Most network problems that look mysterious turn out to be physical: a bad cable, a connector that is not seated, a fiber run that is too long, the wrong transceiver, or two ends of a link that disagree about speed or duplex. Cisco expects you to read interface status lines and error counters and work out which of these is happening. Fixing the physical layer first saves hours of chasing routing or VLAN (virtual LAN) problems that are not really there, because nothing above Layer 1 can work reliably on a link that is corrupting frames.
Start with show interfaces on a switch or router. The first line gives two states: the interface (Layer 1) and the line protocol (Layer 2). 'up/up' is healthy. 'administratively down/down' means someone typed shutdown, and no shutdown fixes it. 'down/down' usually means no cable, a dead far end, a bad cable or a speed mismatch. 'up/down' points to a Layer 2 problem such as a keepalive or encapsulation mismatch on a serial link. On a switch, show interfaces status gives a one-line summary of every port with its VLAN, duplex, speed and a status such as 'connected', 'notconnect' or 'err-disabled'. Lines beginning a-full or a-100 show values that were autonegotiated rather than hard-coded.
Next read the counters. Input errors is a total of several receive problems. CRC (cyclic redundancy check) errors mean frames arrived whose frame check sequence did not match the contents, which usually means electrical noise, a damaged cable, a dirty fiber connector or being the full-duplex side of a duplex mismatch. Runts are frames smaller than 64 bytes and giants are larger than the maximum frame size; both suggest collisions, a faulty NIC (network interface card) or an MTU mismatch. Collisions are normal only on half-duplex links. Late collisions, detected after the first 64 bytes have been sent, are the classic sign of a duplex mismatch or a cable that exceeds the length limit. On the output side, output drops usually mean congestion rather than a cabling fault.
A duplex mismatch happens when one side runs full duplex and the other half. The half-duplex side sees the full-duplex side transmitting while it is sending, so it records collisions and late collisions; the full-duplex side records CRC errors and runts because the half-duplex side aborts frames midway. The link stays up but is slow and lossy. The usual cause is one side hard-coded with speed 100 and duplex full while the other autonegotiates. The autonegotiating side can still sense the speed, but without negotiation it falls back to half duplex at 10 or 100 Mbps. A speed mismatch is different: the link usually just stays down. The fix is to set both ends to speed auto and duplex auto, or hard-code both identically.
Know the cable types and limits. Unshielded twisted pair (UTP) copper such as Category 5e and Category 6 supports Ethernet up to 100 metres per segment. Straight-through cables connect unlike devices (PC to switch) and crossover cables historically connected like devices (switch to switch), but Auto-MDIX (automatic medium-dependent interface crossover) on modern ports detects and adjusts for either. Fiber comes as multimode, with a wider core and cheaper light sources for shorter runs inside buildings and campuses, and single-mode, with a narrow core and laser light for many kilometres. Both ends must use transceivers that match the fiber type and wavelength. Fiber is immune to electromagnetic interference (EMI), so it suits runs near motors, fluorescent ballasts or between buildings where differences in ground potential can damage copper.
Consider a worked example. Users on the third floor say file transfers crawl. On the access switch uplink, show interfaces shows Full-duplex, 100Mb/s and a growing number of CRC errors and runts. On the distribution switch end you find Half-duplex, 100Mb/s with thousands of late collisions. The pattern tells you it is a duplex mismatch and which side is which. show running-config interface on the access switch shows hard-coded speed 100 and duplex full from an old change. You set both ends to auto, run clear counters, wait, and confirm the counters stay at zero and both ends show a-full and a-1000.
Common mistakes: blaming a speed mismatch for errors on a link that is up (speed mismatches usually keep the link down); assuming collisions are always bad when they are normal on a genuinely half-duplex segment; reading counters without clearing them, so an old burst of errors looks like a current problem; forgetting that a mismatched multimode and single-mode pairing or a dirty connector produces CRC errors just like damaged copper; and swapping configuration before checking the cable. Work bottom up: reseat or swap the cable, try another port, check the transceiver and fiber type, verify the run length, then compare speed and duplex on both ends.
Exam questions usually show counters or status output and ask for the cause. 'Late collisions' plus 'half-duplex' points to a duplex mismatch or an over-length cable. 'CRC errors with no collisions' on a full-duplex link points to cabling, EMI or the full-duplex side of a mismatch. 'Down/down' after a new cable points to cabling or a speed mismatch; 'administratively down' points to shutdown. 'Long distance between buildings' or 'kilometres' points to single-mode fiber, and 'near heavy machinery' points to fiber in general.
Key terms
- CRC error
- A received frame whose frame check sequence does not match its contents, usually caused by noise, a damaged cable or connector, or a duplex mismatch.
- Late collision
- A collision detected after the first 64 bytes of a frame, typically caused by a duplex mismatch or an over-length cable.
- Duplex mismatch
- One end of a link runs full duplex and the other half duplex, causing collisions on one side and CRC errors and runts on the other.
- Runt and giant
- A runt is a frame smaller than 64 bytes; a giant is larger than the maximum allowed frame size.
- Auto-MDIX
- A port feature that detects whether a straight-through or crossover cable is attached and adjusts transmit and receive pairs automatically.
- Multimode vs single-mode fiber
- Multimode has a wider core for shorter runs; single-mode has a narrow core and laser light for long distances.
- Autonegotiation
- The process by which two Ethernet ports agree on the best common speed and duplex.
A warehouse link between two buildings keeps logging CRC errors and dropping during storms. The run is 140 metres of Category 6 copper along a steel wall near large motors. It exceeds the 100-metre limit and is exposed to EMI. The team replaces it with multimode fiber and matching SFP transceivers at both ends, clears the counters, and the errors stop.
Check yourself
An interface shows 'up/up' with a rising number of CRC errors and no collisions. What are the most likely causes?
A damaged or noisy cable or connector, electromagnetic interference, or being the full-duplex side of a duplex mismatch. Check the cabling and compare duplex on both ends.
What is the maximum segment length for twisted-pair Ethernet, and what should you use for longer or electrically noisy runs?
100 metres. For longer runs or noisy environments use fiber: multimode for shorter in-building runs, single-mode for long distances.
Why does hard-coding one side of a link to full duplex often cause a mismatch?
Hard-coding disables autonegotiation on that side, so the other side cannot negotiate duplex and falls back to half duplex at 10 or 100 Mbps.
A port shows 'administratively down'. What does that mean and how do you fix it?
The interface was disabled with the shutdown command; enter interface configuration mode and issue no shutdown.