WEBVTT

1
00:00.000 --> 00:05.280
If we're going to be diagnosing network problems, then we need to start with

2
00:05.280 --> 00:06.880
the debug command.

3
00:06.880 --> 00:11.400
The debug command is part of our privileged exec level, meaning we don't have

4
00:11.400 --> 00:11.880
to go into

5
00:11.880 --> 00:15.410
global configuration, but we do have to make sure that we have enabled and

6
00:15.410 --> 00:16.040
entered the

7
00:16.040 --> 00:21.200
enable secret in order to put in these debug commands.

8
00:21.200 --> 00:26.380
The format is going to simply be the word debug, and then we are going to

9
00:26.380 --> 00:27.400
clarify or

10
00:27.400 --> 00:32.160
specify the feature that we want to debug, and then we typically have some
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.400 --> 00:32.160
specify the feature that we want to debug, and then we typically have some

11
00:32.160 --> 00:33.160
other options

12
00:33.160 --> 00:34.160
afterward.

13
00:34.160 --> 00:37.440
And then importantly, I need to be able to turn off my debug.

14
00:37.440 --> 00:42.280
And so even though we can use a no debug command, it's also pretty common

15
00:42.280 --> 00:43.560
simply to

16
00:43.560 --> 00:45.720
say on debug.

17
00:45.720 --> 00:51.310
So if I say on debug, and then I specify the debug I want to disable, or I can

18
00:51.310 --> 00:52.360
say all

19
00:52.360 --> 00:55.790
to get rid of all of my debug, and that's actually pretty helpful when we are

20
00:55.790 --> 00:56.240
running

21
00:56.240 --> 01:00.920
a bunch of debug all at once, we just want to disable everything.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:56.240 --> 01:00.920
a bunch of debug all at once, we just want to disable everything.

22
01:00.920 --> 01:04.120
Now if I want to see the debug messages happening, debug messages are

23
01:04.120 --> 01:05.600
automatically pushed out

24
01:05.600 --> 01:08.120
to the console.

25
01:08.120 --> 01:13.950
However, I might need to make sure that they're going to get pushed out to my

26
01:13.950 --> 01:14.800
terminal, if

27
01:14.800 --> 01:20.600
I'm logged in via telnet and SSH.

28
01:20.600 --> 01:25.520
Well I should say or SSH and hopefully ideally SSH in our secure networks.

29
01:25.520 --> 01:31.600
So I am SSH into a device and I run a debug message, I'm getting nothing back.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:25.520 --> 01:31.600
So I am SSH into a device and I run a debug message, I'm getting nothing back.

30
01:31.600 --> 01:35.840
Well I might need to enable terminal monitor.

31
01:35.840 --> 01:40.760
So simply saying terminal monitor will enable me to get those messages.

32
01:40.760 --> 01:47.500
Now I might also have to check the logging level, because depending on what

33
01:47.500 --> 01:48.680
that set to,

34
01:48.680 --> 01:52.400
I might not be outputting debug messages to the terminal.

35
01:52.400 --> 01:55.410
And technically I could change it so it's not outputting to the console either

36
01:55.410 --> 01:55.720
if I'm

37
01:55.720 --> 01:57.160
not seeing it there.

38
01:57.160 --> 02:00.910
So we'll be talking about logging levels and enabling those coming up later on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:57.160 --> 02:00.910
So we'll be talking about logging levels and enabling those coming up later on

39
02:00.910 --> 02:02.080
in the skill.

40
02:02.080 --> 02:05.800
But for now just keep in mind that we do need to be able to see those debug, it

41
02:05.800 --> 02:06.360
's sort of

42
02:06.360 --> 02:10.410
the easy button if we're logged in via console because all of those debug are

43
02:10.410 --> 02:12.160
output by default.

44
02:12.160 --> 02:16.460
But if I am remote connected in via telnet or SSH, then I'm going to have to

45
02:16.460 --> 02:17.120
enable it

46
02:17.120 --> 02:20.880
with terminal monitor and possibly adjust the logging level.

47
02:20.880 --> 02:26.230
And by the way, if I want to turn off the debug messages, then the no for this

48
02:26.230 --> 02:27.360
command,

49
02:27.360 --> 02:29.880
terminal monitor actually goes right here.

50
02:29.880 --> 02:34.150
So it'd be terminal no monitor, not no terminal monitor, just sort of a little
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:29.880 --> 02:34.150
So it'd be terminal no monitor, not no terminal monitor, just sort of a little

51
02:34.150 --> 02:35.640
nuance there.

52
02:35.640 --> 02:38.400
So what are some important debug that we should know?

53
02:38.400 --> 02:44.200
Well there are hundreds if not thousands of debug and it's all going to depend

54
02:44.200 --> 02:44.400
on the

55
02:44.400 --> 02:45.960
thing we're trying to debug.

56
02:45.960 --> 02:49.080
And so rather than try to memorize all of the different debug is going to be

57
02:49.080 --> 02:49.640
important

58
02:49.640 --> 02:54.050
that we can go out to the documentation and say, hey, I want to debug the

59
02:54.050 --> 02:54.880
events that

60
02:54.880 --> 02:59.680
are happening with a particular protocol like maybe EIGRP or OSPF or spanning

61
02:59.680 --> 03:00.400
tree.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:59.680 --> 03:00.400
tree.

62
03:00.400 --> 03:03.080
And so there are a few useful ones we could list out here.

63
03:03.080 --> 03:06.800
But again, it's going to be about going out to Cisco documentation and really

64
03:06.800 --> 03:07.320
trying to

65
03:07.320 --> 03:11.240
figure out which debug is going to be the one that would help me to understand

66
03:11.240 --> 03:11.720
what's

67
03:11.720 --> 03:12.960
going on.

68
03:12.960 --> 03:18.880
So for example, we might want to run a debug command for spanning tree.

69
03:18.880 --> 03:23.340
And I can always just say debug type this in debug spanning tree and then

70
03:23.340 --> 03:24.280
question mark

71
03:24.280 --> 03:26.680
and see what options are available.

72
03:26.680 --> 03:30.680
And for example, we might lock into debug spanning tree events.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:26.680 --> 03:30.680
And for example, we might lock into debug spanning tree events.

73
03:30.680 --> 03:34.690
And this is a great option for seeing all of the different timers and the VPDUs

74
03:34.690 --> 03:34.960
are

75
03:34.960 --> 03:35.960
getting sent out.

76
03:35.960 --> 03:39.480
There is a different separate BPDU debug that we could use.

77
03:39.480 --> 03:42.590
And so there's a lot of different ways that we could use the debug not only to

78
03:42.590 --> 03:43.320
troubleshoot

79
03:43.320 --> 03:47.920
what's happening, but also keep in mind, it's a great tool for learning.

80
03:47.920 --> 03:52.170
This is one of the ways that I learned spanning tree a long time ago is I

81
03:52.170 --> 03:53.240
enabled a bunch

82
03:53.240 --> 03:57.940
of debug and I also had a stopwatch available and I was timing events to make

83
03:57.940 --> 03:59.160
sure I understood

84
03:59.160 --> 04:01.240
exactly when things would happen.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:59.160 --> 04:01.240
exactly when things would happen.

85
04:01.240 --> 04:06.600
But these debug outputs are a great tool for learning exactly how particular

86
04:06.600 --> 04:07.680
technologies

87
04:07.680 --> 04:08.680
work.

88
04:08.680 --> 04:13.680
We can also see that when we think about our layer three side, if I do a debug

89
04:13.680 --> 04:14.240
IP question

90
04:14.240 --> 04:17.800
mark, I'm going to see a lot of different protocol show up in here.

91
04:17.800 --> 04:21.000
For example, debug IP, EIGRP.

92
04:21.000 --> 04:24.840
We also have BGP in here and OSPF.

93
04:24.840 --> 04:29.560
And there's all kinds of different events tied to these individual protocols.

94
04:29.560 --> 04:34.550
But again, running IP, EIGRP and then a question mark will tell me different
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:29.560 --> 04:34.550
But again, running IP, EIGRP and then a question mark will tell me different

95
04:34.550 --> 04:35.800
types of debug

96
04:35.800 --> 04:37.440
that might be useful.

97
04:37.440 --> 04:39.800
And then this is a big one as well.

98
04:39.800 --> 04:44.220
And this one is rather infamous debug IP packet.

99
04:44.220 --> 04:50.030
So debug IP packet is going to show me every single IP packet that crosses the

100
04:50.030 --> 04:51.040
layer three

101
04:51.040 --> 04:52.440
device.

102
04:52.440 --> 04:59.060
This command is really useful in lab environments, especially because I can see

103
04:59.060 --> 05:00.520
whether packets
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:59.060 --> 05:00.520
whether packets

104
05:00.520 --> 05:05.040
are being routed by a particular way or if they're getting dropped.

105
05:05.040 --> 05:09.650
And so it's great to see these packets and help me figure out, hey, is my

106
05:09.650 --> 05:11.160
routing environment

107
05:11.160 --> 05:12.760
set up correctly?

108
05:12.760 --> 05:15.970
Are the packets actually arriving and getting sent out the interface that I

109
05:15.970 --> 05:16.680
think they should

110
05:16.680 --> 05:18.500
be getting sent out?

111
05:18.500 --> 05:21.100
And so this is a very powerful command.

112
05:21.100 --> 05:24.880
However, there are a couple of things to be aware of.

113
05:24.880 --> 05:30.220
And to understand that, we need to take a look and see how this relates to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:24.880 --> 05:30.220
And to understand that, we need to take a look and see how this relates to the

114
05:30.220 --> 05:31.540
CPU utilization

115
05:31.540 --> 05:32.540
on our devices.

116
05:32.540 --> 05:38.060
We have to be really careful about running debug on the console, especially.

117
05:38.060 --> 05:42.710
And the reason for that is because on our Cisco platforms, output to the

118
05:42.710 --> 05:43.940
console is considered

119
05:43.940 --> 05:49.120
to be a very high priority event.

120
05:49.120 --> 05:52.840
And the reason for that is because Cisco recognizes that in a network emergency

121
05:52.840 --> 05:54.460
type of situation,

122
05:54.460 --> 05:58.300
I need to be able to connect to the console and see what's happening.

123
05:58.300 --> 06:01.820
Jansus are the networks already impaired in some of these situations.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:58.300 --> 06:01.820
Jansus are the networks already impaired in some of these situations.

124
06:01.820 --> 06:08.230
And so we're going to risk dropping packets and not processing packets because

125
06:08.230 --> 06:08.900
the CPU

126
06:08.900 --> 06:12.180
is so busy outputting to the console.

127
06:12.180 --> 06:16.580
And so that's a very important aspect of console connectivity and running the

128
06:16.580 --> 06:17.100
bugs out

129
06:17.100 --> 06:18.940
to the console.

130
06:18.940 --> 06:22.750
But this becomes even more important when we think about commands such as debug

131
06:22.750 --> 06:23.460
IP packet

132
06:23.460 --> 06:29.170
in production, because when we look at this and we're talking about thousands

133
06:29.170 --> 06:30.020
of packets
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:29.170 --> 06:30.020
of packets

134
06:30.020 --> 06:34.440
per second and possibly even more than that, well, this all of a sudden is

135
06:34.440 --> 06:35.380
going to result

136
06:35.380 --> 06:40.620
in our CPU being burned on outputting to the console.

137
06:40.620 --> 06:43.670
So we might want to consider a different logging method, either going to

138
06:43.670 --> 06:44.620
terminal or possibly

139
06:44.620 --> 06:46.740
just a syslog server.

140
06:46.740 --> 06:52.610
But the other option that we can use for this debug and potentially others is

141
06:52.610 --> 06:53.480
using access

142
06:53.480 --> 06:57.980
control lists for the sake of deploying limits.

143
06:57.980 --> 07:02.410
So at this point, what we could do is deploy an ACL that targets a specific
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:57.980 --> 07:02.410
So at this point, what we could do is deploy an ACL that targets a specific

144
07:02.410 --> 07:03.500
source IP address

145
07:03.500 --> 07:09.260
or possibly a destination IP address and then map it to the debug command.

146
07:09.260 --> 07:14.540
So for example, now I can say debug IP packet.

147
07:14.540 --> 07:18.460
And then I can specify the access control list after it.

148
07:18.460 --> 07:22.480
And now it's not outputting all of the packets that cross the layer three

149
07:22.480 --> 07:23.700
device, but rather

150
07:23.700 --> 07:28.300
looking for very specific packets and then reporting that back to me.

151
07:28.300 --> 07:33.090
So we do have that option with especially debug IP packet, but there are other
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
07:28.300 --> 07:33.090
So we do have that option with especially debug IP packet, but there are other

152
07:33.090 --> 07:33.380
debug

153
07:33.380 --> 07:36.580
commands that maybe just give me too much information.

154
07:36.580 --> 07:41.340
And at that point, I can look to apply an access control list to not only

155
07:41.340 --> 07:42.180
reduce CPU

156
07:42.180 --> 07:45.820
load, but also to make it easier on me to parse through the information.

157
07:45.820 --> 07:54.360
[BLANK_AUDIO]