Tshoot - Toolkit

Front 1

To filter the output of a show cmd to only include lines with the specified string.

Back 1

R1# show [cmd] | include [text]

Front 2

To filter the output of a show cmd to display everything except lines containing the string you specify.

Back 2

R1# show [cmd] | exclude [text]

Front 3

To Jump through the output of a show cmd to the first occurrence of a specified string.

Back 3

R1# show [cmd] | begin [name]

Front 4

To display IP routing table with only the specified address space and all its subnets.

Back 4

R1# show ip route [network add] [mask] longer-prefixes

Front 5

To redirect (pipe) the output of a cmd to a file suppressing the onscreen output.

Back 5

R1# show [cmd] | redirect ftp://[ip add]/[filename].txt

Front 6

To redirect (pipe) the output of a cmd to a file without suppressing the onscreen output.

Back 6

R1# show [cmd] | tee ftp://[ip add]/[filename].txt

Front 7

To append an output your exporting to an already existing file.

Back 7

R1# show [cmd] | append ftp://[ip add]/[filename].txt

Front 8

To see 5 second, 1 minute and 5 minute CPU utilization statistics in addition to a listing of processes running on a platform with each processes utilization statistics.

Back 8

R1# show processes cpu

Front 9

To display summary information about processor and I/O memory, followed by a more comprehensive report of memory utilization.

Back 9

R1# show memory

Front 10

To show L1 and L2 interface status, interface load information and error statistics that include: Input queue drops=Receives info faster than can be processed, Output queue drops=Received info faster than could be sent out, Input Errors=Frames not received correctly (e.g. CRC error), Output Errors=Frames not transmitted correctly (perhaps due to duplex mismatch).

Back 10

R1# show interfaces

Front 11

To reset interface counters. It is advisable to do so prior to collecting statistics. Stating interfaces or vans is optional.

Back 11

R1# clear counters [[type] [mod/num]] [vlan [vlan-id]

Front 12

To display very detailed controller and interface information. Most of the time, you will only use this command to see if a serial link is a DCE or a DTE and the clock rate speed.

Back 12

R1# show controllers

Front 13

To send ping. Size=No. of bytes in ECMP Echo packet (default 100), Repeat=No. of packets sent, Timeout=No. of seconds waits for a reply, DF-bit=Sets the do-no-fragment bit.

Back 13

R1# ping [ip add] size [bytes] repeat [no.] timeout [secs] df-bit

Front 14

To connect to a remote IP address via telnet using TCP port 23 by default, or optionally via a specified port.

Back 14

R1# telnet [ip add] [port no.]

Front 15

To configure SPAN, which specifies the src interface from where you want to capture packets of both the incoming and outgoing traffic.

Back 15

SW1(config)# monitor session [no.] source interface [type] [mod/num]

Front 16

To configure SPAN to set the dst port where your packet capture device is.

Back 16

SW1(config)# monitor session [no.] destination interface [type] [mod/num]

Front 17

To configure a VLAN as a Remote SPAN VLAN. It will carry the capture packets to a packet capture device on a different switch.

Back 17

SW1(config-vlan)# remote-span

Front 18

To configure RSPAN on a switch so that it passes packets down the RSPAN VLAN towards the switch with the packet capture device connected.

Back 18

SW1(config)# monitor session [no.] destination remote vlan [vlan-id] reflector-port [type] [mod/num]

Front 19

To configure RSPAN on a switch so that the packets it receives down the Remote-SPAN VLAN are passed onto the packet capture device.

Back 19

SW1(config)# monitor session [no.] source remote vlan [vlan-id]

Front 20

To verify which ports are doing what in SPAN and RSPAN.

Back 20

SW1# show monitor

Front 21

To set up snmp with a read only (ro) or read/write (rw) community string. The community string must match on SNMP agent and NMS.

Back 21

SW1(config)# snmp-server community [string] [ro | rw]

Front 22

To force an SNMP interface index to stay consistent during data collection, even if a device is rebooted.

Back 22

SW1(config)# snmp-server ifindex persist

Front 23

To enable SNMP traps which allow a device running SNMP agent to initiate communication with an NMS. Can individually enter trap names if want to specify certain traps, but by default enables all.

Back 23

SW1(config)# snmp-server enable traps

Front 24

To point the router to an SNMP server (NMS) so it can push info and report problems/events to the NMS (e.g. an interface going down).

Back 24

SW1(config)# snmp-server host [ip add] version [number] [community string]

Front 25

To turn on net flow on a port so that all flows passing through that port, regardless of direction, can be monitored.

Back 25

SW1(config-if)# ip flow ingress

Front 26

To set the NetFlow source interface on the router, which is the interface used to communicate with an external NetFlow collector.

Back 26

SW1(config)# ip flow-export source [type] [mod/num]

Front 27

To set the version of NetFlow to use, with version 5 being the most widely deployed.

Back 27

SW1(config)# ip flow-export version [1 | 5 | 9]

Front 28

To specify the IP address and port number of an external NetFlow Collector. There is no default port number for NetFlow.

Back 28

SW1(config)# ip flow-export destination [ip add] [port]

Front 29

To enter EEM configuration mode. EEM allows you to create your own event definitions and specify custom responses to those events.

Back 29

R3(config)# event manager applet [name]

Front 30

To set the event that will trigger the action. In this case is the cmd you specify, if it occurs once, and that the CLI wont be skipped.

Back 30

R3(config-applet)# event cli pattern [cmd] sync no skip no occurs

Front 31

To set the action that is taken once the event occurs. In this case the action is a specified sys message with the specified severity level.

Back 31

R3(config-applet)# action [name] syslog priority [severity level] msg [message]

Front 32

What is a traffic flow?

Back 32

A flow is a series of packets, all of which have shared header info such as src and dst IP, protocol numbers, port numbers and Type of service (TOS) field info.

Front 33

What are the characteristics of SNMP?

Back 33

It collects device statistics and uses a pull model where statistics are pulled from the SMNP agent (monitoring device) by a Network Management Station (NMS).

Front 34

What are the characteristics of Net flow?

Back 34

It collects detailed information about traffic flows and uses a push model where statistics are pushed from the monitoring device to a NetFlow collector.

Front 35

What's the difference between SNMP v3 and 2c?

Back 35

V3 supports encryption and authentication of SNMP messages, whilst 2c uses Community strings for security. The most popular version deployed today is 2c.