by any extended IP access list. Extended access lists used to control virtual terminal line access or restrict contents of routing updates must not match against the TCP source port, the type of service value, or the packet's precedence.
The following is a list of precedence names:
The following is a list of type of service (TOS) names:
The following is a list of ICMP message type names and ICMP message type and code names:
The following is a list of IGMP message names:
The following is a list of TCP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
The following is a list of UDP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
In the following example, the access list named washington is a dynamic access list.
ip access-group washington in ! ip access-list extended washington dynamic testlist timeout 5 permit ip any any permit tcp any host 185.302.21.2 eq 23
A dagger (+) indicates that the command is documented outside this chapter.
clear access-temp +
distribute-list in
+
distribute-list out +
ip
access-group
ip
access-list
logging console +
priority-list
+
queue-list +
show
access-lists
show
ip access-list
To control access to an interface, use the ip access-group interface configuration command. To remove the specified access group, use the no form of this command.
ip access-group {access-list-number | name}{in | out}| access-list-number | Number of an access list. This is a decimal number from 1 to 199. |
| name | Name of an IP access list as specified by an ip access-list command. |
| in | Filters on inbound packets. |
| out | Filters on outbound packets. |
Entering a keyword is strongly recommended, but if a keyword is not specified, out is the default.
Interface configuration
This command first appeared in Cisco IOS Release 10.0. The name argument first appeared in Cisco IOS Release 11.2.
For standard outbound access lists, after receiving and routing a packet to a controlled interface, the software checks the source address of the packet against the access list.For extended access lists, the router also checks the destination access list. If the access list permits the address, the software transmits the packet. If the access list rejects the address, the software discards the packet and returns an ICMP Host Unreachable message.
If the specified access list does not exist, all packets are passed.
When you enable outbound access lists, you automatically disable autonomous switching for that interface.When you enable input access lists on any cBus or CxBus interface, you automatically disable autonomous switching for all interfaces (with one exception--an SSE configured with simple access lists can still switch packets, on output only).
The following example applies list 101 on packets outbound from Ethernet interface 0:
interface ethernet 0 ip access-group 101 out
access-list
(extended)
access-list
(standard)
ip
access-list
show
access-lists
To define an IP access list by name, use the ip access-list global configuration command. To remove a named IP access lists, use the no form of this command.
ip access-list {standard | extended} name
Caution Named access lists will not be recognized by any software release
prior to Cisco IOS Release 11.2.
| standard | Specifies a standard IP access list. |
| extended | Specifies an extended IP access list. |
| name | Name of the access list. Names cannot contain a space or quotation mark, and must begin with an alphabetic character to prevent ambiguity with numbered access lists. |
There is no named IP access list.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
Use this command to configure a named IP access list as opposed to a numbered IP access list. This command will take you into access-list configuration mode, where you must define the denied or permitted access conditions with the deny and permit commands.
Specifying standard or extended with the ip access-list command determines the prompt you get when you enter access-list configuration mode.
Use the ip access-group command to apply the access-list to an interface.
Named access lists are not compatible with Cisco IOS releases prior to Release 11.2.
The following example of a standard access list named Internetfilter:
ip access-list standard Internetfilter permit 192.5.34.0 0.0.0.255 permit 128.88.0.0 0.0.255.255 permit 36.0.0.0 0.255.255.255 ! (Note: all other access implicitly denied)
deny
ip
access-group
permit
show
ip access-list
To enable IP accounting on an interface, use the ip accounting interface configuration command. To disable IP accounting, use the no form of this command.
ip accounting [access-violations]| access-violations | (Optional) Enables IP accounting with the ability to identify IP traffic that fails IP access lists. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
IP accounting records the number of bytes (IP header and data) and packets switched through the system on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the router access server or terminating in this device is not included in the accounting statistics.
The access-violations option first appeared in IOS Release 10.3. If you specify the access-violations keyword, ip accounting provides information identifying IP traffic that fails IP access lists. Identifying IP source addresses that violate IP access lists alerts you to possible attempts to breach security. The data might also indicate that you should verify IP access list configurations. To receive a logging message on the console when an extended access list entry denies a packet access (to log violations), include the log keyword in the access-list (extended) command.
Statistics are accurate even if IP fast switching or IP access lists are being used on the interface.
IP accounting disables autonomous switching and SSE switching on the interface.
The following example enables IP accounting on Ethernet interface 0:
interface ethernet 0 ip accounting
access-list
(extended)
clear
ip accounting
ip
accounting-list
ip
accounting-threshold
ip
accounting-transits
show
ip accounting
To define filters to control the hosts for which IP accounting information is kept, use the ip accounting-list global configuration command. To remove a filter definition, use the no form of this command.
ip accounting-list ip-address wildcard| ip-address | IP address in dotted-decimal format. |
| wildcard | Wildcard bits to be applied to ip-address. |
No filters are defined.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The source and destination address of each IP datagram is logically ANDed with the wildcard bits and compared with the ip-address. If there is a match, the information about the IP datagram will be entered into the accounting database. If there is no match, the IP datagram is considered a transit datagram and will be counted according to the setting of the ip accounting-transits global configuration command.
The following example adds all hosts with IP addresses beginning with 192.31 to the list of hosts for which accounting information will be kept:
ip accounting-list 192.31.0.0 0.0.255.255
clear
ip accounting
ip
accounting
ip
accounting-threshold
ip
accounting-transits
show
ip accounting
To set the maximum number of accounting entries to be created, use the ip accounting-threshold global configuration command. To restore the default number of entries, use the no form of this command.
ip accounting-threshold threshold| threshold | Maximum number of entries (source and destination address pairs) that the Cisco IOS software accumulates. |
512 entries
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The accounting threshold defines the maximum number of entries (source and destination address pairs) that the software accumulates, preventing IP accounting from possibly consuming all available free memory. This level of memory consumption could occur in a router that is switching traffic for many hosts. Overflows will be recorded; see the monitoring commands for display formats.
The default accounting threshold of 512 entries results in a maximum table size of 12,928 bytes. Active and checkpointed tables can reach this size independently.
The following example sets the IP accounting threshold to only 500 entries:
ip accounting-threshold 500
clear
ip accounting
ip
accounting
ip
accounting-list
ip
accounting-transits
show
ip accounting
To control the number of transit records that are stored in the IP accounting database, use the ip accounting-transits global configuration command. To return to the default number of records, use the no form of this command.
ip accounting-transits count| count | Number of transit records to store in the IP accounting database. |
0
Global configuration
This command first appeared in IOS Release 10.0.
Transit entries are those that do not match any of the filters specified by ip accounting-list global configuration commands. If no filters are defined, no transit entries are possible.
To maintain accurate accounting totals, the Cisco IOS software maintains two accounting databases: an active and a checkpointed database.
The following example specifies that no more than 100 transit records are stored:
ip accounting-transits 100
clear
ip accounting
ip
accounting
ip
accounting-list
ip
accounting-threshold
show
ip accounting
| ip-address | IP address. |
| mask | Mask for the associated IP subnet. |
| secondary | (Optional) Specifies that the configured address is a secondary IP address. If this keyword is omitted, the configured address is the primary IP address. |
No IP address is defined for the interface.
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
An interface can have one primary IP address and multiple secondary IP addresses. Packets generated by the Cisco IOS software always use the primary IP address. Therefore, all routers and access servers on a segment should share the same primary network number.
Hosts can determine subnet masks using the Internet Control Message Protocol (ICMP) Mask Request message. Routers respond to this request with an ICMP Mask Reply message.
You can disable IP processing on a particular interface by removing its IP address with the no ip address command. If the software detects another host using one of its IP addresses, it will print an error message on the console.
The optional keyword secondary allows you to specify an unlimited number of secondary addresses. Secondary addresses are treated like primary addresses, except the system never generates datagrams other than routing updates with secondary source addresses. IP broadcasts and ARP requests are handled properly, as are interface routes in the IP routing table.
Secondary IP addresses can be used in a variety of situations. The following are the most common applications:
To transparently bridge IP on an interface, you must do two things:
To concurrently route and transparently bridge IP on an interface, see the bridge crb command.
In the following example, 131.108.1.27 is the primary address and 192.31.7.17 and 192.31.8.17 are secondary addresses for Ethernet interface 0:
interface ethernet 0 ip address 131.108.1.27 255.255.255.0 ip address 192.31.7.17 255.255.255.0 secondary ip address 192.31.8.17 255.255.255.0 secondary
A dagger (+) indicates that the command is documented outside this chapter.
bridge crb +
bridge-group +
To define a broadcast address for an interface, use the ip broadcast-address interface configuration command. To restore the default IP broadcast address, use the no form of this command.
ip broadcast-address [ip-address]| ip-address | (Optional) IP broadcast address for a network. |
Default address: 255.255.255.255 (all ones)
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The following example specifies an IP broadcast address of 0.0.0.0:
ip broadcast-address 0.0.0.0
To control the invalidation rate of the IP route cache, use the ip cache-invalidate-delay global configuration command. To allow the IP route cache to be immediately invalidated, use the no form of this command.
ip cache-invalidate-delay [minimum maximum quiet threshold]| minimum | (Optional) Minimum time (in seconds) between invalidation request and actual invalidation. The default is 2 seconds. |
| maximum | (Optional) Maximum time (in seconds) between invalidation request and actual invalidation. The default is 5 seconds. |
| quiet | (Optional) Length of quiet period (in seconds) before invalidation. |
| threshold | (Optional) Maximum number of invalidation requests considered to be quiet. |
minimum = 2 seconds
maximum = 5 seconds, and 3 seconds with
no more than zero invalidation requests
Global configuration
This command first appeared in Cisco IOS Release 10.0.
All cache invalidation requests are honored immediately.
This command should typically not be used except under the guidance of technical support personnel. Incorrect settings can seriously degrade network performance.
The IP fast-switching and autonomous-switching features maintain a cache of IP routes for rapid access. When a packet is to be forwarded and the corresponding route is not present in the cache, the packet is process-switched and a new cache entry is built. However, when routing table changes occur (such as when a link or an interface goes down), the route cache must be flushed so that it can be rebuilt with up-to-date routing information.
This command controls how the route cache is flushed. The intent is to delay invalidation of the cache until after routing has settled down, since there tend to be many route table changes clustered in a short period of time, and the cache may be flushed repeatedly, which may put a high CPU load on the router.
When this feature is enabled, and the system requests that the route cache be flushed, the request is held for at least minimum seconds. Then the system determines whether the cache has been "quiet" (that is, less than threshold invalidation requests in the last quiet seconds). If the cache has been quiet, the cache is then flushed. If the cache does not become quiet within maximum seconds after the first request, it is flushed unconditionally.
Manipulation of these parameters trades off CPU utilization versus route convergence time. Note that this does not affect the timing of the routing protocols, but only of the removal of stale cache entries.
The following example sets a minimum delay of 5 seconds, a maximum delay of 30 seconds, and a quiet threshold of no more than 5 invalidation requests in the previous 10 seconds:
ip cache-invalidate-delay 5 30 10 5
At times the router might receive packets destined for a subnet of a network that has no network default route. To have the Cisco IOS software forward such packets to the best supernet route possible, use the ip classless global configuration command. To disable this feature, use the no form of this command.
ip classlessThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
This command allows the software to forward packets that are destined for unrecognized subnets of directly connected networks. By default, the software discards the packets when a router receives packets for a subnet that numerically falls within its subnetwork addressing scheme, if there is no such subnet number in the routing table and there is no network default route. However, when the ip classless command is enabled, the software instead forwards those packets to the best supernet route.
The following example configures the software to forward packets destined for an unrecognized subnet to the best supernet possible:
ip classless
To define a default gateway (router) when IP routing is disabled, use the ip default-gateway global configuration command. To disable this function, use the no form of this command.
ip default-gateway ip-address| ip-address | IP address of the router. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The Cisco IOS software sends any packets that need the assistance of a gateway to the address you specify. If another gateway has a better route to the requested host, the default gateway sends an ICMP redirect message back. The ICMP redirect message indicates which local router the Cisco IOS software should use.
The following example defines the router on IP address 192.31.7.18 as the default router:
ip default-gateway 192.31.7.18
To enable the translation of directed broadcast to physical broadcasts, use the ip directed-broadcast interface configuration command. To disable this function, use the no form of this command.
ip directed-broadcast [access-list-number]| access-list-number | (Optional) Number of the access list. If specified, a broadcast must pass the access list to be forwarded. If not specified, all broadcasts are forwarded. |
Enabled, with no list specified
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
This feature is enabled only for those protocols configured using the ip forward-protocol global configuration command. An access list may be specified to control which broadcasts are forwarded. When an access list is specified, only those IP packets permitted by the access list are eligible to be translated from directed broadcasts to physical broadcasts.
The following example enables forwarding of IP directed broadcasts on Ethernet interface 0:
interface ethernet 0 ip directed-broadcast
To define a list of default domain names to complete unqualified host names, use the ip domain-list global configuration command. To delete a name from a list, use the no form of this command.
ip domain-list name| name | Domain name. Do not include the initial period that separates an unqualified name from the domain name. |
No domain names are defined.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
If there is no domain list, the domain name that you specified with the ip domain-name global configuration command is used. If there is a domain list, the default domain name is not used. The ip domain-list command is similar to the ip domain-name command, except that with ip domain-list you can define a list of domains, each to be tried in turn.
The following example adds several domain names to a list:
ip domain-list martinez.com ip domain-list stanford.edu
The following example adds a name to and then deletes a name from the list:
ip domain-list sunya.edu no ip domain-list stanford.edu
To enable the IP Domain Naming System (DNS)-based host name-to-address translation, use the ip domain-lookup global configuration command. To disable the DNS, use the no form of this command.
ip domain-lookupThis command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The following example enables the IP Domain Naming System-based host name-to-address translation:
ip domain-lookup
ip
domain-lookup nsap
ip
domain-name
ip
name-server
To allow DNS queries for Connectionless Network System (CLNS) addresses, use the ip domain-lookup nsap global configuration command. To disable this feature, use the no form of this command.
ip domain-lookup nsapThis command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
With both IP and International Organization for Standardization (ISO) CLNS enabled, this feature allows the Cisco IOS software to dynamically determine a CLNS address given a host name. This feature is useful for the ISO CLNS ping EXEC command and when making CLNS Telnet connections.
The following example disables DNS queries of CLNS addresses:
no ip domain-lookup nsap
A dagger (+) indicates that the command is documented outside this chapter.
ip
domain-lookup
ping (for ISO CLNS) +
To define a default domain name that the Cisco IOS software uses to complete unqualified host names (names without a dotted-decimal domain name), use the ip domain-name global configuration command. To disable use of the DNS, use the no form of this command.
ip domain-name name| name | Default domain name used to complete unqualified host names. Do not include the initial period that separates an unqualified name from the domain name. |
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Any IP host name that does not contain a domain name (that is, any name without a dot), will have the dot and cisco.com appended to it before being added to the host table.
The following example defines cisco.com as the default domain name:
ip domain-name cisco.com
ip
domain-list
ip
domain-lookup
ip
name-server
To allow the exporting of information in NetFlow cache entries, use the ip flow-export global configuration command. To disable the exporting of information, use the no form of this command.
ip flow-export ip-address udp-port| ip-address | IP address of the workstation to which you want to send the NetFlow information. |
| udp-port | UDP protocol-specific port number. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 11.2.
There is a lot of information in a NetFlow cache entry. When flow switching is enabled with the ip route-cache flow command, you can use the ip flow-export command to configure the router to export the flow cache entry to a workstation when a flow expires. This feature can be useful for purposes of statistics, billing, security, for example.
The following example configures the router to export the NetFlow cache entry to the workstation at 134.22.23.7 when the flow expires:
ip flow-export 134.22.23.7 125
ip route-cache flow
To specify which protocols and ports the router forwards when forwarding broadcast packets, use the ip forward-protocol global configuration command. To remove a protocol or port, use the no form of this command.
ip forward-protocol {udp [port] | nd | sdns}| udp | Forward User Datagram Protocol (UDP) datagrams. See the "Default" section below for a list of port numbers forwarded by default. |
| port | (Optional) Destination port that controls which UDP services are forwarded. |
| nd | Forward Network Disk (ND) datagrams. This protocol is used by older diskless Sun workstations. |
| sdns | Secure Data Network Service. |
If a helper address is specified and UDP forwarding is enabled, broadcast packets destined to the following port numbers are forwarded by default:
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Enabling a helper address or UDP flooding on an interface causes the Cisco IOS software to forward particular broadcast packets. You can use the ip forward-protocol command to specify exactly which types of broadcast packets you would like to have forwarded. A number of commonly forwarded applications are enabled by default. Enabling forwarding for some ports (for example, RIP) may be hazardous to your network.
If you use the ip forward-protocol command, specifying just UDP, without the port, enables forwarding and flooding on the default ports.
One common application that requires helper addresses is Dynamic Host Configuration Protocol (DHCP). DHCP is defined in RFC 1531. DHCP protocol information is carried inside of BOOTP packets. To enable BOOTP broadcast forwarding for a set of clients, configure a helper address on the router interface closest to the client. The helper address should specify the address of the DHCP server. If you have multiple servers, you can configure one helper address for each server. Since BOOTP packets are forwarded by default, DHCP information can now be forwarded by the software. The DHCP server now receives broadcasts from the DHCP clients.
The following example uses the ip forward-protocol command to specify forwarding of UDP port 3001 in addition to the default ports, and then defines a helper address:
ip forward-protocol udp 3001 ! interface ethernet 1 ip helper-address 131.120.1.0
ip
directed-broadcast
ip
forward-protocol spanning-tree
ip
forward-protocol turbo-flood
ip
helper-address
To forward any broadcasts including local subnet broadcasts, use the ip forward-protocol any-local-broadcast global configuration command. To disable this type of forwarding, use the no form of this command.
ip forward-protocol any-local-broadcastThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.3.
The ip forward-protocol any-local-broadcast command forwards packets similarly to how the ip forward-protocol spanning-tree command does. That is, it forwards packets whose contents are all ones (255.255.255.255), all zeros (0.0.0.0), and, if subnetting is enabled, all networks (131.108.255.255 as an example in the network number 131.108.0.0). This mechanism also forwards packets whose contents are the zeros version of the all-networks broadcast when subnetting is enabled (for example, 131.108.0.0). In addition, it forwards any local subnet broadcast packets.
Use the ip forward-protocol any-local-broadcast command in conjunction with the ip forward-protocol spanning-tree command, not as a replacement for it.
Assume a router is directly connected to subnet 1 of network 131.108.0.0 and that the netmask is 255.255.255.0. The following command enables the forwarding of IP broadcasts destined to 131.108.1.255 and 131.108.1.0 in addition to the broadcast addresses mentioned in the "Usage Guidelines" section:
ip forward-protocol any-local-broadcast
ip forward-protocol spanning-tree
To permit IP broadcasts to be flooded throughout the internetwork in a controlled fashion, use the ip forward-protocol spanning-tree global configuration command. To disable the flooding of IP broadcasts, use the no form of this command.
ip forward-protocol spanning-treeThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Packets must meet the following criteria to be considered for flooding:
A flooded UDP datagram is given the destination address specified by the ip broadcast-address interface configuration command on the output interface. The destination address can be set to any desired address. Thus, the destination address may change as the datagram propagates through the network. The source address is never changed. The TTL value is decremented.
After a decision has been made to send the datagram out on an interface (and the destination address possibly changed), the datagram is handed to the normal IP output routines and is therefore subject to access lists, if they are present on the output interface.
The ip forward-protocol spanning-tree command uses the database created by the bridging spanning-tree protocol. Therefore, the transparent bridging option must be in the routing software, and bridging must be configured on each interface that is to participate in the flooding in order to support this capability.
If an interface does not have bridging configured, it still will be able to receive broadcasts, but it will never forward broadcasts received on that interface. Also, it will never use that interface to send broadcasts received on a different interface.
If no actual bridging is desired, you can configure a type-code bridging filter that will deny all packet types from being bridged. Refer to the "Transparent Bridging" chapter in the Bridging and IBM Networking Configuration Guide for more information about using access lists to filter bridged traffic. The spanning-tree database is still available to the IP forwarding code to use for the flooding.
The spanning-tree-based flooding mechanism forwards packets whose contents are all ones (255.255.255.255), all zeros (0.0.0.0), and, if subnetting is enabled, all networks (131.108.255.255 as an example in the network number 131.108.0.0). This mechanism also forward packets whose contents are the zeros version of the all-networks broadcast when subnetting is enabled (for example, 131.108.0.0).
This command is an extension of the ip helper-address interface configuration command, in that the same packets that may be subject to the helper address and forwarded to a single network can now be flooded. Only one copy of the packet will be put on each network segment.
The following example permits IP broadcasts to be flooded through the internetwork in a controlled fashion:
ip forward-protocol spanning-tree
ip
broadcast-address
ip
forward-protocol
ip
forward-protocol turbo-flood
ip
helper-address
To speed up flooding of User Datagram Protocol (UDP) datagrams using the spanning-tree algorithm, use the ip forward-protocol turbo-flood global configuration command. To disable this feature, use the no form of this command.
ip forward-protocol turbo-floodThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Used in conjunction with the ip forward-protocol spanning-tree global configuration command, this feature is supported over Advanced Research Projects Agency (ARPA)-encapsulated Ethernets, FDDI, and HDLC-encapsulated serials, but is not supported on Token Rings. As long as the Token Rings and the non-HDLC serials are not part of the bridge group being used for UDP flooding, turbo flooding will behave normally.
The following is an example of a two-port router (2E) using this feature:
ip forward-protocol turbo-flood ip forward-protocol spanning-tree ! interface ethernet 0 ip address 128.9.1.1 bridge-group 1 ! interface ethernet 1 ip address 128.9.1.2 bridge-group 1 ! ! bridge 1 protocol dec
ip
forward-protocol
ip
forward-protocol spanning-tree
To configure the router discovery feature using the Cisco Gateway Discovery Protocol (GDP) routing protocol, use the ip gdp gdp interface configuration command. To disable this feature, use the no form of this command.
ip gdp gdpThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
In future Cisco IOS software releases, GDP will not be supported.
IP routing must be disabled before you can configure this feature.
The following example configures router discovery using GDP on Ethernet interface 0:
interface ethernet 0 ip gdp gdp
To configure the router discovery feature using the Cisco Interior Gateway Routing Protocol (IGRP), use the ip gdp igrp interface configuration command. To disable this feature, use the no form of this command.
ip gdp igrpThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
In future Cisco IOS software releases, the Gateway Discovery Protocol (GDP) will not be supported.
IP routing must be disabled before you can configure this feature.
The following example configures router discovery using IGRP on Ethernet interface 1:
interface ethernet 1 ip gdp igrp
To configure the router discovery feature using the ICMP Router Discovery Protocol (IRDP), use the ip gdp irdp interface configuration command. To disable this feature, use the no form of this command.
ip gdp irdpThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
In future Cisco IOS software releases, the Gateway Discovery Protocol (GDP) will not be supported.
IP routing must be disabled before you can configure this feature.
The following example configures router discovery using IRDP on Ethernet interface 0:
interface ethernet 0 ip gdp irdp
To configure the router discovery feature using the Routing Information Protocol (RIP), use the ip gdp rip interface configuration command. To disable this feature, use the no form of this command.
ip gdp ripThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
In future Cisco IOS software releases, the Gateway Discovery Protocol (GDP) will not be supported.
IP routing must be disabled before you can configure this feature.
The following example configures router discovery using RIP on Ethernet interface 1:
interface ethernet 1 ip gdp rip
To have the Cisco IOS software forward User Datagram Protocol (UDP) broadcasts, including BOOTP, received on an interface, use the ip helper-address interface configuration command. To disable the forwarding of broadcast packets to specific addresses, use the no form of this command.
ip helper-address address| address | Destination broadcast or host address to be used when forwarding UDP broadcasts. There can be more than one helper address per interface. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
Combined with the ip forward-protocol global configuration command, the ip helper-address command allows you to control which broadcast packets and which protocols are forwarded.
One common application that requires helper addresses is Dynamic Host Configuration Protocol (DHCP), which is defined in RFC 1531. DHCP protocol information is carried inside of BOOTP packets. To enable BOOTP broadcast forwarding for a set of clients, configure a helper address on the router interface closest to the client. The helper address should specify the address of the DHCP server. If you have multiple servers, you can configure one helper address for each server. Since BOOTP packets are forwarded by default, DHCP information can now be forwarded by the router. The DHCP server now receives broadcasts from the DHCP clients.
The following example defines an address that acts as a helper address:
interface ethernet 1 ip helper-address 121.24.43.2
To define a static host name-to-address mapping in the host cache, use the ip host global configuration command. To remove the name-to-address mapping, use the no form of this command.
ip host name [tcp-port-number] address1 [address2...address8]| name | Name of the host. The first character can be either a letter or a number. If you use a number, the operations you can perform are limited. |
| tcp-port-number | (Optional) TCP port number to connect to when using the defined host name in conjunction with an EXEC connect or Telnet command. The default is Telnet (port 23). |
| address1 | Associated IP address. |
| address2...address8 | (Optional) Additional associated IP address. You can bind up to eight addresses to a host name. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The first character can be either a letter or a number. If you use a number, the operations you can perform (such as ping) are limited.
The following example defines two static mappings:
ip host croff 192.31.7.18 ip host bisso-gw 10.2.0.2 192.31.7.33
To enter into the host table the host name of an HP host to be used for HP Probe Proxy service, use the ip hp-host global configuration command. To remove a host name, use the no form of this command.
ip hp-host hostname ip-address| hostname | Name of the host. |
| ip-address | IP address of the host. |
No host names are defined.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
To use the HP Proxy service, you must first enter the host name of the HP host into the host table using this command.
The following example specifies an HP host's name and address, and then enables Probe Proxy:
ip hp-host BCWjo 131.108.1.27 interface ethernet 0 ip probe proxy
To have the Cisco IOS software to respond to Internet Control Message Protocol (ICMP) mask requests by sending ICMP Mask Reply messages, use the ip mask-reply interface configuration command. To disable this function, use the no form of this command.
ip mask-replyThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The following example enables the sending of ICMP Mask Reply messages on Ethernet interface 0:
interface ethernet 0 ip address 131.108.1.0 255.255.255.0 ip mask-reply
To enable local-area mobility, use the ip mobile arp interface configuration command. To disable local-area mobility, use the no form of this command.
ip mobile arp [timers keepalive hold-time] [access-group access-list-number | name]| timers | (Optional) Indicates that you are setting local-area mobility timers. |
| keepalive | (Optional) Frequency, in seconds, at which the Cisco IOS software sends unicast ARP messages to a relocated host to verify that the host is present and has not moved. The default keepalive time is 300 seconds (5 minutes). |
| hold-time | (Optional) Hold time, in seconds. This is the length of time the software considers that a relocated host is present without receiving some type of ARP broadcast or unicast from the host. Normally, the hold time should be at least three times greater than the keepalive time. The default hold time is 900 seconds (15 minutes). |
| access-group | (Optional) Indicates that you are applying an access list. This access list applies only to local-area mobility. |
| access-list-number | (Optional) Number of a standard IP access list. It is a decimal number from 1 to 99. Only hosts with addresses permitted by this access list are accepted for local-area mobility. |
| name | (Optional) Name of an IP access list. The name cannot contain a space or quotation mark, and must begin with an alphabetic character to avoid ambiguity with numbered access lists. |
Local-area mobility is disabled.
If you enable local-area mobility:
keepalive: 300 seconds (5
minutes)
hold-time: 900 seconds (15 minutes)
Interface configuration
This command first appeared in Cisco IOS Release 11.0.
Local-area mobility is supported on Ethernet, Token Ring, and FDDI interfaces only.
To create larger mobility areas, you must first redistribute the mobile routes into your Interior Gateway Protocol (IGP). The IGP must support host routes. You can use Enhanced IGRP, OSPF, or Intermediate System-to-Intermediate System (IS-IS); you can also use RIP, but this is not recommended. The mobile area must consist of a contiguous set of subnets.
Using an access list to control the list of possible mobile nodes is strongly encouraged. Without an access list, misconfigured hosts can be taken for mobile nodes and disrupt normal operations.
The following example configures local-area mobility on Ethernet interface 0:
bridge 1 protocol ieee access-list 10 permit 198.92.37.114 interface ethernet 0 ip mobile arp access-group 10 bridge-group 1
A dagger (+) indicates that the command is documented outside this chapter.
access-list
(standard)
bridge-group +
bridge protocol
+
default-metric (BGP, EGP, OSPF, and RIP)
+
network (BGP)+
network (EGP)
+
network (IGRP) +
network (RIP)
+
redistribute +
router eigrp
+
router isis +
router ospf
+
To set the maximum transmission unit (MTU) size of IP packets sent on an interface, use the ip mtu interface configuration command. To restore the default MTU size, use the no form of this command.
ip mtu bytes| bytes | MTU in bytes. |
Minimum is 128 bytes; maximum depends on interface medium.
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If an IP packet exceeds the MTU set for the interface, the Cisco IOS software will fragment it.
All devices on a physical medium must have the same protocol MTU in order to operate.
The following example sets the maximum IP packet size for the first serial interface to 300 bytes:
interface serial 0 ip mtu 300
A dagger (+) indicates that the command is documented outside this chapter.
mtu +
To specify the address of one or more name servers to use for name and address resolution, use the ip name-server global configuration command. To remove the addresses specified, use the no form of this command.
ip name-server server-address1 [[server-address2]...server-address6]| server-address1 | IP addresses of name server. |
| server-address2...server-address6 | (Optional) IP addresses of additional name servers (a maximum of six name servers). |
No name server addresses are specified.
Global configuration
This command first appeared in Cisco IOS Release 10.0
The following example specifies host 131.108.1.111 as the primary name server and host 131.108.1.2 as the secondary server:
ip name-server 131.108.1.111 131.108.1.2
This command will be reflected in the configuration file as follows:
ip name-server 131.108.1.111 ip name-server 131.108.1.2
ip
domain-lookup
ip
domain-name
To designate that traffic originating from or destined for the interface is subject to Network Address Translation (NAT), use the ip nat interface configuration command. To prevent the interface from being able to translate, use the no form of this command.
ip nat {inside | outside}| inside | Indicates the interface is connected to the inside network (the network subject to NAT translation). |
| outside | Indicates the interface is connected to the outside network. |
Traffic leaving or arriving at this interface is not subject to network address translation.
Interface configuration
This command first appeared in Cisco IOS Release 11.2.
Only packets moving between "inside" and "outside" interfaces can be translated. You must specify at least one inside interface and outside interface for each border router where you intend to use NAT.
The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28 ip nat inside source list 1 pool net-208 ! interface ethernet 0 ip address 171.69.232.182 255.255.255.240 ip nat outside ! interface ethernet 1 ip address 192.168.1.94 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 1 permit 192.168.2.0 0.0.0.255
clear
ip nat translation
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To enable Network Address Translation (NAT) of the inside destination address, use the ip nat inside destination global configuration command. To remove the dynamic association to a pool, use the no form of this command.
ip nat inside destination list {access-list-number | name} pool name| list access-list-number | Standard IP access list number. Packets with destination addresses that pass the access list are translated using global addresses from the named pool. |
| list name | Name of a standard IP access list. Packets with destination addresses that pass the access list are translated using global addresses from the named pool. |
| pool name | Name of the pool from which global IP addresses are allocated during dynamic translation. |
No inside destination addresses are translated.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Alternatively, the syntax form with the keyword static establishes a single static translation.
The following example translates between inside hosts addressed to either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28 ip nat inside destination list 1 pool net-208 ! interface ethernet 0 ip address 171.69.232.182 255.255.255.240 ip nat outside ! interface ethernet 1 ip address 192.168.1.94 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 1 permit 192.168.2.0 0.0.0.255
clear
ip nat translation
ip
nat
ip
nat inside source
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To enable Network Address Translation (NAT) of the inside source address, use the ip nat inside source global configuration command. To remove the static translation or remove the dynamic association to a pool, use the no form of this command.
ip nat inside source {list {access-list-number | name} pool name [overload] | static local-ip| list access-list-number | Standard IP access list number. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool. |
| list name | Name of a standard IP access list. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool. |
| pool name | Name of the pool from which global IP addresses are allocated dynamically. |
| overload | (Optional) Enables the router to use one global address for many local addresses. When overloading is configured, each inside host's TCP or UDP port number distinguishes between the multiple conversations using the same local IP address. |
| static local-ip | Sets up a single static translation; this argument establishes the local IP address assigned to a host on the inside network. The address could be randomly chosen, allocated from RFC 1918, or obsolete. |
| global-ip | Sets up a single static translation; this argument establishes the globally unique IP address of an inside host as it appears to the outside world. |
No NAT translation of inside source addresses occurs.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Alternatively, the syntax form with the keyword static establishes a single static translation.
The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28 ip nat inside source list 1 pool net-208 ! interface ethernet 0 ip address 171.69.232.182 255.255.255.240 ip nat outside ! interface ethernet 1 ip address 192.168.1.94 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 1 permit 192.168.2.0 0.0.0.255
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To enable Network Address Translation (NAT) of the outside source address, use the ip nat outside source global configuration command. To remove the static entry or the dynamic association, use the no form of this command.
ip nat outside source {list {access-list-number | name} pool name | static global-ip local-ip}| list access-list-number | Standard IP access list number. Packets with source addresses that pass the access list are translated using global addresses from the named pool. |
| list name | Name of a standard IP access list. Packets with source addresses that pass the access list are translated using global addresses from the named pool. |
| pool name | Name of the pool from which global IP addresses are allocated. |
| static global-ip | Sets up a single static translation. This argument establishes the globally unique IP address assigned to a host on the outside network by its owner. It was allocated from globally routable network space. |
| local-ip | Sets up a single static translation. This argument establishes the local IP address of an outside host as it appears to the inside world. The address was allocated from address space routable on the inside (RFC 1918, perhaps). |
No translation of source addresses coming from the outside to the inside network occurs.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
You might have IP addresses that are not legal, officially assigned IP addresses. Perhaps you chose IP addresses that officially belong to another network. The case of an address used illegally and legally is called overlapping. You can use NAT to translate inside addresses that overlap with outside addresses. Use this feature if your IP addresses in the stub network happen to be legitimate IP addresses belonging to another network, and you need to communicate with those hosts or routers.
This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Alternatively, the syntax form with the keyword static establishes a single static translation.
The following example would translate between inside hosts addressed from the 9.114.11.0 network to the globally unique 171.69.233.208/28 network. Further packets from outside hosts addressed from the 9.114.11.0 network (the true 9.114.11.0 network) are translated to appear to be from the network 10.0.1.0/24.
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28 ip nat pool net-10 10.0.1.0 10.0.1.255 prefix-length 24 ip nat inside source list 1 pool net-208 ip nat outside source list 1 pool net-10 ! interface ethernet 0 ip address 171.69.232.182 255.255.255.240 ip nat outside ! interface ethernet 1 ip address 9.114.11.39 255.255.255.0 ip nat inside ! access-list 1 permit 9.114.11.0 0.0.0.255
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To define a pool of IP addresses for Network Address Translation (NAT), use the ip nat pool global configuration command. To remove one or more addresses from the pool, use the no form of this command.
ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}| name | Name of the pool. |
| start-ip | Starting IP address that defines the range of addresses in the address pool. |
| end-ip | Ending IP address that defines the range of addresses in the address pool. |
| netmask netmask | Network mask that indicates which address bits belong to the network and subnetwork fields and which bits belong to the host field. Specify the netmask of the network to which the pool addresses belong. |
| prefix-length prefix-length | Number that indicates how many bits of the netmask are ones (how many bits of the address indicate network). Specify the netmask of the network to which the pool addresses belong. |
| type rotary | (Optional) Indicates that the range of address in the address pool identify real, inside hosts among which TCP load distribution will occur. |
No pool of addresses is defined.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
This command defines a pool of addresses using start address, end address, and either netmask or prefix length. The pool could define either an inside global pool, an outside local pool, or a rotary pool.
The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 networks to the globally unique 171.69.233.208/28 network:
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28 ip nat inside source list 1 pool net-208 ! interface ethernet 0 ip address 171.69.232.182 255.255.255.240 ip nat outside ! interface ethernet 1 ip address 192.168.1.94 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 1 permit 192.168.2.0 0.0.0.255
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat translation
show
ip nat statistics
show
ip nat translations
To change the amount of time after which Network Address Translation (NAT) translations time out, use the ip nat translation global configuration command. To disable the timeout, use the no form of this command.
ip nat translation {timeout | udp-timeout | dns-timeout | tcp-timeout | finrst-timeout} seconds| timeout | Specifies that the timeout value applies to dynamic translations except for overload translations. Default is 86400 seconds (24 hours). |
| udp-timeout | Specifies that the timeout value applies to the UDP port. Default is 300 seconds (5 minutes). |
| dns-timeout | Specifies that the timeout value applies to connections to the Domain Naming System (DNS). Default is 60 seconds. |
| tcp-timeout | Specifies that the timeout value applies to the TCP port. Default is 86400 seconds (24 hours). |
| finrst-timeout | Specifies that the timeout value applies to Finish and Reset TCP packets, which terminate a connection. Default is 60 seconds. |
| seconds | Number of seconds after which the specified port translation times out. Default values are listed in the Default section. |
timeout is 86400 seconds (24 hours)
udp-timeout
is 300 seconds (5 minutes)
dns-timeout
is 60 seconds (1 minute)
tcp-timeout is
86400 seconds (24 hours)
finrst-timeout is 60 seconds (1 minute)
Global configuration
This command first appeared in Cisco IOS Release 11.2.
When port translation is configured, there is finer control over translation entry timeouts because each entry contains more context about the traffic that is using it. Non-Domain Naming System UDP translations time out after 5 minutes, while DNS times out in 1 minute. TCP translations timeout in 24 hours, unless a RST or FIN is seen on the stream, in which case they will time out in 1 minute.
The following example causes UDP port translation entries to timeout after 10 minutes:
ip nat translation udp-timeout 600
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat pool
show
ip nat statistics
show
ip nat translations
To specify the format in which netmasks are displayed in show command output, use the ip netmask-format line configuration command. To restore the default display format, use the no form of this command.
ip netmask-format {bitcount | decimal | hexadecimal}| bitcount | Addresses are followed by a slash and the total number of bits in the netmask. For example, 131.108.11.0/24 indicates that the netmask is 24 bits. |
| decimal | Network masks are displayed in dotted decimal notation (for example, 255.255.255.0). |
| hexadecimal | Network masks are displayed in hexadecimal format, as indicated by the leading 0X (for example, 0XFFFFFF00). |
Netmasks are displayed in dotted decimal format.
Line configuration
This command first appeared in Cisco IOS Release 10.3.
IP uses a 32-bit mask that indicates which address bits belong to the network and subnetwork fields, and which bits belong to the host field. This is called a netmask. By default, show commands display an IP address and then its netmask in dotted decimal notation. For example, a subnet would be displayed as 131.108.11.0 255.255.255.0.
However, you can specify that the display of the network mask appear in hexadecimal format or bit count format instead. The hexadecimal format is commonly used on UNIX systems. The previous example would be displayed as 131.108.11.0 0XFFFFFF00.
The bitcount format for displaying network masks is to append a slash (/) and the total number of bits in the netmask to the address itself. The previous example would be displayed as 131.108.11.0/24.
The following example configures network masks for the specified line to be displayed in bitcount notation in the output of show commands:
line vty 0 4 ip netmask-format bitcount
To configure the authentication string for an interface using Next Hop Resolution Protocol (NHRP), use the ip nhrp authentication interface configuration command. To remove the authentication string, use the no form of this command.
ip nhrp authentication string| string | Authentication string configured for the source and destination stations that controls whether NHRP stations allow intercommunication. The string can be up to 8 characters long. |
No authentication string is configured; the Cisco IOS software adds no authentication option to NHRP packets it generates.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
All routers configured with NHRP within one logical NBMA network must share the same authentication string.
In the following example, the authentication string specialxx must be configured in all devices using NHRP on the interface before NHRP communication occurs:
ip nhrp authentication specialxx
To change the number of seconds that NHRP nonbroadcast, multiaccess (NBMA) addresses are advertised as valid in authoritative NHRP responses, use the ip nhrp holdtime interface configuration command. To restore the default value, use the no form of this command.
ip nhrp holdtime seconds-positive [seconds-negative]| seconds-positive | Time in seconds that NBMA addresses are advertised as valid in positive authoritative NHRP responses. |
| seconds-negative | (Optional) Time in seconds that NBMA addresses are advertised as valid in negative authoritative NHRP responses. |
7200 seconds (2 hours) for both arguments
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
The ip nhrp holdtime command affects authoritative responses only. The advertised holding time is the length of time the Cisco IOS software tells other routers to keep information that it is providing in authoritative NHRP responses. The cached IP-to-NBMA address mapping entries are discarded after the holding time expires.
The NHRP cache can contain static and dynamic entries. The static entries never expire. Dynamic entries expire regardless of whether they are authoritative or nonauthoritative.
If you want to change the valid time period for negative NHRP responses, you must also include a value for positive NHRP responses, as the arguments are position-dependent.
In the following example, NHRP NBMA addresses are advertised as valid in positive authoritative NHRP responses for one hour:
ip nhrp holdtime 3600
In the following example, NHRP NBMA addresses are advertised as valid in negative authoritative NHRP responses for one hour and in positive authoritative NHRP responses for two hours:
ip nhrp holdtime 7200 3600
To control which IP packets can trigger sending a Next Hop Resolution Protocol (NHRP) Request, use the ip nhrp interest interface configuration command. To restore the default value, use the no form of this command.
ip nhrp interest access-list-number| access-list-number | Standard or extended IP access list number in the range 1 to 199. |
All non-NHRP packets can trigger NHRP requests.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
Use this command with the access-list command to control which IP packets trigger NHRP Requests.
The ip nhrp interest command controls which packets cause NHRP address resolution to take place; the ip nhrp use command controls how readily the system attempts such address resolution.
In the following example, any TCP traffic can cause NHRP Requests to be sent, but no other IP packets will cause NHRP Requests:
ip nhrp interest 101 access-list 101 permit tcp any any
access-list
(extended)
access-list
(standard)
ip
nhrp use
To statically configure the IP-to-NBMA address mapping of IP destinations connected to a nonbroadcast, multiaccess (NBMA) network, use the ip nhrp map interface configuration command. To remove the static entry from NHRP cache, use the no form of this command.
ip nhrp map ip-address nbma-address| ip-address | IP address of the destinations reachable through the NBMA network. This address is mapped to the NBMA address. |
| nbma-address | NBMA address that is directly reachable through the NBMA network. The address format varies depending on the medium you are using. For example, ATM has an NSAP address, Ethernet has a MAC address, and SMDS has an E.164 address. This address is mapped to the IP address. |
No static IP-to-NBMA cache entries exist.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
You will probably have to configure at least one static mapping in order to reach the Next Hop Server. Repeat this command to statically configure multiple IP-to-NBMA address mappings.
In the following example, this station in a multipoint tunnel network is statically configured to be served by two Next Hop Servers 100.0.0.1 and 100.0.1.3. The NBMA address for 100.0.0.1 is statically configured to be 11.0.0.1 and the NBMA address for 100.0.1.3 is 12.2.7.8.
interface tunnel 0 ip nhrp nhs 100.0.0.1 ip nhrp nhs 100.0.1.3 ip nhrp map 100.0.0.1 11.0.0.1 ip nhrp map 100.0.1.3 12.2.7.8
To configure NBMA addresses used as destinations for broadcast or multicast packets to be sent over a tunnel network, use the ip nhrp map multicast interface configuration command. To remove the destinations, use the no form of this command.
ip nhrp map multicast nbma-address| nbma-address | Nonbroadcast, multiaccess (NBMA) address which is directly reachable through the NBMA network. The address format varies depending on the medium you are using. |
No NBMA addresses are configured as destinations for broadcast or multicast packets.
Interface configuration
This command first appeared in Cisco IOS Release 10.3, and applies only to tunnel interfaces.
The command is useful for supporting broadcasts over a tunnel network when the underlying network does not support IP multicast. If the underlying network does support IP multicast, you should use the tunnel destination command to configure a multicast destination for transmission of tunnel broadcasts or multicasts.
When multiple NBMA addresses are configured, the system replicates the broadcast packet for each address.
In the following example, if a packet is sent to 10.255.255.255, it is replicated to destinations 11.0.0.1 and 11.0.0.2. Addresses 11.0.0.1 and 11.0.0.2 are the IP addresses of two other routers that are part of the tunnel network, but those addresses are their addresses in the underlying network, not the tunnel network. They would have tunnel addresses that are in network 10.0.0.0.
interface tunnel 0 ip address 10.0.0.3 255.0.0.0 ip nhrp map multicast 11.0.0.1 ip nhrp map multicast 11.0.0.2
To change the maximum frequency at which NHRP packets can be sent, use the ip nhrp max-send interface configuration command. To restore this frequency to the default value, use the no form of this command.
ip nhrp max-send pkt-count every interval| pkt-count | Number of packets which can be transmitted in the range from 1 to 65535. Default is 5 packets. |
| interval | Time (in seconds) in the range from 10 to 65535. Default is 10 seconds. |
pkt-count = 5 packets
interval = 10 seconds
Interface configuration
This command first appeared in Cisco IOS Release 11.1.
The software maintains a per-interface quota of NHRP packets that can be transmitted. NHRP traffic, whether locally generated or forwarded, cannot be sent at a rate that exceeds this quota. The quota is replenished at the rate specified by interval.
In the following example, only 1 NHRP packet can be sent from serial interface 0 each minute:
interface serial 0 ip nhrp max-send 1 every 60
To enable the Next Hop Resolution Protocol (NHRP) on an interface, use the ip nhrp network-id interface configuration command. To disable NHRP on the interface, use the no form of this command.
ip nhrp network-id number| number | Globally unique, 32-bit network identifier for a nonbroadcast, multiaccess (NBMA) network. The range is 1 to 4294967295. |
NHRP is disabled on the interface.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
In general, all NHRP stations within one logical NBMA network must be configured with the same network identifier.
The following example enables NHRP on the interface:
ip nhrp network-id 1
To specify the address of one or more NHRP Next Hop Servers, use the ip nhrp nhs interface configuration command. To remove the address, use the no form of this command.
ip nhrp nhs nhs-address [net-address [netmask]]| nhs-address | Address of the Next Hop Server being specified. |
| net-address | (Optional) IP address of a network served by the Next Hop Server. |
| netmask | (Optional) IP network mask to be associated with the net IP address. The net IP address is logically ANDed with the mask. |
No Next Hop Servers are explicitly configured, so normal network layer routing decisions are used to forward NHRP traffic.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
Use this command to specify the address of a Next Hop Server and the networks it serves. Normally, NHRP consults the network layer forwarding table to determine how to forward NHRP packets. When Next Hop Servers are configured, these next hop addresses override the forwarding path that would otherwise be used for NHRP traffic.
For any Next Hop Server that is configured, you can specify multiple networks that it serves by repeating this command with the same nhs-address, but with different net-address IP network addresses.
In the following example, the Next Hop Server with address 131.108.10.11 serves IP network 10.0.0.0. The mask is 255.0.0.0.
ip nhrp nhs 131.108.10.11 10.0.0.0 255.0.0.0
To re-enable the use of forward record and reverse record options in NHRP Request and Reply packets, use the ip nhrp record interface configuration command. To suppress the use of such options, use the no form of this command.
ip nhrp recordThis command has no arguments or keywords.
Forward record and reverse record options are used in NHRP Request and Reply packets.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
Forward record and reverse record options provide loop detection and are enabled by default. Using the no form of this command disables this method of loop detection. For another method of loop detection, see the ip nhrp responder command.
The following example suppresses forward record and reverse record options:
no ip nhrp record
To designate which interface's primary IP address the Next Hop Server will use in NHRP Reply packets when the NHRP requestor uses the Responder Address option, use the ip nhrp responder interface configuration command. To remove the designation, use the no form of this command.
ip nhrp responder type number| type | Interface type whose primary IP address is used when a Next Hop Server complies with a Responder Address option (for example, serial, tunnel). |
| number | Interface number whose primary IP address is used when a Next Hop Server complies with a Responder Address option. |
The Next Hop Server uses the IP address of the interface where the NHRP Request was received.
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
If an NHRP requestor wants to know which Next Hop Server generates an NHRP Reply packet, it can request that information through the Responder Address option. The Next Hop Server that generates the NHRP Reply packet then complies by inserting its own IP address in the Responder Address option of the NHRP Reply. The Next Hop Server uses the primary IP address of the specified interface.
If an NHRP Reply packet being forwarded by a Next Hop Server contains that Next Hop Server's own IP address, the Next Hop Server generates an Error Indication of type "NHRP Loop Detected" and discards the Reply.
In the following example, any NHRP requests for the Responder Address will cause this router acting as a Next Hop Server to supply the primary IP address of serial interface 0 in the NHRP Reply packet:
ip nhrp responder serial 0
To configure the software so that NHRP is deferred until the system has attempted to send data traffic to a particular destination multiple times, use the ip nhrp use interface configuration command. To restore the default value, use the no form of this command.
ip nhrp use usage-count| usage-count | Packet count in the range from 1 to 65535. Default is 1. |
usage-count = 1. The first time a data packet is sent to a destination for which the system determines NHRP can be used, an NHRP request is sent.
Interface configuration
This command first appeared in Cisco IOS Release 11.1.
When the software attempts to transmit a data packet to a destination for which it has determined that NHRP address resolution can be used, an NHRP request for that destination is normally transmitted right away. Configuring the usage-count causes the system to wait until that many data packets have been sent to a particular destination before it attempts NHRP. The usage-count for a particular destination is measured over 1-minute intervals (the NHRP cache expiration interval).
The usage-count applies per destination. So if usage-count is configured to be 3, and 4 data packets are sent toward 10.0.0.1 and 1 packet toward 10.0.0.2, then an NHRP request is generated for 10.0.0.1 only.
If the system continues to need to forward data packets to a particular destination, but no NHRP response has been received, retransmission of NHRP requests are performed. This retransmission occurs only if data traffic continues to be sent to a destination.
The ip nhrp interest command controls which packets cause NHRP address resolution to take place; the ip nhrp use command controls how readily the system attempts such address resolution.
In the following example, if in the first minute 4 packets are sent to one destination and 5 packets are sent to a second destination, then a single NHRP request is generated for the second destination.
If in the second minute the same traffic is generated and no NHRP responses have been received, then the system retransmits its request for the second destination.
ip nhrp use 5
ip
nhrp interest
ip
nhrp max-send
To enable the HP Probe Proxy support, which allows the Cisco IOS software to respond to HP Probe Proxy Name requests, use the ip probe proxy interface configuration command. To disable HP Probe Proxy, use the no form of this command.
ip probe proxyThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
HP Probe Proxy Name requests are typically used at sites that have HP equipment and are already using HP Probe.
To use the HP Proxy service, you must first enter the host name of the HP host into the host table using the ip hp-host global configuration command.
The following example specifies an HP host's name and address, and then enables Probe Proxy:
ip hp-host BCWjo 131.108.1.27 interface ethernet 0 ip probe proxy
To enable proxy ARP on an interface, use the ip proxy-arp interface configuration command. To disable proxy ARP on the interface, use the no form of this command.
ip proxy-arpThis command has no arguments or keywords.
Enabled
Interface configuration
Usage Guidelines
This command first appeared in Cisco IOS Release 10.0.
The following example enables proxy ARP on Ethernet interface 0:
interface ethernet 0 ip proxy-arp
To enable the sending of redirect messages if the Cisco IOS software is forced to resend a packet through the same interface on which it was received, use the ip redirects interface configuration command. To disable the sending of redirect messages, use the no form of this command.
ip redirectsThis command has no arguments or keywords.
Enabled, unless Hot Standby Router Protocol is configured
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If the Hot Standby Router Protocol is configured on an interface, ICMP Redirect messages are disabled by default for the interface.
The following example enables the sending of IP redirects on Ethernet interface 0:
interface ethernet 0 ip redirects
To control the use of high-speed switching caches for IP routing, as well as the use of autonomous switching, use the ip route-cache interface configuration command. To disable any of these switching modes, use the no form of this command.
ip route-cache [cbus]IP autonomous switching is disabled.
Fast switching varies by interface
and media.
SSE switching of IP is disabled.
Optimum switching is enabled
on supported interfaces.
Distributed switching is disabled.
Interface configuration
This command first appeared in Cisco IOS Release 10.0. The optimum keyword first appeared in Cisco IOS Release 11.1. Ths distributed keyword first appeared in Cisco IOS Release 11.2.
Using the route cache is often called fast switching. The route cache allows outgoing packets to be load-balanced on a per-destination basis.
The ip route-cache command with no additional keywords enables fast switching and disables.
Our routers generally offer better packet transfer performance when fast switching is enabled, with one exception. On networks using slow serial links (64 K and below), disabling fast switching to enable the per-packet load sharing is usually the best choice.
Autonomous switching gives a router faster packet processing by allowing the ciscoBus to switch packets independently without interrupting the system processor. It works only in Cisco 7000 series systems with a switch processor controller card running microcode Version 1.4 or later.
You can enable IP fast switching when the input and output interfaces are the same interface, using the ip route-cache same-interface command. This normally is not recommended, though it is useful when you have partially meshed media, such as Frame Relay. You could use this feature on other interfaces, although it is not recommended because it would interfere with redirection.
SSE switching gives a router even faster packet processing than is provided by the other ip route-cache commands by allowing the SSE to switch packets without interrupting the system processor. SSE switching is supported only in Cisco 7000 systems with an SSP board. Fast switching must be active to enable SSE switching. SSE switching requires that fast switching be enabled.
Flow switching is faster than the default optimum fast-switching on Cisco 7507 and 7513 platforms when IP accounting or extended access lists are used. When the RSP is flow switching, it uses a flow cache instead of a destination network cache to switch IP packets. The flow cache uses source and destination network address, protocol, and source and destination port numbers to distinguish entries.
The flow caching option can also be used to allow statistics to be gathered with a finer granularity. The statistics include IP subprotocols, well-known ports, total flows, average number of packets per flow, and average flow lifetime.
On Cisco RSP7000 and Cisco 7500 series routers with a route switch processor (RSP) and with Versatile Interface Processor (VIP) controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. When VIP distributed switching is enabled, the input VIP interface tries to switch IP packets instead of forwarding them to the RSP for switching. Distributed switching helps decrease the demand on the RSP.
Not all switching methods are available on all platforms.
The following example enables both fast switching and autonomous switching:
ip route-cache cbus
The following example disables both fast switching and autonomous switching:
no ip route-cache
The following example turns off autonomous switching only:
no ip route-cache cbus
The following example enables VIP distributed flow switching on the interface:
interface ethernet 0/5/0 ip address 17.252.245.2 255.255.255.0 ip route-cache distributed ip route-cache flow
The following example returns the system to its defaults (fast switching enabled; autonomous switching disabled):
ip route-cache
ip
cache-invalidate-delay
show
ip cache
This command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
To bridge IP, the no ip routing command must be configured to disable IP routing. However, you need not specify no ip routing in conjunction with concurrent routing and bridging to bridge IP.
The following example enables IP routing:
ip routing
To add a basic security option to all outgoing packets, use the ip security add interface configuration command. To disable the adding of a basic security option to all outgoing packets, use the no form of this command.
ip security addThis command has no arguments or keywords.
Disabled, when the security level of the interface is "Unclassified Genser" (or unconfigured). Otherwise, the default is enabled.
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If an outgoing packet does not have a security option present, this interface configuration command will add one as the first IP option. The security label added to the option field is the label that was computed for this packet when it first entered the router. Because this action is performed after all the security tests have been passed, this label will either be the same as or will fall within the range of the interface.
The following example adds a basic security option to each packet leaving Ethernet interface 0:
interface ethernet 0 ip security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To attach Auxiliary Extended Security Options (AESOs) to an interface, use the ip security aeso interface configuration command. To disable AESO on an interface, use the no form of this command.
ip security aeso source compartment-bits| source | Extended Security Option (ESO) source. This can be an integer from 0 to 255. |
| compartment-bits | Compartment bits in hexadecimal. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
Compartment bits are specified only if this AESO is to be inserted in a packet. On every incoming packet at this level on this interface, these AESOs should be present.
Beyond being recognized, no further processing of AESO information is performed. AESO contents are not checked and are assumed to be valid if the source is listed in the configurable AESO table.
Configuring any per-interface extended IP security option (IPSO) information automatically enables ip security extended-allowed (disabled by default).
In the following example, the extended security option source is defined as 5 and the compartments bits are set to 5:
interface ethernet 0 ip security aeso 5 5
ip
security eso-info
ip
security eso-max
ip
security eso-min
ip
security extended-allowed
To set the level of classification and authority on the interface, use the ip security dedicated interface configuration command. To reset the interface to the default classification and authorities, use the no form of this command.
ip security dedicated level authority [authority...]| level | Degree of sensitivity of information. The level keywords are listed in Table 1. |
| authority | Organization that defines the set of security levels that will be used in a network. The authority keywords are listed in Table 2. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
All traffic entering the system on this interface must have a security option that exactly matches this label. Any traffic leaving via this interface will have this label attached to it.
The following definitions apply to the descriptions of the IP security options (IPSO) in this section:
| Level Keyword | Bit Pattern |
|---|---|
| Reserved4 | 0000 0001 |
| TopSecret | 0011 1101 |
| Secret | 0101 1010 |
| Confidential | 1001 0110 |
| Reserved3 | 0110 0110 |
| Reserved2 | 1100 1100 |
| Unclassified | 1010 1011 |
| Reserved1 | 1111 0001 |
| Authority Keyword | Bit Pattern |
|---|---|
| Genser | 1000 0000 |
| Siop-Esi | 0100 0000 |
| DIA | 0010 0000 |
| NSA | 0001 0000 |
| DOE | 0000 1000 |
The following example sets a confidential level with Genser authority:
ip security dedicated confidential Genser
ip
security add
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To configure system-wide defaults for extended IP Security Option (IPSO) information, use the ip security eso-info global configuration command. To return to the default settings, use the no form of this command.
ip security eso-info source compartment-size default-bit| source | Hexadecimal or decimal value representing the extended IPSO source. This is an integer from 0 to 255. |
| compartment-size | Maximum number of bytes of compartment information allowed for a particular extended IPSO source. This is an integer from 1 to 16. |
| default-bit | Default bit value for any unsent compartment bits. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
This command configures Extended Security Option (ESO) information, including Auxiliary Extended Security Option (AESO). Transmitted compartment info is padded to the size specified by the compartment-size argument.
In the following example, system-wide defaults for source, compartment size, and the default bit value are set:
ip security eso-info 100 5 1
ip
security eso-max
ip
security eso-min
To specify the maximum sensitivity level for an interface, use the ip security eso-max interface configuration command. To return to the default, use the no form of this command.
ip security eso-max source compartment-bits| source | Extended Security Option (ESO) source. This is an integer from 1 to 255. |
| compartment-bits | Compartment bits in hexadecimal. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The command is used to specify the minimum sensitivity level for a particular interface. Before the per interface compartment information for a particular Network Level Extended Security Option (NLESO) source can be configured, the ip security eso-info global configuration command must be used to specify the default information.
On every incoming packet on the interface, these extended security options should be resent at the minimum level and should match the configured compartment bits. Every outgoing packet must have these ESOs.
On every packet transmitted or received on this interface, any NLESO sources present in the IP header should be bounded by the minimum sensitivity level and bounded by the maximum sensitivity level configured for the interface.
When transmitting locally generated traffic out this interface, or adding security information (with the ip security add command), the maximum compartment bit information can be used to construct the NLESO sources placed in the IP header.
A maximum of 16 NLESO sources can be configured per interface. Due to IP header length restrictions, a maximum of 9 of these NLESO sources appear in the IP header of a packet.
In the following example, the specified ESO source is 240 and the compartment bits are specified as 500:
interface ethernet 0 ip security eso-max 240 500
ip
security eso-info
ip
security eso-min
To configure the minimum sensitivity for an interface, use the ip security eso-min interface configuration command. To return to the default, use the no form of this command.
ip security eso-min source compartment-bits| source | Extended Security Option (ESO) source. This is an integer from 1 to 255. |
| compartment-bits | Compartment bits in hexadecimal. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The command is used to specify the minimum sensitivity level for a particular interface. Before the per-interface compartment information for a particular Network Level Extended Security Option (NLESO) source can be configured, the ip security eso-info global configuration command must be used to specify the default information.
On every incoming packet on this interface, these extended security options should be resent at the minimum level and should match the configured compartment bits. Every outgoing packet must have these ESOs.
On every packet transmitted or received on this interface, any NLESO sources present in the IP header should be bounded by the minimum sensitivity level and bounded by the maximum sensitivity level configured for the interface.
When transmitting locally generated traffic out this interface, or adding security information (with the iip security add command), the maximum compartment bit information can be used to construct the NLESO sources placed in the IP header.
A maximum of 16 NLESO sources can be configured per interface. Due to IP header length restrictions, a maximum of 9 of these NLESO sources appear in the IP header of a packet.
In the following example, the specified ESO source is 5 and the compartment bits are specified as 5:
interface ethernet 0 ip security eso-min 5 5
ip
security eso-info
ip
security eso-max
To accept packets on an interface that has an extended security option present, use the ip security extended-allowed interface configuration command. To restore the default, use the no form of this command.
ip security extended-allowedThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
Packets containing extended security options are rejected.
The following example allows interface Ethernet 0 to accept packets that have an extended security option present:
interface ethernet 0 ip security extended-allowed
ip
security add
ip
security dedicated
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To prioritize the presence of security options on a packet, use the ip security first interface configuration command. To disable this function, use the no form of this command.
ip security firstThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If a basic security option is present on an outgoing packet, but it is not the first IP option, then the packet is moved to the front of the options field when this interface configuration command is used.
The following example ensures that, if a basic security option is present in the options field of a packet exiting interface Ethernet 0, the packet is moved to the front of the options field:
interface ethernet 0 ip security first
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To have the Cisco IOS software ignore the authorities field of all incoming packets, use the ip security ignore-authorities interface configuration command. To disable this function, use the no form of this command.
ip security ignore-authoritiesThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
When the packet's authority field is ignored, the value used in place of this field is the authority value declared for the specified interface. The ip security ignore-authorities can only be configured on interfaces with dedicated security levels.
The following example causes interface Ethernet 0 to ignore the authorities field on all incoming packets:
interface ethernet 0 ip security ignore-authorities
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To force the Cisco IOS software to accept packets on the interface, even if they do not include a security option, use the ip security implicit-labelling interface configuration command. To disable this function, use the no form of this command.
ip security implicit-labelling [level authority [authority...]]| level | (Optional) Degree of sensitivity of information. If your interface has multilevel security set, you must specify this argument. (See the level keywords listed in Table 1 in the ip security dedicated command section.) |
| authority | (Optional) Organization that defines the set of security levels that will be used in a network. If your interface has multilevel security set, you must specify this argument. You can specify more than one. (See the authority keywords listed in Table 2 in the ip security dedicated command section.) |
Enabled, when the security level of the interface is "Unclassified Genser" (or unconfigured). Otherwise, the default is disabled.
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If your interface has multilevel security set, you must use the expanded form of the command (with the optional arguments as noted in brackets) because the arguments are used to specify the precise level and authority to use when labeling the packet. If your interface has dedicated security set, the additional arguments are ignored.
In the following example, an interface is set for security and will accept unlabeled packets:
ip security dedicated confidential genser ip security implicit-labelling
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security multilevel
ip
security reserved-allowed
ip
security strip
To set the range of classifications and authorities on an interface, use the ip security multilevel interface configuration command. To disable this function, use the no form of this command.
ip security multilevel level1 [authority1...] to level2 authority2 [authority2...]| level1 | Degree of sensitivity of information. The classification level of incoming packets must be equal to or greater than this value for processing to occur. (See the level keywords found in Table 1 in the ip security dedicated command section.) |
| authority1 | (Optional) Organization that defines the set of security levels that will be used in a network. The authority bits must be a superset of this value. (See the authority keywords listed in Table 2 in the ip security dedicated command section.) |
| to | Separates the range of classifications and authorities. |
| level2 | Degree of sensitivity of information. The classification level of incoming packets must be equal to or less than this value for processing to occur. (See the level keywords found in Table 1 in the ip security dedicated command section.) |
| authority2 | Organization that defines the set of security levels that will be used in a network. The authority bits must be a proper subset of this value. (See the authority keywords listed in Table 2 in the ip security dedicated command section.) |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
All traffic entering or leaving the system must have a security option that falls within this range. Being within range requires that the following two conditions be met:
The following example specifies levels Unclassified to Secret and NSA authority:
ip security multilevel unclassified to secret nsa
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security reserved-allowed
ip
security strip
To treat as valid any packets that have Reserved1 through Reserved4 security levels, use the ip security reserved-allowed interface configuration command. To disable this feature, use the no form of this command.
ip security reserved-allowedThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
When you set multilevel security on an interface, and indicate, for example, that the highest range allowed is Confidential, and the lowest is Unclassified, the Cisco IOS software neither allows nor operates on packets that have security levels of Reserved3 and Reserved2 because they are undefined.
If you use the IP Security Option (IPSO) to block transmission out of unclassified interfaces, and you use one of the Reserved security levels, you must enable this feature to preserve network security.
The following example allows a security level of Reserved through Ethernet interface 0:
interface ethernet 0 ip security reserved-allowed
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security strip
To remove any basic security option on outgoing packets on an interface, use the ip security strip interface configuration command. To disable this function, use the no form of this command.
ip security stripThis command has no arguments or keywords.
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The removal procedure is performed after all security tests in the router have been passed. This command is not allowed for multilevel interfaces.
The following example removes any basic security options on outgoing packets on Ethernet interface 0:
interface ethernet 0 ip security strip
ip
security add
ip
security dedicated
ip
security extended-allowed
ip
security first
ip
security ignore-authorities
ip
security implicit-labelling
ip
security multilevel
ip
security reserved-allowed
To allow the Cisco IOS software to handle IP datagrams with source routing header options, use the ip source-route global configuration command. To have the software discard any IP datagram containing a source-route option, use the no form of this command.
ip source-routeThis command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The following example enables the handling of IP datagrams with source routing header options:
ip source-route
To enable the use of subnet zero for interface addresses and routing updates, use the ip subnet-zero global configuration command. To restore the default, use the no form of this command.
ip subnet-zeroThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The ip subnet-zero command provides the ability to configure and route to subnet-zero subnets.
Subnetting with a subnet address of zero is discouraged because of the confusion inherent in having a network and a subnet with indistinguishable addresses.
In the following example, subnet-zero is enabled:
ip subnet-zero
| characters | Maximum number of characters that Telnet or rlogin can read in one read instruction. The default value is 0, which Telnet and rlogin interpret as the largest possible 32-bit positive number. |
0, which Telnet and rlogin interpret as the largest possible 32-bit positive number.
Global configuration
This command first appeared in Cisco IOS Release 9.1.
It is unlikely you will need to change the default value.
The following example sets the maximum TCP read size to 64000 bytes:
ip tcp chunk-size 64000
To specify the total number of header compression connections that can exist on an interface, use the ip tcp compression-connections interface configuration command. To restore the default, use the no form of this command.
ip tcp compression-connections number| number | Number of connections the cache supports. It can be a number from 3 to 256. |
16 connections
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
You should configure one connection for each TCP connection through the specified interface.
Each connection sets up a compression cache entry, so you are in effect specifying the maximum number of cache entries and the size of the cache. Too few cache entries for the specified interface can lead to degraded performance, while too many cache entries can lead to wasted memory.
In the following example, the first serial interface is set for header compression with a maximum of ten cache entries:
interface serial 0 ip tcp header-compression ip tcp compression-connections 10
ip
tcp header-compression
show
ip tcp header-compression
To enable TCP header compression, use the ip tcp header-compression interface configuration command. To disable compression, use the no form of this command.
ip tcp header-compression [passive]| passive | (Optional) Compresses outgoing TCP packets only if incoming TCP packets on the same interface are compressed. If you do not specify the passive keyword, the Cisco IOS software compresses all traffic. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.ß
You can compress the headers of your TCP/IP packets in order to reduce the size of your packets. TCP header compression is supported on serial lines using Frame Relay, HDLC or Point-to-Point (PPP) encapsulation. You must enable compression on both ends of a serial connection. RFC 1144 specifies the compression process. Compressing the TCP header can speed up Telnet connections dramatically. In general, TCP header compression is advantageous when your traffic consists of many small packets, not for traffic that consists of large packets. Transaction processing (usually using terminals) tends to use small packets while file transfers use large packets. This feature only compresses the TCP header, so it has no effect on UDP packets or other protocol headers.
When compression is enabled, fast switching is disabled. This means that fast interfaces like T1 can overload the router. Consider your network's traffic characteristics before using this command.
In the following example, the first serial interface is set for header compression with a maximum of ten cache entries:
interface serial 0 ip tcp header-compression ip tcp compression-connections 10
ip tcp compression-connections
To enable Path MTU Discovery for all new TCP connections from the router, use the ip tcp path-mtu-discovery interface configuration command. To disable the feature, use the no form of this command.
ip tcp path-mtu-discovery [age-timer {minutes | infinite}]| age-timer minutes | (Optional) Time interval (in minutes) after which TCP re-estimates the Path MTU with a larger maximum segment size (MSS). The maximum is 30 minutes; the default is 10 minutes. |
| infinite | (Optional) Turns off the age-timer. |
Disabled. If enabled, default minutes is 10 minutes.
Interface configuration
This command first appeared in Cisco IOS Release 10.3. The age-timer and infinite keywords first appeared in Cisco IOS Release 11.2.
Path MTU Discovery is a method for maximizing the use of available bandwidth in the network between the end points of a TCP connection. It is described in RFC 1191. Existing connections are not affected when this feature is turned on or off.
Customers using TCP connections to move bulk data between systems on distinct subnets would benefit most by enabling this feature. This might include customers using RSRB with TCP encapsulation, STUN, X.25 Remote Switching (also known as XOT, or X.25 over TCP), and some protocol translation configurations.
The age timer is a time interval for how often TCP re-estimates the Path MTU with a larger MSS. By using the age timer, TCP Path MTU becomes a dynamic process. If MSS used for the connection is smaller than what the peer connection can handle, a larger MSS is tried every time the age timer expires. The discovery process is stopped when either the send MSS is as large as the peer negotiated, or the user has disabled the timer on the router. You can turn off the age-timer by setting it to infinite.
The following example enables Path MTU Discovery:
ip tcp path-mtu-discovery
To alter the maximum TCP outgoing queue per connection, use the ip tcp queuemax global configuration command. To restore the default value, use the no form of this command.
ip tcp queuemax packets| packets | Outgoing queue size of TCP packets. The default value is 5 segments if the connection has a TTY associated with it. If there is no TTY associated with it, the default value is 20 segments. |
The default value is 5 segments if the connection has a TTY associated with it. If there is no TTY associated with it, the default value is 20 segments.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Changing the default value changes the 5, not the 20.
The following example sets the maximum TCP outgoing queue to 10 packets:
ip tcp queuemax 10
| seconds | Time in seconds the software waits while attempting to establish a TCP connection. It can be an integer from 5 to 300 seconds. The default is 30 seconds. |
30 seconds
Global configuration
This command first appeared in Cisco IOS Release 10.0.
In previous versions of Cisco IOS software, the system would wait a fixed 30 seconds when attempting to establish a TCP connection. If your network contains Public Switched Telephone Network (PSTN) dial-on-demand routing (DDR), the call setup time may exceed 30 seconds. This amount of time is not sufficient in networks that have dial-up asynchronous connections because it will affect your ability to Telnet over the link (from the router) if the link must be brought up. If you have this type of network, you might want to set this value to the UNIX value of 75.
Because this is a host parameter, it does not pertain to traffic going through the router, just for traffic originated at this device. Because UNIX has a fixed 75-second timeout, hosts are unlikely to see this problem.
The following example configures the Cisco IOS software to continue attempting to establish a TCP connection for 180 seconds:
ip tcp synwait-time 180
| bytes | Window size in bytes. The maximum is 65535 bytes. The default value is 2144 bytes. |
2144 bytes
Global configuration
This command first appeared in Cisco IOS Release 9.1.
Do not use this command unless you clearly understand why you want to change the default value.
If your TCP window size is set to 1000 bytes, for example, you could have 1 packet of 1000 bytes or 2 packets of 500 bytes, etc. However, there is also a limit on the number of packets allowed in the window. There can be a maximum of 5 packets if the connection has TTY; otherwise there can be 20 packets.
The following example sets the TCP window size to 1000 bytes:
ip tcp window-size 1000
To enable IP processing on a serial interface without assigning an explicit IP address to the interface, use the ip unnumbered interface configuration command. To disable the IP processing on the interface, use the no form of this command.
ip unnumbered type number| type number | Type and number of another interface on which the router has an assigned IP address. It cannot be another unnumbered interface. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
Whenever the unnumbered interface generates a packet (for example, for a routing update), it uses the address of the specified interface as the source address of the IP packet. It also uses the address of the specified interface in determining which routing processes are sending updates over the unnumbered interface. Restrictions include the following:
The interface you specify by the type and number arguments must be enabled (listed as "up" in the show interfaces command display).
If you are configuring IS-IS across a serial line, you should configure the serial interfaces as unnumbered. This allows you to conform with RFC 1195, which states that IP addresses are not required on each interface.
In the following example, the first serial interface is given Ethernet 0's address:
interface ethernet 0
ip address 131.108.6.6 255.255.255.0
!
interface serial 0
ip unnumbered ethernet 0
To enable the generation of ICMP Unreachable messages, use the ip unreachables interface configuration command. To disable this function, use the no form of this command.
ip unreachablesThis command has no arguments or keywords.
Enabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
If the Cisco IOS software receives a nonbroadcast packet destined for itself that uses a protocol it does not recognize, it sends an ICMP Protocol Unreachable message to the source.
If the software receives a datagram that it cannot deliver to its ultimate destination because it knows of no route to the destination address, it replies to the originator of that datagram with an ICMP Host Unreachable message.
This command affects all kinds of ICMP unreachable messages.
The following example enables the generation of ICMP Unreachable messages, as appropriate, on an interface:
interface ethernet 0 ip unreachables
To set conditions for a named IP access list, use the permit access-list configuration command. To remove a condition from an access list, use the no form of this command.
permit source [source-wildcard]For ICMP, you can also use the following syntax:
permit icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] |For IGMP, you can also use the following syntax:
permit igmp source source-wildcard destination destination-wildcard [igmp-type]For TCP, you can also use the following syntax:
permit tcp source source-wildcard [operator port [port]] destination destination-wildcardFor UDP, you can also use the following syntax:
permit udp source source-wildcard [operator port [port]] destination destination-wildcard| source | Number of the network or host from which the packet is being sent.
There are two alternative ways to specify the source:
|
|
source-wildcard |
(Optional) Wildcard bits to be applied to the source. There are
two alternative ways to specify the source wildcard:
|
|
protocol |
Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later. |
| source | Number of the network or host from which the packet is being sent.
There are three alternative ways to specify the source:
|
|
source-wildcard |
Wildcard bits to be applied to source. There are three alternative
ways to specify the source wildcard:
|
|
destination |
Number of the network or host to which the packet is being sent. There
are three alternative ways to specify the destination:
|
|
destination-wildcard |
Wildcard bits to be applied to the destination. There are three
alternative ways to specify the destination wildcard:
|
|
precedence precedence |
(Optional) Packets can be filtered by precedence level, as specified by a number from 0 to 7 or by name as listed in the section "Usage Guidelines." |
| tos tos | (Optional) Packets can be filtered by type of service level, as specified by a number from 0 to 15 or by name as listed in the "Usage Guidelines" section of the access-list (extended) command. |
| icmp-type | (Optional) ICMP packets can be filtered by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets which are filtered by ICMP message type can also be filtered by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be filtered by an ICMP message type name or ICMP message type and code name. The possible names are found in the "Usage Guidelines" section of the access-list (extended) command. |
| igmp-type | (Optional) IGMP packets can be filtered by IGMP message type or message name. A message type is a number from 0 to 15. IGMP message names are listed in the "Usage Guidelines" section of the access-list (extended) command. |
| operator | (Optional) Compares source or destination ports. Possible operands
include lt (less than), gt (greater than), eq
(equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (extended) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about
the packet that matches the entry to be sent to the console. (The level of
messages logged to the console is controlled by the logging console
command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
There are no specific conditions under which a packet passes the named access list.
Access-list configuration
This command first appeared in Cisco IOS Release 11.2.
Use this command following the ip access-list command to define the conditions under which a packet passes the access list.
The following is an example of a standard access list named Internetfilter:
ip access-list standard Internetfilter deny 192.5.34.0 0.0.0.255 permit 128.88.0.0 0.0.255.255 permit 36.0.0.0 0.255.255.255 ! (Note: all other access implicitly denied)
deny
ip
access-group
ip
access-list
show
ip access-list
To check host reachability and network connectivity, use the ping (IP packet internet groper function) privileged EXEC command.
ping [protocol] {host | address}| protocol | (Optional) Protocol keyword. The default is IP. |
| host | Host name of system to ping. |
| address | IP address of system to ping. |
Privileged EXEC
Usage Guidelines
This command first appeared in Cisco IOS Release 10.0.
The ping command sends ICMP Echo messages. If the Cisco IOS software receives an ICMP Echo message, it sends an ICMP Echo Reply message to the source of the ICMP Echo message.
You can use the IP ping command to diagnose serial line problems. By placing the local or remote CSU/DSU into loopback mode and pinging your own interface, you can isolate the problem to the router, or to a leased line.
Multicast and broadcast pings are fully supported. When you ping the broadcast address of 255.255.255.255, the system will send out pings and print a list of all stations responding. You can also ping a local network to get a list of all systems that respond, as in the following example, where 128.111.3 is a local network:
ping 128.111.3.255
As a side effect, you also can get a list of all multicast-capable hosts that are connected directly to the router from which you are pinging, as in the following example:
ping 224.0.0.1
To abort a ping session, type the escape sequence (by default, Ctrl-^ X, which is done by simultaneously pressing the Ctrl, Shift, and 6 keys, letting go, then pressing the X key).
Table 3 describes the test characters that the ping facility sends.
| Char | Description |
|---|---|
| ! | Each exclamation point indicates receipt of a reply. |
| . | Each period indicates the network server timed out while waiting for a reply. |
| U | Destination unreachable. |
| N | Network unreachable. |
| P | Protocol unreachable. |
| Q | Source quench. |
| M | Could not fragment. |
| ? | Unknown packet type. |
You can use the extended command mode of the ping command to specify the supported Internet header options, as shown in the following sample display.
To enter ping extended command mode, enter yes at the extended commands prompt of the ping command. The following display shows a sample ping extended command sequence.
Router#pingProtocol [ip]: Target IP address:192.31.7.27Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]:ySource address:131.108.1.1Type of service [0]: Set DF bit in IP header? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.31.7.27, timeout is 2 seconds: !!!!! Success rate is 100 percent, round-trip min/avg/max = 1/3/4 ms
Table 4 describes significant fields shown in the display.
| Field | Description |
|---|---|
| Protocol [ip]: | Default is IP. |
| Target IP address: | Prompts for the IP address or host name of the destination node you plan to ping. |
| Repeat count [5]: | Number of ping packets that will be sent to the destination address. Default: 5. |
| Datagram size [100]: | Size of the ping packet (in bytes). Default: 100 bytes. |
| Timeout in seconds [2]: | Timeout interval. Default: 2 (seconds). |
| Extended commands [n]: | Specifies whether a series of additional commands appears. Many of the following displays and tables show and describe these commands. Default: no. |
| Source address: | IP address that appears in the ping packet as the source address. |
| Type of service [0]: | Internet service quality selection. See RFC 791 for more information. Default: 0. |
| Set DF bit in IP header? | Don't Fragment. Specifies that if the packet encounters a node in its path that is configured for a smaller MTU than the packet's MTU, that the packet is to be dropped and an error message is to be sent to the router at the packet's source address. If performance problems are encountered on the network, a node configured for a small MTU could be a contributing factor. This feature can be used to determine the smallest MTU in the path. Default: no. |
| Data pattern [0xABCD]: | Sets 16-bit hexadecimal data pattern. Default: 0xABCD. Varying the data pattern in this field (to all ones or all zeros for example) can be useful when debugging data sensitivity problems on CSU/DSUs, or detecting cable-related problems such as cross talk. |
| Loose, Strict, Record, Timestamp, Verbose [none]: | Supported Internet header options. The Cisco IOS software examines the
header options to every packet that passes through it. If it finds a
packet with an invalid option, the software sends an ICMP Parameter
Problem message to the source of the packet and discards the packet. The
Internet header options are as follows:
Default: none. For more information on these header options, see RFC 791. |
| Sweep range of sizes [n]: | Allows you to vary the sizes of the echo packets being sent. This capability is useful for determining the minimum sizes of the MTUs configured on the nodes along the path to the destination address. Packet fragmentation contributing to performance problems can then be reduced. |
| !!!!! | Each exclamation point (!) indicates receipt of a reply. A period (.) indicates the network server timed out while waiting for a reply. Other characters may appear in the ping output display, depending on the protocol type. |
| Success rate is 100 percent | Percentage of packets successfully echoed back to the router. Anything less than 80 percent is usually considered problematic. |
| round-trip min/avg/max = 1/3/4 ms | Round-trip travel time intervals for the protocol echo packets, including minimum/average/maximum (in milliseconds). |
Using the Record Route option to trace a path to a particular destination address. Be aware, however, that the trace EXEC command performs a similar function, but the latter does not have the nine-hop limitation.
The following display shows sample extended ping output when this option is specified:
Router#pingProtocol [ip]: Target IP address:fredRepeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]:ySource address: Type of service [0]: Set DF bit in IP header? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]:rNumber of hops [ 9 ]: Loose, Strict, Record, Timestamp, Verbose[RV]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 131.108.1.115, timeout is 2 seconds: Packet has IP options: Total option bytes= 39, padded length=40 Record route: <*> 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
The following display is a detail of the Echo packet section:
0 in 4 ms. Received packet has options
Total option bytes= 40, padded length=40
Record route: 160.89.80.31 131.108.6.10 131.108.1.7 131.108.1.115
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
End of list
1 in 8 ms. Received packet has options
Total option bytes= 4 padded length=40
Record route: 160.89.80.31 131.108.6.10 131.108.1.6 131.108.1.115
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
End of list
2 in 4 ms. Received packet has options
Total option bytes= 40, padded length=40
Record route: 160.89.80.31 131.108.6.10 131.108.1.7 131.108.1.115
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
End of list
3 in 8 ms. Received packet has options
Total option bytes= 40, padded length=40
Record route: 160.89.80.31 131.108.6.10 131.108.1.6 131.108.1.115
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
End of list
4 in 4 ms. Received packet has options
Total option bytes= 40, padded length=40
Record route: 160.89.80.31 131.108.6.10 131.108.1.7 131.108.1.115
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
End of list
Success rate is 100 percent, round-trip min/avg/max = 4/5/8 ms
Router#
In this display, five ping echo packets are sent to the destination address 131.108.1.115. The echo packet detail section includes specific information about each of these echo packets.
The lines of ping output that are unique when the Record Route option is specified are described as follows.
The following line of output allows you to specify the number of hops that will be recorded in the route. Range: 1 to 9. Default: 9.
Number of hops [ 9 ]:
The following line of output indicates that IP header options have been enabled on the outgoing echo packets and shows the number of option bytes and padded bytes in the headers of these packets:
Packet has IP options: Total option bytes= 39, padded length=40
The following lines of output indicate that the fields that will contain the IP addresses of the nodes in the routes have been zeroed out in the outgoing packets:
Record route: <*> 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
The following lines of output display statistics for the first of the five echo packets sent, where 0 is the number assigned to this packet to indicate that it is the first in the series, and 4 ms indicates the round-trip travel time for the packet:
0 in 4 ms. Received packet has options Total option bytes= 40, padded length=40 Record route: 160.89.80.31 131.108.6.10 131.108.1.7 131.108.1.115131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
The following line of output indicates that four nodes were included in the packet's route, including the router at source address 160.89.80.31, two intermediate nodes at addresses 131.108.6.10 and 131.108.1.7, and the destination node at address 131.108.1.115. The underlined address shows where the original route differs from the return route in the line that follows this line.
Record route: 160.89.80.31 131.108.6.10 131.108.1.7 131.108.1.115
The following line of output includes the addresses of the four nodes in the return path of the echo packet. The underlined address shows where the return route differs from the original route shown in the previous line of output.
131.108.1.115 131.108.6.7 160.89.80.240 160.89.80.31 <*> 0.0.0.0
To check host reachability and network connectivity, use the ping (IP packet internet groper function) user EXEC command.
ping [protocol] {host | address}| protocol | (Optional) Protocol keyword. The default is IP. |
| host | Host name of system to ping. |
| address | IP address of system to ping. |
EXEC
This command first appeared in Cisco IOS Release 10.0.
The ping command sends ICMP Echo messages. If the Cisco IOS software receives an ICMP Echo message, it sends an ICMP Echo Reply message to the source of the ICMP Echo message.
The user ping feature provides a basic ping facility for IP users who do not have system privileges. This feature allows the software to perform the simple default ping functionality for the IP protocol. Only the nonverbose form of the ping command is supported for user pings.
If the system cannot map an address for a host name, it will return an "%Unrecognized host or address" error message.
To abort a ping session, type the escape sequence (by default, Ctrl-^ X, which is done by simultaneously pressing the Ctrl, Shift, and 6 keys, letting go, then pressing the X key).
In the ping (privileged) section, Table 3 describes the test characters that the ping facility sends.
The following display shows sample ping output when you ping a host named fred:
Router> ping fred
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.31.7.27, timeout is 2 seconds:
!!!!!
Success rate is 100 percent, round-trip min/avg/max = 1/3/4 ms
The following display shows sample ping output when you ping the broadcast address of 255.255.255.255:
Router> ping 255.255.255.255
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 255.255.255.255, timeout is 2 seconds:
Reply to request 0 from 160.89.48.15 (4 ms)
Reply to request 0 from 160.89.48.10 (4 ms)
Reply to request 0 from 160.89.48.19 (4 ms)
Reply to request 0 from 160.89.49.15 (4 ms)
Reply to request 1 from 160.89.48.15 (4 ms)
Reply to request 1 from 160.89.48.10 (4 ms)
Reply to request 1 from 160.89.48.19 (4 ms)
Reply to request 1 from 160.89.49.15 (4 ms)
Reply to request 2 from 160.89.48.15 (4 ms)
Reply to request 2 from 160.89.48.10 (4 ms)
Reply to request 2 from 160.89.48.19 (4 ms)
Reply to request 2 from 160.89.49.15 (4 ms)
Reply to request 3 from 160.89.48.15 (4 ms)
Reply to request 3 from 160.89.48.10 (4 ms)
Reply to request 3 from 160.89.48.19 (4 ms)
Reply to request 3 from 160.89.49.15 (4 ms)
Reply to request 4 from 160.89.48.15 (4 ms)
Reply to request 4 from 160.89.48.10 (4 ms)
Reply to request 4 from 160.89.48.19 (4 ms)
Reply to request 4 from 160.89.49.15 (4 ms)
To display the contents of current access lists, use the show access-lists privileged EXEC command.
show access-lists [access-list-number | name]| access-list-number | (Optional) Access list number to display. The range is 0 to 1199. The system displays all access lists by default. |
| name | (Optional) Name of the IP access list to display. |
The system displays all access lists.
Privileged EXEC
Usage Guidelines
This command first appeared in Cisco IOS Release
The following is sample output from the show access-lists command when access list 101 is specified:
Router# show access-lists 101
Extended IP access list 101
permit tcp host 198.92.32.130 any established (4304 matches)
permit udp host 198.92.32.130 any eq domain (129 matches)
permit icmp host 198.92.32.130 any
permit tcp host 198.92.32.130 host 171.69.2.141 gt 1023
permit tcp host 198.92.32.130 host 171.69.2.135 eq smtp (2 matches)
permit tcp host 198.92.32.130 host 198.92.30.32 eq smtp
permit tcp host 198.92.32.130 host 171.69.108.33 eq smtp
permit udp host 198.92.32.130 host 171.68.225.190 eq syslog
permit udp host 198.92.32.130 host 171.68.225.126 eq syslog
deny ip 150.136.0.0 0.0.255.255 224.0.0.0 15.255.255.255
deny ip 171.68.0.0 0.1.255.255 224.0.0.0 15.255.255.255 (2 matches)
deny ip 172.24.24.0 0.0.1.255 224.0.0.0 15.255.255.255
deny ip 192.82.152.0 0.0.0.255 224.0.0.0 15.255.255.255
deny ip 192.122.173.0 0.0.0.255 224.0.0.0 15.255.255.255
deny ip 192.122.174.0 0.0.0.255 224.0.0.0 15.255.255.255
deny ip 192.135.239.0 0.0.0.255 224.0.0.0 15.255.255.255
deny ip 192.135.240.0 0.0.7.255 224.0.0.0 15.255.255.255
deny ip 192.135.248.0 0.0.3.255 224.0.0.0 15.255.255.255
deny ip 192.150.42.0 0.0.0.255 224.0.0.0 15.255.255.255
An access list counter counts how many packets are allowed by each line of the access list. This number is displayed as the number of matches.
For information on how to configure access lists, refer to the "Configuring IP" chapter of the Network Protocols Configuration Guide, Part 1.
For information on how to configure dynamic access lists, refer to the "Traffic Filters Commands" chapter of the Security Configuration Guide.
A dagger (+) indicates that the command is documented outside this chapter.
access-list
(extended)
access-list
(standard)
clear
access-list counters
clear access-temp +
ip
access-list
show
ip access-list
To display the entries in the ARP table, use the show arp privileged EXEC command.
show arpThis command has no arguments or keywords.
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show arp command:
Router# show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 131.108.42.112 120 0000.a710.4baf ARPA Ethernet3
AppleTalk 4028.5 29 0000.0c01.0e56 SNAP Ethernet2
Internet 131.108.42.114 105 0000.a710.859b ARPA Ethernet3
AppleTalk 4028.9 - 0000.0c02.a03c SNAP Ethernet2
Internet 131.108.42.121 42 0000.a710.68cd ARPA Ethernet3
Internet 131.108.36.9 - 0000.3080.6fd4 SNAP TokenRing0
AppleTalk 4036.9 - 0000.3080.6fd4 SNAP TokenRing0
Internet 131.108.33.9 - 0000.0c01.7bbd SNAP Fddi0
Table 5 describes significant fields shown in the first line of output in the display.
| Field | Description |
|---|---|
| Protocol | Indicates the type of network address this entry includes. |
| Address | Network address that is mapped to the MAC address in this entry. |
| Age (min) | Indicates the interval (in minutes) since this entry was entered in the table, rather than the interval since the entry was last used. (The timeout value is 4 hours.) |
| Hardware Addr | MAC address mapped to the network address in this entry. |
| Type | Indicates the encapsulation type the Cisco IOS software is using for
the network address in this entry. Possible values include:
|
|
Interface |
Indicates the interface associated with this network address. |
To display state information and the current configuration of the DNSIX audit writing module, use the show dnsix privileged EXEC command.
show dnsixThis command has no arguments or keywords.
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show dnsix command:
Router# show dnsix
Audit Trail Enabled with Source 128.105.2.5
State: PRIMARY
Connected to 128.105.2.4
Primary 128.105.2.4
Transmit Count 1
DMDP retries 4
Authorization Redirection List:
128.105.2.4
Record count: 0
Packet Count: 0
Redirect Rcv: 0
To display the default domain name, the style of name lookup service, a list of name server hosts, and the cached list of host names and addresses, use the show hosts EXEC command.
show hostsThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show hosts command:
Router# show hosts
Default domain is CISCO.COM
Name/address lookup uses domain service
Name servers are 255.255.255.255
Host Flag Age Type Address(es)
SLAG.CISCO.COM (temp, OK) 1 IP 131.108.4.10
CHAR.CISCO.COM (temp, OK) 8 IP 192.31.7.50
CHAOS.CISCO.COM (temp, OK) 8 IP 131.108.1.115
DIRT.CISCO.COM (temp, EX) 8 IP 131.108.1.111
DUSTBIN.CISCO.COM (temp, EX) 0 IP 131.108.1.27
DREGS.CISCO.COM (temp, EX) 24 IP 131.108.1.30
Table 6 describes significant fields shown in the display.
| Field | Description |
|---|---|
| Flag | A temporary entry is entered by a name server; the Cisco IOS software
removes the entry after 72 hours of inactivity. A permanent entry is entered by a configuration command and is not timed out. Entries marked OK are believed to be valid. Entries marked ?? are considered suspect and subject to revalidation. Entries marked EX are expired. |
| Age | Indicates the number of hours since the software last referred to the cache entry. |
| Type | Identifies the type of address, for example, IP, CLNS, or X.121. If you have used the ip hp-host global configuration command, the show hosts command will display these host names as type HP-IP. |
| Address(es) | Shows the address of the host. One host may have up to eight addresses. |
To display the contents of all current IP access lists, use the show ip access-list EXEC command.
show ip access-list [access-list-number | name]| access-list-number | (Optional) Number of the IP access list to display. This is a decimal number from 1 to 199. |
| name | (Optional) Name of the IP access list to display. |
Displays all standard and extended IP access lists.
EXEC
This command first appeared in Cisco IOS Release 10.3.
The show ip access-list command provides output identical to the show access-lists command, except that it is IP-specific and allows you to specify a particular access list.
The following is sample output from the show ip access-list command when all are requested:
Router# show ip access-list
Extended IP access list 101
deny udp any any eq ntp
permit tcp any any
permit udp any any eq tftp
permit icmp any any
permit udp any any eq domain
The following is sample output from the show ip access-list command when the name of a specific access list is requested:
Router# show ip access-list Internetfilter
Extended IP access list Internetfilter
permit tcp any 171.69.0.0 0.0.255.255 eq telnet
deny tcp any any
deny udp any 171.69.0.0 0.0.255.255 lt 1024
deny ip any any log
To display the active accounting or checkpointed database or to display access list violations, use the show ip accounting EXEC command.
show ip accounting [checkpoint] [output-packets | access-violations]If neither the output-packets nor access-violations keyword is specified, show ip accounting displays information pertaining to packets that passed access control and were successfully routed.
EXEC
This command first appeared in Cisco IOS Release 10.0. The output-packets and access-violations keywords first appeared in Cisco IOS Release 10.3.
If you do not specify any keywords, the show ip accounting command displays information about the active accounting database.
To display IP access violations, you must give the access-violations keyword on the command. If you do not specify the keyword, the command defaults to displaying the number of packets that have passed access lists and were routed.
To use this command, you must first enable IP accounting on a per-interface basis.
Following is sample output from the show ip accounting command:
Router# show ip accounting
Source Destination Packets Bytes
131.108.19.40 192.67.67.20 7 306
131.108.13.55 192.67.67.20 67 2749
131.108.2.50 192.12.33.51 17 1111
131.108.2.50 130.93.2.1 5 319
131.108.2.50 130.93.1.2 463 30991
131.108.19.40 130.93.2.1 4 262
131.108.19.40 130.93.1.2 28 2552
131.108.20.2 128.18.6.100 39 2184
131.108.13.55 130.93.1.2 35 3020
131.108.19.40 192.12.33.51 1986 95091
131.108.2.50 192.67.67.20 233 14908
131.108.13.28 192.67.67.53 390 24817
131.108.13.55 192.12.33.51 214669 9806659
131.108.13.111 128.18.6.23 27739 1126607
131.108.13.44 192.12.33.51 35412 1523980
192.31.7.21 130.93.1.2 11 824
131.108.13.28 192.12.33.2 21 1762
131.108.2.166 192.31.7.130 797 141054
131.108.3.11 192.67.67.53 4 246
192.31.7.21 192.12.33.51 15696 695635
192.31.7.24 192.67.67.20 21 916
131.108.13.111 128.18.10.1 16 1137
The following is sample output from the show ip accounting access-violations command. The output pertains to packets that failed access lists and were not routed:
Router# show ip accounting access-violations
Source Destination Packets Bytes ACL
131.108.19.40 192.67.67.20 7 306 77
131.108.13.55 192.67.67.20 67 2749 185
131.108.2.50 192.12.33.51 17 1111 140
131.108.2.50 130.93.2.1 5 319 140
131.108.19.40 130.93.2.1 4 262 77
Accounting data age is 41
Table 7 describes the fields shown in the displays.
| Field | Description |
|---|---|
| Source | Source address of the packet. |
| Destination | Destination address of the packet. |
| Packets | Number of packets transmitted from the source address to the
destination address.
With the access-violations keyword, the number of packets transmitted from the source address to the destination address that violated an access control list. |
| Bytes | Sum of the total number of bytes (IP header and data) of all IP
packets transmitted from the source address to the destination address.
With the access-violations keyword, the total number of bytes transmitted from the source address to the destination address that violated an access-control list. |
| ACL | Number of the access list of the last packet transmitted from the source to the destination that failed an access list filter. |
clear
ip accounting
ip
accounting
ip
accounting-list
ip
accounting-threshold
ip
accounting-transits
To display the IP addresses mapped to TCP ports (aliases) and SLIP addresses, which are treated similarly to aliases, use the show ip aliases EXEC command.
show ip aliasesThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
To distinguish a SLIP address from a normal alias address, the command output uses the form SLIP TTY1 for the "port" number, where 1 is the auxiliary port.
The following is sample output from the show ip aliases command:
Router# show ip aliases
IP Address Port
131.108.29.245 SLIP TTY1
The display lists the IP address and corresponding port number.
A dagger (+) indicates that the command is documented outside this chapter.
show line +
To display the Address Resolution Protocol (ARP) cache, where SLIP addresses appear as permanent ARP table entries, use the show ip arp EXEC command.
show ip arp [<ip-address>] [<hostname>] [<mac-address>] [<interface>]| ip-address | ip address |
| hostname | host name |
| mac-address | 48-bit MAC address |
| interface | interface type |
EXEC
ARP establishes correspondences between network addresses (an IP address, for example) and LAN hardware addresses (Ethernet addresses). A record of each correspondence is kept in a cache for a predetermined amount of time and then discarded.
With ip-address/hostname/mac-address option, arp entries matching the ip address are displayed. With the interface option, all the arp entries learned via a given interface are displayed.
The following is sample output from the show ip arp command:
Router# show ip arp
Protocol Address Age(min) Hardware Addr Type Interface
Internet 171.69.233.22 9 0000.0c59.f892 ARPA Ethernet0/0
Internet 171.69.233.21 8 0000.0c07.ac00 ARPA Ethernet0/0
Internet 171.69.233.19 - 0000.0c63.1300 ARPA Ethernet0/0
Internet 171.69.233.30 9 0000.0c36.6965 ARPA Ethernet0/0
Internet 172.19.168.11 - 0000.0c63.1300 ARPA Ethernet0/0
Internet 172.19.168.254 9 0000.0c36.6965 ARPA Ethernet0/0
Table 18-9 describes significant fields shown in the display.
| Field | Description |
|---|---|
| Protocol | Protocol for network address in the Address field. |
| Address | The network address that corresponds to Hardware Addr. |
| Age (min) | Age, in minutes, of the cache entry. |
| Hardware Addr | LAN hardware address a MAC address that corresponds to network address. |
| Type | Type of encapsulation:
|
|
Interface |
Interface to which this address mapping has been assigned. |
To display the routing table cache used to fast switch IP traffic, use the show ip cache EXEC command.
show ip cache [prefix mask] [type number]| prefix | (Optional) Display only the entries in the cache that match the prefix and mask combination. |
| mask | (Optional) Display only the entries in the cache that match the prefix and mask combination. |
| type | (Optional) Display only the entries in the cache that match the interface type and number combination. |
| number | (Optional) Display only the entries in the cache that match the interface type and number combination. |
EXEC
This command first appeared in Cisco IOS Release 10.0. The arguments prefix, mask, type, and number first apeared in Cisco IOS Release 10.0. The show ip cache display shows MAC headers up to 92 bytes.
The following is sample output from the show ip cache command:
Router# show ip cache
IP routing cache version 4490, 141 entries, 20772 bytes, 0 hash overflows
Minimum invalidation interval 2 seconds, maximum interval 5 seconds,
quiet interval 3 seconds, threshold 0 requests
Invalidation rate 0 in last second, 0 in last 3 seconds
Last full cache invalidation occurred 0:06:31 ago
Prefix/Length Age Interface MAC Header
131.108.1.1/32 0:01:09 Ethernet0/0 AA000400013400000C0357430800
131.108.1.7/32 0:04:32 Ethernet0/0 00000C01281200000C0357430800
131.108.1.12/32 0:02:53 Ethernet0/0 00000C029FD000000C0357430800
131.108.2.13/32 0:06:22 Fddi2/0 00000C05A3E000000C035753AAAA0300
00000800
131.108.2.160/32 0:06:12 Fddi2/0 00000C05A3E000000C035753AAAA0300
00000800
131.108.3.0/24 0:00:21 Ethernet1/2 00000C026BC600000C03574D0800
131.108.4.0/24 0:02:00 Ethernet1/2 00000C026BC600000C03574D0800
131.108.5.0/24 0:00:00 Ethernet1/2 00000C04520800000C03574D0800
131.108.10.15/32 0:05:17 Ethernet0/2 00000C025FF500000C0357450800
131.108.11.7/32 0:04:08 Ethernet1/2 00000C010E3A00000C03574D0800
131.108.11.12/32 0:05:10 Ethernet0/0 00000C01281200000C0357430800
131.108.11.57/32 0:06:29 Ethernet0/0 00000C01281200000C0357430800
Table 8 describes significant fields shown in the display.
| Field | Description |
|---|---|
| IP routing cache version | Version number of this table. This number is incremented any time the table is flushed. |
| entries | Number of valid entries. |
| bytes | Number of bytes of processor memory for valid entries. |
| hash overflows | Number of times autonomous switching cache overflowed. |
| Minimum invalidation interval | Minimum time delay between cache invalidation request and actual invalidation. |
| maximum interval | Maximum time delay between cache invalidation request and actual invalidation. |
| quiet interval | Length of time between cache flush requests before the cache will be flushed. |
| threshold n requests | Maximum number of requests that can occur while the cache is considered quiet. |
| Invalidation rate n in last m seconds | Number of cache invalidations during the last m second.s |
| 0 in last 3 seconds | Number of cache invalidation requests during the last quiet interval. |
| Last full cache invalidation occurred nn:nn:nn ago | Time since last full cache invalidation was performed. |
| Prefix/Length | Network reachability information for cache entry. |
| Age | Age of cache entry. |
| Interface | Output interface type and number. |
| MAC Header | Layer 2 encapsulation information for cache entry. |
The following is sample output from the show ip cache command with a prefix and mask specified:
Router# show ip cache 131.108.5.0 255.255.255.0
IP routing cache version 4490, 119 entries, 17464 bytes, 0 hash overflows
Minimum invalidation interval 2 seconds, maximum interval 5 seconds,
quiet interval 3 seconds, threshold 0 requests
Invalidation rate 0 in last second, 0 in last 3 seconds
Last full cache invalidation occurred 0:11:56 ago
Prefix/Length Age Interface MAC Header
131.108.5.0/24 0:00:34 Ethernet1/2 00000C04520800000C03574D0800
The following is sample output from the show ip cache command with an interface specified:
Router# show ip cache e0/2
IP routing cache version 4490, 141 entries, 20772 bytes, 0 hash overflows
Minimum invalidation interval 2 seconds, maximum interval 5 seconds,
quiet interval 3 seconds, threshold 0 requests
Invalidation rate 0 in last second, 0 in last 3 seconds
Last full cache invalidation occurred 0:06:31 ago
Prefix/Length Age Interface MAC Header
131.108.10.15/32 0:05:17 Ethernet0/2 00000C025FF500000C0357450800
To display summary NetFlow switching statistics, use the show ip cache flow EXEC command.
show ip cache flowThis command has no keywords and arguments.
EXEC
This command first appeared in Cisco IOS Release 11.2.
The following is a sample output from the show ip cache flow command.
Router# show ip cache flow
IP packet size distribution (308093708 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.001 .656 .058 .027 .185 .006 .007 .003 .007 .001 .002 .001 .001 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.001 .006 .004 .000 .002 .022 .000 .000 .000 .000 .000
IP Flow Switching Cache, 421 active, 32347 inactive, 1201604 added
50450 tcp fin, 3209 tcp rst, 1097730 timeout
20815 dns, 28979 counter wrap
1201183 flows exported, 0 not exported, 284078 export msgs sent
flow alloc failures: 0 pkts, 0 bytes
4 cur max hash, 29 worst max hash, 421 valid buckets
0 tcp reordered flows, 0 reordered pkts, 0 syn retries
0 tcp backed-off flows, 0 backoff pkts, 0 backoff secs
statistics cleared 401489 seconds ago
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 14847 0.0 265 70 9.8 64.7 16.7
TCP-FTP 262 0.0 12 57 0.0 24.0 20.5
TCP-FTPD 340 0.0 311 535 0.2 6.3 7.7
TCP-WWW 2416 0.0 9 159 0.0 2.9 7.8
TCP-SMTP 993 0.0 25 308 0.0 3.1 11.7
TCP-X 608957 1.5 175 126 265.5 39.2 33.0
TCP-other 202627 0.5 891 66 450.0 96.7 29.5
UDP-DNS 20823 0.0 2 247 0.1 0.0 6.9
UDP-NTP 80122 0.1 2 76 0.4 1.2 33.9
UDP-TFTP 6649 0.0 95 131 1.5 5.9 34.0
UDP-Frag 3041 0.0 60 1336 0.4 30.9 33.8
UDP-other 239260 0.5 67 457 39.9 152.1 31.7
ICMP 15239 0.0 32 65 1.2 50.3 33.4
IGMP 6066 0.0 3 51 0.0 6.9 33.9
Total: 1201642 2.9 257 108 769.6 68.1 31.5
SrcIf SrcIPaddress DstIf DstIPaddress Pr DstP SrcP Pkts B/Pk Active
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.9.1 01 0000 0000 467 46 33.6
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.8.1 01 0000 0000 1053 46 68.9
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.10.1 01 0000 0000 50 46 2.4
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.1.1 01 0000 0000 17 46 1.4
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.3.1 01 0000 0000 16 46 1.4
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.2.1 01 0000 0000 25 46 1.9
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.5.1 01 0000 0000 22 46 2.0
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.4.1 01 0000 0000 33 46 2.0
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.7.1 01 0000 0000 27 46 2.0
Fd1/0/0 80.0.0.3 Se1/1/0 200.1.6.1 01 0000 0000 31 46 2.0
Table 9 describes the fields in the packet size distribution lines of the output.
| Field | Description |
|---|---|
| IP packet size distribution | The two lines below this banner show the percentage distribution of packets by size range. In this display, 65.6% of the packets fall in the size range 33 to 64 bytes. |
Table 10 describes the fields in the flow switching cache lines of the output.
| Field | Description |
|---|---|
| active | Number of active flows in the NetFlow cache at the time this command was entered. |
| inactive, | Number of flow buffers allocated in the NetFlow cache, but are not currently assigned to a specific flow at the time this command was entered. |
| added | Number of flows created since the start of the summary period. |
| tcp fin | Number of TCP FINs (no more data from sender) detected during the summary period. |
| tcp rst | Number of TCP RSTs (reset connections) detected during the summary period. |
| timeout | Number of flows that exceeded 30 seconds from the last detected packet for that flow during the summary period. |
| dns | Number of DNS datagrams detected during this period. |
| counter wrap | Number of flows that were active longer than 30 minutes during the summary period. |
| flow stats exported | Number of flows that were exported during this summary period. |
| not exported | Number of flows that did not get exported during this summary period. |
| export msgs sent | Number of frames sent to the designated UDP port. |
| flow alloc failures: 0 pkts, 0 bytes, cur max hash worst max hash valid buckets tcp reordered flows reordered pkts syn retries tcp backed-off flows backoff pkts backoff secs |
Fields used for Cisco diagnostics only. |
| statistics cleared... seconds ago | Number of seconds for this summary period. |
Table 11 describes the fields in the activity-by-protocol lines of the output.
| Field | Description |
|---|---|
| Protocol | IP protocol and the "well known" port number as described in RFC 1340. |
| Total Flows | Number of flows for this protocol since the last time statistics were cleared. |
| Flows/Sec | Average number of flows for this protocol seen per second; equal to Total Flows/Number of seconds for this summary period. |
| Packets/Flow | Average number of packets observed for the flows seen for this protocol. Equal to Total Packets for this protocol /Number of flows for this protocol for this summary period. |
| Bytes/Pkt | Average number of bytes observed for the packets seen for this protocol (Total Bytes for this protocol /The total number of packet for this protocol for this summary period). |
| Packets/Sec | Average number of packets for this protocol per second (Total Packets for this protocol) / The total number of seconds for this summary period). |
| Active(Sec)/Flow | Sum of all the durations from the first packet to the last packet of an expired flow (for example, TCP FIN, time-out, and so forth) in seconds/Total Flows for this protocol for this summary period. |
| Idle(Sec)/Flow | Sum of all the seconds from the last packet seen in each nonexpired flow for this protocol until the time this command was entered, in seconds/Total Flows for this protocol for this summary period. |
Table 12 describes the fields in the current flow lines of the output.
| Field | Description |
|---|---|
| SrcIf | Internal port name for the source interface. |
| SrcIPaddress | Source IP address for this flow. |
| DstIf | Router's internal port name for the destination interface. |
| DstIPaddress | Destination IP address for this flow. |
| Pr | IP protocol; for example, 6=TCP, 17=UDP, .... as defined in RFC 1340. |
| DstP | Destination port address, TCP/UDP "well known" port number, as defined in RFC 1340 |
| SrcP | Source port address, TCP/UDP "well known" port number, as defined in RFC 1340 |
| Pkts | Number of packets observed for this flow |
| B/Pkt | Average observed number of bytes per packet for this flow |
| Active | Number of seconds between first and last packet of a flow |
| Idle | Number of seconds from the last packet seen in a flow until the time this command was entered. |
To display the usability status of interfaces configured for IP, use the show ip interface EXEC command.
show ip interface [type number]| type | (Optional) Interface type. |
| number | (Optional) Interface number. |
EXEC
This command first appeared in Cisco IOS Release 10.0.
The Cisco IOS software automatically enters a directly connected route in the routing table if the interface is usable. A usable interface is one through which the software can send and receive packets. If the software determines that an interface is not usable, it removes the directly connected routing entry from the routing table. Removing the entry allows the software to use dynamic routing protocols to determine backup routes to the network (if any).
If the interface can provide two-way communication, the line protocol is marked "up." If the interface hardware is usable, the interface is marked "up."
If you specify an optional interface type, you will see only information on that specific interface.
If you specify no optional arguments, you will see information on all the interfaces.
When an asynchronous interface is encapsulated with PPP or SLIP, IP fast switching is enabled. A show ip interface command on an asynchronous interface encapsulated with PPP or SLIP displays a message indicating that IP fast switching is enabled.
The following is sample output from the show ip interface command:
Router#show ip interfaceEthernet0 is up, line protocol is upInternet address is 192.195.78.24, subnet mask is 255.255.255.240Broadcast address is 255.255.255.255Address determined by non-volatile memoryMTU is 1500 bytesHelper address is not setSecondary address 131.192.115.2, subnet mask 255.255.255.0Directed broadcast forwarding is enabledMulticast groups joined: 224.0.0.1 224.0.0.2Outgoing access list is not setInbound access list is not setProxy ARP is enabledSecurity level is defaultSplit horizon is enabledICMP redirects are always sentICMP unreachables are always sentICMP mask replies are never sentIP fast switching is enabledIP fast switching on the same interface is disabledIP SSE switching is disabledRouter Discovery is disabledIP output packet accounting is disabledIP access violation accounting is disabledTCP/IP header compression is disabledProbe proxy name replies are disabled
Table 13 describes the fields shown in the display.
| Field | Description |
|---|---|
| Ethernet0 is up | If the interface hardware is usable, the interface is marked "up." For an interface to be usable, both the interface hardware and line protocol must be up. |
| line protocol is up | If the interface can provide two-way communication, the line protocol is marked "up." For an interface to be usable, both the interface hardware and line protocol must be up. |
| Broadcast address | Shows the broadcast address. |
| Address determined by ... | Indicates how the IP address of the interface was determined. |
| MTU | Shows the MTU value set on the interface. |
| Helper address | Shows a helper address, if one has been set. |
| Secondary address | Shows a secondary address, if one has been set. |
| Directed broadcast forwarding | Indicates whether directed broadcast forwarding is enabled. |
| Multicast groups joined | Indicates the multicast groups this interface is a member of. |
| Outgoing access list | Indicates whether the interface has an outgoing access list set. |
| Inbound access list | Indicates whether the interface has an incoming access list set. |
| Proxy ARP | Indicates whether Proxy ARP is enabled for the interface. |
| Security level | Specifies the IPSO security level set for this interface. |
| ICMP redirects | Specifies whether redirects will be sent on this interface. |
| ICMP unreachables | Specifies whether unreachable messages will be sent on this interface. |
| ICMP mask replies | Specifies whether mask replies will be sent on this interface. |
| IP fast switching | Specifies whether fast switching has been enabled for this interface. It is generally enabled on serial interfaces, such as this one. |
| IP SSE switching | Specifies whether IP SSE switching is enabled. |
| Router Discovery | Specifies whether the discovery process has been enabled for this interface. It is generally disabled on serial interfaces. |
| IP output packet accounting | Specifies whether IP accounting is enabled for this interface and what the threshold (maximum number of entries) is. |
| TCP/IP header compression | Indicates whether compression is enabled or disabled. |
| Probe proxy name | Indicates whether HP Probe proxy name replies are generated. |
To display the masks used for network addresses and the number of subnets using each mask, use the show ip masks EXEC command.
show ip masks address| address | Network address for which a mask is required. |
EXEC
This command first appeared in Cisco IOS Release 10.0.
The show ip masks command is useful for debugging when a variable-length subnet mask (VLSM) is used. It shows the number of masks associated with the network and the number of routes for each mask.
The following is sample output from the show ip masks command:
Router# show ip masks 131.108.0.0
Mask Reference count
255.255.255.255 2
255.255.255.0 3
255.255.0.0 1
To display Network Address Translation (NAT) statistics, use the show ip nat statistics EXEC command.
show ip nat statisticsThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 11.2.
The following is sample output from the show ip nat statistics command:
Router#show ip nat statistics
Total translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: Serial0
Inside interfaces: Ethernet1
Hits: 135 Misses: 5
Expired translations: 2
Dynamic mappings:
-- Inside Source
access-list 1 pool net-208 refcount 2
pool net-208: netmask 255.255.255.240
start 171.69.233.208 end 171.69.233.221
type generic, total addresses 14, allocated 2 (14%), misses 0
Table 14 describes the significant fields in the display.
| Field | Description |
|---|---|
| Total translations | Number of translations active in the system. This number is incremented each time a translation is created and is decremented each time a translation is cleared or times out. |
| Outside interfaces | List of interfaces marked as outside with the ip nat outside command. |
| Inside interfaces | List of interfaces marked as inside with the ip nat inside command. |
| Hits | Number of times the software does a translations table lookup and finds an entry. |
| Misses | Number of times the software does a translations table lookup, fails to find an entry, and must try to create one. |
| Expired translations | Cumulative count of translations that have expired since the router was booted. |
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
show
ip nat translations
To display active Network Address Translation (NAT) translations, use the show ip nat translations EXEC command.
show ip nat translations [verbose]| verbose | (Optional) Displays additional information for each translation table entry, including how long ago the entry was created and used. |
EXEC
This command first appeared in Cisco IOS Release 11.2.
The following is sample output from the show ip nat translations command. Without overloading, two inside hosts are exchanging packets with some number of outside hosts.
Router#show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- 171.69.233.209 192.168.1.95 --- ---
--- 171.69.233.210 192.168.1.89 --- --
With overloading, a translation for a DNS transaction is still active, and translations for two Telnet sessions (from two different hosts) are also active. Note that two different inside hosts appear on the outside with a single IP address.
Router#show ip nat translations
Pro Inside global Inside local Outside local Outside global
udp 171.69.233.209:1220 192.168.1.95:1220 171.69.2.132:53 171.69.2.132:53
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23 171.69.1.220:23
tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23 171.69.1.161:23
The following is sample output that includes the verbose keyword.
Router#show ip nat translations verbose
Pro Inside global Inside local Outside local Outside global
udp 171.69.233.209:1220 192.168.1.95:1220 171.69.2.132:53 171.69.2.132:53
create 00:00:02, use 00:00:00, flags: extended
tcp 171.69.233.209:11012 192.168.1.89:11012 171.69.1.220:23 171.69.1.220:23
create 00:01:13, use 00:00:50, flags: extended
tcp 171.69.233.209:1067 192.168.1.95:1067 171.69.1.161:23 171.69.1.161:23
create 00:00:02, use 00:00:00, flags: extended
Table 15 describes the significant fields in the display.
| Field | Description |
|---|---|
| Pro | Protocol of the port identifying the address. |
| Inside global | The legitimate IP address (assigned by the NIC or service provider) that represents one or more inside local IP addresses to the outside world. |
| Inside local | The IP address assigned to a host on the inside network; probably not a legitimate address assigned by the NIC or service provider. |
| Outside local | IP address of an outside host as it appears to the inside network; probably not a legitimate address assigned by the NIC or service provider. |
| Outside global | The IP address assigned to a host on the outside network by its owner. |
| create | How long ago the entry was created (in hours:minutes:seconds). |
| use | How long ago the entry was last used (in hours:minutes:seconds). |
clear
ip nat translation
ip
nat
ip
nat inside destination
ip
nat inside source
ip
nat outside source
ip
nat pool
ip
nat translation
show
ip nat statistics
To display the Next Hop Resolution Protocol (NHRP) cache, use the show ip nhrp EXEC command.
show ip nhrp [dynamic | static] [type number]| dynamic | (Optional) Displays only the dynamic (learned) IP-to-NBMA address cache entries. |
| static | (Optional) Displays only the static IP-to-NBMA address entries in the cache (configured through the ip nhrp map command). |
| type | (Optional) Interface type about which to display the NHRP cache (for example, atm, tunnel). |
| number | (Optional) Interface number about which to display the NHRP cache. |
EXEC
This command first appeared in Cisco IOS Release 10.3.
The following is sample output from the show ip nhrp command:
Router# show ip nhrp
10.0.0.2 255.255.255.255, ATM0/0 created 0:00:43 expire 1:59:16
Type: dynamic Flags: authoritative
NBMA address: 11.1111.1111.1111.1111.1111.1111.1111.1111.1111.11
10.0.0.1 255.255.255.255, Tunnel0 created 0:10:03 expire 1:49:56
Type: static Flags: authoritative
NBMA address: 11.1.1.2
Table 16 describes the fields in the display.
| Field | Description |
|---|---|
| 100.0.0.2 255.255.255.255 | IP address and its network mask in the IP-to-NBMA address cache. The mask is currently always 255.255.255.255 because we do not support aggregation of NBMA information through NHRP. |
| ATM0/0 created 0:00:43 | Interface type and number (in this case, ATM slot and port numbers) and how long ago it was created (hours:minutes:seconds). |
| expire 1:59:16 | Time in which the positive and negative authoritative NBMA address
will expire (hours:minutes:seconds). This value is based on the ip nhrp holdtime command. |
| Type | Value can be one of the following:
|
|
Flags |
Value can be one of the following:
|
|
NBMA address |
Nonbroadcast, multiaccess address. The address format is appropriate for the type of network being used (for example, ATM, Ethernet, SMDS, multipoint tunnel). |
To display Next Hop Resolution Protocol (NHRP) traffic statistics, use the show ip nhrp traffic EXEC command.
show ip nhrp trafficThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.3.
The following is sample output from the show ip nhrp traffic command:
Router# show ip nhrp traffic
Tunnel0
request packets sent: 2
request packets received: 4
reply packets sent: 4
reply packets received: 2
register packets sent: 0
register packets received: 0
error packets sent: 0
error packets received: 0
Router#
Table 17 describes the fields in the display.
| Field | Description |
|---|---|
| Tunnel 0 | Interface type and number. |
| request packets sent | Number of NHRP Request packets originated from this station. |
| request packets received | Number of NHRP Request packets received by this station. |
| reply packets sent | Number of NHRP Reply packets originated from this station. |
| reply packets received | Number of NHRP Reply packets received by this station. |
| register packets sent | Number of NHRP Register packets originated from this station. Currently, our routers and access servers do not send Register packets, so this value is 0. |
| register packets received | Number of NHRP Register packets received by this station. Currently, our routers or access servers do not send Register packets, so this value is 0. |
| error packets sent | Number of NHRP Error packets originated by this station. |
| error packets received | Number of NHRP Error packets received by this station. |
To display the address of a default gateway (router) and the address of hosts for which a redirect has been received, use the show ip redirects EXEC command.
show ip redirectsThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show ip redirects command:
Router# show ip redirects
Default gateway is 160.89.80.29
Host Gateway Last Use Total Uses Interface
131.108.1.111 160.89.80.240 0:00 9 Ethernet0
128.95.1.4 160.89.80.240 0:00 4 Ethernet0
Router#
To display the entries in the routing table, use the show ip route EXEC command.
show ip route [address [mask]] | [protocol]| address | (Optional) Address about which routing information should be displayed. |
| mask | (Optional) Argument for a subnet mask. |
| protocol | (Optional) Argument for a particular routing protocol, or static or connected. |
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show ip route command when entered when you do not specify an address:
Router# show ip route
Codes: I - IGRP derived, R - RIP derived, O - OSPF derived
C - connected, S - static, E - EGP derived, B - BGP derived
* - candidate default route, IA - OSPF inter area route
E1 - OSPF external type 1 route, E2 - OSPF external type 2 route
Gateway of last resort is 131.119.254.240 to network 129.140.0.0
O E2 150.150.0.0 [160/5] via 131.119.254.6, 0:01:00, Ethernet2
E 192.67.131.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
O E2 192.68.132.0 [160/5] via 131.119.254.6, 0:00:59, Ethernet2
O E2 130.130.0.0 [160/5] via 131.119.254.6, 0:00:59, Ethernet2
E 128.128.0.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
E 129.129.0.0 [200/129] via 131.119.254.240, 0:02:22, Ethernet2
E 192.65.129.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
E 131.131.0.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
E 192.75.139.0 [200/129] via 131.119.254.240, 0:02:23, Ethernet2
E 192.16.208.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
E 192.84.148.0 [200/129] via 131.119.254.240, 0:02:23, Ethernet2
E 192.31.223.0 [200/128] via 131.119.254.244, 0:02:22, Ethernet2
E 192.44.236.0 [200/129] via 131.119.254.240, 0:02:23, Ethernet2
E 140.141.0.0 [200/129] via 131.119.254.240, 0:02:22, Ethernet2
E 141.140.0.0 [200/129] via 131.119.254.240, 0:02:23, Ethernet2
The following is sample output that includes some IS-IS Level 2 routes learned:
Router# show ip route
Codes: I - IGRP derived, R - RIP derived, O - OSPF derived
C - connected, S - static, E - EGP derived, B - BGP derived
i - IS-IS derived
* - candidate default route, IA - OSPF inter area route
E1 - OSPF external type 1 route, E2 - OSPF external type 2 route
L1 - IS-IS level-1 route, L2 - IS-IS level-2 route
Gateway of last resort is not set
160.89.0.0 is subnetted (mask is 255.255.255.0), 3 subnets
C 160.89.64.0 255.255.255.0 is possibly down,
routing via 0.0.0.0, Ethernet0
i L2 160.89.67.0 [115/20] via 160.89.64.240, 0:00:12, Ethernet0
i L2 160.89.66.0 [115/20] via 160.89.64.240, 0:00:12, Ethernet0
Table 18 describes the fields shown in the displays.
| Field | Description |
|---|---|
| Codes | Codes defining how the route was learned and the type of route. |
| I | Route learned via IGRP. |
| R | Route learned from a RIP update. |
| O | Route learned from an OSPF update. |
| C | Directly connected network. |
| S | Statically defined route via the ip route command. |
| E | Route learned from Exterior Gateway Protocol (EGP). |
| B | Route learned from Border Gateway Protocol (BGP). |
| i | Route learned from IS-IS. |
| D | Route leaved via Enhanced IGRP. |
| * | Candidate default route. In the list of routes, the asterisk is the robin pointer. It indicates the last path used when a packet was forwarded. It applies only to non-fast-switched packets. The asterisk does not give an indication of which path will be used next when forwarding a non-fast-switched packet except when the paths are equal-cost paths. Paths can be equal cost only when running RIP. |
| IA | OSPF interarea route. |
| E1 | OSPF external type 1 route. |
| E2 | OSPF external type 2 route. |
| L1 | IS-IS Level 1 route. |
| L2 | IS-IS Level 2 route. |
| EX | External enhanced IGRP route. |
| 150.150.0.0 | Indicates the address of the remote network. |
| [160/5] | The first number in the brackets is the administrative distance of the information source; the second number is the metric for the route. |
| via 131.119.254.6 | Specifies the address of the next router to the remote network. |
| 0:01:00 | Specifies the last time the route was updated in hours:minutes:seconds. |
| Ethernet 2 | Specifies the interface through which the specified network can be reached. |
The following is sample output from the show ip route command for a specific address:
Router# show ip route 160.89.6.0
Routing entry for 160.89.6.0 (mask 255.255.255.0)
Known via "connected", distance 0, metric 0 (connected)
Tag 0
Routing Descriptor Blocks:
* directly connected, via Ethernet1
Route metric is 0, traffic share count is 1
Table 19 describes the significant fields shown in the display.
| Field | Description |
|---|---|
| Mask | Network mask associated with the route. |
| Connected | Routing protocol name, or connected or static. |
| Distance | Administrative distance. |
| Metric | Route metric that was either configured or learned from the particular route. |
| Routing Descriptor Blocks | Up to 4: Indicates the IP address of the next hop or the interface to which the particular route is connected. |
To display summary information about entries in the routing table, use the show ip route summary EXEC command.
show ip route summaryThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show ip route summary command:
Router# show ip route summary
Route Source Networks Subnets Overhead Memory (bytes)
connected 0 3 126 360
static 1 2 126 360
igrp 109 747 12 31878 91080
internal 3 360
Total 751 17 32130 92160
Router#
Table 20 describes the fields shown in the display:
| Field | Description |
|---|---|
| Route Source | Routing protocol name, or connected, static, or
internal. Internal--those routes that are in the primary routing table merely as markers to hold subnet routes. These routes are not owned by any routing protocol. There should be one of these internal routes for each subnetted network in the routing table. |
| Networks | The number of Class A, B, or C networks that are present in the routing table for each route source. |
| Subnets | The number of subnets that are present in the routing table for each route source, including host routes. |
| Overhead | Any additional memory involved in allocating the routes for the particular route source other than the memory specified under "Memory." |
| Memory | The number of bytes allocated to maintain all the routes for the particular route source. |
To display statistics about TCP header compression, use the show ip tcp header-compression EXEC command.
show ip tcp header-compressionThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show ip tcp header-compression command:
Router# show ip tcp header-compression
TCP/IP header compression statistics:
Interface Serial1: (passive, compressing)
Rcvd: 4060 total, 2891 compressed, 0 errors
0 dropped, 1 buffer copies, 0 buffer failures
Sent: 4284 total, 3224 compressed,
105295 bytes saved, 661973 bytes sent
1.15 efficiency improvement factor
Connect: 16 slots, 1543 long searches, 2 misses, 99% hit ratio
Five minute miss rate 0 misses/sec, 0 max misses/sec
Table 21 describes significant fields shown in the display.
| Field | Description |
|---|---|
| Rcvd: | |
| total | Total number of TCP packets received. |
| compressed | Total number of TCP packets compressed. |
| errors | Unknown packets. |
| dropped | Number of packets dropped due to invalid compression. |
| buffer copies | Number of packets that had to be copied into bigger buffers for decompression. |
| buffer failures | Number of packets dropped due to a lack of buffers. |
| Sent: | |
| total | Total number of TCP packets sent. |
| compressed | Total number of TCP packets compressed. |
| bytes saved | Number of bytes reduced. |
| bytes sent | Number of bytes sent. |
| efficiency improvement factor | Improvement in line efficiency because of TCP header compression. |
| Connect: | |
| number of slots | Size of the cache. |
| long searches | Indicates the number of times the software had to look to find a match. |
| misses | Indicates the number of times a match could not be made. If your output shows a large miss rate, then the number of allowable simultaneous compression connections may be too small. |
| hit ratio | Percentage of times the software found a match and was able to compress the header. |
| Five minute miss rate | Calculates the miss rate over the previous 5 minutes for a longer-term (and more accurate) look at miss rate trends. |
| max misses/sec | Maximum value of the previous field. |
To display statistics about IP traffic, use the show ip traffic EXEC command.
show ip trafficThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show ip traffic command:
Router# show ip traffic
IP statistics:
Rcvd: 98 total, 98 local destination
0 format errors, 0 checksum errors, 0 bad hop count
0 unknown protocol, 0 not a gateway
0 security failures, 0 bad options
Frags: 0 reassembled, 0 timeouts, 0 too big
0 fragmented, 0 couldn't fragment
Bcast: 38 received, 52 sent
Sent: 44 generated, 0 forwarded
0 encapsulation failed, 0 no route
ICMP statistics:
Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 0 unreachable
0 echo, 0 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 info request, 0 other
Sent: 0 redirects, 3 unreachable, 0 echo, 0 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp
0 info reply, 0 time exceeded, 0 parameter problem
UDP statistics:
Rcvd: 56 total, 0 checksum errors, 55 no port
Sent: 18 total, 0 forwarded broadcasts
TCP statistics:
Rcvd: 0 total, 0 checksum errors, 0 no port
Sent: 0 total
EGP statistics:
Rcvd: 0 total, 0 format errors, 0 checksum errors, 0 no listener
Sent: 0 total
IGRP statistics:
Rcvd: 73 total, 0 checksum errors
Sent: 26 total
HELLO statistics:
Rcvd: 0 total, 0 checksum errors
Sent: 0 total
ARP statistics:
Rcvd: 20 requests, 17 replies, 0 reverse, 0 other
Sent: 0 requests, 9 replies (0 proxy), 0 reverse
Probe statistics:
Rcvd: 6 address requests, 0 address replies
0 proxy name requests, 0 other
Sent: 0 address requests, 4 address replies (0 proxy)
0 proxy name replies
Table 22 describes significant fields shown in the display.
| Field | Description |
|---|---|
| format errors | A gross error in the packet format, such as an impossible Internet header length. |
| bad hop count | Occurs when a packet is discarded because its time-to-live (TTL) field was decremented to zero. |
| encapsulation failed | Usually indicates that the router had no ARP request entry and therefore did not send a datagram. |
| no route | Counted when the Cisco IOS software discards a datagram it did not know how to route. |
| proxy name reply | Counted when the Cisco IOS software sends an ARP or Probe Reply on behalf of another host. The display shows the number of probe proxy requests that have been received and the number of responses that have been sent. |
To display a summary of Silicon Switch Processor (SSP) statistics, use the show sse summary EXEC command.
show sse summaryThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show sse summary command:
Router# show sse summary
SSE utilization statistics
Program words Rewrite bytes Internal nodes Depth
Overhead 499 1 8
IP 0 0 0 0
IPX 0 0 0 0
SRB 0 0 0 0
CLNP 0 0 0 0
IP access lists 0 0 0
Total used 499 1 8
Total free 65037 262143
Total available 65536 262144
Free program memory
[499..65535]
Free rewrite memory
[1..262143]
Internals
75032 internal nodes allocated, 75024 freed
SSE manager process enabled, microcode enabled, 0 hangs
Longest cache computation 4ms, longest quantum 160ms at 0x53AC8
To display Hot Standby Router Protocol (HSRP) information, use the show standby EXEC command.
show standbyThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show standby command:
Router# show standby
Ethernet0 - Group 0
Local state is Active, priority 100, may preempt
Hellotime 3 holdtime 10
Next hello sent in 0:00:00
Hot standby IP address is 198.92.72.29 configured
Active router is local
Standby router is 198.92.72.21 expires in 0:00:07
Tracking interface states for 2 interfaces, 2 up:
Up Ethernet0
Up Serial0
Table 23 describes the fields in the display.
| Field | Description |
|---|---|
| Ethernet0 - Group 0 | Interface type and number and Hot Standby group number for the interface. |
| Local state is ... | State of local router; can be one of the following:
|
|
priority |
Priority value of the router based on the standby priority command. |
| may preempt | Indicates that the router will attempt to assume control as the active router if its priority is greater than the current active router. |
| Hellotime | Time between hello packets (in seconds), based on the standby timers command. |
| holdtime | Time (in seconds) before other routers declare the active or standby router to be down, based on the standby timers command. |
| Next hello sent in ... | Time in which the Cisco IOS software will send the next hello packet (in hours:minutes:seconds). |
| Hot Standby IP address is ... configured | IP address of the current Hot Standby router. The word "configured" indicates that this address is known through the standby ip command. Otherwise, the address was learned dynamically through HSRP hello packets from other routers that do have the HSRP IP address configured. |
| Active router is ... | Value can be "local" or an IP address. Address of the current active Hot Standby router. |
| Standby router is ... | Value can be "local" or an IP address. Address of the "standby" router (the router that is next in line to be the Hot Standby router). |
| expires in | Time (in hours:minutes:seconds) in which the standby router will no longer be the standby router if the local router receives no hello packets from it. |
| Tracking interface states for ... | List of interfaces that are being tracked and their corresponding states. Based on the standby track command. |
| group-number | (Optional) Group number on the interface to which this authentication string applies. |
| string | Authentication string. It can be up to eight characters in length. The default string is cisco. |
group-number: 0
string: cisco
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The authentication string is transmitted unencrypted in all HSRP messages. The same authentication string must be configured on all routers and access servers on a cable to ensure interoperation. Authentication mismatch prevents a device from learning the designated Hot Standby IP address and the Hot Standby timer values from other routers configured with HSRP. Authentication mismatch does not prevent protocol events such as one router taking over as the designated router.
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, "word" is configured as the authentication string required to allow Hot Standby routers in group 1 to interoperate:
interface ethernet 0 standby 1 authentication word
| group-number | (Optional) Group number on the interface for which HSRP is being activated. Default is 0. |
| ip-address | (Optional) IP address of the Hot Standby Router interface. |
| secondary | (Optional) Indicates the IP address is a secondary Hot Standby Router interface. Useful on interfaces with primary and secondary addresses; you can configure primary and secondary HSRP addresses. |
group-number: 0
HSRP is disabled.
Interface configuration
This command first appeared in Cisco IOS Release 10.0. The group-number argument first appeared in IOS 10.3. The secondary keyword first appeared in Cisco IOS 11.1.
The standby ip command activates HSRP on the configured interface. If an IP address is specified, that address is used as the designated address for the Hot Standby group. If no IP address is specified, the designated address is learned through the standby function. For HSRP to elect a designated router, at least one router on the cable must have been configured with, or learned, the designated address. Configuring the designated address on the active router always overrides a designated address that is currently in use.
When the standby ip command is enabled on an interface, the handling of proxy ARP requests is changed (unless proxy ARP was disabled). If the interface's Hot Standby state is active, proxy ARP requests are answered using the Hot Standby group's MAC address. If the interface is in a different state, proxy ARP responses are suppressed.
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, HSRP is enabled for group 1 on Ethernet interface 0. The IP address used by the Hot Standby group will be learned using HSRP.
interface ethernet 0 standby 1 ip
In the following example, all three virtual IP addresses appear in the ARP table using the same (single) virtual MAC address. All three virtual IP addresses are using the same HSRP group (group 0).
ip address 1.1.1.1. 255.255.255.0 ip address 1.2.2.2. 255.255.255.0 secondary ip address 1.3.3.3. 255.255.255.0 secondary ip address 1.4.4.4. 255.255.255.0 secondary standby ip 1.1.1.254 standby ip 1.2.2.254 secondary standby ip 1.3.3.254 secondary
| group-number | (Optional) Group number on the interface for which the Hot Standby preemptive feature is being activated. |
group-number: 0
The local router assumes control as the active
router only if it receives information indicating that there is no router
currently in the active state.
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, group 1 on Ethernet interface 0 is configured to preempt the current leader if the interface has a higher priority:
interface ethernet 0 standby 1 preempt
| group-number | (Optional) Group number on the interface to which the priority number applies. |
| priority-number | Priority value. It is an integer from 0 to 255. The default is 100. |
group-number: 0
priority-number: 100
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The assigned priority is used to help select the active and standby routers. Assuming preemption is enabled, the router with the highest priority becomes the designated active router. In case of ties, the primary IP addresses are compared, and the higher IP address has priority.
Note that the device's priority can change dynamically if an interface is configured with the standby track command and another interface on the router goes down.
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, group number 1 on Ethernet interface 0 is assigned with priority 150:
interface ethernet 0 standby 1 priority 150
| group-number | (Optional) Group number on the interface to which the timers apply. The default is 0. |
| hellotime | Hello interval in seconds. This is an integer from 1 to 255. The default is 3 second. |
| holdtime | Time in seconds before the active or standby router is declared to be down. This is an integer from 1 to 255. The default is 10 seconds. |
group-number: 0
hellotime: 3 second
holdtime: 10
seconds
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
The standby timers command configures the time between standby hellos and the time before other routers declare the active or standby router to be down. Routers or access servers on which timer values are not configured can learn timer values from the active or standby router. The timers configured on the active router always override any other timer settings. All routers in a Hot Standby group should use the same timer values. Normally, holdtime is greater than or equal to 3 times hellotime (holdtime > 3 * hellotime).
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, for group number 1 on Ethernet interface 0, the time between hello packets is set to 5 seconds, and the time after which a router is considered to be down is set to 15 seconds:
interface ethernet 0 standby 1 ip standby 1 timers 5 15
To configure an interface so that the Hot Standby priority changes based on the availability of other interfaces, use the standby track interface configuration command. To remove the tracking, use the no form of this command.
standby [group-number] track type number [interface-priority]| group-number | (Optional) Group number on the interface to which the tracking applies. |
| type | Interface type (combined with interface number) that will be tracked. |
| number | Interface number (combined with interface type) that will be tracked. |
| interface-priority | (Optional) Amount by which the Hot Standby priority for the router is decremented (or incremented) when the interface goes down (or comes back up). The default value is 10. |
group-number: 0
interface-priority: 10
Interface configuration
This command first appeared in Cisco IOS Release 10.3.
This command ties the router's Hot Standby priority to the availability of its interfaces. It is useful for tracking interfaces that are not configured for the Hot Standby Router Protocol.
When a tracked interface goes down, the Hot Standby priority decreases by 10. If an interface is not tracked, its state changes do not affect the Hot Standby priority. For each interface configured for Hot Standby, you can configure a separate list of interfaces to be tracked.
The optional argument interface-priority specifies how much to decrement the Hot Standby priority by when a tracked interface goes down. When the tracked interface comes back up, the priority is incremented by the same amount.
When multiple tracked interfaces are down and interface-priority values have been configured, these configured priority decrements are cumulative. If tracked interfaces are down, but none of them were configured with priority decrements, the default decrement is 10 and it is noncumulative.
When group number 0 is used, no group number is written to NVRAM, providing backward compatibility.
In the following example, Ethernet interface 1 tracks Ethernet interface 0 and serial interface 0. If one or both of these two interfaces go down, the Hot Standby priority of the router decreases by 10. Because the default Hot Standby priority is 100, the priority becomes 90 when one or both of the tracked interfaces go down.
interface ethernet 1 ip address 198.92.72.37 255.255.255.240 no ip redirects standby track ethernet 0 standby track serial 0 standby preempt standby ip 198.92.72.46
standby
preempt
standby
priority
This command has no arguments or keywords.
HSRP uses the preassigned MAC address on Ethernet and FDDI, or the functional address on Token Ring.
Interface configuration
This command first appeared in Cisco IOS Release 11.2.
For an interface with this command configured, only one standby group can be configured. Multiple groups need to be removed before this command is configured. Hosts on the interface need to have a default gateway configured. It is recommended you set the no ip proxy-arp command on the interface. It is desirable to configure the standby use-bia command on a Token Ring interface if there are devices that reject ARP replies with source hardware addresses set to a functional address.
When HSRP runs on a multiple-ring, source-routed bridging environment and the HRSP routers reside on different rings, configuring the standby use-bia command can prevent RIF confusion.
In the following example, the burned-in address of Token Ring interface 4/0 will be the virtual MAC address mapped to the virtual IP address:
interface token4/0 standby use-bia
To specify the format in which netmasks are displayed in show command output, use the term ip netmask-format EXEC command. To restore the default display format, use the no form of this command.
term ip netmask-format {bitcount | decimal | hexadecimal}| bitcount | Addresses are followed by a slash and the total number of bits in the netmask. For example, 131.108.11.55/24 indicates that the netmask is 24 bits. |
| decimal | Netmasks are displayed in dotted decimal notation (for example, 255.255.255.0). |
| hexadecimal | Netmasks are displayed in hexadecimal format, as indicated by the leading 0X (for example, 0XFFFFFF00). |
Netmasks are displayed in dotted decimal format.
EXEC
This command first appeared in Cisco IOS Release 10.3.
IP uses a 32-bit mask that indicates which address bits belong to the network and subnetwork fields, and which bits belong to the host field. This is called a netmask. By default, show commands display an IP address and then its netmask in dotted decimal notation. For example, a subnet would be displayed as 131.108.11.55 255.255.255.0.
However, you can specify that the display of the network mask appear in hexadecimal format or bit count format instead. The hexadecimal format is commonly used on UNIX systems. The previous example would be displayed as 131.108.11.55 0XFFFFFF00.
The bitcount format for displaying network masks is to append a slash (/) and the total number of bits in the netmask to the address itself. The previous example would be displayed as 131.108.11.55/24.
The following example specifies that network masks for the session be displayed in bitcount notation in the output of show commands:
term ip netmask-format bitcount
To discover the routes the packets follow when traveling to their destination from the router, use the trace privileged EXEC command.
trace [destination]| destination | (Optional) Destination address or host name on the command line. The default parameters for the appropriate protocol are assumed and the tracing action begins. |
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
The trace command works by taking advantage of the error messages generated by the Cisco IOS software when a datagram exceeds its time-to-live (TTL) value.
The trace command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back an error message. The trace command sends several probes at each TTL level and displays the round-trip time for each.
The trace command sends out one probe at a time. Each outgoing packet may result in one or two error messages. A time exceeded error message indicates that an intermediate router has seen and discarded the probe. A destination unreachable error message indicates that the destination node has received the probe and discarded it because it could not deliver the packet. If the timer goes off before a response comes in, trace prints an asterisk (*).
To use nondefault parameters and invoke an extended trace test, enter the command without a destination argument. You will be stepped through a dialog to select the desired parameters.
Due to bugs in the IP implementation of various hosts and routers, the IP trace command may behave in odd ways.
Not all destinations will respond correctly to a probe message by sending back an ICMP port unreachable message. A long sequence of TTL levels with only asterisks, terminating only when the maximum TTL has been reached, may indicate this problem.
There is a known problem with the way some hosts handle an ICMP TTL exceeded message. Some hosts generate an ICMP message but they reuse the TTL of the incoming packet. Since this is zero, the ICMP packets do not make it back. When you trace the path to such a host, you may see a set of TTL values with asterisks (*). Eventually the TTL gets high enough that the ICMP message can get back. For example, if the host is six hops away, trace will time out on responses 6 through 11.
The following display shows sample IP trace output when a destination host name has been specified:
Router# trace ABA.NYC.mil
Type escape sequence to abort.
Tracing the route to ABA.NYC.mil (26.0.0.73)
1 DEBRIS.CISCO.COM (131.108.1.6) 1000 msec 8 msec 4 msec
2 BARRNET-GW.CISCO.COM (131.108.16.2) 8 msec 8 msec 8 msec
3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec
4 BB2.SU.BARRNET.NET (131.119.254.6) 8 msec 8 msec 8 msec
5 SU.ARC.BARRNET.NET (131.119.3.8) 12 msec 12 msec 8 msec
6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec
7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec
Table 24 describes the fields shown in the display.
| Field | Description |
|---|---|
| 1 | Indicates the sequence number of the router in the path to the host. |
| DEBRIS.CISCO.COM | Host name of this router. |
| 131.108.1.61 | Internet address of this router. |
| 1000 msec 8 msec 4 msec | Round-trip time for each of the three probes that are sent. |
The following display shows a sample trace session involving the extended dialog of the trace command:
Router#traceProtocol [ip]: Target IP address:mit.eduSource address: Numeric display [n]: Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Port Number [33434]: Loose, Strict, Record, Timestamp, Verbose[none]: Type escape sequence to abort. Tracing the route to MIT.EDU (18.72.2.1) 1 ICM-DC-2-V1.ICP.NET (192.108.209.17) 72 msec 72 msec 88 msec 2 ICM-FIX-E-H0-T3.ICP.NET (192.157.65.122) 80 msec 128 msec 80 msec 3 192.203.229.246 540 msec 88 msec 84 msec 4 T3-2.WASHINGTON-DC-CNSS58.T3.ANS.NET (140.222.58.3) 84 msec 116 msec 88 msec 5 T3-3.WASHINGTON-DC-CNSS56.T3.ANS.NET (140.222.56.4) 80 msec 132 msec 88 msec 6 T3-0.NEW-YORK-CNSS32.T3.ANS.NET (140.222.32.1) 92 msec 132 msec 88 msec 7 T3-0.HARTFORD-CNSS48.T3.ANS.NET (140.222.48.1) 88 msec 88 msec 88 msec 8 T3-0.HARTFORD-CNSS49.T3.ANS.NET (140.222.49.1) 96 msec 104 msec 96 msec 9 T3-0.ENSS134.T3.ANS.NET (140.222.134.1) 92 msec 128 msec 92 msec 10 W91-CISCO-EXTERNAL-FDDI.MIT.EDU (192.233.33.1) 92 msec 92 msec 112 msec 11 E40-RTR-FDDI.MIT.EDU (18.168.0.2) 92 msec 120 msec 96 msec 12 MIT.EDU (18.72.2.1) 96 msec 92 msec 96 msec
Table 25 describes the fields that are unique to the extended trace sequence, as shown in the display.
| Field | Description |
|---|---|
| Target IP address | You must enter a host name or an IP address. There is no default. |
| Source address | One of the interface addresses of the router to use as a source address for the probes. The Cisco IOS software will normally pick what it feels is the best source address to use. |
| Numeric display | The default is to have both a symbolic and numeric display; however, you can suppress the symbolic display. |
| Timeout in seconds | The number of seconds to wait for a response to a probe packet. The default is 3 seconds. |
| Probe count | The number of probes to be sent at each TTL level. The default count is 3. |
| Minimum Time to Live [1] | The TTL value for the first probes. The default is 1, but it can be set to a higher value to suppress the display of known hops. |
| Maximum Time to Live [30] | The largest TTL value that can be used. The default is 30. The trace command terminates when the destination is reached or when this value is reached. |
| Port Number | The destination port used by the UDP probe messages. The default is 33434. |
| Loose, Strict, Record, Timestamp, Verbose | IP header options. You may specify any combination. The trace command issues prompts for the required fields. Note that trace will place the requested options in each probe; however, there is no guarantee that all routers (or end nodes) will process the options. |
| Loose Source Routing | Allows you to specify a list of nodes that must be traversed when going to the destination. |
| Strict Source Routing | Allows you to specify a list of nodes that must be the only nodes traversed when going to the destination. |
| Record | Allows you to specify the number of hops to leave room for. |
| Timestamp | Allows you to specify the number of time stamps to leave room for. |
| Verbose | If you select any option, the verbose mode is automatically selected and trace prints the contents of the option field in any incoming packets. You can prevent verbose mode by selecting it again, toggling its current setting. |
Table 26 describes the characters that can appear in trace output.
| Character | Description |
|---|---|
| nn msec | For each node, the round-trip time (in milliseconds) for the specified number of probes. |
| * | The probe timed out. |
| ? | Unknown packet type. |
| Q | Source quench. |
| P | Protocol unreachable. |
| N | Network unreachable. |
| U | Port unreachable. |
| H | Host unreachable. |
To discover the routes the router packets follow when traveling to their destination, use the trace user EXEC command.
trace ip destination| destination | Destination address or host name on the command line. The default parameters for the appropriate protocol are assumed and the tracing action begins. |
User EXEC
This command first appeared in Cisco IOS Release 10.0.
The trace command works by taking advantage of the error messages generated by the Cisco IOS software when a datagram exceeds its time-to-live (TTL) value.
The trace command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back an error message. The trace command sends several probes at each TTL level and displays the round-trip time for each.
The trace command sends out one probe at a time. Each outgoing packet may result in one or two error messages. A time exceeded error message indicates that an intermediate router has seen and discarded the probe. A destination unreachable error message indicates that the destination node has received the probe and discarded it because it could not deliver the packet. If the timer goes off before a response comes in, trace prints an asterisk (*).
Due to bugs in the IP implementation of various hosts and routers, the IP trace command may behave in odd ways.
Not all destinations will respond correctly to a probe message by sending back an ICMP port unreachable message. A long sequence of TTL levels with only asterisks, terminating only when the maximum TTL has been reached, may indicate this problem.
There is a known problem with the way some hosts handle an ICMP TTL exceeded message. Some hosts generate an ICMP message but they reuse the TTL of the incoming packet. Since this is zero, the ICMP packets do not make it back. When you trace the path to such a host, you may see a set of TTL values with asterisks (*). Eventually the TTL gets high enough that the ICMP message can get back. For example, if the host is six hops away, trace will time out on responses 6 through 11.
The following display shows sample IP trace output when a destination host name has been specified:
Router# trace ip ABA.NYC.mil
Type escape sequence to abort.
Tracing the route to ABA.NYC.mil (26.0.0.73)
1 DEBRIS.CISCO.COM (131.108.1.6) 1000 msec 8 msec 4 msec
2 BARRNET-GW.CISCO.COM (131.108.16.2) 8 msec 8 msec 8 msec
3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec
4 BB2.SU.BARRNET.NET (131.119.254.6) 8 msec 8 msec 8 msec
5 SU.ARC.BARRNET.NET (131.119.3.8) 12 msec 12 msec 8 msec
6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec
7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec
In the trace (privileged) command section, Table 24 describes the fields shown in the display. Table 26 describes the characters that can appear in trace output.
To assign a transmit interface to a receive-only interface, use the transmit-interface interface configuration command. To return to normal duplex Ethernet interfaces, use the no form of this command.
transmit-interface type number| type | Transmit interface type to be linked with the (current) receive-only interface. |
| number | Transmit interface number to be linked with the (current) receive-only interface. |
Disabled
This command first appeared in Cisco IOS Release 10.0.
Interface configuration
Receive-only interfaces are used commonly with microwave Ethernet links.
The following example specifies Ethernet interface 0 as a simplex Ethernet interface:
interface ethernet 1 ip address 128.9.1.2 transmit-interface ethernet 0
To set the encapsulation mode for the tunnel interface, use the tunnel mode interface configuration command. To set to the default, use the no form of this command.
tunnel mode {aurp | cayman | dvmrp | eon | gre ip [multipoint] | nos}| aurp | AppleTalk Update-Based Routing Protocol (AURP). |
| cayman | Cayman TunnelTalk AppleTalk encapsulation. |
| dvmrp | Distance Vector Multicast Routing Protocol. |
| eon | EON compatible CLNS tunnel. |
| gre ip | Generic routing encapsulation (GRE) protocol over IP. |
| multipoint | (Optional) Enables a GRE tunnel to be used in a multipoint fashion. Can be used with the gre ip keyword only, and requires the use of the tunnel key command. |
| nos | KA9Q/NOS compatible IP over IP. |
GRE tunneling
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
You cannot have two tunnels using the same encapsulation mode with exactly the same source and destination address. The workaround is to create a loopback interface and source packets off of the loopback interface.
Cayman tunneling implements tunneling as designed by Cayman Systems. This enables our routers and access servers to interoperate with Cayman GatorBoxes. With Cayman tunneling, you can establish tunnels between two routers or between our device and a GatorBox. When using Cayman tunneling, you must not configure the tunnel with an AppleTalk network address. This means that there is no way to ping the other end of the tunnel.
Use Distance Vector Multicast Routing Protocol (DVMRP) when a router connects to a mrouted router to run DVMRP over a tunnel. It is required to configure Protocol-Independent Multicast (PIM) and an IP address on a DVMRP tunnel.
Generic routing encapsulation (GRE) tunneling can be done between our routers and access servers only. When using GRE tunneling for AppleTalk, you configure the tunnel with an AppleTalk network address. This means that you can ping the other end of the tunnel.
For multipoint GRE tunnels, a tunnel key must be configured. Unlike other tunnels, the tunnel destination is optional. However, if the tunnel destination is supplied, it must map to an IP multicast address.
The following example enables Cayman tunneling:
interface tunnel 0 tunnel source ethernet 0 tunnel destination 131.108.164.19 tunnel mode cayman
The following example enables GRE tunneling:
interface tunnel 0 appletalk cable-range 4160-4160 4160.19 appletalk zone Engineering tunnel source ethernet0 tunnel destination 131.108.164.19 tunnel mode gre ip
A dagger (+) indicates that the command is documented outside this chapter.
appletalk cable-range +
appletalk zone
+
tunnel destination +
tunnel source
+
|
|