Basic Cisco Show Commands

Use Show Commands to Gather Operational Facts

A CCST Networking objective is to run basic show commands on a Cisco network device. show commands are read-oriented: they display device state, interfaces, software, configuration, neighbors, and tables, and they do not alter the device the way configuration commands do. A CCST technician collects this output under direction, recognizes obvious clues, and avoids changes unless authorized.

First, confirm the device identity, prompt, hostname, management address, physical label, or inventory record, because many networks reuse similar names and output from the wrong switch wastes time. Record date, time, device, access method, and reason. Some commands require privileged EXEC mode (the # prompt reached via enable); never bypass access controls to get there.

The Four Core Commands

show ip interface brief is the entry-level workhorse. Its Status and Protocol columns decode like this:

show interfaces goes deeper: description, hardware (MAC) address, bandwidth, MTU, duplex and speed (watch for a duplex mismatch, often half/full), input/output rates, and error counters such as CRC errors, input errors, runts, giants, late collisions, and resets. Counters matter most over time: run the command, wait, run it again, and note whether errors increased during the problem. A large number alone may be old history.

show version identifies the model, IOS image and version, uptime (a low uptime can reveal a recent reboot), memory, and often the serial number, useful for inventory, TAC cases, and compatibility checks. Do not judge a version as good or bad without guidance; just record it accurately.

show running-config displays the active configuration, including interface settings, routing, management, usernames, and access lists. Some platforms mask passwords, but not all sensitive data is removed, so collect and share it only when policy permits. If only one interface is needed, an engineer may ask for show running-config interface GigabitEthernet1/0/14.

Other Handy Show Commands

• show mac address-table, learned MACs and the port each was seen on (switch).
• show arp, IP-to-MAC mappings on a Layer 3 device.
• show ip route, routes known to a router or L3 switch.
• show cdp neighbors / show lldp neighbors, directly connected devices when discovery is enabled.
• show vlan brief, VLANs and assigned ports on a switch.

Use only commands approved in your environment. Two of these are especially common on the exam: show cdp neighbors reveals adjacent Cisco devices (their device ID, local and remote port, platform, and capability) using the proprietary Cisco Discovery Protocol, which is invaluable for confirming what is plugged into a port without walking the cabling. show mac address-table proves which MAC addresses a switch has learned and on which ports, helping confirm that a host's traffic is actually reaching the expected port.

Worked Scenario

A user reports no wired connectivity. On the access switch you run show ip interface brief and find Gi1/0/14 in down/down state. That rules out an administrative shutdown (which would read "administratively down") and points squarely at Layer 1: cable, port, or remote NIC. You then run show interfaces GigabitEthernet1/0/14 and see rising CRC errors and a duplex of half against an expected full, classic signs of a cabling fault or a duplex mismatch. After the patch cable is replaced, a second show ip interface brief shows up/up and the counters stop climbing.

Notice the workflow: the brief command localizes the layer, the detailed command names the likely cause, and a repeat confirms the fix, none of it changing the configuration.

show vs. Configuration Mode

It is worth being explicit about the boundary the exam cares about. show commands run from user or privileged EXEC mode and only read state. Entering configure terminal drops you into configuration mode where commands like shutdown, no shutdown, or vlan 20 change behavior, and where a careless keystroke can take an interface or the whole device offline. A CCST technician's mandate is to stay on the read side unless explicitly authorized. If you find yourself at a (config)# prompt while you were only asked to collect output, you have gone too far, back out with end and gather the show output instead.

Documenting Output

The value of show output is the context around it. Interface Gi1/0/14 is down is thin; Gi1/0/14 connects to Room 214 jack A-12 where the user reports no wired link; it was down/down at 11:02 and came up/up after replacing the patch cable is strong evidence, it pairs the operational state with the physical location, the timestamp, and the action that changed it. Copy output exactly when requested, do not trim lines that could matter (an error counter or a description line is often the clue), and never paste secrets such as community strings or unmasked passwords into public channels.

When unsure which command an engineer wants, collect the minimum needed, label it clearly, and escalate rather than improvising configuration changes.