CCNA :) Be a Good Network Administrator (CCNP is coming soon)

Creating ACLs

2011-11-16T23:50:00.000-08:00

Creating ACLs
11.1.3 This page will explain how ACLs are created in global configuration mode. There are many types of ACLs. This lesson explains standard ACLs, extended ACLs, and named ACLs. When ACLs are configured on a router, each ACL must have a unique identification number assigned to it. This number identifies the type of access list created and must fall within the specific range of numbers that is valid for that type of list.

After the proper command mode is entered and the list type number is decided upon, the user enters the access list statements using the keyword access-list, followed by the proper parameters. After the proper command mode is entered and the list type number is set, the user enters the access list statements with the access-list command followed by the proper parameters. This is the first of the two-step process. The second step of the process is assigning the ACL to the proper interface.

In TCP/IP, ACLs are assigned to one or more interfaces and can filter inbound traffic or outbound traffic by using the ip access-group command in interface configuration mode. The access-group command is issued in the interface configuration mode. When an ACL is assigned to an interface, inbound or outbound placement should be specified. The filter direction can be set to check packets that travel into or out of an interface. To determine if an ACL controls inbound or outbound traffic, the network administrator must view the interfaces as if looking at them from inside the router. This is a very important concept. Traffic that travels into an interface is filtered by the inbound access list. Traffic going out of an interface is filtered by the outbound access list. After a numbered ACL is created, it must be assigned to an interface. An ACL containing numbered ACL statements cannot be altered. It must be deleted by using the no access-list list-number command and then recreated.

Use the following rules to create and apply access lists:

There should be one access list per protocol per direction.
Standard access lists should be applied closest to the destination.
Extended access lists should be applied closest to the source.
The inbound or outbound interface should be referenced as if looking at the port from inside the router.
Statements are processed sequentially from the top of the list to the bottom until a match is found. If no match is found then the packet is denied, and discarded.
There is an implicit deny any at the end of all access lists. This will not appear in the configuration listing.
Access list entries should filter in the order from specific to general. Specific hosts should be denied first, and groups or general filters should come last.
The match condition is examined first. The permit or deny is examined only if the match is true.
Never work with an access list that is actively applied.
A text editor should be used to create comments that outline the logic. Then fill in the statements that perform the logic.
New lines are always added to the end of the access list. A no access-list x command will remove the whole list. It is not possible to selectively add and remove lines with numbered ACLs
An IP access list will send an ICMP host unreachable message to the sender of the rejected packet and will discard the packet in the bit bucket.
An access list should be removed carefully. If an access list that is applied to a production interface is removed, some versions of IOS will apply a default deny any to the interface and all traffic will be halted.
Outbound filters do not affect traffic that originates from the local router.

The Lab Activity will help students become more familiar with the syntax that is used to create an ACL.

The next page will discuss wildcard masks.

How ACLs work

2011-11-16T23:45:00.000-08:00

How ACLs work
11.1.2 An ACL is made up of statements that define whether packets are accepted or rejected at inbound and outbound interfaces. This page will explain how these statements are edited and added to an ACL. These decisions are made by matching a condition statement in an access list and then performing the accept or reject action defined in the statement.

The order in which ACL statements are placed is important. The Cisco IOS software tests the packet against each condition statement in order from the top of the list to the bottom. Once a match is found in the list, the accept or reject action is performed and no other ACL statements are checked. If a condition statement that permits all traffic is located at the top of the list, no statements added below that will ever be checked.

If additional condition statements are needed in an access list, the entire ACL must be deleted and recreated with the new condition statements. To make the process of revising an ACL simpler it is a good idea to use a text editor such as Notepad and paste the ACL into the router configuration.

The beginning of the router process is the same, whether ACLs are used or not. As a frame enters an interface, the router checks to see whether the Layer 2 address matches or if it is a broadcast frame. If the frame address is accepted, the frame information is stripped off and the router checks for an ACL on the inbound interface. If an ACL exists, the packet is now tested against the statements in the list. If the packet matches a statement, the packet is either accepted or rejected. If the packet is accepted in the interface, it will then be checked against routing table entries to determine the destination interface and switched to that interface. Next, the router checks whether the destination interface has an ACL. If an ACL exists, the packet is tested against the statements in the list. If the packet matches a statement, it is either accepted or rejected. If there is no ACL or the packet is accepted, the packet is encapsulated in the new Layer 2 protocol and forwarded out the interface to the next device.

As a review, ACL statements operate in sequential, logical order. If a condition match is true, the packet is permitted or denied and the rest of the ACL statements are not checked. If all the ACL statements are unmatched, an implicit deny any statement is placed at the end of the list by default. The invisible deny any statement at the end of the ACL will not allow unmatched packets to be accepted. When first learning how to create ACLs, it is a good idea to add the deny any at the end of ACLs to reinforce the dynamic presence of the implicit deny.

The next page will describe how ACLs are created

Access Control List Fundamentals / Introduction to ACLs

2011-11-16T23:26:00.000-08:00

Access Control List Fundamentals
Introduction to ACLs
11.1.1 This page will explain what ACLs are and how they are used.

ACLs are lists of conditions used to test network traffic that tries to travel across a router interface. These lists tell the router what types of packets to accept or deny. Acceptance and denial can be based on specified conditions. ACLs enable management of traffic and secure access to and from a network.

ACLs can be created for all routed network protocols such as IP and Internetwork Packet Exchange (IPX). ACLs can be configured at the router to control access to a network or subnet.

To filter network traffic, ACLs determine if routed packets are forwarded or blocked at the router interfaces. The router examines each packet and will forward or discard it based on the conditions specified in the ACL. An ACL makes routing decisions based on source address, destination address, protocols, and upper-layer port numbers.

ACLs must be defined on a per protocol, per direction, or per port basis. To control traffic flow on an interface, an ACL must be defined for each protocol enabled on the interface. ACLs control traffic in one direction at a time on an interface. Two separate ACLs must be created to control inbound and outbound traffic. Every interface can have multiple protocols and directions defined. If the router has two interfaces configured for IP, AppleTalk, and IPX, 12 separate ACLs would be needed. There would be one ACL for each protocol, times two for each direction, times two for the number of ports.

ACLs can be used to perform the following tasks:

Limit network traffic and increase network performance. For example, ACLs that restrict video traffic could greatly reduce the network load and increase network performance.
Provide traffic flow control. ACLs can restrict the delivery of routing updates. If updates are not required because of network conditions, bandwidth is preserved.
Provide a basic level of security for network access. ACLs can allow one host to access a part of the network and prevent another host from accessing the same area. For example, Host A is allowed to access the Human Resources network and Host B is prevented from accessing it.
Decide which types of traffic are forwarded or blocked at the router interfaces. ACLs can permit e-mail traffic to be routed, but block all Telnet traffic.
Control which areas a client can access on a network.
Screen hosts to permit or deny access to a network segment. ACLs can be used to permit or deny a user to access file types such as FTP or HTTP.

If ACLs are not configured on the router, all packets that pass through the router will be permitted to access the entire network.
The next page will describe how ACLs work.

Module 11: Access Control Lists (ACLs) / Overview

2011-11-16T23:19:00.000-08:00

Overview

Network administrators must be able to deny unwanted access to a network and allow authorized users to access necessary services. Security tools such as passwords, callback equipment, and physical security devices are helpful. However, they often lack the flexibility of basic traffic filters and the specific controls that most administrators prefer. For example, a network administrator may want to allow users access to the Internet, but not permit external users Telnet access into the LAN.

Routers provide the capability to filter traffic, such as blocking Internet traffic, with access control lists (ACLs). An ACL is a sequential list of permit or deny statements that apply to addresses or upper-layer protocols. This module will introduce standard and extended ACLs as a way to control network traffic and explain how they are used as part of a security solution.

This module includes tips, considerations, recommendations, and general guidelines on how to use ACLs. It also includes the commands and configurations needed to create ACLs. Finally, this module provides examples of standard and extended ACLs and describes ACL placement on router interfaces.

An ACL can be as simple as a single line that permits packets from a specific host or it can be a complex set of rules and conditions that defines network traffic and determines the router processes. While many of the advanced uses of ACLs are beyond the scope of this course, this module provides details about standard and extended ACLs, the proper placement of ACLs, and some special applications of ACLs.

This module covers some of the objectives for the CCNA 640-801 and ICND 640-811 exams.
Students who complete this module should be able to perform the following tasks:

Describe the differences between standard and extended ACLs
Explain the rules for placement of ACLs
Create and apply named ACLs
Describe the function of firewalls

Use ACLs to restrict virtual terminal access

Summary of Module 10

2011-11-16T23:17:00.000-08:00

Summary

This page summarizes the topics discussed in this module.
The transport layer of the OSI model is responsible for the reliable transport and regulation of data flow from a source to a destination. TCP makes sure that each host on the network is ready and willing to communicate.
A three-way handshake is a process that ensures that each side is ready for data transmission and allows each device to determine the initial sequence number. A three-way handshake starts with a host initiating a connection. The other host receives a packet, records a sequence number and then replies with an ACK. The initiating host then responds back and finalizes the connection.
DoS attacks are designed to deny services to legitimate hosts that attempt to establish connections. It is used by hackers to halt system response. SYN flooding is one type of DoS attack. It exploits the normal three-way handshake and causes targeted devices to ACK to source addresses that will not complete the handshake. Spoofing occurs when a receiving device replies to a non-existent, unreachable IP address and is placed in a wait state until it receives the final ACK from the initiator. In addition to software specifically created as a defense against these kinds of attacks, an administrator can decrease the connection timeout period and increase the connection queue size.
Breaking data into smaller pieces is called segmenting and is done with TCP. Once the data is segmented, it must be transmitted to the destination device. TCP applies sequence numbers to the data segments so that the receiver can reassemble the bytes properly and the sender knows when all the segments have been received. Windowing is the process of flow control that regulates how much data is sent during a given transmission period. TCP uses a sliding window when determining transmission size. A sliding window allows for devices to negotiate a window size to allow for more than one byte to be sent during a single transmission.
Many protocols use PAR to provide reliability. With PAR, the source sends a packet, starts a timer, and waits for an ACK before it sends the next packet. If the timer expires before the source receives an ACK, the source retransmits the packet and resets the timer. TCP uses expectational ACKs in which the Acknowledgment Number refers to the next octet that is expected.
UDP provides connectionless, non-guaranteed transmission of packets at Layer 4 of the OSI model. Since UDP does not use windowing or acknowledgments, application layer protocols must provide error detection.
A port number must be associated with the conversation between hosts to ensure that the packet reaches the appropriate service on the server. Port numbers have the following assigned ranges:

The Well Known Ports are those from 0 through 1023
The Registered Ports are those from 1024 through 49151
The Dynamic and/or Private Ports are those from 49152 through 65535

The three methods of addressing include port numbers, which are located at the transport layer and serviced by the network layer. The network layer assigns the logical or IP address and the data link layer assigns the physical or MAC address.

Comparison of MAC addresses, IP addresses, and port numbers

2011-11-16T23:15:00.000-08:00

Comparison of MAC addresses, IP addresses, and port numbers
10.2.6 This page will describe the three types of addresses in reference to the OSI model. Port numbers are located at the transport layer and are serviced by the network layer. The network layer assigns the logical address, or IP address, and is then serviced by the data link layer, which assigns the physical address, or MAC address.
A good analogy can be made with a normal letter. The address on a letter consists of a name, street, city, and state. These can be compared to the port, MAC, and IP address used for network data. The name on the envelope would be equivalent to a port number, the street address is the MAC, and the city and state is the IP address. Multiple letters can be mailed to the same street address, city and state, but contain different names on the letters. For instance, two letters could be mailed to the same house with one addressed to “John Doe” and the other to “Jane Doe”. This is analogous to multiple sessions with different port numbers.
This page concludes this lesson. The next page will summarize the main points from this module.

Port numbering and well-known port numbers / Example of multiple sessions between hosts

2011-11-16T23:09:00.000-08:00

Port numbering and well-known port numbers

10.2.4 This page will discuss the three categories of port numbers.

Port numbers are represented by 2 bytes in the header of a TCP or UDP segment. This 16-bit value can result in port numbers ranging from 0 to 65535. The three categories of port numbers are well-known ports, registered ports, and dynamic or private ports. The first 1023 ports are well-known ports. These ports are used for well-known network services such as FTP, Telnet, or DNS.

Registered ports range from 1024 to 49151. Ports between 49152 and 65535 are defined as dynamic or private ports.

The Interactive Media Activity will help students become more familiar with port numbers.

The next page will give an example of multiple sessions.

Example of multiple sessions between hosts

10.2.5 This page will explain how port numbers are used to track multiple sessions that can occur between hosts. The source and destination port numbers combine with the network address to form a socket. A pair of sockets, one on each host, forms a unique connection. For instance, a host might have a Telnet connection through port 23 and an Internet connection through port 80. The IP and the MAC addresses would be the same because the packets are received from the same host. Therefore, each conversation on the source side needs its own port number, and each service requested needs its own port number.

In the Lab Activity, students will enable HTTP on a router and observe well-known ports.
The next page will discuss the three types of addresses.

Ports for clients

2011-11-16T23:05:00.000-08:00

Ports for clients

10.2.3 This page will discuss source ports, which are set by clients.

Whenever a client connects to a service on a server, a source and destination port must be specified. TCP and UDP segments contain fields for source and destination ports. Destination ports, or ports for services, are normally defined using the well-known ports. Source ports set by the client are determined dynamically.

In general, a client determines the source port by randomly assigning a number above 1023. For example, a client that attempts to communicate with a Web server will use TCP and assign the destination port as 80 and the source port as 1045. When the packet arrives at the server, it moves up to the transport layer and eventually to the HTTP service, which operates at port 80. The HTTP server responds to the clients request with a segment that uses port 80 as the source and 1045 as the destination. Clients and servers use ports to distinguish which process each segment is associated with.

The next page will teach students about the three categories of port numbers.

Ports for services

2011-11-16T23:02:00.000-08:00

Ports for services
10.2.2 Services running on hosts must have a port number assigned to them so communication can occur. A remote host attempting to connect to a service expects that service to use specific transport layer protocols and ports. Some ports, which are defined in RFC 1700, are known as the well-known ports. These ports are reserved in both TCP and UDP.

These well-known ports define applications that run above the transport layer protocols. For example, a server that runs FTP will use ports 20 and 21 to forward TCP connections from clients to its FTP application. This allows the server to determine which service a client requests. TCP and UDP use port numbers to determine the correct service to which requests are forwarded.

The next page will discuss ports in greater detail.

Multiple conversations between hosts

2011-11-16T22:59:00.000-08:00

Multiple conversations between hosts
10.2.1 At any given moment, thousands of packets that provide hundreds of different services travel through a modern network. Many servers use a multitude of services and this causes unique problems for the addressing of packets. If a server is running both SMTP and HTTP, it uses the destination port field to determine what service the source is requesting. The source cannot construct a packet destined for just the server IP address because the destination would not know what service was being requested. A port number must be associated with the conversation between hosts to ensure that the packet reaches the appropriate service on the server. If a server could not distinguish between different conversations, a client could not send an e-mail and browse a Web page at the same time. A method for transport layer conversations to be separated must be used.

Hosts running TCP/IP associate ports at the transport layer with certain applications. Port numbers are used to keep track of different conversations that cross the network at the same time. Port numbers are needed for a host to communicate with a server that uses multiple services. Both TCP and UDP use port or socket numbers to pass information to the upper layers.

Application software developers have agreed to use the well-known port numbers that are defined in RFC1700. Any conversation bound for the FTP application uses the standard port number 21. Conversations that do not involve applications with well-known port numbers are assigned port numbers that have been randomly selected from within a specific range. These port numbers are used as source and destination addresses in the TCP segment.

Port numbers have the following assigned ranges:

The Well Known Ports are those from 0 through 1023
The Registered Ports are those from 1024 through 49151
The Dynamic and/or Private Ports are those from 49152 through 65535

Systems initiating communication requests use port numbers to select proper applications. Source port numbers for these requests are dynamically assigned by the originating host, and are usually a number larger than 1023. Port numbers in the range of 0-1023 are considered public port numbers and are controlled by the Internet Assigned Numbers Authority (IANA).

Post office box numbers are a good analogy for port numbers. A piece of mail may be sent to a zip code, city, and P.O. box. The zip code and city direct mail to the correct general mail facility while the P.O. box ensures the item is delivered to the one individual to whom the mail is addressed. Similarly, the IP address gets the packet to the correct server, but the TCP or UDP port number guarantees the packet is passed to the correct application.

The next page will discuss well-known ports.

UDP operation

2011-11-16T22:48:00.000-08:00

UDP operation
10.1.7 This page will explain the similarities and differences between TCP and UDP.

The TCP/IP protocol stack contains many different protocols, each designed to perform a certain task. IP provides Layer 3 connectionless transport through an internetwork. TCP enables connection-oriented, reliable transmission of packets at Layer 4 of the OSI model. UDP provides connectionless, unreliable transmission of packets at Layer 4 of the OSI model.

Both TCP and UDP use IP as their Layer 3 protocol. In addition, TCP and UDP are used by various application layer protocols. TCP provides services for applications such as FTP, HTTP, SMTP, and DNS. UDP is the transport layer protocol used by DNS, TFTP, SNMP, and DHCP.

TCP must be used when applications need to guarantee that a packet arrives intact, in sequence, and unduplicated. The overhead necessary to ensure delivery of a packet is sometimes a problem with TCP. Not all applications need to guarantee delivery of the data packet, so they use the faster, connectionless delivery mechanism afforded by UDP. The UDP protocol standard is described in RFC 768.

UDP does not use windowing or ACKs so application layer protocols must provide error detection.

The Source Port field is an optional field used only if information needs to return to the sending host. When a destination router receives a routing update, the source router is not requesting anything so nothing needs to return to the source. There is no exchange of information or data. The Destination Port field specifies the application to which UDP needs to pass the protocol. A DNS request from a host to a DNS server would have a Destination Port field of 53, the UDP port number for DNS. The Length field identifies the number of octets in the UDP segment. The UDP checksum is optional but should be used to ensure that the data has not been damaged during transmission. For transport across the network, UDP is encapsulated within the IP packet.

Once a UDP segment arrives at the destination IP address, a mechanism must exist which allows the receiving host to determine the exact destination application. Destination ports are used for this purpose. If a host is running both TFTP and DNS services, it must be able to determine what service the arriving UDP segments need. The Destination Port field in the UDP header determines the application to which a UDP segment will be delivered.

This page concludes this lesson. The next lesson will provide an overview of transport layer ports. The first page describes multiple conversations between hosts

Positive acknowledgments

2011-11-16T22:36:00.000-08:00

Positive acknowledgments

10.1.6 Acknowledgment is a common step in the synchronization process, which includes sliding windows and data sequencing. In a TCP segment, the sequence number field is followed by the Acknowledgment Number field. This field is where tracking of transmitted and received bytes are indicated.

One problem with the IP protocol is that there is no verification method to determine if data segments reach their destination. So data segments may be constantly forwarded with no knowledge as to whether or not they were actually received. TCP uses positive acknowledgment and retransmission (PAR) to control data flow and confirm data delivery.

Many protocols use PAR to provide reliability. With PAR, the source sends a packet, starts a timer, and waits for an acknowledgment before it sends the next packet in the session. If the timer expires before the source receives an acknowledgment, the source retransmits the packet and resets the timer. The acknowledgment is provided by the value of Acknowledgment Number and the ACK flag set in the TCP header. TCP uses expectational acknowledgment in which the Acknowledgment Number value refers to the next octet that is expected as part of the TCP session.

Windowing is a flow control mechanism that requires the source device to receive an acknowledgment from the destination after a specific amount of data bytes has been transmitted. With a window size of three, the source device can send three octets to the destination. It must then wait for an acknowledgment of these bytes. If the destination receives the three octets, it sends an acknowledgment to the source device, which can then transmit three more octets. If the destination does not receive the three octets, it does not send an acknowledgment. This may be caused by overflowing buffers or packets lost in transit. Since the source does not receive an acknowledgment, it knows that the octets should be retransmitted and that the window size should be reduced. This window size reduction provides the receiving host less bytes to process from its buffers before more data arrives. This effectively slows the communication between hosts to provide more reliability between the hosts.

The Lab Activity will teach students how to enable and monitor multiple host sessions. The Interactive Media Activity will help students become more familiar with windows.

The next page will explain how UDP works.

Sequencing numbers

2011-11-16T22:31:00.000-08:00

Sequencing numbers

10.1.5 TCP breaks data into segments. After the synchronization process occurs and the window size has been established, the data segments are transported from the sender to the receiver. The data segments must be reassembled after all the data is received. There is no guarantee that the data will arrive in the order it was transmitted. TCP applies sequence numbers to the data segments that are transmitted so that the receiver can reassemble the bytes in their original order. This way, if TCP segments arrive out of order, the segments will still be assembled correctly.

These sequencing numbers also act as reference numbers so that the receiver will know if it has received all of the data. They also identify the missing data pieces to the sender so it can retransmit the missing data. This offers increased efficiency since the sender only needs to resend the missing segments instead of the entire set of data.

Each TCP segment is numbered before transmission.

The sequence number portion comes after the destination port in the segment format. At the receiving station, TCP uses the sequence numbers to reassemble the segments into a complete message. If a sequence number is missing in the series, that segment is retransmitted.

The next page discusses positive acknowledgments.

Windowing and window size

2011-11-16T22:24:00.000-08:00

Windowing and window size
10.1.4 The amount of data that needs to be transmitted is often too large to be sent in a single data segment. In this case, the data must be broken into smaller pieces to allow for proper data transmission. TCP is responsible for breaking data into segments. This can be compared to the way that small children are fed. Their food is cut into smaller pieces that their mouths can accommodate. Additionally, a device may not be able to receive data as quickly as the source can send it. The device may be busy with other tasks or the sender may be a more robust device.

Once the data is segmented, it must be transmitted to the destination device. One of the services provided by TCP is flow control, which regulates how much data is sent during a given transmission period. The process of flow control is known as windowing.

Window size determines the amount of data that can be transmitted at one time before the destination responds with an acknowledgment. After a host transmits the window-sized number of bytes, the host must receive an acknowledgment that the data has been received before it can send any more data. For example, if the window size is 1, each byte must be acknowledged before the next byte is sent.

TCP utilizes windowing to dynamically determine transmission size. Devices negotiate a window size to allow a specific number of bytes to be transmitted before an acknowledgment.

This process of dynamically varying the window size increases reliability. The window size can be varied based upon acknowledgments.

The Interactive Media Activity will help students understand the concept of windowing.

The next page describes TCP sequence numbers.

Denial of service attacks

2011-11-16T22:20:00.000-08:00

Denial of service attacks
10.1.3 his page will teach students about denial of service (DoS) attacks. DoS attacks are designed to deny services to legitimate hosts that try to establish connections. DoS attacks are commonly used by hackers to halt system responses. One type of DoS is known as SYN flooding. SYN flooding exploits the normal three-way handshake and causes targeted devices to acknowledge to source addresses that will not complete the handshake.

The three-way handshake begins when the initiating host sends a SYN packet. The SYN packet includes the source IP address and the destination IP address. This source and destination address information is used by the recipient to send the acknowledgment packet back to the initiating device.

In a DoS attack, the hacker initiates a SYN but spoofs the source IP address. Spoofing is a term used when the receiving device replies to a non-existent, unreachable IP address and then is placed in a wait state until it receives the final acknowledgment from the initiator. The waiting request is placed in a connection queue or a holding area in memory. This wait state requires the attacked device to use system resources, such as memory, until the connection timer times out. Hackers will flood the attacked host with false SYN requests to utilize all of its connection resources and prevent it from responding to legitimate connection requests.

To defend against these attacks, system administrators may decrease the connection timeout period and increase the connection queue size. Software also exists that can detect these types of attacks and initiate defensive measures.

The next page will discuss the concept of windowing.

Synchronization or three-way handshake

2011-10-31T11:18:00.000-07:00

Synchronization or three-way handshake
10.1.2 This page will explain the synchronization process that TCP uses. The process is also called a three-way handshake.

TCP is a connection-oriented protocol. Prior to data transmission, the two communicating hosts go through a synchronization process to establish a virtual connection for each session between hosts. This synchronization process ensures that both sides are ready for data transmission and allows the devices to determine the initial sequence numbers for that session. This process is known as a three-way handshake. This is a three-step process that establishes the virtual connection between the two devices. It is also important to note that the three-way handshake is initiated by a client host. To establish a TCP session, the client host will use the well-known port number of the service it wishes to contact on a server host.

In step one, the initiating host (client) sends a synchronization (SYN flag set) packet to initiate a connection. This indicates that a packet has a valid initial Sequence Number value in this segment for this session of x. The SYN bit set in the header indicates a connection request. The SYN bit is single bit in the code field of the TCP segment header. The Sequence Number is a 32 bit field TCP segment header.

In step two, the other host receives the packet, records the Sequence Number of x from the client, and replies with an acknowledgment (ACK flag set). The ACK control bit set indicates that the Acknowledgment Number field contains a valid acknowledgment value. The ACK flag is a single bit in the code field of the TCP segment header and the Acknowledgment Number is a 32 bit field TCP segment header. Once a connection is established, the ACK flag is set for all segments during the session. The Acknowledgment Number field contains the next sequence number that this host is expecting to receive (x + 1). The Acknowledgment Number of x + 1 means the host has received all bytes up to and including x, and expects to next receive byte x + 1. The host also initiates a return session. This includes a TCP segment with its own initial Sequence Number value of y and with the SYN flag set.

In step three, the initiating host responds with a simple Acknowledgment Number value of y + 1, which is the Sequence Number value of Host B + 1. This indicates that it received the previous acknowledgment and finalizes the connection process for this session.

It is important to understand that initial sequence numbers are used to initiate communication between two devices. They act as reference starting numbers between the two devices. The sequence numbers give each host a way to acknowledge so that the receiver knows the sender is responding to the proper connection request.

The Interactive Media Activity will help students understand synchronization.

The next page will discuss denial of service attacks

TCP Operation

2011-10-31T11:15:00.000-07:00

TCP Operation
10.1.1This page will explain how the transport layer provides reliability and flow control.
IP addresses allow for the routing of packets between networks. However, IP makes no guarantees about delivery. The transport layer is responsible for the reliable transport of and regulation of data flow from source to destination. This is accomplished through the use of sliding windows and sequencing numbers along with a synchronization process. This process ensures that each host is ready and willing to communicate.
To understand reliability and flow control, think of a student who studies a foreign language for one year. Now imagine the student visits a country where the language is used. The student must ask people to repeat their words for reliability and to speak slowly for comprehension, which relates to the concept of flow control. The transport layer, which is Layer 4 of the OSI model, uses TCP to provide these services to Layer 5.
The next page will describe the concept of synchronization.

Module 10: Intermediate TCP/IP / Overview

2011-10-31T11:10:00.000-07:00

Module 10: Intermediate TCP/IP

Overview

Routers use the IP address information in an IP packet header to determine the interface to which a packet should be switched based on its destination. Since IP does not ensure that the packet reaches the destination, it is described as an unreliable, connectionless protocol, that uses best-effort delivery. If packets are dropped in route, arrive in the wrong order, or are transmitted faster than the receiver can accept them, IP alone cannot correct the problem. To address these problems, IP relies on TCP. This module describes TCP and its functions and introduces UDP, another important Layer 4 protocol.
Each layer within the OSI reference model has various functions. These functions are independent of the other layers. Each layer expects to receive services from the layer beneath it, and each layer provides certain services to the layer above it. The application, presentation, and session layers of the OSI model, which are all considered to be part of the application layer in the TCP/IP model, access the services of the transport layer through logical entities called ports. This module will introduce the concept of ports and will explain the critical importance of ports and port numbers in data networking.
This module covers some of the objectives for the CCNA 640-801, INTRO 640-821, and ICND 640-811 exams. -
Students who complete this module should be able to perform the following tasks:

Describe TCP and its functions
Describe TCP synchronization and flow control
Describe UDP operation and processes
Identify common port numbers
Describe multiple conversations between hosts
Identify ports used for services and clients
Describe port numbering and well known ports

Understand the differences and the relationship between MAC addresses, IP addresses, and port numbers

Module 9: Summary

2011-10-22T06:11:00.000-07:00

Summary
The show ip route command is used to gather detailed information about the routes installed on the router. It displays the contents of the IP routing table. New routes may be added with static routing, which allows an administrator to manually define routes, or with dynamic routing, which uses the rules defined by a routing protocol to exchange information and determine the best path.
Default routes are used when the router is unable to match a destination network with a more specific entry in the routing table. The router uses this default route to reach the gateway of last resort in an effort to forward the packet.
The path determination function occurs at the network layer of the OSI model. It enables a router to evaluate the available paths to a destination and to establish the preferred handling of a packet. This information is configured manually or collected dynamically. The administrative distance of the route is used by the router to decide what the best path is to a particular destination. The administrative distance is a number that measures the trustworthiness of the source of the route information. Lower administrative distances indicate more trustworthy sources.
To determine the best route to a destination, routing protocols use a value that measures the desirability of a route called a metric. The metric is usually determined by factors such as hop count, bandwidth, delay, load, reliability, and cost. Typically, the smaller the metric number, the better the path.
Troubleshooting should be an orderly process based on the networking standards set in place by an administrator. Documentation is an important part of the troubleshooting process. Indicator lights are a useful tool for troubleshooting at Layer 1. At Layer 3, ping is used to test network connectivity. Telnet connections are used to verify the application layer software between a source and a destination.
The show interfaces command shows the status of two important portions of the interfaces. They are the physical or hardware portion and logical or software portion. These can be related to the Layer 1 and the Layer 2 functions. If the interface is up and the line protocol is down, a Layer 2 problem exists. If the physical layer is properly functioning, then all other directly connected Cisco devices should be displayed. If no known device appears, a Layer 1 problem likely exists.
To debug connectivity issues, the show cdp neighbors command is used to display information about directly connected neighbors. Use the traceroute command to trace the routes that packets take to destinations. This command can be used to test the network layer at each hop and provide performance benchmarks.
To verify the routing protocol configuration, use the show ip protocols and show ip route commands. These commands display information about routing protocols and the routing table. To determine the type of cable connected without inspecting the cables, use the show controllers command.
The debug command is used to display dynamic data and events. Since the show commands only display static information, they provide a historical picture of the router operation. The debug command output gives more insight to the current events of the router.

Introduction to debug

2011-10-22T06:10:00.000-07:00

Introduction to debug
9.3.7 This page will explain the functions of the debug command.
The debug commands assist in the isolation of protocol and configuration problems. The debug command is used to display dynamic data and events. Since the show commands only display static information, they provide a historical picture of the router operation. The debug command output gives more insight into the current events of the router. These events could be traffic on an interface, error messages generated by nodes on the network, protocol-specific diagnostic packets, and other useful troubleshooting data. The dynamic output of the debug command creates performance issues. This command produces high processor overhead that may disrupt normal router operation. For this reason, debug should be used conservatively. Use debug commands to examine specific types of traffic or problems after likely problems have been narrowed a few causes. The debug command should be used to isolate problems and not to monitor normal network operation.

WARNING:

The debug all command should be used sparingly as this can disrupt router operations.

By default, the router sends the debug output and system messages to the console. If a Telnet session is used to examine the router, then the debug output and system messages can be redirected to the remote terminal. This is done through the Telnet session with the terminal monitor command. Use extra caution when the debug commands are selected from a Telnet session. No command should be selected that will cause the debug output to create additional traffic that creates debug output. If this occurs, the Telnet session will rapidly saturate the link with traffic or the router will exhaust one or more resources. A good rule to follow to prevent this recursion of traffic is to never debug any activity on the port where the session is established.
The output of the different debug commands varies. Some may frequently generate many lines while others produce a line or two of output every few minutes.
Another IOS software service that will enhance the usefulness of the debug output is the timestamps command. This command will put a timestamp on a debug message. This information provides the time when the debug event occurred and the duration of time between events.
This is often very useful when troubleshooting intermittent problems. By time stamping the output, a pattern of occurrence is often recognized. This helps to isolate the source of the problem. This also prevents the technician from intently watching the debug output for what may seem like hours.
The following command configures a timestamp that will show the hour:minute:second of the output, the amount of time since the router was last powered up, or when a reload command was executed:

GAD(config)#service timestamps debug uptime

The output from this is useful to determine the time between events. To determine how long since the last occurrence of the debug event, the time since the last reload has to be used as a reference. This time can be found with the show version command.
A more practical use of the timestamps is to have it display the time and date that the event occurred. This will simplify the process of determining the last occurrence of the debug event. This is done using the datetime option:

GAD(config)#service timestamps debug datetime localtime

It should be noted that this command is only useful if the clock is set on the router. Otherwise, the timestamp shown in the debug output is not an accurate time. To ensure that the timestamps are correct, the router clock should be set to the correct time from privileged EXEC mode with the following command:

GAD#clock set 15:46:00 3 May 2004

Note:

On some Cisco platforms, the router clock is not backed up with a battery source, so the system time will need to be reset after a router reload or power failure.

The no debug all and undebug all commands turn off all diagnostic output. To disable a particular debug command, use the no form of the command. For example, if the debug ip rip command is used to monitor RIP, it can be disabled with no debug ip rip. To view what is currently being examined by a debug command, use show debugging.
The Lab Activity will help students become more familiar with the debug command.
This page concludes this lesson. The next page will summarize the main points from this module

Troubleshooting using show controllers

2011-10-22T06:08:00.001-07:00

Troubleshooting using show controllers
9.3.6

This page will teach students about troubleshooting using the show controllers command.

Router configuration and troubleshooting can be performed remotely when physical inspection of the connections is not possible. The show controllers command is useful to determine the type of cable connected without inspecting the cables.

The output displayed by the show controllers command indicates the type of cable detected by the controller. This is useful for finding a serial interface with no cable, the wrong type of cable, or a defective cable.

The show controllers serial 0/0 command queries the integrated circuit, or controller chip, that controls the serial interfaces and displays information about the physical interface serial 0/0. This output varies for different controller chips.

Regardless of the controller chip type, the show controllers command produces a large amount of output. Other than the cable type, most of this output is internal technical detail about the controller chip status. Without specific knowledge of the integrated circuit, this information is of little use.

The Lab Activity will show students how to troubleshoot with the show controllers command.

The Interactive Media Activity will help students link network problems to the corresponding layer of the OSI model.

The next page will introduce the debug command.

Troubleshooting routing issues

2011-10-22T06:07:00.000-07:00

Troubleshooting routing issues
9.3.5 This page will describe the show ip protocols and show ip route commands. These commands display information about routing protocols and the routing table. The output from these commands can be used to verify the routing protocol configuration.

The show ip route command may be the most important command used to troubleshoot routing issues. This command displays the contents of the IP routing table. The output from the show ip route command shows the entries for all known networks and subnetworks, and how that information was learned.

If there is a problem reaching a host in a particular network, then the output of the show ip route command can be used to verify that the router has a route to that network.

If the output of the show ip route command does not show the expected learned routes, or any learned routes, then the problem may be that routing information has not been exchanged. In this case, use the show ip protocols command on the router to check for a routing protocol configuration error.

The show ip protocols command displays values about IP routing protocol information on the entire router. This command can be used to confirm which protocols are configured, which networks are being advertised, which interfaces are sending updates, and the sources of routing updates. The show ip protocols output also shows timers, filters, route summarization, route redistribution, and other parameters that are specific to each routing protocol that is enabled on the router. When multiple routing protocols are configured, the information about each protocol is listed in a separate section.

The show ip protocols command output can be used to diagnose many routing issues. For example, it can be used to identify a router that may advertise incorrect routing information. This command may be used to confirm that expected protocols, advertised networks, and routing neighbors are present. It is important to have documentation that indicates the expected results, or baseline information, when a problem occurs. It may be impossible to identify the problem without such documentation.

The Lab Activity will teach students how to use the show ip route and show ip protocols command.

The next page will discuss the show controllers serial command.

Troubleshooting using show cdp / traceroute

2011-10-22T06:04:00.000-07:00

Troubleshooting using show cdp
9.3.3 This page will explain the functions of the show cdp command.
CDP advertises device information to its direct neighbors. This includes MAC and IP addresses and outgoing interfaces.
The output from the show cdp neighbors command displays information about directly connected Cisco device neighbors. This information is useful for debugging connectivity issues. If a cabling problem is suspected, enable the interfaces with the no shutdown command and then execute the show cdp neighbors detail command before any other configuration. The command displays specific device detail such as the active interfaces, the port ID, and the device. The version of Cisco IOS that is running on the remote devices is also shown.
If the physical layer functions properly, then all other directly connected Cisco devices should be displayed. If no known device appears, this usually indicates a Layer 1 problem.
One area of concern with CDP is security. The amount of information CDP provides is so extensive that it can be a potential security hole. For security reasons CDP should be configured only on links between Cisco devices and disabled on user ports or links that are not locally managed.
In the Lab Activity, students will use the show cdp command to learn about network devices.
The next page will discuss the traceroute command.

Troubleshooting using show traceroute

9.3.4 This page will describe the functions of the traceroute command.

The traceroute command is often referred to as the trace command in reference materials. However, the correct command syntax is traceroute. The traceroute command displays the routes that packets take to their destinations. The traceroute command can also be used to test each hop at the network layer and provide performance benchmarks.

The output of the traceroute command generates a list of hops that were successfully reached. If the data successfully reaches the intended destination, then the output indicates every router that the datagram passes through. This output can be captured and used for future troubleshooting of the internetwork.

Traceroute output will also indicate the specific hop at which the failure occurs. A line of output is generated on the terminal for each router in the path. This indicates the IP address of the interface that the data entered. If an asterisk (*) appears, the packet failed. To isolate the problem area, obtain the last good hop from the traceroute output and compare it to a diagram of the internetwork.

The traceroute command also provides information about the performance of links. The round trip time (RTT) is the time required to send an echo packet and get a response. This is useful for an approximate idea of the delay on the link. These figures are not precise enough to be used for an accurate performance evaluation. However, this output can be captured and used for future performance troubleshooting of the internetwork.

Notice that the device receiving the traceroute also has to know how to send the reply back to the source of the traceroute. For the traceroute or ping data to make the round trip between routers, there must be known routes in both directions. A failed response is not always an indication of a problem because ICMP messages could be rate-limited or filtered at the host site. This is especially true across the Internet.

Traceroute sends out a sequence of User Datagram Protocol (UDP) datagrams from the router to an invalid port address on the remote host. For the first sequence of three datagrams, a TTL field value is set to 1. The TTL value of 1 causes the datagram to time out at the first router in the path. This router then responds with an ICMP Time Exceeded Message (TEM) indicating that the datagram has expired.

Three more UDP messages are now sent, this time with the TTL value set to 2. This causes the second router to return ICMP TEMs. This process continues until the packets actually reach the other destination or the maximum TTL has been reached. The default maximum TTL for traceroute is 30.

Since these datagrams are trying to access an invalid port at the destination host, ICMP Port Unreachable Messages are returned instead of ICMP TEMs. This indicates an unreachable port and signals the Traceroute program to end the process.

The Lab Activity will help students become more familiar with the traceroute command.

The next page will discuss some other commands that are used to troubleshoot routing issues.

Troubleshooting Layer 2 using show interfaces

2011-10-22T06:01:00.000-07:00

Troubleshooting Layer 2 using show interfaces
9.3.2 This page will further explain why the show interfaces command may be the most important tool to discover Layer 1 and Layer 2 problems with the router. The first parameter, which is line, refers to the physical layer. The second parameter, which is protocol, indicates if the IOS processes that control the line protocol consider the interface usable. This is determined by whether keepalives are successfully received. Keepalives are defined as messages sent by one network device to inform another network device that the virtual circuit between the two is still active. If the interface misses three consecutive keepalives, the line protocol is marked as down.
When the line is down, the protocol is always down, because there is no useable media for the Layer 2 protocol. This will be true when the interface is down due to a hardware problem and when it is administratively down.
If the interface is up and the line protocol is down, a Layer 2 problem exists. Possible causes are as follows:

No keepalives
No clock rate
Mismatch in encapsulation type

The show interfaces command should be used after configuring a serial interface to verify the changes and that the interface is operational.
The Interactive Media activity will help students understand the show interfaces command.
The next page will discuss the show cdp command

Troubleshooting Layer 1 using show interfaces

2011-10-22T05:56:00.000-07:00

Troubleshooting Layer 1 using show interfaces
9.3.1 This page will discuss show commands and explain how they are used to troubleshoot Layer 1 issues.

The Cisco IOS contains many commands for troubleshooting. Among the more widely used are the show commands. Every aspect of the router can be viewed with one or more of the show commands. The show command used to check the status and statistics of the interfaces is the show interfaces command. The show interfaces command without arguments returns status and statistics on all the router ports. The show interfaces returns the status and statistics of only the named port. To view the status of Serial 0/0, use show interfaces serial 0/0.

The status of two important portions of the interfaces is shown with the show interfaces command. They are the physical, or hardware portion and logical, or software, portion. These can be related to the Layer 1 and the Layer 2 functions.

The hardware includes cables, connectors, and interfaces showing the condition of the physical connection between the devices. The software status shows the state of messages such as keepalives, control information, and user information that are passed between adjacent devices. This relates to the condition of a Layer 2 protocol passed between two connected router interfaces.

These important elements can be demonstrated by an example of a serial port on a modular router. The show interfaces serial 0/0 command displays the line and data-link protocol status of serial port one.
The first parameter refers to the hardware layer and indicates if the interface receives a Carrier Detect (CD) signal from the other end of the connection. If the line is down, a problem may exist with the cabling, equipment somewhere in the circuit may be powered off or malfunctioning, or one end may be administratively down. If the interface is administratively down it has been manually disabled in the configuration.
The show interfaces serial 0/0 command also provides information to help diagnose other Layer 1 issues that are not as easy to determine. An increasing number of carrier transitions counts on a serial link may indicate one or more of the following problems:

Line interruptions due to problems in the service provider network
Faulty switch, DSU, or router hardware

If an increasing number of input errors appear in the show interfaces serial 0/0 output, there are several possible sources of those errors. Some common Layer 1 problems are as follows:

Faulty telephone company equipment
Noisy serial line
Incorrect cable or cable length
Damaged cable or connection
Defective CSU or DSU
Defective router hardware

Another area to examine is number of interface resets. These are the result of too many missed keepalives. The following Layer 1 problems could be a cause of interface resets:

Bad line that causes carrier transitions
Possible hardware problem at the CSU, DSU, or switch

If carrier transitions and interface resets are increasing or if input errors are high while this occurs, the problem is likely to be a bad link or defective CSU or DSU.
The number of errors should be interpreted relative to the amount of traffic that the router has processed and the amount of time that the statistics have been captured. The router tracks statistics that provide information about the interface. The statistics reflect router operation since it was started or since the last time the counters were cleared.
If the show interfaces output shows the last clearing of the counters as never, use the show version command to find out how long the router has been functional.
Use the clear counters privileged EXEC command to reset the counters to zero. These counters should always be cleared after an interface problem has been corrected. This reset to zero gives a better picture of the current status of the network and will help verify that an issue has been corrected.
The Lab Activity will help students become more familiar with the show interfaces command.
The next page will explain how the show interfaces command is used to troubleshoot Layer 2 problems.

Layer 7 troubleshooting using Telnet

2011-10-22T05:44:00.000-07:00

Layer 7 troubleshooting using Telnet
9.2.7 The Telnet utility is a virtual terminal protocol that is part of the TCP/IP protocol suite. It allows verification of the application layer software between source and destination stations. This is the most complete test mechanism available. The Telnet utility is normally used to connect remote devices, to gather information, and to run programs.
The Telnet application provides a virtual terminal connection to routers that use TCP/IP. For troubleshooting purposes, it is useful to verify that a connection can be made using Telnet. This proves that at least one TCP/IP application is able to connect end-to-end. A successful Telnet connection indicates that the upper-layer application and the services of lower layers are functioning properly.
If an administrator can Telnet to one router but not to another router, verify lower layer connectivity. If connectivity has been verified, it is likely that the Telnet failure is caused by specific addressing, naming, or access permission problems. These problems can exist on the administrator's router or on the router that failed as a Telnet target.
If the Telnet to a particular server fails from one host, Telnet from a router and other devices. If a login prompt is not achieved during Telnet, check the following:

A reverse DNS lookup may not be found on the client address. Many Telnet servers will not allow connections from IP addresses that have no DNS entry. This is a common problem for DHCP-assigned addresses if the administrator has not added DNS entries for the DHCP pools.
It is possible that a Telnet application cannot negotiate the appropriate options and will not connect. On a Cisco router, this negotiation process can be viewed with the debug telnet command.
It is possible that Telnet is disabled or has been moved to a port other than 23 on the destination server.

The Lab Activity will allow students to troubleshoot a network with Telnet and the ping command. The Interactive Media Activity will help students become more familiar with Telnet.
This page concludes this lesson. The next lesson will teach students how to troubleshoot router issues. The first page will discuss show commands.

Layer 1 troubleshooting using indicators / Layer 3 troubleshooting using ping

2011-10-22T05:41:00.000-07:00

Layer 1 troubleshooting using indicators
9.2.4 The page will explain how to troubleshoot Layer 1 issues with the help of indicator lights. Most interfaces or NICs have indicator lights that show if there is a valid connection. This light is often called the link light. The interface may also have lights to indicate when traffic is transmitted (TX) or received (RX). If the interface has indicator lights that do not show a valid connection, check for faulty or incorrect cabling. If cabling is correct, power off the device and reseat the interface card.
Check to make sure that all cables are connected to the appropriate ports. Make sure that all cross-connects are properly patched to the correct location using the appropriate cable and method.
Verify that the proper cable is used. A crossover cable may be required for direct connections between two switches or hubs, or between two hosts such as PCs or routers. Verify that the cable from the source interface is properly connected and is in good condition. If there is doubt that the connection is good, reseat the cable and ensure that the connection is secure. Try replacing the cable with a known working cable. If this cable connects to a wall jack, use a cable tester to ensure that the jack is properly wired.
Also check any transceiver in use to ensure that it is the correct type, is properly connected, and is properly configured. If the problem continues after the cable is replaced, replace the transceiver if one is used.
Always check to make sure that the device is powered on. Always check the basics before running diagnostics or attempting complex troubleshooting.
The next page will describe the ping command.

Layer 3 troubleshooting using ping

9.2.5

This page will explain how the ping utility can be used to test network connectivity. Many network protocols support an echo protocol to help diagnose basic network connectivity. Echo protocols are used to determine if protocol packets are routed. The ping command sends a packet to the destination host and then waits for a reply packet from that host. Results from this echo protocol can help evaluate the path-to-host reliability, delays over the path, and whether the host can be reached or is functioning. The ping output displays the minimum, average, and maximum times it takes for a ping packet to find a specified system and return. The ping command uses ICMP to verify the hardware connection and the logical address of the network layer. This is a very basic way to test network connectivity. Figure shows the ICMP message types. This is a very basic testing mechanism for network connectivity.
In Figure , the ping target 172.16.1.5 responded successfully to all five datagrams sent. Each exclamation point (!) indicates a successful echo. One or more periods (.) indicates that the application on the router timed out before it received a packet echo from the ping target.
The following command activates a diagnostic tool that is used to test connectivity:

Router#ping [protocol] {host | address}

To test network connectivity, the ping command sends ICMP echo requests to a target host and measures how long it takes to reply. The ping command tracks the number of packets sent, the number of replies received, and the percentage of packets lost. It also tracks the amount of time required for packets to reach the destination and for replies to be received. This information can be used to verify communications between hosts and determine if information was lost.
The ping command can be invoked from both user EXEC mode and privileged EXEC mode. The ping command can be used to confirm basic network connectivity on AppleTalk, ISO Connectionless Network Service (CLNS), IP, Novell, Apollo, VINES, DECnet, or XNS networks.
The use of an extended ping command directs the router to perform a more extensive range of test options. To use extended ping, type ping at the command line, and press the Enter key. Prompts will appear each time the Enter key is pressed. These prompts provide many more options than with a standard ping.
Use the ping command when the network functions properly to see how the command works under normal conditions. This can be used as a comparison, or baseline, when troubleshooting.
The Lab Activity will allow students to use the ping command to send an ICMP echo request.
The next page will describe the Telnet application.

Testing by OSI layers

2011-10-22T05:27:00.000-07:00

Testing by OSI layers
9.2.3 This page will describe the types of errors that occur at the first three layers of the OSI model.
Layer 1 errors can include the following:

Broken cables
Disconnected cables
Cables connected to the wrong ports
Intermittent cable connection
Rollover, crossover, or straight-through cables used incorrectly
Transceiver problems
DCE cable problems
DTE cable problems
Devices turned off

Layer 2 errors can include the following:

Improperly configured serial interfaces
Improperly configured Ethernet interfaces
Improper encapsulation set
Improper clockrate settings on serial interfaces
Network interface card (NIC) problems

Layer 3 errors can include the following:

Routing protocol not enabled
Wrong routing protocol enabled
Incorrect IP addresses
Incorrect subnet masks

If errors appear on the network, the process of testing through the OSI layers should begin. The ping command is used at Layer 3 to test connectivity. At Layer 7 the telnet command may be used to verify the application layer software between source and destination stations. Both of these commands will be discussed in detail in a later section.
The next page will explain how indicator lights can be used to test a network.

Using a structured approach to troubleshooting

2011-10-22T05:21:00.000-07:00

Using a structured approach to troubleshooting
9.2.2 Troubleshooting is a process that allows a user to find problems on a network. This page explains why an orderly process should be used to troubleshoot a network. This process should be based on the networking standards set in place by a network administrator. Documentation is a very important part of the troubleshooting process.
The steps in this model are as follows:
Step 1 Collect all available information and analyze the symptoms of the failure.
Step 2 Localize the problem to a particular network segment, module, unit, or user.
Step 3 Isolate the trouble to specific hardware or software within the unit, module, or user network account.
Step 4 Locate and correct the problem.
Step 5 Verify that the problem has been solved.
Step 6 Document the problem and the solution.
Another approach to troubleshooting. These are not the only ways to troubleshoot a network. However, an orderly process is important to keep a network running smoothly and efficiently.
When a structured approach is used, every member of a network support team knows which steps the other team members have completed to troubleshoot the network. If a variety of troubleshooting ideas are tried with no organization or documentation, problem solving is not efficient. Even if a problem is solved in the non-structured environment, it will be difficult to replicate the solution for similar problems.
The Interactive Media Activity will help students become familiar with the troubleshooting process.
The next page will teach students the types of errors that occur at the first three layers of the OSI model.

Network Testing / Introduction to network testing

2011-10-22T05:19:00.000-07:00

Network Testing
>Introduction to network testing
9.2.1 This page will give students an overview of how to test a network.
Basic testing of a network should proceed in sequence from one OSI reference model layer to the next. Begin with Layer 1 and work up to Layer 7, if necessary. At Layer 1, look for simple problems such as power cords plugged in the wall and other physical connections. The most common problems that occur on IP networks result from errors in the addressing scheme. It is important to test the address configuration before continuing with further configuration steps.
Each test presented in this lesson focuses on network operations at a specific layer of the OSI model. At Layer 3, the commands telnet and ping are used to test the network.
The next page will discuss the troubleshooting process.

Observing multiple paths to destination

2011-10-22T05:17:00.000-07:00

Observing multiple paths to destination
9.1.9 Multi-path algorithms permit traffic over multiple lines, provide better throughput, and are more reliable than single path algorithms.
IGRP supports unequal cost path load balancing, which is known as variance. The variance command instructs the router to include routes with a metric less than n times the minimum metric route for that destination, where n is the number specified by the variance command. The variable n can take a value between 1 and 128, with the default being 1, which means equal cost load balancing.
rt1 has two routes to network 192.168.30.0. The variance command will be set on rt1 to ensure that both paths to network 192.168.30.0 are utilized.
Figure shows the output from show ip route from rt1 before the variance is configured. FastEthernet 0/0 is the only route to 192.168.30.0. This route has an Administrative Distance of 100 and a metric of 8986.
Figure shows the output from show ip route from rt1 after the variance is configured. The preferred route is interface FastEthernet 0/0, but Serial 0/0 will also be used. After the variance command is executed, IGRP will use load balancing between the two links.
This page concludes this lesson. The next lesson will discuss network testing. The lesson begins with an overview.

Determining the route next hop / Determining the last routing update

2011-10-22T05:14:00.000-07:00

Determining the route next hop
9.1.7 Routing algorithms fill routing tables with a variety of information. Destination next hop associations determine the best path and which router to forward the packet to next. This router represents the next hop on the way to the final destination.
When a router receives an incoming packet, it checks the destination address and attempts to associate this address with a next hop.
Determining the last routing update
9.1.8

show ip route
show ip route address
show ip protocols
show ip rip database

Determining the route metric

2011-10-22T05:09:00.000-07:00

Determining the route metric
9.1.6 Routing protocols use metrics to determine the best route to a destination. The metric is a value that measures the desirability of a route. Some routing protocols use only one factor to calculate a metric. For example, RIP v1 uses hop count as the only factor to determine the metric of a route. Other protocols base their metric on hop count, bandwidth, delay, load, reliability, and cost.
Each routing algorithm interprets what is best in its own way. The algorithm generates a number, called the metric value, for each path through the network. A lower metric number generally indicates a better path.
Factors such as bandwidth and delay are static because they remain the same for each interface until the router is reconfigured or the network is redesigned. Factors such as load and reliability are dynamic because they are calculated for each interface in real-time by the router.
The more factors that make up a metric, the greater the flexibility to tailor network operations to meet specific needs. By default, IGRP uses the static factors bandwidth and delay to calculate a metric value. These two factors can be configured manually to control which routes a router chooses. IGRP may also be configured to include the dynamic factors of load and reliability in the metric calculation. By using dynamic factors, IGRP routers can make decisions based on current conditions. If a link becomes heavily loaded or unreliable, IGRP will increase the metric of routes using that link. An alternate route with a lower metric would be used instead.
IGRP calculates the metric by adding the weighted values of different characteristics of the link to the network in question. Here is the formula for calculating the composite metric for IGRP:
Metric = [K1 * Bandwidth + (K2 * Bandwidth)/(256-load) + K3*Delay] * [K5/(reliability + K4)]
The default constant values are K1 = K3 = 1 and K2 = K4 = K5 = 0.
If K5 = 0, the [K5/(reliability + K4)] term is not used. Given the default values for K1 through K5, the composite metric calculation used by IGRP reduces to Metric = Bandwidth + Delay.
The Interactive Media Activity will help students understand route metrics.
The next page explains how a next hop is chosen.

Determining the route administrative distance

2011-10-22T05:04:00.000-07:00

Determining the route administrative distance
9.1.5 A router can discover routes through dynamic routing protocols or routes can be configured manually. After the routes are discovered or configured, the router must choose the best routes to other networks.
The router uses the administrative distance of each route to determine the best path to a particular destination. The administrative distance is a number that measures the trustworthiness of the source of the route information. The lower the administrative distance, the more trustworthy the source.
Different routing protocols have different default administrative distances. The path with the lowest administrative distance is installed in the routing table.
In the Lab Activity, students will analyze two routing protocols.
The next page will discuss route metrics.

Determining L2 and L3 addresses

2011-10-14T14:37:00.000-07:00

Determining L2 and L3 addresses
9.1.4 This page will explain how Layer 2 and Layer 3 addresses are used to route a packet.
For a packet to get from the source to the destination, both Layer 2 and Layer 3 addresses are used. Figure explains the process that occurs as a packet moves through a network.
The Layer 3 address is used to route the packet from the source network to the destination network. The source and destination IP addresses remain the same. The MAC address changes at each hop or router. A data link layer address is necessary because delivery within the network is determined by the address in the Layer 2 frame header.
The Interactive Media Activity will help students recognize physical and logical addresses.
The next page will describe the administrative distance of a route.

Determining route source and destination

2011-10-14T14:34:00.000-07:00

Determining route source and destination
9.1.3 This page will explain how a router chooses a path for packet delivery.
For traffic going through a network cloud, path determination occurs at the network layer. The path determination function enables a router to evaluate the available paths to a destination and to establish the preferred handling of a packet. Routing services use network topology information to evaluate network paths. This information can be configured by the network administrator or collected through dynamic processes that are used in the network.
The network layer provides best-effort, end-to-end, packet delivery across interconnected networks. The network layer uses the IP routing table to send packets from the source network to the destination network. After the router determines which path to use, it forwards the packet from one interface to the interface or port that leads to the destination.
The next page will discuss Layer 2 and Layer 3 addresses.

Determining the gateway of last resort

2011-10-14T14:30:00.000-07:00

Determining the gateway of last resort
9.1.2 This page will teach students how to configure a gateway of last resort and why it is used.
It is not feasible, or even desirable, for a router to maintain routes to every possible destination. Instead, routers keep a default route, or a gateway of last resort. Default routes are used when the router is unable to match a destination network with a more specific entry in the routing table. The router uses this default route to reach the gateway of last resort in an effort to forward the packet.
A key scalability feature is that default routes keep routing tables as lean as possible. They make it possible for routers to forward packets destined to any Internet host without having to maintain a table entry for every Internet network. Default routes can be statically entered by an administrator or dynamically learned using a routing protocol.
Default routing begins with the administrator. Before routers can dynamically exchange information, an administrator must configure at least one router with a default route. Depending on the desired results, an administrator can use either of the following commands to statically configure a default route:

ip default-network

ip route 0.0.0.0 0.0.0.0

The ip default-network command is used to establish a default route in networks that use dynamic routing protocols. The ip default-network command is classful, which means if the router has a route to the subnet indicated by this command, it installs the route to the major net. The ip default-network command must be issued using the major net, in order to flag the candidate default route.
The global command ip default-network 192.168.17.0 defines the Class C network 192.168.17.0 as the destination path for packets that have no routing table entries. Any routes to a network configured with ip default-network will be flagged as a candidate for the default route.
The ip route 0.0.0.0/0 command can also be used to configure a default route.

Router(config)#ip route prefix mask {address 1 interface } [distance ]

After configuring a default route or default network, the command show ip route will show the following:

Gateway of last resort is 172.16.1.2 to network 0.0.0.0

The Lab Activity will show students how to configure a gateway of last resort.
The next page explains how path determination occurs.

Examining the Routing Table / The show ip route command

2011-10-14T14:24:00.000-07:00

Examining the Routing Table
The show ip route command
9.1.1 This page will explain the functions of the show ip route command.
One of the primary functions of a router is to determine the best path to a given destination. A router learns paths, which are also called routes, from the configurations entered by an administrator or from other routers through routing protocols. Routers store this routing information in routing tables using on-board random access memory (RAM). A routing table contains a list of the best available routes. Routers use the routing table to make packet forwarding decisions.
The show ip route command displays the contents of the IP routing table. This table contains entries for all known networks and subnetworks, as well as a code that indicates how that information was learned. The following are some additional commands that can be used with the show ip route command:

show ip route connected
show ip routeaddress
show ip route rip
show ip route igrp
show ip route static

A routing table maps network prefixes to an outbound interface. When RTA receives a packet destined for 192.168.4.46, it looks for the prefix 192.168.4.0/24 in its table. RTA then forwards the packet out interface Ethernet0 based on the routing table entry. If RTA receives a packet destined for 10.3.21.5, it sends that packet out Serial 0/0.
The example routing table shows four routes for directly connected networks. These routes are labeled with a C. RTA drops any packet destined for a network that is not listed in the routing table. The routing table for RTA will have to include more routes before it can forward to other destinations. There are two ways to add new routes:

Static routing - An administrator manually defines routes to one or more destination networks.
Dynamic routing - Routers follow rules defined by a routing protocol to exchange routing information and independently select the best path.

Administratively defined routes are said to be static because they do not change until a network administrator manually programs the changes. Routes learned from other routers are dynamic because they change automatically as directly connected routers update each other with new information. Each method has fundamental advantages and disadvantages.
The Lab Activity will allow students to use the show ip route command to examine routing tables.
The next page will define a gateway of last resort.

Module 9: Basic Router Troubleshooting

2011-10-14T14:22:00.000-07:00

Module 9: Basic Router Troubleshooting

Overview A router uses a dynamic routing protocol to learn about routes to destination networks. Most routers use a combination of dynamic routing and manually configured static routes. Regardless of the method used, when a router determines that a route is the best path to a destination, it installs that route in its routing table. This module will describe methods that are used to examine and interpret the contents of the routing table.
Network testing and troubleshooting are perhaps the most time consuming components of every network administrator’s job. Efficient testing and troubleshooting must be done in a logical, orderly, and well-documented fashion. Otherwise, the same problems will reoccur, and the network administrator will never truly understand the network. This module describes a structured approach to network troubleshooting and provides some tools to use in the troubleshooting process.
Routing problems are among the most common and difficult for network administrators to diagnose. There are many tools that make it easier to identify and solve routing problems. This module will introduce several of the most important of these tools and provide practice in their use.
This module covers some of the objectives for the CCNA 640-801, INTRO 640-821, and ICND 640-811 exams. -
Students who complete this module should be able to perform the following tasks:

Use the show ip route command to gather detailed information about the routes installed on the router
Configure a default route or default network
Understand how a router uses both Layer 2 and Layer 3 addressing to move data through the network
Use the ping command to perform basic network connectivity tests
Use the telnet command to verify the application layer software between source and destination stations
Troubleshoot by sequential testing of OSI layers
Use the show interfaces command to confirm Layer 1 and Layer 2 problems
Use the show ip route and show ip protocol commands to identify routing issues
Use the show cdp command to verify Layer 2 connectivity
Use the trace route command to identify the path packets take between networks
Use the show controllers serial command to ensure the proper cable is attached

Use basic debug commands to monitor router activity

Module 8 : Summary

2011-10-14T14:20:00.001-07:00

Summary

This page summarizes the topics discussed in this module.
IP is an unreliable method for delivery of network data. ICMP is an error reporting protocol for IP. When datagram delivery errors occur, ICMP is used to report these errors back to the source of the datagram. ICMP echo request and echo reply messages allow the network administrator to test IP connectivity to aid in the troubleshooting process.
Network communication depends on the proper configuration of TCP/IP for both sending and receiving devices. A router also must have the TCP/IP protocol properly configured on its interfaces, and it must use an appropriate routing protocol. To test the availability of a destination use the ICMP ping command.
Incorrect routing information can cause a datagram to travel in a circle. The datagram will not reach its destination within the maximum hop count defined by the routing protocol. This is also known as the TTL. The ICMP message format starts with the type, code, and checksum fields. The type field indicates the type of ICMP message being sent. The code field includes further information specific to the message type. The checksum field, as in other types of packets, is used to verify the integrity of the data.
Destination unreachable messages are delivered to the sender when a datagram cannot be forwarded. Codes in the message header provide information about the problem. When a datagram is not forwarded due to an error in the header, an ICMP type 12 parameter problem message is sent to the source of the datagram.
Control messages inform hosts of conditions such as network congestion or the existence of a better gateway to a remote network. The ICMP redirect/change request is a common control message. It is initiated by a gateway, which is a term commonly used to describe a router.
The following situations will cause default gateways to send ICMP redirect/change request messages:

A packet enters a router and leaves from the same interface.
The subnet/network of the source IP address is the same as the subnet/network of the next-hop IP address of the routed packet.
The datagram is not source-routed.
The route for the redirect is not another ICMP redirect or a default route.

All ICMP timestamp reply messages contain the originate, receive, and transmit timestamps. The host can subtract the originate time from the transit time to estimate transit time across the network. Transit time will vary based on traffic and congestion on a network.

Router solicitation message / Congestion and flow control messages

2011-10-14T14:19:00.000-07:00

Router solicitation message
8.2.7 This page will explain why router solicitation messages are used.
A host generates an ICMP router solicitation message in response to a missing default gateway.This message is sent using multicast and it is the first step in the router discovery process. A local router will respond with a router advertisement that identifies the default gateway for the local host. Figure identifies the frame format and Figure gives an explanation of each field.
The next page will discuss source quench messages.Congestion and flow control messages
8.2.8 This page will explain how source quench messages are used to solve problems related to network congestion.
If multiple computers try to access the same destination at the same time, the destination computer can be overwhelmed with traffic. Congestion can also occur when traffic from a high speed LAN reaches a slower WAN connection. Dropped packets occur when there is too much congestion on a network. ICMP source quench messages are used to reduce the amount of data lost. The source quench message asks senders to reduce the rate at which they transmit packets. Congestion will usually subside after a short period of time and the source will slowly increase the transmission rate if no other source quench messages are received. Most Cisco routers do not send source quench messages by default, because the source quench message may add to the network congestion.
A small office, home office (SOHO) is a scenario where ICMP source quench messages might be used effectively. A SOHO could consist of four computers that are networked with CAT-5 cable and have a shared Internet connection over a 56K modem. The 10-Mbps bandwidth of the SOHO LAN could quickly overwhelm the 56K bandwidth of the WAN link, which would result in data loss and retransmissions. The gateway host can use an ICMP source quench message to request that the other hosts reduce their transmission rates to prevent continued data loss. A network where congestion on the WAN link could cause communication problems is shown in Figure .
This page concludes this lesson. The next page will summarize the main points from this module.

Router solicitation message

2011-10-14T14:16:00.000-07:00

Router solicitation message
8.2.6 This page will explain why router solicitation messages are used.
A host generates an ICMP router solicitation message in response to a missing default gateway. This message is sent using multicast and it is the first step in the router discovery process. A local router will respond with a router advertisement that identifies the default gateway for the local host. Figure identifies the frame format and Figure gives an explanation of each field.
The next page will discuss source quench messages.

Address mask requests

2011-10-14T14:11:00.001-07:00

Address mask requests
8.2.5 This page will explain address mask request messages and how they are used.
When a network administrator uses the process of subnetting to divide a major IP address into multiple subnets, a new subnet mask is created. This new subnet mask is important to identify network, subnet, and host bits in an IP address. If a host does not know the subnet mask, it may send an address mask request to the local router. If the address of the router is known, this request may be sent directly to the router. Otherwise, the request will be broadcast. When the router receives the request, it will respond with an address mask reply. This address mask reply will identify the correct subnet mask. For example, assume that a host is located within a Class B network and has an IP address of 172.16.5.2. This host does not know the subnet mask so it broadcasts an address mask request:
Source address: 172.16.5.2
Destination address: 255.255.255.255
Protocol: ICMP = 1
Type: Address Mask Request = AM1
Code: 0
Mask: 255.255.255.0
This broadcast is received by 172.16.5.1, the local router. The router responds with the address mask reply:
Source address: 172.16.5.1
Destination address: 172.16.5.2
Protocol: ICMP = 1
Type: Address Mask Reply = AM2
Code: 0
Mask: 255.255.255.0
The frame format for the address mask request and reply is shown in Figure . Figure shows the descriptions for each field in the address mask request message. Note that the same frame format is used for both the address mask request and the reply. However, an ICMP type number of 17 is assigned to the request and 18 is assigned to the reply.
The next page will introduce the ICMP router discovery message.

Information requests and reply message formats

2011-10-14T14:10:00.000-07:00

Information requests and reply message formats
8.2.4 This page will describe the format of ICMP information request and reply messages.
The ICMP information request and reply messages were originally intended to allow a host to determine its network number. Figure shows the format for an ICMP information request and reply message.
Two type codes are available in this message. Type 15 signifies an information request message and type 16 is an information reply message. This particular ICMP message type is considered obsolete. Other protocols such as BOOTP, Reverse Address Resolution Protocol (RARP), and Dynamic Host Configuration Protocol (DHCP) are now used to allow hosts to obtain their network numbers.
The next page will describe address mask request and reply messages.

Clock synchronization and transit time estimation

2011-10-14T14:08:00.001-07:00

Clock synchronization and transit time estimation
8.2.3 This page explains how ICMP timestamps are used to solve clock synchronization issues.
The TCP/IP protocol suite allows systems to connect to one another over vast distances through multiple networks. Each network provides clock synchronization in its own way. As a result, hosts on different networks who attempt to communicate with software that requires time synchronization can encounter problems. The ICMP timestamp message type is designed to help alleviate this problem.
The ICMP timestamp request message allows a host to ask for the current time according to the remote host. The remote host uses an ICMP timestamp reply message to respond to the request.
The type field on an ICMP timestamp message can be either 13 for a timestamp request or 14 for a timestamp reply. The code field value is always set to 0 because there are no additional parameters available. The ICMP timestamp request contains an originate timestamp, which is the time on the requesting host just before the timestamp request is sent. The receive timestamp is the time that the destination host receives the ICMP timestamp request. The transmit timestamp is filled in just before the ICMP timestamp reply is returned. Originate, receive, and transmit timestamps are computed in milliseconds elapsed since midnight Universal Time (UT).
All ICMP timestamp reply messages contain the originate, receive, and transmit timestamps. Using these three timestamps, the host can determine transit time across the network by subtracting the originate time from the receive time. Or it could determine transit time in the return direction by subtracting the transmit time from the current time. The host that originated the timestamp request can also estimate the local time on the remote computer.
While ICMP timestamp messages provide a simple way to estimate time on a remote host and total network transmit time, this is not the best way to obtain this information. Instead, more robust protocols such as Network Time Protocol (NTP) at the upper layers of the TCP/IP protocol stack perform clock synchronization in a more reliable manner.
The next page will discuss ICMP information request and reply messages.

ICMP redirect/change reque

2011-10-14T14:07:00.000-07:00

ICMP redirect/change request
8.2.2 This page will introduce the ICMP redirect request, which is a common ICMP control message. This type of message can only be initiated by a gateway, which is a term commonly used to describe a router. All hosts that communicate with multiple IP networks must be configured with a default gateway. This default gateway is the address of a router port connected to the same network as the host. Figure displays a host connected to a router that has access to the Internet. After Host B is configured with the IP address of FastEthernet 0/0 as its default gateway, it uses that IP address to reach any network that is not directly connected. Normally, Host B is connected to a single gateway. However, a host may be connected to a segment that has two or more directly connected routers. In this case, the default gateway of the host may need to use a redirect/change request to inform the host of the best path to a certain network.
Figure shows a network where ICMP redirects would be used. Host B sends a packet to Host C on network 10.0.0.0/8. Since Host B is not directly connected to the same network, it forwards the packet to its default gateway, Router A. Router A finds the correct route to network 10.0.0.0/8 by looking into its route table. It determines that the path to the network is back out the same interface the request to forward the packet came from. It forwards the packet and sends an ICMP redirect/change request to Host B. The request instructs Host B to use Router B as the gateway to forward all future requests to network 10.0.0.0/8.
Default gateways only send ICMP redirect/change request messages if the following conditions are met:

The interface on which the packet comes into the router is the same interface on which the packet gets routed out.
The subnet/network of the source IP address is the same subnet/network of the next-hop IP address of the routed packet.
The datagram is not source-routed.
The route for the redirect is not another ICMP redirect or a default route.
The router is configured to send redirects. By default, Cisco routers send ICMP redirects. The interface subcommand no ip redirects will disable ICMP redirects.

The ICMP redirect/change request uses the format shown in Figure . It has an ICMP type code of 5. In addition, it has a code value of 0, 1, 2, or 3.
The Router Internet Address field in the ICMP redirect is the IP address that should be used as the default gateway for a particular network. In the example in Figure , the ICMP redirect sent from Router A to Host B would have a Router Internet Address field value of 172.16.1.200, which is the IP address of E0 on Router B.
The next page will describe clock synchronization.

TCP/IP Suite Control Messages / Introduction to control messages

2011-10-14T14:01:00.000-07:00

Introduction to control messages
8.2.1 This page will provide an overview of TCP/IP control messages.
ICMP is an important part of the TCP/IP protocol suite. All IP implementations must include ICMP support. The reasons for this are simple. Since IP does not guarantee delivery, it cannot inform hosts when errors occur. Second, IP has no built-in method to provide informational or control messages to hosts.
Unlike error messages, control messages are not the results of lost packets or error conditions that occur during packet transmission. Instead, they are used to inform hosts of conditions such as network congestion or the existence of a better gateway to a remote network. ICMP uses the basic IP header to travel through multiple networks.
Multiple types of control messages are used by ICMP. Some of the most common are shown in Figure . Many of these are discussed in this lesson.
The next page will describe ICMP redirect requests.

Miscellaneous error reporting

2011-10-14T13:56:00.001-07:00

Miscellaneous error reporting
8.1.9 This page will explain what a parameter problem message is and why it occurs.
Devices that process datagrams may not be able to forward a datagram due to an error in the header parameter. This error does not relate to the state of the destination host or network but still prevents the datagram from being processed and delivered, and because of that, the datagram is discarded. In this case, an ICMP type 12 parameter problem message is sent to the source of the datagram. Figure shows the parameter problem message header.
The parameter problem message includes the pointer field in the header. When the code value is 0, the pointer field indicates the octet of the datagram that produced the error.
This page concludes this lesson. The next lesson will describe TCP/IP suite control messages. The first page will provide an overview of control messages.

Destination unreachable message

2011-10-14T13:55:00.000-07:00

Destination unreachable message
8.1.8 This page will explain what a destination unreachable message is and why it occurs.
Datagrams cannot always be forwarded to their destinations. Hardware failures, improper protocol configuration, down interfaces, and incorrect routing information are some of the factors that prevent successful delivery. In these cases, ICMP sends the sender a destination unreachable message, which indicates that the datagram could not be forwarded.
Figure shows an ICMP destination unreachable message header. The value of 3 in the type field indicates it is a destination unreachable message. The code value indicates the reason the packet could not be delivered. Figure has a code value of 0, which indicates that the network was unreachable. Figure shows the meaning for each possible code value in a destination unreachable message.
A destination unreachable message may also be sent when packet fragmentation is required to forward a packet. Fragmentation is usually necessary when a datagram is forwarded from a Token Ring network to an Ethernet network. If the datagram does not allow fragmentation, the packet cannot be forwarded, so a destination unreachable message will be sent. Destination unreachable messages may also be generated if IP-related services such as FTP or Web services are unavailable. To effectively troubleshoot an IP network, it is necessary to understand the various causes of ICMP destination unreachable messages.
The next page introduces parameter problem messages.

Echo messages

2011-08-13T04:50:00.000-07:00

Echo messages

8.1.7 This page will provide information about ICMP messages.

As with any type of packet, ICMP messages have special formats. Each ICMP message type shown in Figure has its own unique characteristics. All ICMP message formats start with the same three fields:

• Type

• Code

• Checksum

The type field indicates the type of ICMP message being sent. The code field includes further information specific to the message type. The checksum field, as in other types of packets, is used to verify the integrity of the data.

Figure shows the message format for the ICMP echo request and echo reply messages. The relevant type and code numbers are shown for each message type. The identifier and sequence number fields are unique to the echo request and echo reply messages. The identifier and sequence fields are used to match the echo replies to the corresponding echo request. The data field contains additional information that may be a part of the echo reply or echo request message.

The Interactive Media Activity will test the ability of students to place the ICMP message fields in the correct order.

The next page will explain why destination unreachable messages occur

Detecting excessively long routes

2011-08-13T04:47:00.001-07:00

Detecting excessively long routes

8.1.6 This page will explain how excessively long routes are created.

Situations can occur in network communication where a datagram travels in a circle, never reaching its destination. This might occur if two routers continually route a datagram back and forth between them, thinking the other should be the next hop to the destination. When there are several routers involved, a routing cycle is created. In a routing cycle, a router sends the datagram to the next hop router and thinks the next hop router will route the datagram to the correct destination. The next hop router then routes the datagram to the next router in the cycle. This can be caused by incorrect routing information.

The limitations of the routing protocol can result in unreachable destinations. The hop limit of RIP is 15, which means that networks that are greater than 15 hops will not be learned through RIP.

In either of these cases, an excessively long route exists. Whether the actual path includes a circular routing path or too many hops, the packet will eventually exceed the maximum hop count.

The next page will discuss ICMP messages

Use ping to test destination reachability

2011-08-13T04:37:00.000-07:00

Use ping to test destination reachability

8.1.5 This page will explain how the ping command can be used to test the reachability of a network.

The ICMP protocol can be used to test the availability of a particular destination. Figure shows ICMP being used to issue an echo request message to the destination device. If the destination device receives the ICMP echo request, it formulates an echo reply message to send back to the source of the echo request. If the sender receives the echo reply, this confirms that the destination device can be reached using the IP protocol.

The echo request message is typically initiated with the ping command as shown in Figure . In this example, the command is used with the IP address of the destination device. The command can also be entered with the IP address of the destination device as shown in Figure . In these examples, the ping command issues four echo requests and receives four echo replies. This confirms IP connectivity between the two devices.

As seen in Figure , the echo reply includes a time-to-live (TTL) value. TTL is a field in the IP packet header used by IP to provide a limitation on packet forwarding. As each router processes the packet, it decreases the TTL value by one. When a router receives a packet with a TTL value of 1, it will decrement the TTL value to 0 and the packet cannot be forwarded. An ICMP message may be generated and sent back to the source machine, and the undeliverable packet is dropped.

The next page will discuss excessively long routes

Unreachable networks

2011-08-13T04:32:00.000-07:00

Unreachable networks

8.1.4 This page will explain why some networks are unreachable.

Network communication depends on some basic conditions that must be met. First, the TCP/IP protocol must be properly configured for devices that send and receive data. This includes the installation of the TCP/IP protocol and proper configuration of an IP address and subnet mask. A default gateway must also be configured if datagrams are to travel outside of the local network. Second, intermediary devices must be in place to route the datagram from the source device and its network to the destination network. Routers perform this function. A router also must have the TCP/IP protocol properly configured on its interfaces, and it must use an appropriate routing protocol.

If these conditions are not met, then network communication cannot take place. For instance, the sending device may address the datagram to a non-existent IP address or to a destination device that is disconnected from its network. Routers can also be points of failure if a connecting interface is down or if the router does not have the information necessary to find the destination network. If a destination network is not accessible, it is said to be an unreachable network.

Figures and show a router that receives a packet that cannot be delivered. The packet is undeliverable because there is no known route to the destination. Because of this, the router sends an ICMP host unreachable message to the source.

The next page will teach students how to test network reachability

ICMP message delivery

2011-08-13T04:26:00.001-07:00

ICMP message delivery

8.1.3 This page will describe the delivery method that is used by ICMP.

ICMP messages are encapsulated into datagrams in the same way any other data is delivered when IP is used. Figure displays the encapsulation of ICMP data within an IP datagram.

Since ICMP messages are transmitted in the same way as any other data, they are subject to the same delivery failures. This creates a scenario where error reports could generate more error reports and cause increased congestion on a network. For this reason, errors created by ICMP messages do not generate their own ICMP messages. Therefore, it is possible to have a datagram delivery error that is never reported back to the sender of the data.

The next page will discuss unreachable networks.

Error reporting and error correction

2011-08-13T04:25:00.000-07:00

Error reporting and error correction

8.1.2 This page will explain how ICMP reports errors for IP. When datagram delivery errors occur, ICMP is used to report these errors back to the source of the datagram. Look at the example in Figure . Workstation 1 tries to send a datagram to Workstation 6, but interface Fa0/0 on Router C goes down. Router C uses ICMP to send a message back to Workstation 1. The message indicates that the datagram could not be delivered. ICMP does not correct any network problems that it encounters, it only reports them.

When Router C receives the datagram from Workstation 1, it knows only the source and destination IP addresses of the datagram. It does not know the exact path that the datagram took. Therefore, Router C can only notify Workstation 1 of the failure and no ICMP messages are sent to Router A and Router B. ICMP reports on the status of the delivered packet only to the source device. It does not send information about network changes to other routers.

The next page will explain how ICMP message delivery occurs.

Overview of TCP/IP Error Message / ICMP

2011-08-13T04:15:00.000-07:00

Overview of TCP/IP Error Message

ICMP

8.1.1 This page will introduce a protocol that addresses the limitations of IP.

IP is an unreliable method for the delivery of network data. It is known as a best effort delivery mechanism. It has no built-in process to ensure that data is delivered if problems exist with network communication. If an intermediary device such as a router fails, or if a destination device is disconnected from the network, data cannot be delivered. Additionally, nothing in its basic design allows IP to notify the sender that a data transmission has failed. ICMP is the component of the TCP/IP protocol stack that addresses this basic limitation of IP. ICMP does not overcome the unreliability issues in IP. Reliability is provided by upper layer protocols.

The next page will explain how ICMP reports delivery errors.

Module 8: TCP/IP Suite Error and Control Messages / Overview

2011-08-13T04:10:00.000-07:00

TCP/IP Suite Error and Control Messages

Overview

IP is limited because it is a best effort delivery system. It has no mechanism to ensure that data is delivered over a network. Data may fail to reach its destination for a variety of reasons such as hardware failure, improper configuration, or incorrect routing information. To help identify these failures, IP uses the Internet Control Message Protocol (ICMP) to notify the sender of the data that there was an error in the delivery process. This module describes the various types of ICMP error messages and some of the ways they are used.

Because IP does not have a built-in mechanism for sending error and control messages, it uses ICMP to send and receive error and control messages to hosts on a network. This module focuses on control messages, which are messages that provide information or configuration parameters to hosts. Knowledge of ICMP control messages is an essential part of network troubleshooting and is important to fully understand IP networks.

This module covers some of the objectives for the CCNA 640-801, INTRO 640-821, and ICND 640-811 exams. -

Students who complete this module should be able to perform the following tasks:

• Describe ICMP

• Describe ICMP message format

• Identify ICMP error message types
• Identify potential causes of specific ICMP error messages
• Describe ICMP control messages
• Identify a variety of ICMP control messages used in networks
• Determine the causes for ICMP control messages

Summary of Module 7

2011-08-13T04:08:00.001-07:00

Summary

This page summarizes the topics discussed in this module.

Distance vector algorithms call for each router to send its entire routing table to each of its adjacent neighbors. The routing tables include information about the total path cost as defined by the metrics and the logical address of the first router on the path to each network contained in the table.

RIP uses many techniques to reduce routing loops and counting to infinity. RIP permits a maximum hop count of 15. A destination greater than 15 hops away is tagged as unreachable.

The split horizon rule specifies that it is not useful to send information about a route back in the direction from which it came. In some network configurations, it may be necessary to disable split horizon.

Route poisoning is used to overcome large routing loops and provide information when a network is down. It also keeps a router from receiving incorrect updates.

Holddown timers help prevent counting to infinity but also increase convergence time. The default holddown for RIP is 180 seconds. Triggered updates are also sent if routing information changes. The router sends triggered routing update on its other interfaces rather than waiting on the routing update timer to expire.

RIP v2 enhancements include the ability to carry additional packet routing information, an authentication mechanism to secure table updates, and support for VLSM. By default, routing updates are broadcast every 30 seconds.

RIP is enabled with the router rip command. The network command is then used to tell the router on which interfaces to run RIP.

A supernet route is a route that covers a greater range of subnets with a single entry. The ip classless global configuration command is used to forward packets to the best supernet route when a router receives packets destined for an unknown subnet of a network.

The two most common commands used to verify that RIP is properly configured are the show ip route and show ip protocols commands. The show ip route command shows the routes that are installed in the routing table and the status of each route. The show ip protocols command is used to verify the state of the active routing protocol as well as the installed routes specific to the protocol.

To display RIP routing updates as they are sent and received, use the debug ip rip command.

The passive-interface command prevents routers from sending routing updates through a router interface. This keeps update messages from being sent through a router interface so that other systems on a network will not learn about routes dynamically.

The show ip route command is used to find equal cost routes for load balancing. RIP uses round robin load balancing. Routers take turns to forward packets over equal cost paths. IGRP is a distance vector routing protocol that measures distances to mathematically compare routes. It sends routing updates at 90 second intervals to advertise networks for an AS. IGRP uses a composite metric. This metric is calculated as a function of bandwidth, delay, load, and reliability. IGRP advertises three types of routes. These include interior, system, and exterior. There are many features such as holddowns and split horizons that provide stability. Use the show ip protocols and the show ip route commands to verify that IGRP is properly configured. In addition, the ping and trace commands are used to troubleshoot errors.

Troubleshooting IGRP

2011-08-13T04:07:00.000-07:00

Troubleshooting IGRP

7.3.8 This page will introduce some commands that can be used to troubleshoot IGRP.

Most IGRP configuration errors involve a mistyped network statement, discontiguous subnets, or an incorrect AS Number.

The following commands are used to troubleshoot IGRP:

• show ip protocols
• show ip route
• debug ip igrp events
• debug ip igrp transactions
• ping
• traceroute

Figure shows output from the debug ip igrp events command.

Figure shows output from the debug ip igrp transactions command.

If the AS number is wrong and then corrected, it results in the output shown in Figure .

The Lab Activity will show students how to use the IGRP debug commands.

This page concludes this lesson. The next page will summarize the main points from this module.

Verifying IGRP configuration

2011-08-13T04:05:00.000-07:00

Verifying IGRP configuration

7.3.7 This page will teach students how to verify an IGRP configuration.

To verify that IGRP has been configured properly, enter the show ip route command and look for IGRP routes signified by an "I".

Additional commands for checking IGRP configuration are as follows:

• show interfaceinterface
• show running-config
• show running-config interfaceinterface
• show running-config
begin interfaceinterface
• show running-config
begin igrp
• show ip protocols

To verify that the Ethernet interface is properly configured, enter the show interface fa0/0 command. Figure illustrates the output.

To see if IGRP is enabled on the router, enter the show ip protocols command. Figure illustrates the output.

The commands illustrated in Figures - verify the network statements, IP addressing, and routing tables.

In the Lab Activities, students will verify an IGRP configuration and then use IGRP to set up dynamic routing.

The next page will teach students how to troubleshoot IGRP

Migrating RIP to IGRP

2011-08-13T04:04:00.000-07:00

Migrating RIP to IGRP

7.3.6 This page will teach students how to convert a router from RIP to IGRP.

When Cisco created IGRP in the early 1980s, it was the first company to solve the problems associated with the use of RIP to route datagrams between interior routers. IGRP examines the bandwidth and delay of the networks between routers to determine the best path through an internetwork. IGRP converges faster than RIP. This prevents routing loops that are caused by disagreement over the next routing hop. Further, IGRP does not share the hop count limitation of RIP. As a result of this and other improvements over RIP, IGRP enabled many large, complex, topologically diverse internetworks to be deployed.

Use the following steps to convert from RIP to IGRP:

1. Enter show ip route to verify that RIP is the routing protocol on the routers to be converted.

2. Configure IGRP on Router A and Router B.

3. Enter show ip protocols on Router A and Router B.
4. Enter show ip route on Router A and Router B.

The Lab Activities will show students how to configure a default route, use RIP to propagate the information, and then convert the router to IGRP.

The next page will explain how to verify that IGRP has been configured properly

Configuring IGRP

2011-08-13T03:54:00.000-07:00

Configuring IGRP

7.3.5 This page will introduce the commands that are used to configure IGRP.

To configure the IGRP routing process, use the router igrp configuration command. To shut down an IGRP routing process, use the no form of this command.

The command syntax is as follows:

RouterA(config)#router igrpas-number

RouterA(config)#no router igrpas-number

The AS number identifies the IGRP process.

To specify a list of networks for IGRP routing processes, use the network router configuration command. To remove an entry, use the no form of the command.

Figure shows an example of how to configure IGRP for AS 101.

The Lab Activities will help students configure IGRP.

The next page will explain how to convert a router from RIP to IGRP.

IGRP stability features

2011-08-13T03:48:00.000-07:00

IGRP stability features

7.3.4 This page will describe three features that are designed to enhance the stability of IGRP:

• Holddowns

• Split horizons

• Poison reverse updates

Holddowns

Holddowns are used to prevent regular update messages from reinstating a route that may not be up. When a router goes down, neighbor routers detect this from the lack of regularly scheduled update messages.

Split horizons

Split horizons are derived from the premise that it is not useful to send information about a route back in the direction from which it came. The split horizon rule helps prevent routing loops between adjacent routers.

Poison reverse updates

Poison reverse updates are used to prevent larger routing loops. Increases in routing metrics usually indicate routing loops. Poison reverse updates then are sent to remove the route and place it in holddown. With IGRP, poison reverse updates are sent only if a route metric has increased by a factor of 1.1 or greater.

IGRP also maintains many timers and variables that contain time intervals. These include an update timer, an invalid timer, a holddown timer, and a flush timer.

The update timer specifies how frequently routing update messages should be sent. The IGRP default for this variable is 90 seconds.

The invalid timer specifies how long a router should wait in the absence of routing-update messages about a route before it declares that route invalid. The IGRP default for this variable is three times the update period.

The holddown timer specifies the amount of time for which information about poorer routes is ignored. The IGRP default for this variable is three times the update timer period plus 10 seconds.

Finally, the flush timer indicates how much time should pass before a route is flushed from the routing table. The IGRP default is seven times the routing update timer.

IGRP lacks support for VLSM. Cisco has created Enhanced IGRP to correct this problem.

The next page will show students how to configure IGRP.

IGRP routes

2011-08-13T03:44:00.000-07:00

IGRP routes

7.3.3 This page will introduce the three types of routes that IGRP advertises:

• Interior

• System

• Exterior

Interior

Interior routes are routes between subnets of a network attached to a router interface. If the network attached to a router is not subnetted, IGRP does not advertise interior routes.

System

System routes are routes to networks within an autonomous system. The Cisco IOS software derives system routes from directly connected network interfaces and system route information provided by other IGRP routers or access servers. System routes do not include subnet information.

Exterior

Exterior routes are routes to networks outside the autonomous system that are considered when a gateway of last resort is identified. The Cisco IOS software chooses a gateway of last resort from the list of exterior routes that IGRP provides. The software uses the gateway of last resort if a better route is not found and the destination is not a connected network. If the autonomous system has more than one connection to an external network, different routers can choose different exterior routers as the gateway of last resort.

The Interactive Media Activity will help students understand the different types of IGRP routes.

The next page will introduce three features that increase the stability of IGRP.

IGRP metrics

2011-08-13T03:39:00.000-07:00

IGRP metrics

7.3.2 This page will describe the metrics that IGRP uses.

The show ip protocols command displays parameters, filters, and network information about the routing protocols in use on the router. The algorithm used to calculate the routing metric for IGRP is shown in the graphic. It defines the value of the K1 to K5 metrics and provides information about the maximum hop count. The metric K1 represents bandwidth and the metric K3 represents delay. By default the values of the metrics K1 and K3 are set to 1, and K2, K4, and K5 are set to 0.

This composite metric is more accurate than the hop count metric that RIP uses to choose a path to a destination. The path that has the smallest metric value is the best route.

IGRP uses the following metrics:

• Bandwidth – The lowest bandwidth value in the path

• Delay – The cumulative interface delay along the path

• Reliability – The reliability on the link toward the destination as determined by the exchange of keepalives
• Load – The load on a link toward the destination based on bits per second

IGRP uses a composite metric. This metric is calculated as a function of bandwidth, delay, load, and reliability. By default, only bandwidth and delay are considered. The other parameters are considered only if enabled through configuration. Delay and bandwidth are not measured values, but are set with the delay and bandwidth interface commands. The show ip route command in the example shows the IGRP metric values in brackets. A link with a higher bandwidth will have a lower metric and a route with a lower cumulative delay will have a lower metric.

The next page will discuss the IGRP routes.

IGRP / IGRP features

2011-08-13T03:35:00.000-07:00

IGRP

IGRP features

7.3.1 This page will explain the main features and functions of IGRP.

IGRP is a distance vector IGP. Distance vector routing protocols measure distances to mathematically compare routes. This measurement is known as the distance vector. Routers that use distance vector protocols must send all or a portion of their routing table in a routing update message at regular intervals to each neighbor router. As routing information spreads throughout the network, routers perform the following functions:

• Identify new destinations

• Learn of failures

IGRP is a distance vector routing protocol developed by Cisco. IGRP sends routing updates at 90 second intervals. These updates advertise all the networks for a particular AS. Key design characteristics of IGRP are a follows:

• The versatility to automatically handle indefinite, complex topologies

• The flexibility needed to segment with different bandwidth and delay characteristics

• Scalability for functioning in very large networks

By default, the IGRP routing protocol uses bandwidth and delay as metrics. Additionally, IGRP can be configured to use a combination of variables to determine a composite metric. These variables are as follows:

• Bandwidth
• Delay
• Load
• Reliability

The next page will introduce the IGRP metrics.

Integrating static routes with RIP

2011-08-13T03:31:00.000-07:00

Integrating static routes with RIP

7.2.10 This page will explain how static routes can be configured on a router that uses RIP.

Static routes are user-defined routes that force packets to take a set path from a source to a destination. Static routes become very important if the Cisco IOS software does not learn a route to a particular destination. They are also used to specify a gateway of last resort, which is commonly referred to as a default route. If a packet is destined for a subnet that is not explicitly listed in the routing table, the packet is forwarded to the default route.

A router that runs RIP can receive a default route through an update from another router that runs RIP. Another option is for the router to generate the default route itself.

Use the no ip route global configuration command to remove static routes. The administrator can override a static route with dynamic routing information by adjusting the administrative distance values. Each dynamic routing protocol has a default administrative distance (AD). A static route can be defined as less desirable than a dynamically learned route, as long as the AD of the static route is higher than that of the dynamic route. Note that after the static route to network 172.16.0.0 through 192.168.14.2 was entered, the routing table does not show it. Only the dynamic route learned through RIP is present. This is because the AD of 130 is higher for the static route, and unless the RIP route through S0/0 goes down, the static route will not be installed in the routing table.

Static routes that point out an interface will be advertised by the RIP router that owns the static route and propagated throughout the internetwork. This is because static routes that point to an interface are considered in the routing table to be connected and thus lose their static nature in the update. If a static route is assigned to an interface that is not defined in a network command, a redistribute static command must be specified in the RIP process before RIP will advertise the route.

When an interface goes down, all static routes pointing out that interface are removed from the IP routing table. Likewise, when the software can no longer find a valid next hop for the address specified in the static route, then the static route is removed from the IP routing table.

In Figure a static route has been configured on the GAD router to take the place of the RIP route in the event that the RIP routing process fails. This is referred to as a floating static route. To configure the floating static route, an AD of 130 was defined on the static route. This is greater than the default AD of RIP, which is 120. The BHM router would also need to be configured with a default route.

The Lab Activity will teach students how to define static routes when RIP is used.

This page concludes this lesson. The next lesson will discuss IGRP. The first page provides an overview of IGRP.

Load balancing across multiple paths

2011-08-13T03:28:00.000-07:00

Load balancing across multiple paths

7.2.9 This page will further explain how routers use load balancing to transmit packets to a destination IP address over multiple paths. The paths are derived either statically or with dynamic protocols, such as RIP, EIGRP, OSPF, and IGRP.

When a router learns multiple routes to a specific network, the route with the lowest administrative distance is installed in the routing table. Sometimes the router must select a route from among many, learned through the same routing process with the same administrative distance. In this case, the router chooses the path with the lowest cost or metric to the destination. Each routing process calculates its cost differently and the costs may need to be manually configured in order to achieve load balancing.

If the router receives and installs multiple paths with the same administrative distance and cost to a destination, load-balancing can occur. Cisco IOS imposes a limit of up to six equal cost routes in a routing table, but some IGPs have their own limitations. EIGRP allows up to four equal cost routes.

By default, most IP routing protocols install a maximum of four parallel routes in a routing table. Static routes always install six routes. The exception is BGP, which by default allows only one path to a destination.

The range of maximum paths is one to six paths. To change the maximum number of parallel paths allowed, use the following command in router configuration mode:

Router(config-router)#maximum-paths [number ]

IGRP can load balance up to six unequal links. RIP networks must have the same hop count to load balance, whereas IGRP uses bandwidth to determine how to load balance.

In Figure , there are three ways to reach Network X:

• E to B to A with a metric of 30

• E to C to A with a metric of 20

• E to D to A with a metric of 45

Router E chooses the second path, E to C to A with a metric of 20, since it is a lower cost than 30 and 45.

Cisco IOS supports two methods of load balancing for IP packets. These are per-packet and per-destination load balancing. If process switching is enabled, the router will alternate paths on a per-packet basis. If fast switching is enabled, only one alternate route will be cached for the destination address. All packets that are bound for a specific host will take the same path. Packets bound for a different host on the same network may use an alternate route. Traffic is load balanced on a per-destination basis.

By default the router uses per-destination load balancing, also called fast switching. The route cache allows outgoing packets to be load-balanced on a per-destination basis rather than on a per-packet basis. To disable fast switching, use the no ip route-cache command. Using this command will cause traffic to be load balanced on a per-packet basis.

In the Lab Activities, students will configure and observe load balancing.

The next page will discuss static routes with RIP.

Load balancing with RIP

2011-08-13T03:25:00.000-07:00

Load balancing with RIP

7.2.8 This page will describe load balancing and explain how RIP uses this feature.

Load balancing is a concept that allows a router to take advantage of multiple best paths to a given destination. These paths are either statically defined by a network administrator or calculated by a dynamic routing protocol such as RIP.

RIP is capable of load balancing over as many as six equal-cost paths. The default is four paths. RIP performs what is referred to as “round robin” load balancing. This means that RIP takes turns forwarding packets over the parallel paths.

Figure shows an example of RIP routes with four equal cost paths. The router will start with an interface pointer to the interface connected to Router 1. Then the interface pointer cycles through the interfaces and routes in a deterministic fashion such as 1-2-3-4-1-2-3-4-1 and so on. Since the metric for RIP is hop count, the speed of the links is not considered. Therefore, the 56-Kbps path will be given the same preference as the 155-Mbps path.

The show ip route command can be used to find equal cost routes. For example, Figure is a display of the output show ip route to a particular subnet with multiple routes.

Notice there are two routing descriptor blocks. Each block is one route. There is also an asterisk (*) next to one of the block entries. This corresponds to the active route that is used for new traffic.

The next page will explain load balancing in greater detail.

Preventing routing updates through an interface

2011-08-13T03:22:00.000-07:00

Preventing routing updates through an interface

7.2.7 This page will teach students how to prevent routing updates.

Route filtering regulates the routes that are entered into or advertised out of a route table. These have different effects on link-state routing protocols than they do on distance vector protocols. A router that runs a distance vector protocol advertises routes based on what is in its route table. As a result, a route filter influences which routes the router advertises to its neighbors.

Routers that run link-state protocols determine routes based on information in the link-state database, rather than the route entries advertised by neighbor routers. Route filters have no effect on link-state advertisements or the link-state database. For this reason, the information on this page only applies to distance vector IP routing protocols such as RIP and IGRP.

The passive-interface command prevents the transmission of routing updates through a router interface. When update messages are not sent through a router interface, other systems on the network cannot learn about routes dynamically. In Figure , Router E uses the passive-interface command to prevent routing updates from being sent.

For RIP and IGRP, the passive-interface command stops the router from sending updates to a particular neighbor, but the router continues to listen and use routing updates from that neighbor.

The Lab Activities will instruct students on how to prevent routing updates through an interface.

The next page will explain the concept of load balancing.

Troubleshooting RIP update issues

2011-08-13T03:20:00.000-07:00

Troubleshooting RIP update issues

7.2.6 This page will teach students how to troubleshoot RIP update issues.

Most of the RIP configuration errors involve an incorrect network statement, discontiguous subnets, or split horizons. An effective command that is used to find RIP update issues is the debug ip rip command.

The debug ip rip command displays RIP routing updates as they are sent and received. The example in Figure shows the output from the debug ip rip command after a router receives a RIP update. After the router receives and processes the update, it sends the updated information out its two RIP interfaces. The output shows the router uses RIP v1 and broadcasts the update with the broadcast address 255.255.255.255. The number in parenthesis represents the source address encapsulated into the IP header of the RIP update.

There are several key indicators to look for in the output of the debug ip rip command. Problems such as discontiguous subnetworks or duplicate networks can be diagnosed with this command. A symptom of these issues would be a router that advertises a route with a metric that is less than the metric it received for that network.

The following commands can also be used to troubleshoot RIP:

• show ip rip database

• show ip protocols {summary}

• show ip route

• debug ip rip {events}

• show ip interface brief
The next page will introduce the command that is used to prevent routing updates

Verifying RIP configuration

2011-08-13T03:18:00.000-07:00

Verifying RIP configuration

7.2.5 This page will describe several commands that can be used to verify that RIP is properly configured. Two of the most common are the show ip route command and the show ip protocols command.

The show ip protocols command shows which routing protocols carry IP traffic on the router. This output can be used to verify most if not all of the RIP configuration. Some of the most common configuration items to verify are as follows:

• RIP routing is configured.
• The correct interfaces send and receive RIP updates.
• The router advertises the correct networks.

The show ip route command can be used to verify that routes received by RIP neighbors are installed in the routing table. Examine the output of the command and look for RIP routes signified by "R". Remember that the network will take some time to converge so the routes may not appear immediately.

Additional commands to check RIP configuration are as follows:

• show interfaceinterface

• show ip interfaceinterface

• show running-config

The next page discusses some commands that can be used to troubleshoot RIP.