Last updated · reviewed for accuracy
Reading show command output
Configuring a device is half the job; the other half is reading what it tells you. Three show commands answer ninety percent of “what is wrong with this network”: if you can decode their output.
The one-glance health check
show ip interface brief lists every interface, its IP address, and two status columns: Status (Layer 1, the physical link) and Protocol (Layer 2, the line protocol). Healthy is up/up; everything else is a diagnosis.
R1# show ip interface brief Interface IP-Address OK? Method Status Protocol Gig0/0 10.0.0.1 YES manual up up Gig0/1 10.0.1.1 YES manual administratively down down Gig0/2 unassigned YES unset down down
The four states and what they accuse
up/up is working. administratively down means someone typed shutdown: fix it with no shutdown. down/down means no physical signal: cable, far end powered off, or wrong port. up/down means the link has signal but the protocol layer disagrees: think mismatched settings on the two ends.
| Status / Protocol | Meaning | First thing to check |
|---|---|---|
up / up |
Working normally | Nothing: move on |
administratively down / down |
Port was shut down on purpose | no shutdown on the interface |
down / down |
No signal at Layer 1 | Cable, SFP, far-end device power |
up / down |
Signal, but line protocol failing | Mismatched encapsulation or speed/duplex |
Decoding a route line
Each show ip route line packs five facts: how the route was learned (the letter code), the destination prefix, [administrative distance / metric], the next hop, and the exit interface. The bracket pair trips everyone up once: distance ranks the source of the route, metric ranks paths within that source.
O 192.168.2.0/24 [110/2] via 10.0.0.2, 00:04:11, Gig0/0 | | | | | | ↳ exit interface | | | | ↳ next hop ↳ route age | | | ↳ metric (OSPF cost) | ↳ destination ↳ administrative distance (OSPF = 110) ↳ learned via OSPF
Administrative distance answers “which source do I trust more?” (connected 0, static 1, OSPF 110). Metric answers “among routes from the same source, which path is best?” A static route will beat an OSPF route to the same prefix every time, because 1 < 110.
A reading order that finds faults fast
Work bottom-up like a structured troubleshooter: interface states first, then the routing table, then the specific path. Each command scopes the next.
show ip interface brief: are the doors even open?show ip route: does the router know a way to the destination?show ip route 10.20.3.7: which exact route will this packet use?- Then
pingandtracerouteconfirm the data plane agrees with the control plane.
This is the CLI version of the troubleshooting toolkit you already know from the host side: same discipline, different prompt.
Practice on simulated output
The practice problems include terminal exercises that show you real command output and ask what is wrong: the fastest way to make this lesson stick.
Frequently asked questions
What does administratively down mean on a Cisco interface?
The port was disabled on purpose with shutdown. It is not a fault: someone turned it off. Bring it back with no shutdown.
What do the numbers in brackets mean in show ip route?
The pair is [administrative distance / metric]: distance ranks the route source (connected 0, static 1, OSPF 110), metric ranks paths within that source. Lower wins on both.
Why does my interface show up/down?
Layer 1 sees signal but the line protocol disagrees, typically an encapsulation or speed/duplex mismatch, or a far-end error state. Compare both ends of the link.