Do Cisco show commands change the device configuration?

Show commands normally read device state without changing the configuration. Some related operational commands, such as clearing counters, do change stored statistics, so use them carefully.

What is the difference between show running-config and show startup-config?

`show running-config` displays the active configuration held in RAM. `show startup-config` displays the saved configuration that the device intends to load during its next normal boot.

What does up down mean in show ip interface brief?

`up/down` means the physical interface is active but the line protocol is not operational. Investigate encapsulation, keepalive, peer configuration and other data-link conditions relevant to that interface type.

Which Cisco command shows interface errors?

Use `show interfaces` followed by the interface name. Check CRC errors, input errors, drops, collisions where applicable, resets and whether the counters continue increasing.

Which command shows the route used for a destination?

Use `show ip route` followed by the destination IPv4 address, such as `show ip route 10.20.20.25`. The output identifies the matching route, next hop and outgoing interface.

How can I shorten long Cisco IOS output?

Use pipe filters such as `include`, `exclude`, `begin` or `section` where the platform supports them. For example, `show logging | include LINK` displays log lines containing the word LINK.

Cisco Show Commands: How to Read IOS Output

Cisco IOS show commands display the current state of routers and switches without changing their configuration. Network engineers use them to verify interfaces, VLANs, routes, neighbours, MAC addresses, logs and device health before deciding what to fix.

This guide focuses on reading command output rather than memorising syntax. Outputs can differ slightly between Cisco IOS releases, IOS XE versions and hardware platforms, but the main fields and troubleshooting logic remain consistent.

What are Cisco IOS show commands?

Cisco IOS show commands retrieve operational and configuration information from a Cisco device. Most are read-only commands, making them suitable for verification and troubleshooting when used at the correct privilege level.

At the user EXEC prompt, represented by >, only a limited set of commands is available. Enter privileged EXEC mode to access commands such as show running-config:

Router> enable
Router# show running-config

Think of the device as having several information panels:

Physical state → Interfaces and errors
Layer 2 state  → VLANs, trunks, MAC table and STP
Layer 3 state  → IP addresses, ARP entries and routing table
Control state  → Neighbours and routing protocols
System state   → IOS version, uptime, CPU, memory and logs

The following Cisco show commands inspect each panel separately.

How do you check the Cisco IOS version and device uptime?

Use show version to identify the IOS software, hardware model, uptime, restart reason and configuration register. It is often the first command collected during inventory checks or after an unexpected reboot.

Router# show version
Cisco IOS XE Software, Version 17.09.04a
Cisco ISR4331/K9 (1RU) processor with 1795999K/6147K bytes of memory.
Router uptime is 3 days, 4 hours, 18 minutes
System returned to ROM by PowerOn
System image file is "bootflash:isr4300-universalk9.17.09.04a.SPA.bin"
Configuration register is 0x2102

Read these fields carefully:

Field	What it tells you
Software version	The IOS or IOS XE release currently running
Device model	The router or switch platform
Uptime	Time since the last restart
Restart reason	Power failure, manual reload, crash or another cause
System image	Image file loaded during boot
Configuration register	Controls boot behaviour on supported platforms

An uptime of only a few minutes may explain why routing neighbours or MAC tables have not fully populated. A restart reason such as PowerOn points towards a power interruption rather than an IOS reload command.

How do you read show ip interface brief?

show ip interface brief gives a compact view of interface names, IP addresses and operational states. It is usually the fastest command for finding shutdown ports, failed links and incorrect Layer 3 addresses.

Router# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   192.168.10.1    YES manual up                    up
GigabitEthernet0/0/1   10.0.12.1       YES manual up                    down
GigabitEthernet0/0/2   unassigned      YES unset  administratively down down
Loopback0              1.1.1.1         YES manual up                    up

The two most important columns are Status and Protocol:

Status and protocol	Common interpretation
`up/up`	Physical and data-link operation are working
`administratively down/down`	The interface has a `shutdown` command
`down/down`	Physical problem, disconnected cable, powered-off peer or failed port
`up/down`	Physical signal exists, but the line protocol is failing

In words, imagine two indicator lights. The first light represents the physical interface; the second represents the data-link protocol. Both normally need to be up before Layer 3 communication can succeed.

Students who need practice from initial console access through interface addressing can use the Cisco router configuration basics lab.

What does show interfaces reveal?

show interfaces provides detailed counters, bandwidth information, encapsulation and traffic statistics. Use it after show ip interface brief identifies a suspicious interface.

Router# show interfaces GigabitEthernet0/0/1
GigabitEthernet0/0/1 is up, line protocol is up
  Hardware is ISR4331-3x1GE, address is 00ab.12cd.3401
  Internet address is 10.0.12.1/30
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec
  Full Duplex, 1000Mbps, media type is RJ45
  5 minute input rate 24000 bits/sec, 18 packets/sec
  5 minute output rate 17000 bits/sec, 14 packets/sec
     184220 packets input, 0 input errors, 0 CRC
     175604 packets output, 0 output errors, 3 interface resets

Important fields include:

Line state: Confirms whether the interface and line protocol are operational.
Internet address: Verifies the assigned IP address and prefix.
MTU: Shows the largest supported Layer 3 packet size without fragmentation on that interface.
Bandwidth: An IOS reference value used by some routing calculations; it is not a live speed test.
Input and output rates: Recent traffic averages.
CRC errors: Often suggest damaged cables, interference, faulty hardware or a Layer 1 issue.
Input drops: Can indicate that traffic arrived faster than the device could process or queue it.
Interface resets: May indicate link instability or driver and hardware events.

Do not diagnose a fault from one old counter. Clear counters only during an approved troubleshooting window, then check whether errors increase again:

Router# clear counters GigabitEthernet0/0/1
Router# show interfaces GigabitEthernet0/0/1

Clearing counters removes useful historical evidence, so record the values first.

How do you inspect VLANs, access ports and trunks?

Use show vlan brief for VLAN membership and show interfaces trunk for trunk status. Together, these commands reveal many common switching problems, including ports in the wrong VLAN and VLANs missing from a trunk.

Switch# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/4, Gi1/0/5
10   USERS                            active    Gi1/0/1, Gi1/0/2
20   SERVERS                          active    Gi1/0/3
99   MANAGEMENT                       active

show vlan brief mainly lists access-port membership. A trunk interface may not appear beside an individual VLAN because it carries multiple VLANs.

Switch# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi1/0/24    on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/24    10,20,99

Port        Vlans allowed and active in management domain
Gi1/0/24    10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    10,20,99

Check three things: the interface must be trunking, the native VLAN should match the design on both ends, and the required VLAN must appear in the allowed and forwarding lists.

For access-port security verification, see the practical guide to switch port security configuration and violation modes.

How do you read the MAC address and ARP tables?

The MAC address table maps Ethernet addresses to switch ports, while the ARP table maps IPv4 addresses to MAC addresses. Reading both tables helps trace a device through Layer 2 and Layer 3.

Switch# show mac address-table dynamic
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0011.2233.4455    DYNAMIC     Gi1/0/2
  20    00aa.bbcc.ddee    DYNAMIC     Gi1/0/24

The first entry means the switch learned MAC address 0011.2233.4455 in VLAN 10 through Gi1/0/2. The second entry was learned through the trunk, suggesting the device is reachable through another switch.

Router# show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.10.10           2   0011.2233.4455  ARPA   Gi0/0/0
Internet  192.168.10.1            -   00ab.12cd.3400  ARPA   Gi0/0/0

A hyphen in the age field commonly identifies the router's own address. An Incomplete ARP entry means the device sent ARP requests but did not receive a reply. Possible causes include the wrong VLAN, an offline host, bad cabling or an incorrect subnet.

How do you interpret show ip route?

show ip route displays the IPv4 routes a router can use to forward packets. Read the route source code, prefix, administrative distance, metric, next hop and outgoing interface.

Router# show ip route
Gateway of last resort is 10.0.12.2 to network 0.0.0.0

C    192.168.10.0/24 is directly connected, GigabitEthernet0/0/0
L    192.168.10.1/32 is directly connected, GigabitEthernet0/0/0
O    10.20.20.0/24 [110/2] via 10.0.12.2, 00:04:18, GigabitEthernet0/0/1
S*   0.0.0.0/0 [1/0] via 10.0.12.2

Code or field	Meaning
`C`	Connected network
`L`	Local interface address represented as a host route
`S`	Static route
`O`	Route learned through OSPF
`*`	Candidate default route
`[110/2]`	Administrative distance of 110 and metric of 2
`via 10.0.12.2`	Next-hop router

Routers first use longest-prefix matching. If several routes have the same prefix length, route source preference and protocol metrics help determine which route enters the routing table.

To check one destination without reading the entire table, use:

Router# show ip route 10.20.20.25

Which commands show neighbours and network topology?

show cdp neighbors identifies directly connected Cisco devices, while show lldp neighbors can discover supported devices from multiple vendors. These commands help confirm cabling, local ports and the physical topology.

Switch# show cdp neighbors
Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
R1               Gig 1/0/24       142         R S I       ISR4331   Gig 0/0/0
SW2              Gig 1/0/23       131         S I         C9200L    Gig 1/0/24

Read each row as a cable description: local Gi1/0/24 connects to router R1 on its Gi0/0/0. Use the detailed version to view management addresses and software details:

Switch# show cdp neighbors detail
Switch# show lldp neighbors detail

Discovery information should not replace documentation, and organisations may disable CDP or LLDP on untrusted interfaces.

How do you verify Spanning Tree Protocol?

Use show spanning-tree to identify the root bridge, root port and forwarding or blocking roles. This is essential when a valid VLAN exists but one path is intentionally not forwarding frames.

Switch# show spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0010.aaaa.0000
             Cost        4
             Port        24 (GigabitEthernet1/0/24)

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1          Desg FWD 4         128.1    P2p Edge
Gi1/0/23         Altn BLK 4         128.23   P2p
Gi1/0/24         Root FWD 4         128.24   P2p

In this output, Gi1/0/24 is the best path towards the root bridge. Gi1/0/23 is an alternate port in a blocking or discarding state, preventing a Layer 2 loop. That state may be normal rather than a fault.

How do you view the active configuration and logs safely?

show running-config displays the active configuration in RAM, while show startup-config displays the saved configuration used at the next boot. show logging provides messages about interface transitions, protocol events and system conditions.

Router# show running-config
Router# show startup-config
Router# show logging

Useful focused commands include:

Router# show running-config interface GigabitEthernet0/0/1
Router# show running-config | section router ospf
Router# show logging | include LINK|LINEPROTO
Router# show ip interface brief | exclude unassigned

The pipe character filters output. Common filters include include, exclude, begin and, on many IOS platforms, section.

Configuration output may contain usernames, hashed secrets, community strings or other sensitive information. Remove confidential data before sharing command output in tickets, chats or public forums.

How can Cisco show commands troubleshoot a failed connection?

Start at the local interface and move outward through VLAN, trunk, MAC, ARP and routing state. This ordered process separates physical, Layer 2 and Layer 3 problems instead of making random configuration changes.

Consider this path described in words:

PC-A → access port Gi1/0/2 → VLAN 10 → trunk Gi1/0/24
→ router gateway 192.168.10.1 → routed network → server

PC-A cannot reach the server. Use this sequence:

Check interface state.

Switch# show interfaces status
Switch# show interfaces Gi1/0/2

Confirm that the port is connected and that errors are not increasing.

Verify access VLAN membership.

Switch# show vlan brief
Switch# show interfaces Gi1/0/2 switchport

If Gi1/0/2 is in VLAN 1 instead of VLAN 10, frames will enter the wrong broadcast domain.

Verify the uplink trunk.

Switch# show interfaces trunk

Confirm that VLAN 10 is allowed, active and forwarding on Gi1/0/24.

Trace the client MAC address.

Switch# show mac address-table address 0011.2233.4455

If the address is missing, the switch has not recently received frames from the client. Recheck the endpoint, cable and access port.

Check the gateway ARP entry and route.

Router# show ip arp 192.168.10.10
Router# show ip route 10.20.20.50

An incomplete ARP entry points back towards the local LAN. A missing route to the server network points towards routing configuration or a failed routing neighbour.

This evidence-first workflow is practised in a structured CCNA course, where learners can compare normal and faulty output in routing and switching labs.

What are the most useful Cisco show commands to remember?

A small command set covers most initial checks. Learn what each output proves rather than trying to memorise every available command.

Command	Main use
`show version`	Software, hardware, uptime and reload reason
`show ip interface brief`	Interface and IP status summary
`show interfaces`	Detailed counters and physical errors
`show vlan brief`	VLANs and access-port membership
`show interfaces trunk`	Trunk state and permitted VLANs
`show mac address-table`	Learned Layer 2 addresses
`show ip arp`	IPv4-to-MAC mappings
`show ip route`	Routing decisions and next hops
`show cdp neighbors`	Directly connected Cisco devices
`show spanning-tree`	STP root, roles and states
`show running-config`	Active configuration
`show logging`	Recorded events and state changes

Summary

Cisco show commands turn device state into evidence that can guide troubleshooting. Begin with summaries, inspect detailed output only where needed, and correlate interface, Layer 2, Layer 3 and system information before changing the configuration.

A strong workflow is: identify the symptom, collect output, compare it with the intended design, isolate the failing layer, apply one controlled correction and verify the result.

Reviewed by Network Rhinos networking trainers.

To practise these commands in guided router and switch labs, enquire about CCNA course batch details.

Common Cisco IOS Show Commands and How to Read Output