Network management notes

1. Network management is the discipline in computing dealing with operating, managing and monitoring voice and
data networks.
Network management is often defined as consisting of five areas, using the acronym FCAPS:
 Fault Management
 Configuration Management
 Accounting (Administration)
 Performance Management
 Security Management.
Fault Management
Fault management is the component of network management concerned with detecting, isolating
and resolving problems. Properly implemented, fault management can keep a network running at an
optimum level, provide a measure of fault tolerance and minimize downtime. A set of functions
or applications designed specifically for this purpose is called a fault-management platform.
Important functions of fault management include:
Definition of thresholds for potential failure conditions.
Constant monitoring of system status and usage levels.
Continuous scanning for threats such as viruses and Trojans.
General diagnostics.
Remote control of system elements including workstations and servers from a single location.
Alarms that notify administrators and users of impending and actual malfunctions.
Tracing the locations of potential and actual malfunctions.
Automatic correction of potential problem-causing conditions.
Automatic resolution of actual malfunctions.
Detailed logging of system status and actions taken.
Configuration Management
Network configuration management (NCM) is the process of organizing and maintaining information
about all the components of a computer network. When a network needs repair, modification,
expansion or upgrading, the administrator refers to the network configuration management
database to determine the best course of action. This database contains the locations and network
addresses of all hardware devices, as well as information about the programs, versions and updates
installed in network computers.
Network configuration management tools can be vendor-neutral or vendor-specific. Vendor-neutral
tools, by far the more common, are designed for networks containing hardware and programs from
multiple suppliers. Vendor-specific tools usually work only with the products of a single company,
and can offer enhanced performance in networks where that vendor dominates.

2. Advantages of network configuration management include:
Streamlining the processes of maintenance, repair, expansion and upgrading.
Minimizing configuration errors.
Minimizing downtime.
Optimizing network security.
Ensuring that changes made to a device or system do not adversely affect other devices or
systems.
Rolling back changes to a previous configuration if results are unsatisfactory.
Archiving the details of all network configuration changes.
Accounting Management
Accounting management is the process used to measure network utilization parameters so that individual or group users on the
network can be regulated appropriately for the purposes of accounting or chargeback. Similar to performance management, the
first step toward appropriate accounting management is to measure the utilization of all important network resources. Network
resource utilization can be measured using the Cisco NetFlow and Cisco IP Accounting features. Analysis of the data gathered
through these methods provides insight into current usage patterns.
A usage-based accounting and billing system is an essential part of any service level agreement (SLA). It provides both a
practical way of defining obligations under an SLA and clear consequences for behavior outside the terms of the SLA.
Performance Management Systems
Successful organizations know that to win in today’s competitive marketplace they must attract, develop, and
retain talented and productive employees. Winning organizations get their competitive edge from a
performance management system that helps them hire talented people, place them in the right position, align
their individual performance with the organization’s vision and strategic objectives, develop their abilities,
and reward performance commensurate with contributions to the organization’s success.
Benefits of Effective Performance Management
Improved Productivity -- Improvement in both the way people work and the outcomes they produce.
Improved Employee Morale -- Resulting from on-time performance appraisals and rewards
commensurate with employee contributions.
Retention of Top Performers – Employees who feel accomplished in their work become
loyal employees.
Increased Profitability – Loyal employees deliver higher levels of service that result in
customer loyalty.
TCP/IP Protocol Architecture Model
The OSI model describes idealized network communications with a family of protocols. TCP/IP does not directly correspond to
this model. TCP/IP either combines several OSI layers into a single layer, or does not use certain layers at all. The following
table shows the layers of the Oracle Solaris implementation of TCP/IP. The table lists the layers from the topmost layer
(application) to the bottommost layer (physical network).
Table 1–2 TCP/IP Protocol Stack
OSI Ref. OSI Layer TCP/IP TCP/IP Protocol Examples
Layer No. Equivalent Layer
5,6,7 Application, session, Application NFS, NIS, DNS, LDAP, telnet, ftp, rlogin, rsh, rcp,
presentation RIP, RDISC, SNMP, and others

3. OSI Ref. OSI Layer TCP/IP TCP/IP Protocol Examples
Layer No. Equivalent Layer
4 Transport Transport TCP, UDP, SCTP
3 Network Internet IPv4, IPv6, ARP, ICMP
2 Data link Data link PPP, IEEE 802.2
1 Physical Physical Ethernet (IEEE 802.3), Token Ring, RS-232, FDDI, and others
network
The table shows the TCP/IP protocol layers and the OSI model equivalents. Also shown are examples of the protocols that are
available at each level of the TCP/IP protocol stack. Each system that is involved in a communication transaction runs a unique
implementation of the protocol stack.
Physical Network Layer
The physical network layer specifies the characteristics of the hardware to be used for the network. For example, physical
network layer specifies the physical characteristics of the communications media. The physical layer of TCP/IP describes
hardware standards such as IEEE 802.3, the specification for Ethernet network media, and RS-232, the specification for
standard pin connectors.
Data-Link Layer
The data-link layer identifies the network protocol type of the packet, in this instance TCP/IP. The data-link layer also provides
error control and “framing.” Examples of data-link layer protocols are Ethernet IEEE 802.2 framing and Point-to-Point Protocol
(PPP) framing.
Internet Layer
The Internet layer, also known as the network layer or IP layer, accepts and delivers packets for the network. This layer
includes the powerful Internet Protocol (IP), the Address Resolution Protocol (ARP), and the Internet Control Message Protocol
(ICMP).
IP Protocol
The IP protocol and its associated routing protocols are possibly the most significant of the entire TCP/IP suite. IP is
responsible for the following:
IP addressing – The IP addressing conventions are part of the IP protocol. Designing an IPv4 Addressing
Scheme introduces IPv4 addressing and IPv6 Addressing Overview introduces IPv6 addressing.
Host-to-host communications – IP determines the path a packet must take, based on the receiving system's IP
address.
Packet formatting – IP assembles packets into units that are known as datagrams. Datagrams are fully described
in Internet Layer: Where Packets Are Prepared for Delivery.
Fragmentation – If a packet is too large for transmission over the network media, IP on the sending system breaks the
packet into smaller fragments. IP on the receiving system then reconstructs the fragments into the original packet.
Oracle Solaris supports both IPv4 and IPv6 addressing formats, which are described in this book. To avoid confusion when
addressing the Internet Protocol, one of the following conventions is used:
When the term “IP” is used in a description, the description applies to both IPv4 and IPv6.
When the term “IPv4” is used in a description, the description applies only to IPv4.
When the term “IPv6” is used in a description, the description applies only to IPv6.
ARP Protocol
The Address Resolution Protocol (ARP) conceptually exists between the data-link and Internet layers. ARP assists IP in
directing datagrams to the appropriate receiving system by mapping Ethernet addresses (48 bits long) to known IP addresses
(32 bits long).

4. ICMP Protocol
The Internet Control Message Protocol (ICMP) detects and reports network error conditions. ICMP reports on the following:
Dropped packets – Packets that arrive too fast to be processed
Connectivity failure – A destination system cannot be reached
Redirection – Redirecting a sending system to use another router
Internet Control Message Protocol
From Wikipedia, the free encyclopedia
The Internet Control Message Protocol (ICMP) is one of the core protocols of the Internet Protocol Suite. It is chiefly used by
the operating systems of networked computers to send error messages indicating, for example, that a requested service is not
available or that a host or router could not be reached. ICMP can also be used to relay query messages.[1] It is assigned
protocol number 1.[2]
ICMP[3] differs from transport protocols such as TCP and UDP in that it is not typically used to exchange data between systems,
nor is it regularly employed by end-user network applications (with the exception of some diagnostic tools
like ping and traceroute).
ICMP for Internet Protocol version 4 (IPv4) is also known as ICMPv4. IPv6 has a similar protocol, ICMPv6.
Transport Layer
The TCP/IP transport layer ensures that packets arrive in sequence and without error, by swapping acknowledgments of data
reception, and retransmitting lost packets. This type of communication is known as end-to-end. Transport layer protocols at
this level are Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Stream Control Transmission Protocol
(SCTP). TCP and SCTP provide reliable, end-to-end service. UDP provides unreliable datagram service.
TCP Protocol
TCP enables applications to communicate with each other as though they were connected by a physical circuit. TCP sends
data in a form that appears to be transmitted in a character-by-character fashion, rather than as discrete packets. This
transmission consists of the following:
Starting point, which opens the connection
Entire transmission in byte order
Ending point, which closes the connection.
TCP attaches a header onto the transmitted data. This header contains many parameters that help processes on the sending
system connect to peer processes on the receiving system.
TCP confirms that a packet has reached its destination by establishing an end-to-end connection between sending and
receiving hosts. TCP is therefore considered a “reliable, connection-oriented” protocol.
SCTP Protocol
SCTP is a reliable, connection-oriented transport layer protocol that provides the same services to applications that are
available from TCP. Moreover, SCTP can support connections between systems that have more than one address,
or multihomed. The SCTP connection between sending and receiving system is called an association. Data in the
association is organized in chunks. Because SCTP supports multihoming, certain applications, particularly applications used by
the telecommunications industry, need to run over SCTP, rather than TCP.
UDP Protocol
UDP provides datagram delivery service. UDP does not verify connections between receiving and sending hosts. Because
UDP eliminates the processes of establishing and verifying connections, applications that send small amounts of data use
UDP.

5. Application Layer
The application layer defines standard Internet services and network applications that anyone can use. These services work
with the transport layer to send and receive data. Many application layer protocols exist. The following list shows examples of
application layer protocols:
Standard TCP/IP services such as the ftp, tftp, and telnet commands
UNIX “r” commands, such as rlogin and rsh
Name services, such as NIS and the domain name system (DNS)
Directory services (LDAP)
File services, such as the NFS service
Simple Network Management Protocol (SNMP), which enables network management
Router Discovery Server protocol (RDISC) and Routing Information Protocol (RIP) routing protocols
Standard TCP/IP Services
FTP and Anonymous FTP – The File Transfer Protocol (FTP) transfers files to and from a remote network. The protocol
includes the ftpcommand and the in.ftpd daemon. FTP enables a user to specify the name of the remote host and
file transfer command options on the local host's command line. The in.ftpd daemon on the remote host then handles
the requests from the local host. Unlike rcp,ftp works even when the remote computer does not run a UNIX based
operating system. A user must log in to the remote system to make an ftp connection, unless the remote system has
been configured to allow anonymous FTP.
You can obtain an enormous amount of material from anonymous FTP servers that are connected to the Internet.
Universities and other institutions set up these servers to offer software, research papers, and other information to the
public domain. When you log in to this type of server, you use the login name anonymous, hence the term “anonymous
FTP server.”
Using anonymous FTP and setting up anonymous FTP servers is outside the scope of this manual. However, many
books, such as The Whole Internet User's Guide & Catalog, discuss anonymous FTP in detail. Instructions for using
FTP are in System Administration Guide: Network Services. The ftp(1) man page describes all ftp command options
that are invoked through the command interpreter. Theftpd(1M) man page describes the services that are provided by
the in.ftpd daemon.
Telnet – The Telnet protocol enables terminals and terminal-oriented processes to communicate on a network that runs
TCP/IP. This protocol is implemented as the telnet program on local systems and the in.telnetd daemon on
remote machines. Telnet provides a user interface through which two hosts can communicate on a character-by-character
or line-by-line basis. Telnet includes a set of commands that are fully documented in the telnet(1) man page.
TFTP – The Trivial File Transfer Protocol (tftp) provides functions that are similar to ftp, but the protocol does not
establish ftp's interactive connection. As a result, users cannot list the contents of a directory or change directories. A
user must know the full name of the file to be copied. The tftp(1)man page describes the tftp command set.
UNIX “r” Commands
The UNIX “r” commands enable users to issue commands on their local machines that run on the remote host. These
commands include the following:
rcp
rlogin
rsh
Instructions for using these commands are in the rcp(1), rlogin(1), and rsh(1) man pages.
Name Services
Oracle Solaris provides the following name services:
DNS – The domain name system (DNS) is the name service provided by the Internet for TCP/IP networks. DNS provides
host names to the IP address service. DNS also serves as a database for mail administration. For a complete description
of this service, see System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP). See also
the resolver(3RESOLV) man page.

6. /etc files – The original host-based UNIX name system was developed for standalone UNIX machines and then
adapted for network use. Many old UNIX operating systems and computers still use this system, but it is not well suited for
large complex networks.
NIS – Network Information Service (NIS) was developed independently of DNS and has a slightly different focus.
Whereas DNS focuses on making communication simpler by using machine names instead of numerical IP addresses,
NIS focuses on making network administration more manageable by providing centralized control over a variety of
network information. NIS stores information about machine names and addresses, users, the network itself, and network
services. NIS name space information is stored in NIS maps. For more information on NIS Architecture and NIS
Administration, see System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).
Directory Service
Oracle Solaris supports LDAP (Lightweight Directory Access Protocol) in conjunction with the Sun Open Net Environment (Sun
ONE) Directory Server, as well as other LDAP directory servers. The distinction between a name service and a directory
service is in the differing extent of functionality. A directory service provides the same functionality of a naming service, but
provides additional functionalities as well. See System Administration Guide: Naming and Directory Services (DNS, NIS, and
LDAP).
File Services
The NFS application layer protocol provides file services for Oracle Solaris. You can find complete information about the NFS
service in System Administration Guide: Network Services.
Network Administration
The Simple Network Management Protocol (SNMP) enables you to view the layout of your network and the status of key
machines. SNMP also enables you to obtain complex network statistics from software that is based on a graphical user
interface (GUI). Many companies offer network management packages that implement SNMP.
Routing Protocols
The Routing Information Protocol (RIP) and the Router Discovery Server Protocol (RDISC) are two available routing protocols
for TCP/IP networks. For complete lists of available routing protocols for Oracle Solaris 10, refer to Table 5–1 and Table 5–2.
What is SNMP?
• SNMP (Simple Network Management Protocol) is a standard
produced by working groups within the IETF (Internet Engineering
Task Force). It is published as a set of RFCs.
• SNMP is more than a protocol. It is a management framework,
including an architecture, an information model, management
operations, etc.
• SNMP is the most widely used management framework today, but
many other frameworks exist. Virtually all networked devices support
SNMP.
• This presentation refers to SNMP version 1, unless stated otherwise.
We will discuss the key extensions in versions 2 and 3.
Management information base
A management information base (MIB) is a virtual database used for managing the entities in a
communications network. Most often associated with the Simple Network Management Protocol (SNMP), the
term is also used more generically in contexts such as in OSI/ISO Network management model. While intended

7. to refer to the complete collection of management information available on an entity, it is often used to refer to a
particular subset, more correctly referred to as MIB-module.
Objects in the MIB are defined using a subset of Abstract Syntax Notation One (ASN.1) called "Structure of
Management Information Version 2 (SMIv2)" RFC 2578.The software that performs the parsing is a MIB
compiler.
The database is hierarchical (tree-structured) and entries are addressed through object
identifiers. Internet documentation RFCs discuss MIBs, notably RFC 1155, "Structure and Identification of
Management Information for TCP/IP based internets", and its two companions, RFC 1213, "Management
Information Base for Network Management of TCP/IP-based internets", and RFC 1157, "A Simple Network
Management Protocol".
A management information base (MIB) is a formal description of a set of network objects
that can be managed using the Simple Network Management Protocol (SNMP). The format
of the MIB is defined as part of the SNMP. (All other MIBs are extensions of this basic
management information base.) MIB-I refers to the initial MIB definition; MIB-II refers to
the current definition. SNMPv2 includes MIB-II and adds some new objects.
Address Resolution Protocol
Short for Address Resolution Protocol, a network layer protocol used to convert an IP address into a physical
address (called a DLC address), such as an Ethernet address. A host wishing to obtain a physical
addressbroadcasts an ARP request onto the TCP/IP network. The host on the network that has the IP address in
the request then replies with its physical hardware address.
There is also Reverse ARP (RARP) which can be used by a host to discover its IP address. In this case, the host
broadcasts its physical address and a RARP server replies with the host's IP address.
Address Resolution Protocol (ARP) is a telecommunications protocol used for resolution of network
layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was
[1]
defined byRFC 826 in 1982. It is Internet Standard STD 37. It is also the name of the program for
manipulating these addresses in most operating systems.
subnet mask
A mask used to determine what subnet an IP address belongs to. An IP address has two components, the
network address and the host address. For example, consider the IP address 150.215.017.009. Assuming this is
part of a Class B network, the first two numbers (150.215) represent the Class B network address, and the
second two numbers (017.009) identify a particular host on this network.
Subnetting enables the network administrator to further divide the host part of the address into two or more
subnets. In this case, a part of the host address is reserved to identify the particular subnet. This is easier to see
if we show the IP address in binary format. The full address is:
10010110.11010111.00010001.00001001
The Class B network part is:
10010110.11010111
and the host address is
00010001.00001001
If this network is divided into 14 subnets, however, then the first 4 bits of the host address (0001) are reserved for
identifying the subnet.
A subnet allows the flow of network traffic between hosts to be segregated based on a network configuration. By organizing
hosts into logical groups, subnetting can improve network security and performance.

8. Subnet Mask
Perhaps the most recognizable aspect of subnetting is the subnet mask. Like IP addresses, a subnet mask contains four bytes
(32 bits) and is often written using the same "dotted-decimal" notation. For example, a very common subnet mask in its
binary representation
11111111 11111111 11111111 00000000
is typically shown in the equivalent, more readable form
255.255.255.0
DMI (Desktop Management Interface)
Desktop Management Interface (DMI) is an industry framework for managing and keeping track of
hardware and software components in a system of personal computers from a central location. DMI
was created by the Desktop Management Task Force (DMTF) to automate system management and
is particularly beneficial in a network computing environment where dozens or more computers are
managed. DMI is hardware and operating system-independent, independent of specific
management protocol, easy for vendors to adopt, mappable to existing management protocols such
as the Simple Network Management Protocol (SNMP), and used on network and non-network
computers. DMI consists of four components:
Management Information Format (MIF): An MIF is a text file that contains specific information
about the hardware and software being used on a computer. An MIF file consists of one or more
groups containing attributes, which describe each component. By default, each MIF file contains
the standard component ID group.
This group contains the product name, version, serial number, and the time and date of the last
installation. The ID number is assigned based on when the component was installed in relation
to other components. Manufacturers can create their own MIFs specific to a component. For
example, a manufacturer might write an MIF file for a fax/modem that contains two groups: a
fax group and a modem group. Some group attributes include warranty information, support
phone numbers, and any errors encountered. This information is then sent to an MIF database.
Service layer: The service layer is memory-resident code that acts as a mediator for the
management interface and the component interface and allows management and component
software to access MIF files in the MIF database. The service layer is available as an operating
system add-on and is a shared resource for all programs. Because the service layer must run all
the time, it is designed not to use a lot of memory. The service layer also includes a common
interface called the local agent, which is used to manage individual components.
Component interface (CI): The CI is an application program interface (API) that sends status
information to the appropriate MIF file via the service layer. Commands include the Get and Set

9. command that modifies the MIF as needed and the Event command that notifies management
software of critical events.
Management interface (MI): The management software communicates with the service layer
using the MI application program interface. The MI allows administrators to issue the Get and
Set command and the List command that lists all the DMI-manageable devices.
Internet Group Management Protocol
The Internet Group Management Protocol (IGMP) is a communications protocol used by hosts and
adjacent routers on IP networks to establish multicast group memberships.
IGMP is an integral part of the IP multicast specification. It is analogous
to ICMP for unicast connections. IGMP can be used for online streaming video and gaming, and
allows more efficient use of resources when supporting these types of applications.
IGMP is used on IPv4 networks. Multicast management on IPv6 networks is handled by Multicast
Listener Discovery (MLD) which uses ICMPv6 messaging contrary to IGMP's bare IP encapsulation.
A network designed to deliver a multicast service using IGMP might use this basic architecture:
IGMP is used between the client computer and a local multicast router. Switches featuring IGMP
snooping derive useful information by observing these IGMP transactions. Protocol Independent
Multicast (PIM) is then used between the local and remote multicast routers, to direct multicast traffic
from the multicast server to many multicast clients.
]
IGMP operates above the network layer, though it does not actually act as a transport protocol.
Routing Information Protocol
The Routing Information Protocol (RIP) is a distance-vector routing protocol, which employs
the hop count as a routing metric. RIP prevents routing loops by implementing a limit on the number
of hops allowed in a path from the source to a destination. The maximum number of hops allowed for
RIP is 15. This hop limit, however, also limits the size of networks that RIP can support. A hop count
of 16 is considered an infinite distance and used to deprecate inaccessible, inoperable, or otherwise
undesirable routes in the selection process.

10. RIP implements the split horizon, route poisoning and holddown mechanisms to prevent incorrect
routing information from being propagated. These are some of the stability features of RIP. It is also
[1]
possible to use the so called RMTI (Routing Information Protocol with Metric-
based Topology Investigation) algorithm to cope with the count-to-infinity problem. With its help, it is
possible to detect every possible loop with a very small computation effort.
Limitations
 Without using RMTI, Hop count can not exceed 15, in the case that it exceeds this
limitation, it will be considered invalid.
 Most RIP networks are flat. There is no concept of areas or boundaries in RIP networks.
 Variable Length Subnet Masks were not supported by RIP version 1.
 Without using RMTI, RIP has slow convergence and count to infinity problems
Virtual private network
A virtual private network (VPN) is a network that uses primarily public telecommunication
infrastructure, such as the Internet, to provide remote offices or traveling users access to a central
organizational network.
VPNs typically require remote users of the network to be authenticated, and often secure data with
encryption technologies to prevent disclosure of private information to unauthorized parties.
VPNs may serve any network functionality that is found on any network, such as sharing of data and
access to network resources, printers, databases, websites, etc. A VPN user typically experiences the
central network in a manner that is identical to being connected directly to the central network. VPN
technology via the public Internet has replaced the need to requisition and maintain expensive
dedicated leased-line telecommunication circuits once typical in wide-area network installations.
(Desktop Management Interface) The first desktop management standard from the DMTF. Enabling PCs to be
monitored from a central console, it was superseded by the DMTF's Common Information Model (see CIM).
The Management Information File (MIF)
When a query is made to a DMI-enabled device, the memory-resident DMI agent sends back data such as model
ID, serial number, memory and port addresses in a management information file (MIF). It can also extract data
from memory to provide a current status.

11. Support for SNMP
DMI can co-exist with SNMP. A single machine can serve as a proxy agent to service an entire LAN segment of
DMI machines. When SNMP queries arrive, it can transfer the data from the MIF into the SNMP's MIB
(management information base). See CIM, SNMP, WBEM and DMTF.
What is the Cisco Discovery Protocol (CDP)?
CDP is a Cisco proprietary protocol that runs on all Cisco IOS-enabled devices. It is used to gather
information about directly connected neighboring devices. CDP operates at Layer 2 of the OSI model
and is media-independent. With CDP, you can tell the hardware type, device identifier, address list,
software version, and active interfaces on neighboring Cisco devices. CDP is enabled by default on
all Cisco equipment. It uses a nonroutable SNAP frame to communicate between devices.
Note: Because CDP is media-independent it can operate over most media types. The only media
types CDP cannot operate over are X.25, because it doesn't support SNAP encapsulation, and Frame
Relay point-to-multipoint interfaces.
What are three reasons to disable CDP?
Three reasons to disable CDP are as follows:
. To save network bandwidth by not exchanging CDP frames.

12. . If you are connecting to non-Cisco devices.
. Security. CDP broadcasts information about the device every 60 seconds. Sniffers and other devices
can view these broadcasts to discover information about your network.
How do you disable CDP on Cisco routers?
Two commands disable CDP on a Cisco router. To disable CDP on the entire device, use the no cdp
run global command:
RouterB(config)#no cdp run
To disable CDP on an interface only, use the no cdp enable interface command:
RouterB(config)#int e0
RouterB(config-if)#no cdp enable
This disables CDP on Ethernet interface 0.
What does the show CDP command display?
The show CDP command displays global CDP information about the device. It tells you when the
device will send CDP packets and the CDP holdtime:
RouterB#show cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
Note: For the CCNA test, remember that the default time a device will send out CDP information is 60
seconds and the default holdtime is 180 seconds.
On a Cisco router, what does the show cdp neighbors command display?

13. The show cdp neighbors command displays the following:
· Device ID (name of the device)
· The local interface (local outgoing port)
· The holdtime displayed in seconds
· The device's capability code (this tells you if the device is a router, switch, or repeater)
· Hardware platform of the neighboring device (what type of Cisco device it is and the model)
· Port ID of the neighboring device (remote port)
RouterB#show cdp neighbors
Capability Codes:
R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
RouterA Ser 0 146 R 2505 Ser 0
What does the show cdp neighbors detail command display?
The show cdp neighbors detail and show cdp entry * commands show the same output. They both
display the following:
· Device ID (host name) of the remote neighbor
· Layer 3 address of the remote device (if the device has more than one Layer 3 address on its
interface, only the primary address is shown)

14. · Device platform and capabilities· Local interface and outgoing port ID
· Remote device holdtime in seconds
· IOS type and version
RouterB#show cdp neighbors detail
-------------------------
Device ID: RouterA
Entry address(es):
IP address: 192.168.2.1
Platform: cisco 2505, Capabilities: Router
Interface: Serial1, Port ID (outgoing port): Serial1
Holdtime : 164 sec Version :Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-D-L), Version 12.0(13), RELEASE SOFTWARE
(fc1)Copyright (c) 1986-2000 by cisco Systems, Inc.Compiled Wed 06-Sep-00 01:08 by Linda
What does the show cdp traffic command display?
The show cdp traffic command displays information about interface traffic. This includes the number
of CDP packets sent and received and CDP errors:
RouterB#show cdp traffic
CDP counters :
Packets output: 105, Input: 103

15. Hdr syntax: 0, Chksum error: 0, Encaps failed:
No memory: 0, Invalid packet: 0, Fragmented: 0
What does the show cdp interface command display?
The show cdp interface command displays the status of CDP on all interfaces on your device:
RouterB#show cdp interface
Ethernet0 is up, line protocol is down
Encapsulation ARPA
Sending CDP packets every 60 seconds Holdtime is 180 seconds
Serial0 is up, line protocol is up
Encapsulation HDLC
Sending CDP packets every 60 seconds Holdtime is 180 seconds
Serial1 is up, line protocol is up
Encapsulation HDLC
Sending CDP packets every 60 seconds Holdtime is 180 seconds
What Cisco IOS router command can you use to see a neighbor router's IP address?
To see a neighbor router's IP address, you must use the show cdp neighbor detail or show cdp entry *
user mode or EXEC command. (This one will probably be on the exam)
What IOS command do you use to view the active outbound telnet sessions for the current user on a
Cisco router?

16. The show sessions command displays the active outbound telnet sessions from that particular user
on your router.
RouterA#show sessions
Conn Host Address Byte Idle Conn Name
* 1 192.168.1.2 192.168.1.2 0 0 192.168.1.2
What key sequence do you use to suspend a Telnet session on a remote system and return to your
local router?
To suspend a Telnet session, press Ctrl-Shift-6, and then press X.
How do you end a remote Telnet session on a Cisco router?
To end a Telnet session, use the exit or logout command while you're on the remote device:
RouterB>exit
[Connection to 192.168.1.2 closed by foreign host]
RouterA#
Upon using the ping EXEC command, you receive one of the following responses:
·.
·!
·?
·C
·U

17. ·I
What does each of these responses mean?
. = Each period indicates that the network server timed out while waiting for a reply.
! =Each exclamation point indicates the receipt of a reply.
? =Unknown packet type.
C =A congestion experienced packet was received.
U =A destination unreachable error PDU was received.
I = The user interrupted the test.
What is the trace EXEC command used for?
RouterA#trace 192.168.2.2
Type escape sequence to abort.
Tracing the route to 192.168.2.2
1 192.168.2.2 16 msec 16 msec *
Note: If trace responds with a * it means the probe timed out. If it responds with a ? it means it
received an unknown packet type.
What are the two ways in which a Cisco router resolves host names to IP addresses?
A Cisco router resolves host names using either a host table on each router or a DNS server.
What is the main purpose of RAM on a Cisco router?
On most Cisco routers, the IOS is loaded into RAM, as well as the running configuration. It is also
used to hold routing tables and packet buffers.

18. What is the function of ROM on a Cisco router?
On a Cisco router, ROM is used to start and maintain the router.
What is Flash memory used for on a Cisco router?
Flash memory is used to store the Cisco IOS software image and, if there is room, multiple
configuration files or multiple IOS files. On some routers (the 2500 series), it is also used to run the
IOS.
What is the function of NVRAM on a Cisco router?
Nonvolatile Random-Access Memory (NVRAM) is used to hold the saved router configuration. This
configuration is not lost when the router is turned off or reloaded.
What is the main purpose of the configuration register on a Cisco router?
The configuration register's main purpose is to control how the router boots up. It is a 16-bit software
register that by default is set to load the Cisco IOS from Flash memory and to look for and load the
startup-config file from NVRAM.
What Cisco IOS command would you use to view the current configuration register value?
The show version command is used to display the router's current configuration register:
RouterA#show version
Cisco Internetwork Operating System SoftwareIOS (tm) 2500 Software (C2500-D-L),
Version 12.0(13), RELEASE SOFTWARE (fc1)Copyright (c) 1986-2000 by cisco Systems,
Inc.Compiled Wed 06-Sep-00 01:08 by lindaImage text-base: 0x030388F8, data-base: 0x00001000
Configuration register is 0x2102
How do you change the configuration register on a Cisco router?
To change the configuration register on a Cisco router, use the config-register global command.

19. What Cisco IOS command displays the contents of Flash memory?
The show flash command displays the contents of Flash memory. This includes the images stored in
Flash memory, the images' names, bytes used in Flash memory, bytes available, and the total
amount of Flash memory on your router:
RouterA#show flash
System flash directory:File Length Name/status
1 6897716 c2500-d-l.120-13.bin[6897780 bytes used, 1490828 available, 8388608 total]8192K bytes
of processor board System flash (Read ONLY)
What IOS command would you use to copy the running configuration on a router to a TFTP server?
To copy the running configuration to a TFTP server, use the copy running-config tftp privileged EXEC
command:
RouterB#copy run tftp
Address or name of remote host []? 192.168.0.2
Destination filename [routerb-confg]?
!!
780 bytes copied in 6.900 secs (130 bytes/sec)
This gives you a backup of your running config on a TFTP server.
How do you erase the router's configuration and bring it back to the factory default?
The erase startup-config privileged EXEC command erases your router's configuration, thus bringing
it back to its factory defaults:
RouterB#erase startup-config

20. Erasing the nvram filesystem will remove all files! Continue? [confirm]
[OK]Erase of nvram: complete
Note: In order to complete the process, you need to reload the router. An older IOS command that
you can use to accomplish the same results is write erase.
How do you restore a configuration file from a TFTP server into your Cisco router's RAM?
The copy tftp running-config privileged EXEC command merges the saved and running configuration
into your router's RAM, so any commands not explicitly change or removed will remain in the running
configuration.
RouterB#copy tftp running-config
Address or name of remote host []? 192.168.0.2
Source filename []? routerb-confg
Destination filename [running-config]?
Accessing tftp://192.168.0.2/routerb-confg...
Loading routerb-confg from 192.168.0.2 (via Ethernet0):
!
[OK - 780/1024 bytes] 780 bytes copied in 4.12 secs (195 bytes/sec)
RouterB# 01:40:46: %SYS-5-CONFIG: Configured from tftp://192.168.0.2/routerb-confg
How do you back up a Cisco router IOS?
To back up the current IOS image on your router, use the copy flash tftp privileged EXEC mode
command:
RouterB#copy flash tftp

21. Source filename [routerb-flash]? flash:c2500-d-l.120-13.bin
Address or name of remote host []? 192.168.0.2
Destination filename [c2500-d-l.120-13.bin]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!6897716 bytes copied in 90.856 secs
(76641 bytes/sec)
How do you upgrade or restore the Cisco router IOS?
To upgrade or restore the Cisco router IOS, use the copy tftp flash privileged EXEC mode command.
How you make a Cisco router a TFTP server?
To configure a Cisco router as a TFTP server, use the tftp-server global configuration command.
What is the boot sequence of a Cisco router?
The boot sequence of a router is as follows:
hardware /power on
load run bootstrapfind the IOS software
load the softwarefind the config (default NVRAM)
load the configuration (startup-config) into RAM
Run the IOS
What can you configure on a router in setup mode?
ip addresses

22. routed protocols
enable password
Important Config Register Notes:
2100 manual boot rommon>
2101 boot from ROM
2102 normal/password recovery
2105 boot system command - config-register NVRAM
2142 bypass NVRAM
ctrl-break = ROM monitor mode
router(config)#boot system flash ios filename
router(config)#boot system tftp filename ip address
router(config)#boot system ROM
Note the router prompt for boot commands. Copy commands = router#