This command sets the device’s IP address, subnet mask, and gateway. The IP address and gateway must be on the same subnet. If you specify the none option, the IP address and subnet mask are set to the factory defaults.

network parms {ipaddr netmask [gateway] | none}

Mode: Privileged EXEC

This command sets locally administered MAC addresses. The following rules apply:

- Bit 6 of byte 0 (called the U/L bit) indicates whether the address is universally administered (b’0’) or locally administered (b’1’).
- Bit 7 of byte 0 (called the I/G bit) indicates whether the destination address is an individual address (b’0’) or a group address (b’1’).
- The second character, of the twelve character macaddr, must be 2, 6, A or E.

A locally administered address must have bit 6 On (b’1’) and bit 7 Off (b’0’).

network mac-address macaddr

Mode: Privileged EXEC

This command specifies whether the switch uses the burned-in or the locally administered MAC address.

network mac-type {local | burnedin}

Mode: Privileged EXEC
Default: burnedin

This command specifies whether or not the switch should allow access to the Java applet in the header frame of the web interface. When access is enabled, the Java applet can be viewed from the web interface. When access is disabled, the user cannot view the Java applet.

network javamode

Mode: Privileged EXEC
Default: Enabled

Select DHCP, BootP, or None as the network config protocol. Use the none keyword to rollback to the default network configuration. This option also allows you to configure a static IP address. The dhcp client-id option enables the DHCP client to specify the unique client identifier (option 61).

network protocol [ bootp | dhcp {client-id} | none ]

Mode: Privileged EXEC
Default: dhcp

Select static network configuration. Configuring an IP address with this command is the same as using network parms command. Use the none keyword to remove all system network configuration.

network protocol static parms [ none | ipaddr netmask gw ]

Mode: Privileged EXEC

This command displays configuration settings associated with the switch’s network interface. The network interface is the logical interface used for in-band connectivity with the switch via any of the switch’s front panel ports.

The configuration parameters associated with the switch’s network interface do not affect the configuration of the front panel ports through which traffic is switched or routed.

The network interface is always considered to be up, whether or not any member ports are up; therefore, the show network command will always show Interface Status as Up.

show network

Modes: User / Privileged EXEC
Parameters:

 

Interface Status	The network interface status; it is always considered to be “Up”.
IP Address	The IP address of the interface. The factory default value is 0.0.0.0.
Subnet Mask	The IP subnet mask for this interface. The factory default value is 0.0.0.0.
Default Gateway	The default gateway for this IP interface. The factory default value is 0.0.0.0.
IPv6 Administrative Mode	Whether enabled or disabled.
IPv6 Address/Length	The IPv6 address and length.
IPv6 Default Router	The IPv6 default router address.
Burned In MAC Address	The burned in MAC address used for in-band connectivity.
Locally Administered MAC Address	If desired, a locally administered MAC address can be configured for in-band connectivity.
MAC Address Type	The MAC address which should be used for in-band connectivity. The choices are the burned in or the Locally Administered address. The factory default is to use the burned in MAC address.
Configured IPv4 Protocol	The IPv4 network protocol being used. The options are bootp | dhcp | none.
Configured IPv6 Protocol	The IPv6 network protocol being used. The options are dhcp | none.
DHCPv6 Client DUID	The DHCPv6 client’s unique client identifier. This row is displayed only when the configured IPv6 protocol is dhcp.
IPv6 Autoconfig Mode	Whether IPv6 Stateless address autoconfiguration is enabled or disabled.
DHCP Client Identifier	The client identifier is displayed in the output of the command only if DHCP is enabled with the client- id option on the network port. See “network protocol dhcp” on page 39.

This command gives you access to the Line Console mode, which allows you to configure various Telnet settings and the console port, as well as to configure console login/enable authentication.

line {console | telnet | ssh}

Mode: Global Config

Parameters:

 

console	Console terminal line.
telnet	Virtual terminal for remote console access (Telnet).
ssh	Virtual terminal for secured remote console access (SSH).

This command specifies the communication rate of the terminal interface. The supported rates are 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200.

serial baudrate {1200 | 2400 | 4800 | 9600 | 19200 | 38400 | 57600 | 115200}

Mode: Line Config

Default: 115200

This command specifies the maximum connect time (in minutes) without console activity. A value of 0 indicates that a console can be connected indefinitely. The time range is 0 to 160.

serial timeout 0-160

Mode: Line Config

Default: 5

This command displays serial communication settings for the switch.

show serial

Modes: User / Privileged EXEC

Parameters:

 

Serial Port Login Timeout (minutes)	The time, in minutes, of inactivity on a Serial port connection, after which the Switch will close the connection. Any numeric value between 0 and 160 is allowed, the factory default is 5. A value of 0 disables the timeout.
Baud Rate (bps)	The default baud rate at which the serial port will try to connect. The available values are 1200, 2400, 4800, 9600, 19200, 38400,57600, and 115200 baud. The factory default is 115200 baud.
Character Size (bits)	The number of bits in a character. The number of bits is always 8.
Flow Control	Whether Hardware Flow-Control is enabled or disabled. Hardware Flow Control is always disabled.
Stop Bits	The number of Stop bits per character. The number of Stop bits is always 1.
Parity Type	The Parity Method used on the Serial Port. The Parity Method is always None.

Use this command to enable Telnet connections to the system and to enable the Telnet Server Admin Mode. This command opens the Telnet listening port.

ip telnet server enable

Mode: Privileged EXEC

Default: Disabled

This command regulates new Telnet sessions. If enabled, new Telnet sessions can be established until there are no more sessions available. An established session remains active until the session is ended or an abnormal network error ends the session.

transport input telnet

Mode: Line Config

Default: Disabled

This command specifies the maximum number of Telnet connection sessions that can be established. A value of 0 indicates that no Telnet connection can be established. The range is 0-5.

telnetcon maxsessions 0-5

Mode: Privileged EXEC

Default: 5

This command sets the Telnet connection session timeout value, in minutes. A session is active as long as the session has not been idle for the value set. The time is a decimal value from 1 to 160.

telnetcon timeout 1-160

Mode: Privileged EXEC

Default: 5

This command displays the current inbound Telnet settings. In other words, these settings apply to Telnet connections initiated from a remote system to the switch.

show telnetcon

Modes: User / Privileged EXEC

Parameters:

 

Remote Connection Login Timeout (minutes)	This object indicates the number of minutes a remote connection session is allowed to remain inactive before being logged off. May be specified as a number from 1 to 160. The factory default is 5.
Maximum Number of Remote Connection Sessions	This object indicates the number of simultaneous remote connection sessions allowed. The factory default is 5.
Allow New Telnet Sessions	New Telnet sessions will not be allowed when this field is set to no. The factory default value is no.

Use this command to enable SSH access to the system. (This command is the short form of the ip ssh server enable command).

ip ssh

Mode: Privileged EXEC

Default: Enabled

This command is used to set or remove protocol levels (or versions) for SSH. Either SSH1 (1), SSH2 (2), or both SSH 1 and SSH 2 (1 and 2) can be set.

ip ssh protocol [1] [2]

Mode: Privileged EXEC

Default: 2

This command enables the IP secure shell server.

ip ssh server enable

Mode: Privileged EXEC

Default: Enabled

This command specifies the maximum number of SSH connection sessions that can be established. A value of 0 indicates that no SSH connection can be established. The range is 0 to 5.

sshcon maxsessions 0-5

Mode: Privileged EXEC

Default: 5

This command sets the SSH connection session timeout value, in minutes. A session is active as long as the session has been idle for the value set. The time is a decimal value from 1 to 160.

Changing the timeout value for active sessions does not become effective until the session is re accessed. Also, any keystroke activates the new timeout duration.

sshcon timeout 1-160

Mode: Privileged EXEC

Default: 5

This command displays the SSH settings.

show ip ssh

Mode: Privileged EXEC

Parameters:

Administrative Mode	This field indicates whether the administrative mode of SSH is enabled or disabled.
Protocol Level	The protocol level may have the values of version 1, version 2 or both versions 1 and version 2.
SSH Sessions Currently Active	The number of SSH sessions currently active.
Max SSH Sessions Allowed	The maximum number of SSH sessions allowed.
SSH Timeout	The SSH timeout value in minutes.
Keys Present	Indicates whether the SSH RSA and DSA key files are present on the device.
Key Generation in Progress	Indicates whether RSA or DSA key files generation is currently in progress.

Use this command to generate a self-signed certificate for HTTPS. The generated RSA key for SSL has a length of 1024 bits. The resulting certificate is generated with a common name equal to the lowest IP address of the device and a duration of 365 days.

crypto certificate generate

Mode: Global Config

Use this command to generate an RSA key pair for SSH. The new key files will overwrite any existing generated or downloaded RSA key files.

crypto key generate rsa

Mode: Global Config

Use this command to generate a DSA key pair for SSH. The new key files will overwrite any existing generated or downloaded DSA key files.

crypto key generate dsa

Mode: Global Config

These commands apply the user exec (start-stop/stop-only) accounting list to the line methods HTTP and HTTPS.

ip {http|https} accounting exec {default | listname}

Mode: Global Config

Use these commands to specify authentication methods for HTTP and HTTPS users. The default configuration is the local user database is checked. This action has the same effect as the command ip http|https authentication local. The additional methods of authentication are used only if the previous method returns an error, not if it fails.

To ensure that the authentication succeeds even if all methods return an error, specify none as the final method in the command line. For example, if none is specified as an authentication method after RADIUS, no authentication is used if the RADIUS server is down.

ip {http|https} authentication {local | none | radius | tacacs} {method2}

Mode: Global Config

Default: local

Parameters:

local	Uses the local username database for authentication.
none	Uses no authentication.
radius	Uses the list of all RADIUS servers for authentication.
tacacs	Uses the list of all TACACS+ servers for authentication.

This command enables access to the switch through the web interface. When access is enabled, the user can login to the switch from the web interface. When access is disabled, the user cannot login to the switch’s web server. Disabling the web interface takes effect immediately. All interfaces are affected.

ip http server

Mode: Privileged EXEC

Default: Enabled

This command is used to enable the secure socket layer for secure HTTP.

ip http secure-server

Mode: Privileged EXEC

Default: Enabled

This commands configures the hard timeout for insecure HTTP sessions in hours. Configuring this value to zero will give an infinite hard-timeout. When this timeout expires, the user will be forced to re-authenticate. This timer begins on initiation of the web session and is unaffected by the activity level of the connection.

ip http session hard-timeout 1-168

Mode: Privileged EXEC

Default: 24

This command limits the number of allowable insecure HTTP sessions. Zero is the configurable minimum.

ip http session maxsessions 0-16

Mode: Privileged EXEC

Default: 16

This command configures the soft timeout for insecure HTTP sessions in minutes. Configuring this value to zero will give an infinite soft-timeout. When this timeout expires the user will be forced to re authenticate. This timer begins on initiation of the web session and is restarted with each access to the switch.

ip http session soft-timeout 1-60

Mode: Privileged EXEC

Default: 5

This command configures the hard timeout for secure HTTP sessions in hours. When this timeout expires, the user is forced to re authenticate. This timer begins on initiation of the web session and is unaffected by the activity level of the connection. The secure-session hard-timeout can not be set to zero (infinite).

ip http secure-session hard-timeout 1-168

Mode: Privileged EXEC

Default: 24

This command limits the number of secure HTTP sessions. Zero is the configurable minimum.

ip http secure-session maxsessions 0-16

Mode: Privileged EXEC

Default: 16

This command configures the soft timeout for secure HTTP sessions in minutes. Configuring this value to zero will give an infinite soft-timeout. When this timeout expires, you are forced to re-authenticate. This timer begins on initiation of the web session and is restarted with each access to the switch. The secure-session soft-timeout cannot be set to zero (infinite).

ip http secure-session soft-timeout 1-60

Mode: Privileged EXEC

Default: 5

This command is used to set the SSL port where port can be 1025-65535 and the default is port 443.

ip http secure-port [port-id]

Mode: Privileged EXEC

Default: 443

This command is used to set protocol levels (versions). The protocol level can be set to TLS1, SSL3 or to both TLS1 and SSL3.

ip http secure-protocol [SSL3] [TLS1]

Mode: Privileged EXEC

Default: SSL3 and TLS1

This command displays the HTTP settings for the switch.

show ip http

Mode: Privileged EXEC

Parameters:

HTTP Mode (Unsecure)	The insecure HTTP server administrative mode.
Java Mode	The java applet administrative mode which applies to both secure and un-secure web connections.
Maximum Allowable HTTP Sessions	The number of allowable insecure HTTP sessions.
HTTP Session Hard Timeout	The hard timeout for insecure HTTP sessions in hours.
HTTP Session Soft Timeout	The soft timeout for insecure HTTP sessions in minutes.
HTTP Mode (Secure)	The secure HTTP server administrative mode.
Secure Port	The secure HTTP server port number.
Secure Protocol Level(s)	The protocol level may have the values of SSL3, TSL1, or both SSL3 and TSL1.
Maximum Allowable HTTPS Sessions	The number of allowable secure HTTP sessions.
HTTPS Session Hard Timeout	The hard timeout for secure HTTP sessions in hours.
HTTPS Session Soft Timeout	The soft timeout for secure HTTP sessions in minutes.
Certificate Present	Indicates whether the secure-server certificate files are present on the device.
Certificate Generation in Progress	Indicates whether certificate generation is currently in progress.

Use the disconnect command to close HTTP, HTTPS, Telnet or SSH sessions. Use all to close all active sessions, or use session-id to specify the session ID to close. To view the possible values, use the show loginsession command.

disconnect {session_id | all}

Mode: Privileged EXEC

This command displays current Telnet, SSH and serial port connections to the switch. This command displays truncated user names. Use the show loginsession long command to display the complete usernames.

show loginsession

Mode: Privileged EXEC

Parameters:

ID	Login Session ID.
User Name	The name the user entered to log on to the system.
Connection From	IP address of the remote client machine or EIA-232 for the serial port connection.
Idle Time	Time this session has been idle.
Session Time	Total time this session has been connected.
Session Type	Shows the type of session, which can be HTTP, HTTPS, telnet, serial, or SSH.

This command displays the complete user names of the users currently logged in to the switch.

show loginsession long

Mode: Privileged EXEC

Use this command to set authentication at login. The default and optional list names created with the command are used with the aaa authentication login command. Create a list by entering the aaa authentication login <list-name> {method} command, where <list-name> is any character string used to name this list. The {method} argument identifies the list of methods that the authentication algorithm tries, in the given sequence.

The additional methods of authentication are used only if the previous method returns an error, not if there is an authentication failure. To ensure that the authentication succeeds even if all methods return an error, specify none as the final method in the command line. For example, if none is specified as an authentication method after RADIUS, no authentication is used if the RADIUS server is down.

aaa authentication login {default | list-name} {enable | local | none | radius | tacacs} {method2}

Mode: Global Config

Default:  networkList - Used by Telnet and SSH and only contains the method local.

Parameters:

default	Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in.
list-name	Character string of up to 15 characters used to name the list of authentication methods activated when a user logs in.
enable	Uses the enable password for authentication.
local	Uses the local username database for authentication.
none	Uses no authentication.
radius	Uses the list of all RADIUS servers for authentication.
tacacs	Uses the list of all TACACS servers for authentication.

Use this command to set authentication for accessing higher privilege levels. The default enable list is enableList. It is used by console, telnet and SSH, and contains the method as enable followed by none.

aaa authentication enable {default | list-name} {deny | enable | line | none | radius | tacacs} {method2}

Mode: Global Config

Default: default

Parameters:

default	Uses the local username database for authentication.
list-name	Character string (15 characters max), used to name the list of authentication methods activated when a user logs in.
deny	Used to deny access.
enable	Uses the enable password for authentication.
line	Uses the line password for authentication.
none	Uses no authentication.
radius	Uses the list of all RADIUS servers for authentication.
tacacs	Uses the list of all TACACS servers for authentication.

This command enables access to the switch through the web interface. When access is enabled, the user can login to the switch from the web interface. When access is disabled, the user cannot login to the switch’s web server. Disabling the web interface takes effect immediately. All interfaces are affected.

aaa authorization {commands | exec} {default | list-name} {local | none | radius | tacacs}

Mode: Global Config

Parameters:

commands	Provides authorization for all user-executed commands.
exec	Provides exec authorization.
default	The default list of methods for authorization services.
list-name	Alphanumeric character string used to name the list of authorization methods.
local	Uses the local username database for authorization.
none	Uses no authorization.
radius	Uses the list of all RADIUS servers for authorization.
tacacs	Uses the list of all TACACS servers for authorization.

This command is used to enable the secure socket layer for secure HTTP.

show authorization methods

Mode: Privileged EXEC

Use this command to specify the authentication method list when accessing a higher privilege level from a remote Telnet session.

enable authentication {default | list-name}

Mode: Line Config

Parameters:

default	Uses the default list created with the aaa authentication enable command.
list-name	Uses the indicated list created with the aaa authentication enable command.

Use the username command in Global Config mode to add a new user to the local user database. The default privilege level is 1. Using the encrypted keyword allows the administrator to transfer local user passwords between devices without having to know the passwords. When the password parameter is used along with encrypted parameter, the password must be exactly 128 hexadecimal characters in length.

If the password strength feature is enabled, this command checks for password strength and returns an appropriate error if it fails to meet the password strength criteria. Giving the optional parameter override-complexity-check disables the validation of the password strength.

username name {password password [encrypted [override-complexity-check] | level level [encrypted [override-complexity-check]] | override-complexity-check]} | {level level [override-complexity-check] password}

Mode: Global Config

Parameters:

name	The name of the user. Range: 1-64 characters.
password	The authentication password for the user. Range 8-64 characters. This value can be zero if the no passwords min-length command has been executed. The special characters allowed in the password include: ! # $ % & ‘ ( ) * + , -. / : ; < = > @ [ \ ] ^ _ ` { | } ~.
level	The user level. Level 0 can be assigned by a level 15 user to another user to suspend that user’s access. Range 0-15. Enter access level 1 for Read Access or 15 for Read/Write Access. If not specified where it is optional, the privilege level is 1.
encrypted	Encrypted password entered, copied from another switch configuration.
override-complexity- check	Disables the validation of the password strength.

Use this command to remove an existing user’s password (NULL password).

username [name] nopassword [level level]

Mode: Global Config

Parameters:

name	The name of the user. Range: 1-32 characters.
password	The authentication password for the user. Range 8-64 characters.
level	The user level. Level 0 can be assigned by a level 15 user to another user to suspend that user’s access. Range 0-15.

Use this command to allow a locked user account to be unlocked. Only a user with read/write access can reactivate a locked user account.

username name unlock

Mode: Global Config

This command displays the configured user names and their settings. The show users command displays truncated user names. Use the show users long command to display the complete user names. The show users command is only available for users with Read/Write privileges. The SNMPv3 fields will only be displayed if SNMP is available on the system.

show users

Mode: Privileged EXEC

Parameters:

User Name	The name the user enters to login using the serial port, Telnet or web.
Access Mode	Shows whether the user is able to change parameters on the switch (Read/Write) or is only able to view them (Read Only). As a factory default, the ubnt user has Read/Write access.
SNMPv3 Access Mode	The SNMPv3 Access Mode. If the value is set to ReadWrite, the SNMPv3 user is able to set and retrieve parameters on the system. If the value is set to ReadOnly, the SNMPv3 user is only able to retrieve parameter information. The SNMPv3 access mode may be different than the CLI and web access mode.
SNMPv3 Authentication	The authentication protocol to be used for the specified login user.
SNMPv3 Encryption	The encryption protocol to be used for the specified login user.

This command displays the complete usernames of the configured users on the switch.

show users long

Mode: Privileged EXEC

This command displays local user status with respect to user account lockout and password aging. Displayed user names are truncated. Use the show users long command to show the complete user names.

show users accounts [detail]

Mode: Privileged EXEC

Parameters:

User Name	The local user account’s user name.
Access Level	The user’s access level (1 for read-only or 15 for read/write).
Password Aging	Number of days, since the password was configured, until the password expires.
Password Expiry Date	The current password expiration date in date format.
Lockout	Indicates whether the user account is locked out (true or false).
Override Complexity Check	Displays the user’s Password override complexity check status. By default it is disabled. View with detail keyword.
Password Strength	Displays the user password’s strength (Strong or Weak). This field is displayed only if the Password Strength feature is enabled. View with detail keyword.

Use this command to display information about the login history of users.

show users login-history {long | username name}

Mode: Privileged EXEC

Use this command to specify the login authentication method list for a line (console, telnet or SSH) The default configuration uses the default set with the command aaa authentication login.

login authentication {default | list-name}

Mode: Line Configuration

Parameters:

default	Uses the default list created with the aaa authentication login command.
list-name	Uses the indicated list created with the aaa authentication login command.

Use this command to allow a user to change the password for only that user. This command should be used after the password has aged. The user is prompted to enter the old password and the new password.

password

Mode: User EXEC

Use the password command in Line Configuration mode to specify a password on a line. The default configuration is no password is specified.

password [password [encrypted]]

Mode: Line Configuration

Parameters:

password	Password for this level. Range: 8-64 characters.
encrypted	Encrypted password to be entered, copied from another switch configuration. The encrypted password should be 128 characters long because the assumption is that this password is already encrypted with AES.

This command is used to configure a password for a user in the IAS database. An optional encrypted parameter is provided to indicate that the password given to the command is already encrypted.

password [password [encrypted]]

Mode: aaa IAS User Config

Parameters:

password	Password for this level.
encrypted	Encrypted password to be entered, copied from another switch configuration.

Use the enable password command to set a local password to control access to the privileged EXEC mode.

enable password [password [encrypted]]

Mode: Privileged EXEC

Parameters:

password	Password for this level. Range: 8-64 characters.
encrypted	Encrypted password to be entered, copied from another switch configuration. The encrypted password should be 128 characters long because the assumption is that this password is already encrypted with AES.

Use this command to enforce a minimum password length for local users. The value also applies to the enable password. The valid range is 8-64.

passwords min-length [8-64]

Mode: Global Config

Default: 8

Use this command to set the number of previous passwords that shall be stored for each user account. When a local user changes his or her password, the user will not be able to reuse any password stored in password history. This ensures that users don’t reuse their passwords often. The valid range is 0-10.

passwords history [0-10]

Mode: Global Config

Default: 0

Use this command to implement aging on passwords for local users. When a user’s password expires, the user is prompted to change it before logging in again. The valid range is 1-365. The default is 0, or no aging.

passwords aging [1-365]

Mode: Global Config

Default: 0

Use this command to strengthen the security of the switch by locking user accounts that have failed login due to wrong passwords. When a lockout count is configured, a user that is logged in must enter the correct password within that count. Otherwise the user will be locked out from further switch access.

Only a user with read/write access can reactivate a locked user account. Password lockout does not apply to logins from the serial console. The valid range is 1-5. The default is 0, or no lockout count enforced.

passwords lock-out [1-5]

Mode: Global Config

Default: 0

Use this command to enable the password strength feature. It is used to verify the strength of a password during configuration.

passwords strength-check

Mode: Global Config

Default: Disabled

Use this command to set the maximum number of consecutive characters to be used in password strength. The valid range is 0-15. The default is 0. Minimum of 0 means no restriction on that set of characters.

passwords strength maximum consecutive-characters [0-15]

Mode: Global Config

Default: 0

Use this command to set the maximum number of repeated characters to be used in password strength. The valid range is 0-15. The default is 0. Minimum of 0 means no restriction on that set of characters.

passwords strength maximum repeated-characters [0-15]

Mode: Global Config

Default: 0

Use this command to enforce a minimum number of uppercase letters that a password should contain. The valid range is 0-16. The default is 2. Minimum of 0 means no restriction on that set of characters.

passwords strength minimum uppercase-letters [0-16]

Mode: Global Config

Default: 2

Use this command to enforce a minimum number of lowercase letters that a password should contain. The valid range is 0-16. The default is 2. Minimum of 0 means no restriction on that set of characters.

passwords strength minimum lowercase-letters [0-16]

Mode: Global Config

Default: 2

Use this command to enforce a minimum number of numeric characters that a password should contain. The valid range is 0-16. The default is 2. Minimum of 0 means no restriction on that set of characters.

passwords strength minimum numeric-characters [0-16]

Mode: Global Config

Default: 2

Use this command to enforce a minimum number of special characters that a password should contain. The valid range is 0-16. The default is 2. Minimum of 0 means no restriction on that set of characters.

passwords strength minimum special-characters [0-16]

Mode: Global Config

Default: 2

Use this command to enforce a minimum number of characters classes that a password should contain. Character classes are uppercase letters, lowercase letters, numeric characters and special characters. The valid range is 0-4. The default is 4.

passwords strength minimum character-classes [0-4]

Mode: Global Config

Default: 4

Use this command to exclude the specified keyword while configuring the password. The password does not accept the keyword in any form (in between the string, case insensitive and reverse) as a substring. You can configure up to a maximum of 3 keywords.

passwords strength exclude-keyword [keyword]

Mode: Global Config

Use this command to display the configured password management settings.

show passwords configuration

Mode: Privileged EXEC

Parameters:

Minimum Password Length	Minimum number of characters required when changing passwords.
Password History	Number of passwords to store for reuse prevention.
Password Aging	Length in days that a password is valid.
Lockout Attempts	Number of failed password login attempts before lockout.
Minimum Password Uppercase Letters	Minimum number of uppercase characters required in a password.
Minimum Password Lowercase Letters	Minimum number of lowercase characters required in a password.
Minimum Password Numeric Characters	Minimum number of numeric characters required in a password.
Maximum Password Consecutive Characters	Maximum number of consecutive characters allowed in a password.
Maximum Password Repeated Characters	Maximum number of repeated characters allowed in a password.
Minimum Password Character Classes	Minimum number of character classes (uppercase, lowercase, numeric and special) required when configuring passwords.
Password Exclude-Keywords	The set of keywords to be excluded from the configured password when strength checking is enabled.

Use this command to specify the login authentication method list for a line (console, telnet or SSH) The default configuration uses the default set with the command aaa authentication login.

show passwords result

Mode: Privileged EXEC

Parameters:

Last User Whose Password Is Set	Shows the name of the user with the most recently set password.
Password Strength Check	Shows whether password strength checking is enabled.
Last Password Set Result	Shows if the attempt to set a password succeeded; if not, the reason for the failure is included.

The Internal Authentication Server (IAS) database is a dedicated internal database used for local authentication of users for network access through the IEEE 802.1X feature. Use the aaa ias-user username command in Global Config mode to add the specified user to the internal user database. This command also changes the mode to AAA User Config mode.

aaa ias-user username [user]

Mode: Global Config

Use this command in Global Config mode to specify if the same session-id is used for Authentication, Authorization and Accounting service type within a session.

aaa session-id [common | unique]

Mode: Global Config

Default: common

Parameters:

common	Use the same session-id for all AAA Service types.
unique	Use a unique session-id for all AAA Service types.

Use this command in Global Config mode to create an accounting method list for user EXEC sessions, user- executed commands, or 802.1X. This list is identified by default or a user-specified list_name.
Accounting records, when enabled for a line-mode, can be sent at both the beginning and at the end (start- stop) or only at the end (stop-only).

If none is specified, then accounting is disabled for the specified list. If tacacs is specified as the accounting method, accounting records are notified to a TACACS+ server. If radius is the specified accounting method, accounting records are notified to a RADIUS server.

aaa accounting {exec | commands | dot1x} {default | list-name} {start-stop | stop-only | none} {none | radius | tacacs} {method2}

Mode: Global Config

Notes:

- A maximum of five Accounting Method lists can be created for each exec and commands type.
- Only the default Accounting Method list can be created for 802.1X. There is no provision to create more.
- The same list-name can be used for both exec and commands accounting type.
- AAA Accounting for commands with RADIUS as the accounting method is not supported.
- The start-stop or none options are the only supported record types for 802.1X accounting.
- The start-stop option enables accounting and none disables accounting.
- RADIUS is the only accounting method type supported for 802.1X accounting.

Parameters:

exec	Provides accounting for a user EXEC terminal sessions.
commands	Provides accounting for all user executed commands.
dot1x	Provides accounting for 802.1X user commands.
default	The default list of methods for accounting services.
list-name	Character string used to name the list of accounting methods.
start-stop	Sends a start accounting notice at the beginning of a process and a stop accounting notice at the beginning of a process and a stop accounting notice at the end of a process.
stop-only	Sends a stop accounting notice at the end of the requested user process.
none	Disables accounting services on this line.
radius	Use RADIUS+ server for accounting purposes.
tacacs	Use TACACS+ server for accounting purposes.

Use this command to remove all users from the IAS database.

clear aaa ias-users

Mode: Privileged Exec

Use this command to display configured IAS users and their attributes. Passwords configured are not shown in the show command output.

show aaa ias-users [username]

Mode: Privileged Exec

Use this command in Line Configuration mode to apply the accounting method list to a line config (Telnet/SSH).

accounting {exec | commands} {default | list-name}

Mode: Line Configuration

Parameters:

exec	Causes accounting for an EXEC session.
commands	This causes accounting for each command execution attempt. If a user is enabling accounting for exec mode for the current line-configuration type, the user will be logged out.
default	The default Accounting List.
list-name	Enter a string of not more than 15 characters.

Use this command to display ordered methods for accounting lists.

show accounting

Mode: Privileged EXEC

Use this command to display configured accounting method lists.

show accounting methods

Mode: Privileged EXEC

This command clears the accounting statistics.

clear accounting statistics

Mode: Privileged EXEC

This command sets the name and the physical location of the switch, and the organization responsible for the network. The parameters name, location, and contact can be up to 255 characters in length.

snmp-server {sysname [name] | location [location] | contact [contact]}

Mode: Global Config

This command adds (and names) a new SNMP community, and optionally sets the access mode, allowed IP address, and create a view for the community.

Community names in the SNMP Community Table must be unique. When making multiple entries using the same community name, the first entry is kept and processed and all duplicate entries are ignored.

snmp-server community community-name [{ro | rw |su }] [ipaddress ip-address] [view view-name]

Mode: Global Config

Parameters:

community-name	A name associated with the switch and with a set of SNMP managers that manage it with a specified privileged level. The length of community-name can be up to 16 case-sensitive characters.
ro | rw | su	The access mode of the SNMP community, which can be public (Read-Only/RO), private (Read-Write/ RW), or Super User (SU).
ip-address	The associated community SNMP packet sending address and is used along with the client IP mask value to denote a range of IP addresses from which SNMP clients may use that community to access the device. A value of 0.0.0.0 allows access from any IP address. Otherwise, this value is ANDed with the mask to determine the range of allowed client IP addresses.
view-name	The name of the view to create or update.

This command configures a community access string to permit access via the SNMPv1 and SNMPv2 protocols.

snmp-server community-group community-string group-name [ipaddress ipaddress]

Mode: Global Config

Parameters:

community-string	The community which is created and then associated with the group. The range is 1 to 20 characters.
group-name	The name of the group that the community is associated with. The range is 1 to 30 characters.
ipaddress	Optionally, the IPv4 address that the community may be accessed from.

The Port MAC locking component interprets this command and configures violation action to send an SNMP trap with default trap frequency of 30 seconds. The Global command configures the trap violation mode across all interfaces valid for port-security. There is no global trap mode as such.

snmp-server enable traps violation

Modes: Global / Interface Config

Default: Disabled

This command enables the Authentication Flag.

snmp-server enable traps

Mode: Global Config

Default: Enabled

This command enables link status traps on an interface or range of interfaces. This command is valid only when the Link Up/Down Flag is enabled.

snmp trap link-status

Mode: Interface Config

This command enables link status traps for all interfaces. This command is valid only when the Link Up/Down Flag is enabled.

snmp trap link-status all

Mode: Global Config

This command enables Link Up/Down traps for the entire switch. When enabled, link traps are sent only if the Link Trap flag setting associated with the port is enabled.

snmp-server enable traps linkmode

Mode: Global Config

Default: Enabled

This command enables Multiple User traps. When the traps are enabled, a Multiple User Trap is sent when a user logs in to the terminal interface (EIA 232 or Telnet) and there is an existing terminal interface session.

snmp-server enable traps multiusers

Mode: Global Config

Default: Enabled

This command enables the sending of new root traps and topology change notification traps.

snmp-server enable traps stpmode

Mode: Global Config

Default: Enabled

This command configures the SNMP engine ID on the local device. Changing the engine ID will invalidate all SNMP configuration that exists on the box.

snmp-server engineID local {engineid-string | default}

Mode: Global Config

Default: The engineID is configured automatically, based on the device MAC address. 

Parameters:

engineid-string	A hexadecimal string identifying the engine ID, used for localizing configuration. The engine ID must be an even length in the range of 6 to 32 hexadecimal characters.
default	Sets the engine ID to the default string, based on the device MAC address.

This command creates a filter entry for use in limiting which traps will be sent to a host.

snmp-server filter filtername oid-tree {included | excluded}

Mode: Global Config

Default: No filters are created by default.

Parameters:

filtername	The label for the filter being created. The range is 1 to 30 characters.
oid-tree	The OID subtree to include or exclude from the filter. Subtrees may be specified numerically (1.3.6.2.4) or by keywords (system), and asterisks may be used to specify a subtree family (1.3.*.4).
included	The tree is included in the filter.
excluded	The tree is excluded from the filter.

Use this command to remove an existing user’s password (NULL password).

snmp-server group group-name {v1 | v2 | v3 {noauth | auth | priv}} [context context-name] [read read-view] [write write-view] [notify notify-view]

Mode: Global Config

Default: Generic groups are created for all versions and privileges using the default views.

Parameters:

group-name	The group name to be used when configuring communities or users. The range is 1 to 30 characters.
v1	This group can only access via SNMPv1.
v2	This group can only access via SNMPv2.
v3	This group can only access via SNMPv3.
noauth	This group can be accessed only when not using Authentication or Encryption. Applicable only if SNMPv3 is selected.
auth	This group can be accessed only when using Authentication but not Encryption. Applicable only if SNMPv3 is selected.
priv	This group can be accessed only when using both Authentication and Encryption. Applicable only if SNMPv3 is selected.
context-name	The SNMPv3 context used during access. Applicable only if SNMPv3 is selected.
read-view	The view this group will use during GET requests. The range is 1 to 30 characters.
write-view	The view this group will use during SET requests. The range is 1 to 30 characters.
notify-view	The view this group will use when sending out traps. The range is 1 to 30 characters.

This command configures traps to be sent to the specified host.

snmp-server host host-addr {informs [timeout seconds] [retries retries] | traps version {1 | 2} community-string [udp-port port] [filter filter-name]

Mode: Global Config

Default: No default hosts are configured.

Parameters:

host-addr	The IPv4 or IPv6 address of the host to send the trap or inform to.
informs	Send SNMPv2 informs to the host.
seconds	The number of seconds to wait for an acknowledgement before resending the Inform. The default is 15 seconds. The range is 1 to 300 seconds.
retries	The number of times to resend an Inform. The default is 3 attempts. The range is 0 to 255 retries.
traps	Send SNMP traps to the host. This option is selected by default.
version 1	Sends SNMPv1 traps. This option is not available if informs is selected.
version 2	Sends SNMPv2 traps. This option is not available if informs is selected. This option is selected by default.
community-string	Community string sent as part of the notification. The range is 1 to 20 characters.
port	The SNMP Trap receiver port. The default is port 162.
filter-name	The filter name to associate with this host. Filters can be used to specify which traps are sent to this host. The range is 1 to 30 characters.

This command creates an SNMPv3 user for access to the system.

snmp-server user username groupname [remote engineid-string] [ {auth-md5 password | auth-sha password | auth-md5-key md5-key | auth-sha-key sha-key} [priv-des password | priv-des-key des-key]

Mode: Global Config

Default: No default users are created.

Parameters:

username	The username the SNMPv3 user will connect to the switch as. The range is 1 to 30 characters.
groupname	The name of the group the user belongs to. The range is 1 to 30 characters.
engineid-string	The engine-id of the remote management station that this user will be connecting from. The range is 5 to 32 characters.
password	The password the user will use for the authentication or encryption mechanism. The range is 1 to 32 characters.
md5-key	A pregenerated MD5 authentication key. The length is 32 characters.
sha-key	A pregenerated SHA authentication key. The length is 48 characters.
des-key	A pregenerated DES encryption key. The length is 32 characters if MD5 is selected, 48 characters if SHA is selected.

This command creates or modifies an existing view entry that is used by groups to determine which objects can be accessed by a community or user.

snmp-server viewname oid-tree {included | excluded}

Mode: Global Config

Default: Views are created by default to provide access to the default groups.

Parameters:

viewname	The label for the view being created. The range is 1 to 30 characters.
oid-tree	The OID subtree to include or exclude from the view. Subtrees may be specified numerically (1.3.6.2.4) or by keywords (system), and asterisks may be used to specify a subtree family (1.3.*.4).
included	The tree is included in the view.
excluded	The tree is excluded from the view.

This command configures traps to be sent to the specified host.

snmp-server v3-host host-addr username [traps | informs [timeout seconds] [retries retries]] [auth | noauth | priv] [udpport port] [filter filter-name]

Mode: Global Config

Default: No default hosts are configured.

Parameters:

 

host-addr	The IPv4 or IPv6 address of the host to send the trap or inform to.
username	User used to send a Trap or Inform message. This user must be associated with a group that supports the version and access method. The range is 1 to 30 characters.
traps	Send SNMP traps to the host. This is the default option.
informs	Send SNMP informs to the host.
seconds	Number of seconds to wait for an acknowledgement before resending the Inform. The default is 15 seconds. The range is 1 to 300 seconds.
retries	Number of times to resend an Inform. The default is 3 attempts. The range is 0 to 255 retries.
auth	Enables authentication but not encryption.
noauth	No authentication or encryption. This is the default.
priv	Enables authentication and encryption.
port	The SNMP Trap receiver port. This value defaults to port 162.
filter-name	The filter name to associate with this host. Filters can be used to specify which traps are sent to this host. The range is 1 to 30 characters.

Use this command in Global Configuration mode to configure the global source-interface (Source IP address) for all SNMP communication between the SNMP client and the server.

snmptrap source-interface {slot/port | vlan vlan-id}

Mode: Global Config

Parameters:

slot/port	The unit identifier assigned to the switch.
vlan-id	Configures the VLAN interface to use as the source IP address. The range of the VLAN ID is 1 to 4093.

This command displays the current SNMP configuration.

show snmp

Mode: Privileged EXEC

Parameters:

 

Community Table:
Community-String	The community string for the entry. This is used by SNMPv1 and SNMPv2 protocols to access the switch.
Community-Access	The type of access the community has (read only / read write / super user).
View Name	The view this community has access to.
IP Address	Access to this community is limited to this IP address.
Community Group Table:
Community-String	The community this mapping configures.
Group Name	The group this community is assigned to.
IP Address	The IP address this community is limited to.
Host Table:
Target Address	The address of the host that traps will be sent to.
Type	The type of message that will be sent, either traps or informs.
Community	The community traps will be sent to.
Version	The version of SNMP the trap will be sent as.
UDP Port	The UDP port the trap or inform will be sent to.
Filter name	The filter the traps will be limited by for this host.
TO Sec	The number of seconds before informs will time out when sending to this host.
Retries	The number of times informs will be sent after timing out.

This command displays the currently configured SNMP engineID.

show snmp engineID

Mode: Privileged EXEC

This command displays the configured filters used when sending traps.

show snmp filters [filtername]

Mode: Privileged EXEC

Parameters:

Name	The filter name for this entry.
OID Tree	The OID tree this entry will include or exclude.
Type	Indicates if this entry includes or excludes the OID Tree.

This command displays the configured groups.

show snmp group [groupname]

Mode: Privileged EXEC

Parameters:

Name	The name of the group.
Security Model	Indicates which protocol can access the system via this group.
Security Level	Indicates the security level allowed for this group.
Read View	The view this group provides read access to.
Write View	The view this group provides write access to.
Notify View	The view this group provides trap access to.

Use this command in Privileged EXEC mode to display the configured global source-interface (Source IP address) details used for an SNMP client.

show snmp source-interface

Mode: Privileged EXEC

This command displays the currently configured SNMPv3 users.

show snmp user [username]

Mode: Privileged EXEC

Parameters:

 

Name	The name of the user.
Group Name	The group that defines the SNMPv3 access parameters.
Auth Method	The authentication algorithm configured for this user.
Privilege Method	The encryption algorithm configured for this user.
Remote Engine ID	The engineID for the user defined on the client machine.

This command displays the currently configured views.

show snmp views [viewname]

Mode: Privileged EXEC

Parameters:

Name	The view name for this entry.
OID Tree	The OID tree that this entry will include or exclude.
Type	Indicates if this entry includes or excludes the OID tree.

This command displays trap conditions. The command’s display shows all the enabled OSPFv2 and OSPFv3 trapflags. Configure which traps the switch should generate by enabling or disabling the trap condition. If a trap condition is enabled and the condition is detected, the SNMP agent on the switch sends the trap to all enabled trap receivers.

You do not have to reset the switch to implement the changes. Cold and warm start traps are always generated and cannot be disabled.

show trapflags

Mode: Privileged EXEC

Parameters:

 

Authentication Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether authentication failure traps will be sent.
Link Up/Down Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether link status traps will be sent.
Multiple Users Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether a trap will be sent when the same user ID is logged into the switch more than once at the same time (either through Telnet or the serial port).
Spanning Tree Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether spanning tree traps are sent.

This command is used to enable the RADIUS accounting function.

radius accounting mode

Mode: Global Config

Default: Disabled

This command sets a custom NAS Identifer attribute for RADIUS authentication.

radius server attribute 32 nas-identifier

Mode: Global Config

This command specifies the RADIUS client to use the NAS-IP Address attribute in the RADIUS requests. If the specific IP address is configured while enabling this attribute, the RADIUS client uses that IP address while sending NAS-IP-Address attribute in RADIUS communication.

radius server attribute 4 [ipaddr]

Mode: Global Config

Parameters:

4	NAS-IP-Address attribute to be used in RADIUS requests.
ipaddr	The IP address of the server.

This command configures the IP address or DNS name to use for communicating with the RADIUS server of a selected server type. While configuring the IP address or DNS name for the authenticating or accounting servers, you can also configure the port number and server name. If the authenticating and accounting servers are configured without a name, the command uses the Default_RADIUS_Auth_Server and Default_RADIUS_Acct_ Server as the default names, respectively. The same name can be configured for more than one authenticating servers and the name should be unique for accounting servers. The RADIUS client allows the configuration of a maximum of 32 authenticating and accounting servers.

If you use the auth parameter, the command configures the IP address or hostname to use to connect to a RADIUS authentication server. You can configure up to 3 servers per RADIUS client. If the maximum number of configured servers is reached, the command fails until you remove one of the servers by issuing the no form of the command. If you use the optional port parameter, the command configures the UDP port number to use when connecting to the configured RADIUS server. The port number range is 1-65535, with a default of 1812.

If you use the acct parameter, the command configures the IP address or hostname to use for the RADIUS accounting server. You can only configure one accounting server. If an accounting server is currently configured, use the no form of the command to remove it from the configuration. The IP address or hostname you specify must match that of a previously configured accounting server. If you use the optional port parameter, the command configures the UDP port to use when connecting to the RADIUS accounting server. If a port is already configured for the accounting server, the new port replaces the previously configured port. The port value must be in the range 0-65535, with a default of 1813.

radius server host {auth | acct} {ipaddr | dnsname} [name servername] [port 0-65535]

Mode: Global Config

Parameters:

 

ipaddr	The IP address of the server.
dnsname	The DNS name of the server.
port	The port number (range 0-65535) to use to connect to the specified RADIUS server.
servername	The alias name to identify the server.

This command configures the key to be used in RADIUS client communication with the specified server. Depending on whether the auth or acct keyword is used, the shared secret is configured for the RADIUS authentication or RADIUS accounting server. The IP address or hostname provided must match a previously configured server. When this command is executed, the secret is prompted.

Text-based configuration supports RADIUS server’s secrets in encrypted and non-encrypted format. When you save the configuration, these secret keys are stored in encrypted format only. If you want to enter the key in encrypted format, enter the key along with the encrypted keyword. In the show running-config command’s display, these secret keys are displayed in encrypted format. You cannot show these keys in plain text format.

radius server key {auth | acct} {ipaddr | dnsname} encrypted password

Modes: Global Config

Parameters:

 

ipaddr	The IP address of the server.
dnsname	The DNS name of the server.
password	The password in encrypted format.

This command enables the message authenticator attribute to be used for the specified RADIUS Authenticating server.

radius server msgauth [ipaddr | dnsname]

Mode: Global Config

Parameters:

 

ipaddr	The IP address of the server.
dnsname	The DNS name of the server.

This command specifies a configured server that should be the primary server in the group of servers which have the same server name. Multiple primary servers can be configured for each number of servers that have the same name.

When the RADIUS client has to perform transactions with an authenticating RADIUS server of specified name, the client uses the primary server that has the specified server name by default. If the RADIUS client fails to communicate with the primary server for any reason, the client uses the backup servers configured with the same server name. These backup servers are identified as the Secondary type.

radius server primary [ipaddr | dnsname]

Mode: Global Config

Parameters:

 

ipaddr	The IP address of the server.
dnsname	The DNS name of the server.

This command configures the RADIUS client global parameter that specifies the maximum number of message transmissions before using the fall back server upon unsuccessful communication with the current RADIUS authenticating server. When the maximum number of retries is reached for the RADIUS accounting server and no response is received, the client does not communicate with any other server.

The maximum number of transmission attempts can be set between 1 to 15, with a default of 4 attempts.

radius server retransmit retries

Mode: Global Config

Default: 4

Use this command to specify the physical or logical interface to use as the RADIUS client source interface (source IP address). If configured, the address of source-interface is used for all RADIUS communications between the RADIUS server and the RADIUS client. The selected source-interface IP address is used for filling the IP header of RADIUS management protocol packets. This allows security devices (firewalls) to identify the source packets coming from the specific switch.

If a source-interface is not specified, the primary IP address of the originating (outbound) interface is used as the source address. If the configured interface is down, the RADIUS client falls back to its default behavior.

radius source-interface {slot/port | vlan vlan-id}

Mode: Global Config

This command configures the RADIUS client global parameter that specifies the timeout value (in seconds) after which a request must be retransmitted to the RADIUS server if no response is received. The timeout value is an integer in the range of 1 to 30.

radius server timeout seconds

Mode: Global Config

Default: 5

This command displays the values configured for the global parameters of the RADIUS client.

show radius

Mode: Privileged EXEC

Parameters:

 

Number of Configured Authentication Servers	The number of RADIUS Authentication servers that have been configured.
Number of Configured Accounting Servers	The number of RADIUS Accounting servers that have been configured.
Number of Named Authentication Server Groups	The number of configured named RADIUS server groups.
Number of Named Accounting Server Groups	The number of configured named RADIUS server groups.
Number of Retransmits	The configured value of the maximum number of times a request packet is retransmitted.
Time Duration	The configured timeout value, in seconds, for request retransmissions.
RADIUS Accounting Mode	A global parameter to indicate whether the accounting mode for all the servers is enabled or not.
RADIUS Attribute 4 Mode	A global parameter to indicate whether the NAS-IP-Address attribute has been enabled to use in RADIUS requests.
RADIUS Attribute 4 Value	A global parameter that specifies the IP address to be used in the NAS-IP-Address attribute to be used in RADIUS requests.

This command displays the summary and details of the RADIUS authenticating servers configured for the RADIUS client.

show radius servers [{ipaddr | dnsname | name [servername]}]

Mode: Privileged EXEC

Parameters:

 

Current	The * symbol preceding the server host address specifies that the server is currently active.
Host Address	The IP address of the host.
Server Name	The name of the authenticating server.
Port	The port used for communication with the authenticating server.
Type	Specifies whether this server is a primary or secondary type.
Current Host Address	The IP address of the currently active authenticating server.
Secret Configured	Yes or No Boolean value that indicates whether this server is configured with a secret.
Number of Retransmits	The configured value of the maximum number of times a request packet is retransmitted.
Message Authenticator	Global parameter that indicates whether the Message Authenticator attribute is enabled or disabled.
Time Duration	The configured timeout value, in seconds, for request retransmissions.
RADIUS Accounting Mode	Global parameter that indicates whether the accounting mode for all the servers is enabled or not.
RADIUS Attribute 4 Mode	Global parameter that indicates whether the NAS-IP-Address attribute has been enabled to use in RADIUS requests.
RADIUS Attribute 4 Value	Global parameter that specifies the IP address to use in NAS-IP-Address attribute used in RADIUS requests.

This command displays a summary of configured RADIUS accounting servers.

show radius accounting name [servername]

Mode: Privileged EXEC

Parameters:

 

Host Address	The IP address of the host.
Server Name	The name of the accounting server.
RADIUS Accounting Mode	A global parameter to indicate whether the accounting mode for all the servers is enabled or not.
Port	The port used for communication with the accounting server.
Secret Configured	Yes or No Boolean value indicating whether this server is configured with a secret.

This command displays a summary of statistics for the configured RADIUS accounting servers.

show radius accounting statistics {ipaddr | dnsname | name servername}

Mode: Privileged EXEC

Parameters:

 

RADIUS Accounting Server Name	The name of the accounting server.
Host Address	The IP address of the host.
Round Trip Time	The time interval, in hundredths of a second, between the most recent Accounting-Response and the Accounting-Request that matched it from this RADIUS accounting server.
Requests	The number of RADIUS Accounting-Request packets sent to this server. This number does not include retransmissions.
Retransmission	The number of RADIUS Accounting-Request packets retransmitted to this RADIUS accounting server.
Responses	The number of RADIUS packets received on the accounting port from this server.
Malformed Responses	The number of malformed RADIUS Accounting-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators or signature attributes or unknown types are not included as malformed accounting responses.
Bad Authenticators	The number of RADIUS Accounting-Response packets containing invalid authenticators received from this accounting server.
Pending Requests	The number of RADIUS Accounting-Request packets sent to this server that have not yet timed out or received a response.
Timeouts	The number of accounting timeouts to this server.
Unknown Types	The number of RADIUS packets of unknown types, which were received from this server on the accounting port.
Packets Dropped	The number of RADIUS packets received from this server on the accounting port and dropped for some other reason.

Use this command in Privileged EXEC mode to display the configured RADIUS client source-interface (Source IP address) information.

show radius source-interface

Mode: Privileged EXEC

This command displays the summary statistics of configured RADIUS Authenticating servers.

show radius statistics {ipaddr | dnsname | name servername}

Mode: Privileged EXEC

Parameters:

 

RADIUS Server Name	The name of the authenticating server.
Server Host Address	The IP address of the host.
Access Requests	The number of RADIUS Access-Request packets sent to this server. This number does not include retransmissions.
Access Retransmissions	The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server.
Access Accepts	The number of RADIUS Access-Accept packets, including both valid and invalid packets, that were received from this server.
Access Rejects	The number of RADIUS Access-Reject packets, including both valid and invalid packets, that were received from this server.
Access Challenges	The number of RADIUS Access-Challenge packets, including both valid and invalid packets, that were received from this server.
Malformed Access Responses	The number of malformed RADIUS Access-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators or signature attributes or unknown types are not included as malformed access responses.
Bad Authenticators	The number of RADIUS Access-Response packets containing invalid authenticators or signature attributes received from this server.
Pending Requests	The number of RADIUS Access-Request packets destined for this server that have not yet timed out or received a response.
Timeouts	The number of authentication timeouts to this server.
Unknown Types	The number of packets of unknown type that were received from this server on the authentication port.
Packets Dropped	The number of RADIUS packets received from this server on the authentication port and dropped for some other reason.

Use the tacacs-server host command in Global Configuration mode to configure a TACACS+ server. This command enters into the TACACS+ configuration mode. The ip-address|hostname parameter is the IP address or hostname of the TACACS+ server. To specify multiple hosts, multiple tacacs-server host commands can be used.

tacacs-server host ip-address|hostname

Mode: Global Config

Use the tacacs-server key command to set the authentication and encryption key for all TACACS+ communications between the switch and the TACACS+ daemon. The key-string parameter has a range of 0-128 characters and specifies the authentication and encryption key for all TACACS communications between the switch and the TACACS+ server. This key must match the key used on the TACACS+ daemon.

Text-based configuration supports TACACS server’s secrets in encrypted and non-encrypted format. When you save the configuration, these secret keys are stored in encrypted format only. If you want to enter the key in encrypted format, enter the key along with the encrypted keyword. The show running-config command displays these secret keys in encrypted format. You cannot show these keys in plain text format.

tacacs-server key [key-string | encrypted key-string]

Mode: Global Config

Use the tacacs-server keystring command to set the global authentication encryption key used for all TACACS+ communications between the TACACS+ server and the client.

tacacs-server keystring

Mode: Global Config

Use this command in Global Configuration mode to configure the source interface (Source IP address) for TACACS+ server configuration. The selected source-interface IP address is used for filling the IP header of management protocol packets. This allows security devices (firewalls) to identify the source packets coming from the specific switch.

If a source-interface is not specified, the primary IP address of the originating (outbound) interface is used as the source address.

tacacs-server source-interface {slot/port | vlan vlan-id}

Modes: Global Config

Use this command to set the timeout value for communication with the TACACS+ servers. The timeout parameter has a range of 1-30 and is the timeout value in seconds.

tacacs-server timeout timeout

Mode: Global Config

Use the key command in TACACS Configuration mode to specify the authentication and encryption key for all TACACS communications between the device and the TACACS server. This key must match the key used on the TACACS daemon. The key-string parameter specifies the key name. For an empty string use “ ”. The range is 0-128 characters.

Text-based configuration supports TACACS server’s secrets in encrypted and non-encrypted format. When you save the configuration, these secret keys are stored in encrypted format only. If you want to enter the key in encrypted format, enter the key along with the encrypted keyword. In the show running-config command’s display, these secret keys are displayed in encrypted format. You cannot show these keys in plain text format.

key [key-string | encrypted key-string]

Mode: TACACS Config

Use the keystring command in TACACS Server Configuration mode to set the TACACS+ server-specific authentication encryption key used for all TACACS+ communications between the TACACS+ server and the client.

keystring

Mode: TACACS Server Config

Use the port command in TACACS Configuration mode to specify a server port number. The server port-number range is 0 - 65535.

port port-number

Mode: TACACS Config

Default: 49

Use this command in TACACS Configuration mode to specify the order in which servers are used, where 0 (zero) is the highest priority. The priority parameter specifies the priority for servers. The highest priority is 0 (zero), and the range is 0 - 65535.

priority priority

Mode: TACACS Config

Default: 0

Use this command in TACACS Configuration mode to specify the timeout value in seconds. If no timeout value is specified, the global value is used. The timeout parameter has a range of 1-30 and is the timeout value in seconds.

timeout timeout

Mode: TACACS Config

Use this command to display the configuration, statistics, and source interface details of the TACACS+ client.

show tacacs [ip-address|hostname|client|server]

Mode: Privileged EXEC

Parameters:

 

Host address	The IP address or hostname of the configured TACACS+ server.
Port	The configured TACACS+ server port number.
TimeOut	The timeout in seconds for establishing a TCP conection.
Priority	The preference order in which TACACS+ servers are contacted. If a server connection fails, the next highest priority server is contacted.
client	Display SNTP client information.
server	Display SNTP server information.

Use this command in Global Config mode to display the configured global source interface details used for a TACACS+ client. The IP address of the selected interface is used as source IP for all communications with the server.

show tacacs source-interface

Mode: Privileged EXEC

This command applies the commands in the script to the switch. The scriptname parameter is the name of the script to apply.

script apply scriptname

Mode: Privileged EXEC

This command deletes a specified script where the scriptname parameter is the name of the script to delete. The all option deletes all the scripts present on the switch.

script delete {scriptname | all}

Mode: Privileged EXEC

This command lists all scripts present on the switch as well as the remaining available space.

script list

Mode: Privileged EXEC

This command displays the contents of a script file, which is named scriptname.

script show scriptname

Mode: Privileged EXEC

This command validates a script file by parsing each line in the script file where scriptname is the name of the script to validate. The validate option is intended to be used as a tool for script development. Validation identifies potential problems. It might not identify all problems with a given script on any given device.

script validate scriptname

Mode: Privileged EXEC

This command starts or stops an installed application.

application start | stop filename

Mode: Privileged EXEC

The copy command includes the option to upload or download the CLI Banner to or from the switch. You can specify local URLs by using TFTP, SFTP, SCP, or Xmodem.

copy tftp://ipaddr/filepath/filename nvram:clibanner

copy nvram:clibanner tftp://ipaddr/filepath/filename

Mode: Privileged EXEC

This command changes the name of the prompt. The length of name may be up to 64 alphanumeric characters.

set prompt prompt_string

Mode: Privileged EXEC

This command sets the system hostname. It also changes the prompt. The length of name may be up to 64 alphanumeric, case-sensitive characters.

hostname hostname

Mode: Privileged EXEC

Use this command to display the configured prelogin CLI banner. The prelogin banner is the text that displays before displaying the CLI prompt.

show clibanner

Mode: Privileged EXEC

Use this command to configure the prelogin CLI banner before displaying the login prompt. The line parameter sets the banner text where double quote ("") is a delimiting character. The banner message can be up to 2000 characters.

set clibanner line

Mode: Global Config

Use this command to enable IPv6 operation on the network port.

network ipv6 enable

Mode: Privileged EXEC

Default: Enabled

Use the options of this command to manually configure IPv6 global address, enable/disable stateless global address auto-configuration and to enable/disable DHCPv6 client protocol information for the network port. Multiple IPv6 addresses can be configured on the network port.

network ipv6 address {address/prefix-length [eui64] | autoconfig | dhcp}

Mode: Privileged EXEC

Parameters:

 

address	IPv6 prefix in IPv6 global address format.
prefix-length	IPv6 prefix length value.
eui64	Formulate IPv6 address in eui64 format.
autoconfig	Configure stateless global address auto-configuration capability.
dhcp	Configure DHCPv6 client protocol.

Use this command to configure IPv6 default gateway (global or link-local address format) information for the network port.

network ipv6 gateway gateway-address

Mode: Privileged EXEC

Use this command to manually add IPv6 neighbors to the IPv6 neighbor table for this network port. If an IPv6 neighbor already exists in the neighbor table, the entry is automatically converted to a static entry. Static entries are not modified by the neighbor discovery process. They are, however, treated the same for IPv6 forwarding.

Static IPv6 neighbor entries are applied to the kernel stack and to the hardware when the corresponding interface is operationally active.

network ipv6 neighbor ipv6-address macaddr

Mode: Privileged EXEC

Parameters:

 

ipv6-address	The IPv6 address of the neighbor or interface.
macaddr	The link-layer address.

Use this command to display the information about the IPv6 neighbor entries cached on the network port. The information is updated to show the type of the entry.

show network ipv6 neighbors

Mode: Privileged EXEC

Parameters:

 

IPv6 Address	The IPv6 address of the neighbor.
MAC Address	The MAC Address of the neighbor.
isRtr	Shows if the neighbor is a router. If TRUE, the neighbor is a router; if FALSE, it is not a router.
Neighbor State	The state of the neighbor cache entry. Possible values are: Incomplete, Reachable, Stale, Delay, Probe, and Unknown.
Age	The time in seconds that has elapsed since an entry was added to the cache.
Last Updated	The time in seconds that has elapsed since an entry was added to the cache.
Type	The type of neighbor entry: Static if the entry is manually configured, Dynamic if dynamically resolved.

Use this command to display  information about the IPv6 DHCPv6 client statistics.

show network ipv6 dhcp statistics

Mode: Privileged EXEC

Use this command to determine whether another computer is on the network. Ping provides a synchronous response when initiated from the CLI and browser-based UI interfaces. To use the command, configure the switch for network (in-band) connection. The source and target devices must have the ping utility enabled and running on top of TCP/IP. The switch can be pinged from any IP workstation with which the switch is connected through the default VLAN (VLAN 1), as long as there is a physical path between the switch and the workstation.

The terminal interface sends three pings to the target station. Use the ipv6-global-address|hostname parameter to ping an interface by using the global IPv6 address of the interface. The argument slot/port corresponds to a physical routing interface or VLAN routing interface. The keyword vlan is used to specify the VLAN ID of the routing VLAN directly instead of a slot/port format. Use the optional size keyword to specify the size of the ping packet.

You can utilize the ping or traceroute facilities over the service/network ports when using an IPv6 global address ipv6-global-address|hostname. Any IPv6 global address or gateway assignments to these interfaces will cause IPv6 routes to be installed within the IP stack such that the ping or traceroute request is routed out the service/network port properly. When referencing an IPv6 link-local address, you must also specify the service or network port interface by using the network parameter.

ping ipv6 {ipv6-global-address|hostname | {interface {slot/port | vlan 1-4093 | network} link-local-address} [size datagram-size]}

Modes: User / Privileged EXEC

Default: count 1 / interval 3 seconds / size 0 bytes

Use this command to determine whether another computer is on the network. To use the command, configure the switch for network (in-band) connection. The source and target devices must have the ping utility enabled and running on top of TCP/IP. The switch can be pinged from any IP workstation with which the switch is connected through the default VLAN (VLAN 1), as long as there is a physical path between the switch and the workstation.

The terminal interface sends three pings to the target station. You can use a network port, service port, VLAN, or physical interface as the source. The parameter slot/port corresponds to a physical routing interface or VLAN routing interface. The keyword vlan is used to specify the VLAN ID of the routing VLAN directly instead of in a slot/port format.

ping ipv6 interface {slot/port | vlan 1-4093 | network} {link-local-address link-local-address | ipv6-address} [size datagram-size]

Modes: User / Privileged EXEC

Parameters:

 

interface	Use the interface keyword to ping an interface by using the link-local address or the global IPv6 address of the interface.
size	Use the optional size keyword to specify the size of the ping packet.
ipv6-address	The link local IPv6 address of the device you want to query.

Use this command to enable or disable the Ubiquiti Discovery responder.

service ubnt-discovery

Mode: Global Config

Default: Enabled

Use this command to enable or disable the Ubiquiti Discovery scanner.

service ubnt-discovery-scanner

Mode: Global Config

Default: Enabled

Use this command to enable or disable the Ubiquiti Discovery active scan feature.

ubnt-discovery-active-scan

Mode: Global Config

Default: Disabled

Use this command to enable or disable the UNMS service.

service unms

Mode: Global Config

Default: Disabled

Use this command to manually add the UNMS key obtained from the UNMS server.

service unms key key-value

Mode: Global Config

Use this command to enable or disable the Ubiquiti Device Analytics feature.

device analytics

Mode: Global Config

Default: Disabled

Use this command to view the UNMS connection status and log entries.

show unms [log]

Mode: Privileged EXEC

Use this command to verify if the Ubiquiti Device Analytics feature is enabled or disabled.

show device analytics

Mode: Privileged EXEC

Use this command to operationally start or stop the AutoInstall process on the switch. The command is non-persistent and is not saved in the startup or running configuration file.

boot autoinstall {start | stop}

Mode: Privileged EXEC

Default: Stopped

Use this command to set the number of attempts to download a configuration file from the TFTP server.

boot host retrycount [1-3]

Mode: Privileged EXEC

Default: 3

Use this command to enable AutoInstall on the switch for the next reboot cycle. The command does not change the current behavior of AutoInstall and saves the command to NVRAM.

boot host dhcp

Mode: Privileged EXEC

Default: Disabled

Use this command to automatically save the downloaded configuration file to the startup-config file on the switch. When autosave is disabled, you must explicitly save the downloaded configuration to non-volatile memory by using the write memory or copy system:running-config nvram:startup-config command.

If the switch reboots and the downloaded configuration has not been saved, the AutoInstall process begins, if the feature is enabled.

boot host autosave

Mode: Privileged EXEC

Default: Disabled

Use this command to allow the switch to automatically reboot after successfully downloading an image. When auto reboot is enabled, no administrative action is required to activate the image and reload the switch.

boot host autoreboot

Mode: Privileged EXEC

Default: Enabled

Use this command to erase the text-based configuration file stored in non-volatile memory. If the switch boots and no startup-config file is found, the AutoInstall process automatically begins.

erase startup-config

Modes: Privileged EXEC

Use this command to erase the text-based factory-defaults file stored in non-volatile memory.

erase factory-defaults

Modes: Privileged EXEC

Use this command to erase an application file stored in non-volatile memory.

erase application filename

Modes: Privileged EXEC

This command displays the current status of the AutoInstall process.

show autoinstall

Modes: Privileged EXEC

This command deletes the backup image file from the permanent storage.

delete backup

Mode: Privileged EXEC

This command activates the specified image. It will be the active-image for subsequent reboots and will be loaded by the boot loader. The current active-image is marked as the backup-image for subsequent reboots. If the specified image doesn’t exist on the system, this command returns an error message.

boot system {active | backup}

Mode: Privileged EXEC

This command displays the version information and the activation status for the current active and backup images. The command also displays any text description associated with an image. This command displays the switch activation status.

show bootvar

Mode: Privileged EXEC

This command associates a given text description with an image. Any existing description will be replaced.

filedescr {active | backup} text-description

Mode: Privileged EXEC

This command updates the bootcode (boot loader) on the switch. The bootcode is read from the active-image for subsequent reboots.

update bootcode

Mode: Privileged EXEC

This command displays the contents of the IP stack’s Address Resolution Protocol (ARP) table. The IP stack only learns ARP entries associated with the management interfaces – network or service ports. ARP entries associated with routing interfaces are not listed.

show arp switch

Mode: Privileged EXEC

Parameters:

 

IP Address	IP address of the management interface or another device on the management network.
MAC Address	Hardware MAC address of that device.
Interface	For a service port the output is Management. For a network port, the output is the slot/port of the physical interface.

This command displays the event log, which contains error messages from the system. The event log is not cleared on a system reset. The unit is the switch identifier.

show eventlog [unit]

Mode: Privileged EXEC

Parameters:

 

File	The file in which the event originated.
Line	The line number of the event.
Task Id	The task ID of the event.
Code	The event code.
Time	The time this event occurred.
Unit	The unit for the event.

This command displays inventory information for the switch.

show hardware

Mode: Privileged EXEC

This command displays whether the reload in command was previously set and the time before the switch will be restarted.

show reload

Mode: Privileged EXEC

This command displays the temperature and fan information (if applicable) for the switch.

show environment

Mode: Privileged EXEC

This command displays inventory information for the switch.

show version

Mode: Privileged EXEC

Parameters:

 

System Description	Text used to identify the product name of this switch.
Machine Type	The machine model as defined by the Vital Product Data.
Machine Model	The machine model as defined by the Vital Product Data
Serial Number	The unique box serial number for this switch.
Burned in MAC Address	Universally assigned network address.
Software Version	The release.version.revision number of the code currently running on the switch.

This command displays vital product data for the switch.

show platform vpd

Modes: User / Privileged EXEC

Parameters:

 

Operational Code Image File Name	Build Signature loaded into the switch
Software Version	Release Version Maintenance Level and Build (RVMB) information of the switch.
Timestamp	Timestamp at which the image is built

This command displays a summary of statistics for a specific interface or a count of all CPU traffic based upon the argument.

show interface {slot/port | switchport}

Mode: Privileged EXEC

Parameters:

 

Receive Packets Discarded	The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffered space.
Packets Transmitted Without Error	The total number of packets transmitted out of the interface.
Transmit Packets Discarded	The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. A possible reason for discarding a packet could be to free up buffer space.
Transmit Packets Errors	The number of outbound packets that could not be transmitted because of errors.
Collisions Frames	The best estimate of the total number of collisions on this Ethernet segment.
Time Since Counters Last Cleared	The elapsed time, in days, hours, minutes, and seconds since the statistics for this port were last cleared.
Packets Received Without Error	The total number of packets (including broadcast packets and multicast packets) received by the processor.
Broadcast Packets Received	The total number of packets received that were directed to the broadcast address. Note that this does not include multicast packets.
Packets Received With Error	The number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.
Packets Transmitted Without Error	The total number of packets transmitted out of the interface.
Broadcast Packets Transmitted	The total number of packets that higher-level protocols requested to be transmitted to the Broadcast address, including those that were discarded or not sent.
Transmit Packet Errors	The number of outbound packets that could not be transmitted because of errors.
Time Since Counters Last Cleared	The elapsed time, in days, hours, minutes, and seconds since the statistics for this switch were last cleared.

Use this command to display interface information, including the description, port state, speed and auto- neg capabilities. The command is similar to show port all but displays additional fields like interface description and port-capability.

The description of the interface is configurable through the existing command description <name> which has a maximum length of 64 characters that is truncated to 28 characters in the output. The long form of the
description can be displayed using show port description. The interfaces displayed by this command are physical interfaces, LAG interfaces and VLAN routing interfaces.

show interfaces status [slot/port]

Mode: Privileged EXEC

Use this command to display interface traffic information.

show interfaces traffic [slot/port]

Mode: Privileged EXEC

This command reports key summary statistics for all the ports (physical, port-channel, and CPU).

show interface counters

Mode: Privileged EXEC

Parameters:

 

Packets Received Successfully:
Port	Interface (slot/port), port-channel number, or CPU.
InOctets	Total Packets Received Without Error - The total number of packets received that were without errors.
InUcastPkts	Unicast Packets Received - The number of subnetwork-unicast packets delivered to a higher-layer protocol.
InMcastPkts	Multicast Packets Received - The total number of good packets received that were directed to a multicast address. Note that this number does not include packets directed to the broadcast address.
InBcastPkts	Broadcast Packets Received - The total number of good packets received that were directed to the broadcast address. Note that this does not include multicast packets.
Packets Transmitted Successfully:
Port	Interface (slot/port), port-channel number, or CPU.
OutOctets	Total Packets Transmitted Successfully - The number of frames that have been transmitted by this port to its segment.
OutUcastPkts	Unicast Packets Transmitted - The total number of packets that higher-level protocols requested be transmitted to a subnetwork-unicast address, including those that were discarded or not sent.
OutMcastPkts	Multicast Packets Transmitted - The total number of packets that higher-level protocols requested be transmitted to a Multicast address, including those that were discarded or not sent.
OutBcastPkts	Broadcast Packets Transmitted - The total number of packets that higher-level protocols requested be transmitted to the Broadcast address, including those that were discarded or not sent.

This command displays detailed statistics for a specific interface or for all CPU traffic based upon the argument.

show interface ethernet {slot/port | switchport | all}

Mode: Privileged EXEC

Parameters:

 

Total Packets Received (Octets)	The total number of octets of data (including those in bad packets) received on the network (excluding framing bits but including Frame Check Sequence (FCS) octets). This object can be used as a reasonable estimate of Ethernet utilization. If greater precision is desired, the etherStatsPkts and etherStatsOctets objects should be sampled before and after a common interval. The result of this equation is the value Utilization which is the percent utilization of the Ethernet segment on a scale of 0 to 100 percent.
Packets Received 64 Octets	The total number of packets (including bad packets) received that were 64 octets in length (excluding framing bits but including FCS octets).
Packets Received 65–127 Octets	The total number of packets (including bad packets) received that were from 65 to 127 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Received 128–255 Octets	The total number of packets (including bad packets) received that were from 128 to 255 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Received 256–511 Octets	The total number of packets (including bad packets) received that were from 256 to 511 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Received 512–1023 Octets	The total number of packets (including bad packets) received that were from 512 to 1023 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Received 1024–1518 Octets	The total number of packets (including bad packets) received that were from 1024 to 1518 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Received > 1518 Octets	The total number of packets received that were longer than 1522 octets (excluding framing bits, but including FCS octets) and were otherwise well formed.
Packets RX and TX 64 Octets	The total number of packets (including bad packets) received and transmitted that were 64 octets in length (excluding framing bits but including FCS octets).
Packets RX and TX 65–127 Octets	The total number of packets (including bad packets) received and transmitted that were from 65 to 127 octets in length inclusive (excluding framing bits but including FCS octets).
Packets RX and TX 128–255 Octets	The total number of packets (including bad packets) received and transmitted that were from 128 to 255 octets in length inclusive (excluding framing bits but including FCS octets).
Packets RX and TX 256–511 Octets	The total number of packets (including bad packets) received and transmitted that were from 256 to 511 octets in length inclusive (excluding framing bits but including FCS octets).
Packets RX and TX 512–1023 Octets	The total number of packets (including bad packets) received and transmitted that were from 512 to 1023 octets in length inclusive (excluding framing bits but including FCS octets).
Packets RX and TX 1024–1518 Octets	The total number of packets (including bad packets) received and transmitted that were from 1024 to 1518 octets in length inclusive (excluding framing bits but including FCS octets).
Packets RX and TX 1519–2047 Octets	The total number of packets received and transmitted that were from 1519 to 2047 octets in length inclusive (excluding framing bits, but including FCS octets) and were otherwise well formed.
Packets RX and TX 2048–4095 Octets	The total number of packets received that were from 2048 to 4095 octets in length inclusive (excluding framing bits, but including FCS octets) and were otherwise well formed.
Packets RX and TX 4096–9216 Octets	The total number of packets received that were from 4096 to 9216 octets in length inclusive (excluding framing bits, but including FCS octets) and were otherwise well formed.
Total Packets Received Without Error	The total number of packets received that were without errors.
Unicast Packets Received	The number of subnetwork-unicast packets delivered to a higher-layer protocol.
Multicast Packets Received	The total number of good packets received that were directed to a multicast address. Note that this number does not include packets directed to the broadcast address.
Broadcast Packets Received	The total number of good packets received that were directed to the broadcast address. Note that this does not include multicast packets.
Receive Packets Discarded	The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space.
Total Packets Received with MAC Errors	The total number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.
Jabbers Received	The total number of packets received that were longer than 1518 octets (excluding framing bits, but including FCS octets), and had either a bad Frame Check Sequence (FCS) with an integral number of octets (FCS Error) or a bad FCS with a non-integral number of octets (Alignment Error). Note that this definition of jabber is different than the definition in IEEE-802.3 section 8.2.1.5 (10BASE5) and section 10.3.1.4 (10BASE2). These documents define jabber as the condition where any packet exceeds 20 ms. The allowed range to detect jabber is between 20 ms and 150 ms.
Fragments/Undersize Received	The total number of packets received that were less than 64 octets in length (excluding framing bits but including FCS octets).
Alignment Errors	The total number of packets received that had a length (excluding framing bits, but including FCS octets) of between 64 and 1518 octets, inclusive, but had a bad Frame Check Sequence (FCS) with a non-integral number of octets.
FCS Errors	The total number of packets received that had a length (excluding framing bits, but including FCS octets) of between 64 and 1518 octets, inclusive, but had a bad Frame Check Sequence (FCS) with an integral number of octets.
Overruns	The total number of frames discarded as this port was overloaded with incoming packets, and could not keep up with the inflow.
Total Received Packets Not Forwarded	A count of valid frames received which were discarded (in other words, filtered) by the forwarding process
802.3x Pause Frames Received	A count of MAC Control frames received on this interface with an opcode indicating the PAUSE operation. This counter does not increment when the interface is operating in half-duplex mode.
Unacceptable Frame Type	The number of frames discarded from this port due to being an unacceptable frame type.
Total Packets Transmitted (Octets)	The total number of octets of data (including those in bad packets) received on the network (excluding framing bits but including FCS octets). This object can be used as a reasonable estimate of Ethernet utilization. If greater precision is desired, the etherStatsPkts and etherStatsOctets objects should be sampled before and after a common interval.
Packets Transmitted 64 Octets	The total number of packets (including bad packets) received that were 64 octets in length (excluding framing bits but including FCS octets).
Packets Transmitted 65-127 Octets	The total number of packets (including bad packets) received that were between 65 and 127 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Transmitted 128-255 Octets	The total number of packets (including bad packets) received that were between 128 and 255 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Transmitted 256-511 Octets	The total number of packets (including bad packets) received that were between 256 and 511 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Transmitted 512-1023 Octets	The total number of packets (including bad packets) received that were between 512 and 1023 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Transmitted 1024-1518 Octets	The total number of packets (including bad packets) received that were between 1024 and 1518 octets in length inclusive (excluding framing bits but including FCS octets).
Packets Transmitted > 1518 Octets	The total number of packets transmitted that were longer than 1518 octets (excluding framing bits, but including FCS octets) and were otherwise well formed.
Max Frame Size	The maximum size of the Info (non-MAC) field that this port will receive or transmit.
Total Packets Transmitted Successfully	The number of frames that have been transmitted by this port to its segment.
Unicast Packets Transmitted	The total number of packets that higher-level protocols requested be transmitted to a subnetwork-unicast address, including those that were discarded or not sent.
Multicast Packets Transmitted	The total number of packets that higher-level protocols requested be transmitted to a Multicast address, including those that were discarded or not sent.
Broadcast Packets Transmitted	The total number of packets that higher-level protocols requested be transmitted to the Broadcast address, including those that were discarded or not sent.
Transmit Packets Discarded	The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. A possible reason for discarding a packet could be to free up buffer space.
Total Transmit Errors	The sum of Single, Multiple, and Excessive Collisions.
Total Transmit Packets Discards	The sum of single collision frames discarded, multiple collision frames discarded, and excessive frames discarded.
Single Collision Frames	A count of the number of successfully transmitted frames on a particular interface for which transmission is inhibited by exactly one collision.
Multiple Collision Frames	A count of the number of successfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision.
Excessive Collisions	A count of frames for which transmission on a particular interface fails due to excessive collisions.
802.3x Pause Frames Transmitted	A count of MAC Control frames transmitted on this interface with an opcode indicating the PAUSE operation. This counter does not increment when the interface is operating in half-duplex mode.
GVRP PDUs Received	The count of GVRP PDUs received in the GARP layer.
GVRP PDUs Transmitted	The count of GVRP PDUs transmitted from the GARP layer.
GVRP Failed Registrations	The number of times attempted GVRP registrations could not be completed.
GMRP PDUs Received	The count of GMRP PDUs received in the GARP layer.
GMRP PDUs Transmitted	The count of GMRP PDUs transmitted from the GARP layer.
GMRP Failed Registrations	The number of times attempted GMRP registrations could not be completed.
STP BPDUs Transmitted	Spanning Tree Protocol Bridge Protocol Data Units sent.
STP BPDUs Received	Spanning Tree Protocol Bridge Protocol Data Units received.
RST BPDUs Transmitted	Rapid Spanning Tree Protocol Bridge Protocol Data Units sent.
RSTP BPDUs Received	Rapid Spanning Tree Protocol Bridge Protocol Data Units received.
MSTP BPDUs Transmitted	Multiple Spanning Tree Protocol Bridge Protocol Data Units sent.
MSTP BPDUs Received	Multiple Spanning Tree Protocol Bridge Protocol Data Units received.
EAPOL Frames Transmitted	The number of EAPOL frames of any type that have been transmitted by this authenticator.
EAPOL Frames Received	The number of valid EAPOL frames of any type that have been received by this authenticator.
Time Since Counters Last Cleared	The elapsed time, in days, hours, minutes, and seconds since the statistics for this port were last cleared.
Bytes Tx	The total number of bytes transmitted by the interface.
Bytes Rx	The total number of bytes received by the interface.
Packets Tx	he total number of packets transmitted by the interface.
Packets Rx	The total number of packets received by the interface.

This command displays the private VLAN mapping information for the switch interfaces.

show interface ethernet interface-id switchport

Mode: Privileged EXEC

Use this command to display configuration information about the specified LAG interface.

show interface lag lag-intf-num

Mode: Privileged EXEC

This command displays the diagnostics information of the SFP like Temp, Voltage, Current, Input Power, Output Power, Tx Fault, and LOS. The values are derived from the SFP’s A2 (Diagnostics) table using the I2C interface.

show fiber-ports optical-transceiver {all | slot/port}

Mode: Privileged EXEC

Parameters:

 

Temp	Internally measured transceiver temperature.
Voltage	Internally measured supply voltage.
Current	Measured TX bias current.
Output Power	Measured optical output power relative to 1mW.
Input Power	Measured optical power received relative to 1mW.
TX Fault	Transmitter fault.
LOS	Loss of signal.

This command displays the SFP vendor-related information such as the vendor name, SFP serial number, and SFP part number. The values are derived from the SFP’s A0 table using the I2C interface.

show fiber-ports optical-transceiver-info {all | slot/port}

Mode: Privileged EXEC

Parameters:

 

Port	The interface (slot/port).
Vendor Name	The vendor name is a 16-character field that contains ASCII characters, left-aligned and padded on the right with ASCII spaces (20h). The vendor name is the full name of the corporation, a commonly accepted abbreviation of the name of the corporation, the SCSI company code for the corporation, or the stock exchange code for the corporation.
Link Length (50um, OM2)	This value specifies link length that is supported by the transceiver while operating in compliance with applicable standards using 50 micron multi-mode OM2 [500MHz*km at 850nm] fiber. A value of zero means that the transceiver does not support 50 micron multi-mode fiber or that the length information must be determined from the transceiver technology.
Link Length (62.5um, OM1)	This value specifies link length that is supported by the transceiver while operating in compliance with applicable standards using 62.5 micron multi-mode OM1 [200 MHz*km at 850nm, 500 MHz*km at 1310nm] fiber. A value of zero means that the transceiver does not support 62.5 micron multi-mode fiber or that the length information must be determined from the transceiver technology.
Serial Number	The vendor serial number (vendor SN) is a 16 character field that contains ASCII characters, left- aligned and padded on the right with ASCII spaces (20h), defining the vendor’s serial number for the transceiver. A value of all zero in the 16-byte field indicates that the vendor SN is unspecified.
Part Number	The vendor part number (vendor PN) is a 16-byte field that contains ASCII characters, left aligned and added on the right with ASCII spaces (20h), defining the vendor part number or product name. A value of all zero in the 16-byte field indicates that the vendor PN is unspecified.
Nominal Bit Rate (Mbps)	The nominal bit (signaling) rate (BR, nominal) is specified in units of 100 MBd, rounded off to the nearest 100 MBd. The bit rate includes those bits necessary to encode and delimit the signal as well as those bits carrying data information. A value of 0 indicates that the bit rate is not specified and must be determined from the transceiver technology. The actual information transfer rate will depend on the encoding of the data, as defined by the encoding value.
Rev	The vendor revision number (vendor rev) contains ASCII characters, left aligned and padded on the right with ASCII spaces (20h), defining the vendor’s product revision number. A value of all zero in this field indicates that the vendor revision is unspecified.

This command displays the forwarding database entries. These entries are used by the transparent bridging function to determine how to forward a received frame. Enter all or no parameters to display the entire table. Enter a MAC Address and VLAN ID to display the table entry for the requested MAC address on the specified VLAN. Enter the count parameter to view summary information about the forwarding database table. Use the interface slot/port parameter to view MAC addresses on a specific interface.

The lag lag-intf-num can also be used as an alternate way to specify the LAG interface. Use the vlan vlan_id parameter to display information about MAC addresses on a specified VLAN.

show mac-addr-table [{macaddr vlan_id | all | count | interface slot/port | vlan vlan_id}]

Mode: Privileged EXEC

Parameters:

 

VLAN ID	The VLAN in which the MAC address is learned.
MAC Address	A unicast MAC address for which the switch has forwarding and or filtering information. The format is six 2-digit hexadecimal numbers that are separated by colons, for example 01:23:45:67:89:AB.
Interface	The port through which this address was learned.
Interface Index	This object indicates the ifIndex of the interface table entry associated with this port.
Static	The value of the corresponding instance was added by the system or a user when a static MAC filter was defined. It cannot be relearned.
Learned	The value of the corresponding instance was learned by observing the source MAC addresses of incoming traffic, and is currently in use.
Management	The value of the corresponding instance (system MAC address) is also the value of an existing instance of dot1dStaticAddress. It is identified with interface 0/1. and is currently used when enabling VLANs for routing.
Self	The value of the corresponding instance is the address of one of the switch’s physical interfaces (the system’s own MAC address).
GMRP	Learned The value of the corresponding was learned via GMRP and applies to Multicast.
Other	The value of the corresponding instance does not fall into one of the other categories.
Dynamic Address count	Number of MAC addresses in the forwarding database that were automatically learned.
Static Address (User-defined) count	Number of MAC addresses in the forwarding database that were manually entered by a user.
Total MAC Addresses in use	Number of MAC addresses currently in the forwarding database.
Total MAC Addresses available	Number of MAC addresses the forwarding database can handle.

Use this command to configure the CPU utilization thresholds. The Rising and Falling thresholds are specified as a percentage of CPU resources. The utilization monitoring time period can be configured from 5 seconds to 86400 seconds in multiples of 5 seconds. The CPU utilization threshold configuration is saved across a switch reboot. Configuring the falling utilization threshold is optional. If the falling CPU utilization parameters are not configured, then they take the same value as the rising CPU utilization parameters.

process cpu threshold type total rising 1-100 interval

Mode: Global Config

This command displays the user and system applications.

show process app-list

Mode: Privileged EXEC

This command displays the configured and in-use resources of each application.

show process app-resource-list

Mode: Privileged EXEC

This command provides the percentage utilization of the CPU by different tasks.

show process cpu

Mode: Privileged EXEC

This application displays the processes started by applications created by the Process Manager.

show process proc-list

Mode: Privileged EXEC

Display the currently running (active) configuration. To display or capture the commands with settings and configurations that are equal to the default value, include the all option.

The optional interface parameter can be used to display the configuration of an physical, LAG or VLAN interface.

If the optional scriptname parameter is used with a file name .scr extension, the output is redirected to a script file.

show running-config [all | interface | scriptname]

Mode: Privileged EXEC

Display the startup (boot) configuration.

show startup-config

Mode: Privileged EXEC

Display the backup configuration if present.

show backup-config

Mode: Privileged EXEC

Display the factory default configuration.

show factory-defaults

Mode: Privileged EXEC

This command displays switch information.

show sysinfo

Mode: Privileged EXEC

Parameters:

 

Switch Description	Text used to identify this switch.
System Name	Name used to identify the switch.The factory default is blank.
System Location	Text used to identify the location of the switch. The factory default is blank.
System Contact	Text used to identify a contact person for this switch. The factory default is blank.
System ObjectID	The base object ID for the switch’s enterprise MIB.
System Up Time	The time in days, hours and minutes since the last switch reboot.
Current SNTP Synchronized Time	The system time acquired from a network SNTP server.
MIBs Supported	A list of MIBs supported by this agent.

Use the show tech-support command to display system and configuration information when you contact technical support. Only share the output of the tech-support file with trusted parties as the contents may contain sensitive information on your environment/network.

show tech-support

Mode: Privileged EXEC

This command displays the memory mbuf information for the switch.

show mbuf [ detail | total ]

Mode: Privileged EXEC

Use this command to set the pagination length to value number of lines for the sessions specified by configuring on different Line Config modes (Telnet/SSH) and is persistent.

length value

Mode: Line Config

Default: 24

Use this command to set the pagination length to value number of lines for the current session. This command configuration takes an immediate effect on the current session and is not persistent.

terminal length value

Mode: Privileged EXEC

Use this command to display all the configured terminal length values.

show terminal length

Mode: Privileged EXEC

Use this command to get notifications when the CPU free memory falls below the configured threshold. A notification is generated when the free memory falls below the threshold. Another notification is generated once the available free memory rises to 10 percent above the specified threshold.

To prevent generation of excessive notifications when the CPU free memory fluctuates around the configured threshold, only one Rising or Falling memory notification is generated over a period of 60 seconds. The threshold is specified in kilobytes. The CPU free memory threshold configuration is saved across a switch reboot.

memory free low-watermark processor 1-256392

Mode: Global Config

Default: 0 (Disabled)

This command enables logging to memory. You can specify the severitylevel value as an integer from 0 to 7.

logging buffered [severitylevel]

Mode: Global Config

Default: Enabled

This command enables wrapping of in-memory logging when the log file reaches full capacity. Otherwise when the log file reaches full capacity, logging stops.

logging buffered wrap

Mode: Global Config

Default: Enabled

This command enables the CLI command logging feature, which enables the EdgeSwitch software to log all CLI commands issued on the system.

logging cli-command

Mode: Global Config

Default: Disabled

This command sets the severity at which SNMP traps are logged and sent in an email. Specify the severitylevel value as an integer from 0 to 7.

logging traps severitylevel

Mode: Global Config

Default: 6 (Info)

This command enables logging to the console. You can specify the severitylevel value as an integer from 0 to 7.

logging console [severitylevel]

Mode: Global Config

Default: Disabled

This command configures the logging host parameters. You can configure up to eight hosts.

logging host {hostaddress|hostname} addresstype {port severitylevel}

Mode: Global Config

Default: Disabled

Parameters:

 

hostaddress	The IP address of the logging host.
hostname	The hostname of the logging host.
addresstype	Indicates the type of address ipv4 or ipv6 or dns being passed.
port	A port number from 1 to 65535.
severitylevel	Specify this value as an integer from 0 to 7.

This command enables logging host reconfiguration. The hostindex is the logging host index for which to change the IP address. The index value can be displayed with the show logging hosts command.

logging host reconfigure hostindex

Mode: Global Config

This command disables logging to host. The hostindex is the logging host index that should be deleted. The index value can be displayed with the show logging hosts command.

logging host remove hostindex

Mode: Global Config

This command sets the local port number of the LOG client for logging messages. The portid can be in the range from 1 to 65535.

logging port portid

Mode: Global Config

Default: 514

This command enables syslog logging.

logging syslog

Mode: Global Config

Default: Disabled

This command enables syslog logging. The portid parameter is an integer with a range of 1-65535.

logging syslog port portid

Mode: Global Config

Default: 514

This command configures the syslog source-interface (source IP address) for syslog server configuration. The selected source-interface IP address is used for filling the IP header of management protocol packets. This allows security devices (firewalls) to identify the source packets coming from the specific switch. If a source-interface is not specified, the primary IP address of the originating (outbound) interface is used as the source address.

logging syslog source-interface {slot/port | {vlan vlan-id}}

Mode: Global Config

This command displays logging configuration information.

show logging

Mode: Privileged EXEC

Parameters:

 

Logging Client Local Port	Port on the collector/relay to which syslog messages are sent.
Logging Client Source Interface	Shows the configured syslog source-interface (source IP address).
CLI Command Logging	Shows whether CLI Command logging is enabled.
Console Logging	Shows whether console logging is enabled.
Console Logging Severity Filter	The minimum severity to log to the console log. Messages with an equal or lower numerical severity are logged.
Buffered Logging	Shows whether buffered logging is enabled.
Persistent Logging	Shows whether persistent logging is enabled.
Persistent Logging Severity Filter	The minimum severity at which the logging entries are retained after a system reboot.
Syslog Logging	Shows whether syslog logging is enabled.
Log Messages Received	Number of messages received by the log process. This includes messages that are dropped or ignored.
Log Messages Dropped	Number of messages that could not be processed due to error or lack of resources.
Log Messages Relayed	Number of messages sent to the collector/relay.

This command displays buffered logging (system startup and system operation logs).

show logging buffered

Mode: Privileged EXEC

Parameters:

 

Buffered (In-Memory) Logging	Shows whether the In-Memory log is enabled or disabled.
Buffered Logging Wrapping Behavior	The behavior of the In-Memory log when faced with a log full situation.
Buffered Log Count	The count of valid entries in the buffered log.

This command displays all configured logging hosts. 

show logging hosts

Mode: Privileged EXEC

Parameters:

 

Index	Used for deleting hosts.
IP Address / Hostname	IP address or hostname of the logging host.
Severity	The minimum severity to log to the specified address.
Port	The server port number, which is the port on the local host from which syslog messages are sent.
Status	The state of logging to configured syslog hosts. If the status is disable, no logging occurs.

This command displays display persistent log entries.

show logging persistent

Mode: Privileged EXEC

This command displays SNMP trap events and statistics.

show logging traplogs

Mode: Privileged EXEC

Parameters:

 

Number of Traps Since Last Reset	The number of traps since the last boot.
Trap Log Capacity	The number of traps the system can retain.
Number of Traps Since Log Last Viewed	The number of new traps since the command was last executed.
Log	The log number.
System Time Up	How long the system had been running at the time the trap was sent.
Trap	The text of the trap message.

This command clears buffered logging (system startup and system operation logs).

clear logging buffered

Mode: Privileged EXEC

This command enables email alerting and sets the lowest severity level for which log messages are emailed. If you specify a severity level, log messages at or above this severity level, but below the urgent severity level, are emailed in a non-urgent manner by collecting them together until the log time expires. The severitylevel value is specified as an integer from 0 to 7.

logging email [severitylevel]

Mode: Global Config

Default: Disabled

This command sets the lowest severity level at which log messages are emailed immediately in a single email message. The severitylevel value is specified as an integer from 0 to 7. Specify none to indicate that log messages are collected and sent in a batch email at a specified interval.

logging email urgent {severitylevel | none}

Mode: Global Config

Default: 1 (Alert)

This command configures the email address to which messages are sent. The message types supported are urgent, non-urgent, and both. For each supported severity level, multiple email addresses can be configured. The to-email-addr variable is a standard email address.

logging email message-type {urgent|non-urgent|both} to-addr to-email-addr

Mode: Global Config

This command configures the email address of the sender (the switch).

logging email from-addr from-email-addr

Mode: Global Config

This command configures the subject line of the email for the specified type.

logging email message-type {urgent |non-urgent |both} subject subject

Mode: Global Config

This command configures how frequently non-urgent email messages are sent. Non-urgent messages are collected and sent in a batch email at the specified interval. The valid range is every 30-1440 minutes.

logging email logtime minutes

Mode: Global Config

Default: 30 minutes

This command sends an email to the SMTP server to test the email alerting function.

logging email test message-type {urgent |non-urgent |both} message-body message-body

Mode: Global Config

This command displays information about the email alert configuration.

show logging email config

Mode: Privileged EXEC

Parameters: 

 

Email Alert Logging	The administrative status of the feature: enabled or disabled
Email Alert From Address	The email address of the sender (the switch).
Email Alert Urgent Severity Level	The lowest severity level that is considered urgent. Messages of this type are sent immediately.
Email Alert Non Urgent Severity Level	The lowest severity level that is considered non-urgent. Messages of this type, up to the urgent level, are collected and sent in a batch email. Log messages that are less severe are not sent in an email message at all.
Email Alert Trap Severity Level	The lowest severity level at which traps are logged.
Email Alert Notification Period	The amount of time to wait between non-urgent messages.
Email Alert To Address Table	The configured email recipients.
Email Alert Subject Table	The subject lines included in urgent (Type 1) and non-urgent (Type 2) messages.

This command displays email alerting statistics.

show logging email statistics

Mode: Privileged EXEC

Parameters:

 

Email Alert Operation Status	The operational status of the email alerting feature.
No of Email Failures	The number of email messages that have attempted to be sent but were unsuccessful.
No of Email Sent	The number of email messages that were sent from the switch since the counter was cleared.
Time Since Last Email Sent	The amount of time that has passed since the last email was sent from the switch.

This command resets the email alerting statistics.

clear logging email statistics

Mode: Privileged EXEC

This command configures the SMTP server to which the switch sends email alert messages and changes the mode to Mail Server Configuration mode. The server address can be in the IPv4, IPv6, or DNS name format.

mail-server {ip-address | ipv6-address | hostname}

Mode: Global Config

 

This command sets the email alerting security protocol by enabling the switch to use TLS authentication with the SMTP Server. If the TLS mode is enabled on the switch but the SMTP sever does not support TLS mode, no email is sent to the SMTP server.

security {tlsv1 | none}

Mode: Mail Server Config

Default: none

 

This command configures the TCP port to use for communication with the SMTP server. The recommended port for TLSv1 is 465, and for no security (i.e. none) it is 25. However, any nonstandard port in the range 1 to 65535 is also allowed.

port {465 | 25 | 1–65535}

Mode: Mail Server Config

Default: 25

This command configures the login ID the switch uses to authenticate with the SMTP server.

username name

Mode: Mail Server Config

Default: admin

This command configures the password the switch uses to authenticate with the SMTP server.

password password

Mode: Mail Server Config

Default: admin

This command displays information about the email alert configuration.

show mail-server {ip-address | hostname | all} config

Mode: Privileged EXEC

Parameters:

 

No of mail servers configured	The number of SMTP servers configured on the switch.
Email Alert Mail Server Address	The IPv4/IPv6 address or DNS hostname of the configured SMTP server.
Email Alert Mail Server Port	The TCP port the switch uses to send email to the SMTP server
Email Alert Security Protocol	The security protocol (TLS or none) the switch uses to authenticate with the SMTP server.
Email Alert Username	The username the switch uses to authenticate with the SMTP server.
Email Alert Password	The password the switch uses to authenticate with the SMTP server.

Display help for various special keys.

help

Mode: Privileged EXEC

Use the no form to reverse the action of a command or reset a value back to its default. For example, the no shutdown configuration command reverses the previously entered shutdown command on an interface. 

no command

Mode: Global Config

This command gives you access to the Privileged EXEC mode. From the Privileged EXEC mode, you can configure the network interface.

enable

Mode: User EXEC

This command executes Privileged EXEC mode commands from any of the configuration modes.

do

Modes: Global / Interface / VLAN Config

Use this command to save running configuration changes to NVRAM so that changes will persist across a reboot. This command is the same as copy system:running-config nvram:startup-config. Use the confirm keyword to directly save the configuration to NVRAM without prompting for confirmation.

write memory [confirm]

Mode: Privileged EXEC

This command gives you access to the Global Config mode. From the Global Config mode, you can configure a variety of system settings, including user accounts. From the Global Config mode, you can enter other command modes, including Line Config mode.

configure

Mode: Privileged EXEC

Use this command to list the files in the directory /mnt/fastpath in flash from the CLI.

dir

Mode: Privileged EXEC

Use this command to discover the routes that IPv4 or IPv6 packets actually take when traveling to their destination through the network on a hop-by-hop basis. Traceroute continues to provide a synchronous response when initiated from the CLI.

traceroute {ip-address | [ipv6] {ipv6-address | hostname}} [initTtl initTtl] [maxTtl maxTtl] [maxFail maxFail] [interval interval] [count count] [port port] [size size] [source {ip-address | ipv6-address | slot/port}]

Mode: Privileged EXEC

Default: count: 3 probes / interval: 3 seconds / size: 0 bytes / port: 33434 / maxTtl: 30 hops / maxFail: 5 probes / initTtl: 1 hop

Parameters:

 

ip-address	The IP address value should be a valid IP address.
ipv6-address	The IPv6 address value should be a valid IPv6 address.
hostname	The hostname value should be a valid hostname.
ipv6	The optional ipv6 keyword can be used before ipv6-address or hostname. Giving the ipv6 keyword before the hostname tries it to resolve to an IPv6 address.
initTtl	Use initTtl to specify the initial time-to-live (TTL), the maximum number of router hops between the local and remote system. Range is 1 to 255.
maxTtl	Use maxTtle to specify the maximum TTL. Range is 1 to 255.
maxFail	Use maxFail to terminate the traceroute after failing to receive a response for this number of consecutive probes. Range is 1 to 255.
interval	Use the optional interval parameter to specify the time between probes, in seconds. If a response is not received within this interval, then traceroute considers that probe a failure (printing *) and sends the next probe. If traceroute does receive a response to a probe within this interval, then it sends the next probe immediately. Range is 1 to 60 seconds.
count	Use the optional count parameter to specify the number of probes to send for each TTL value. Range is 1 to 10 probes.
port	Use the optional port parameter to specify destination UDP port of the probe. This should be an unused port on the remote destination system. Range is 1 to 65535.
size	Use the optional size parameter to specify the size, in bytes, of the payload of the Echo Requests sent. Range is 0 to 65507 bytes.
source	Use the optional source parameter to specify the source IP address or interface for the traceroute.

This command resets the configuration to the factory defaults without powering off the switch. When you issue this command, a prompt appears to confirm that the reset should proceed. When you enter y, you automatically reset the current configuration on the switch to the default values. It does not reset the switch.

clear config

Mode: Privileged EXEC

This command clears entries from the persistent event log.

clear eventlog

Mode: Privileged EXEC

This command clears a specific dynamic MAC address entry or all entries. You can match on specific interface or VLAN when clearing a MAC address.

clear mac-addr-table [all | interface slot/port | vlan vlan-id | macaddr

Mode: Privileged EXEC

This command resets all user passwords to the factory defaults without powering off the switch. You are prompted to confirm that the password reset should proceed.

clear pass

Mode: Privileged EXEC

This command clears the trap log.

clear traplog

Mode: Privileged EXEC

This command resets VLAN configuration parameters to the factory defaults.

When the VLAN configuration is reset to the factory defaults, there are some scenarios regarding GVRP and MVRP that happen due to this:
- Static VLANs are deleted.
- GVRP is restored to the factory default as a result of handling the VLAN RESTORE NOTIFY event.
- Since GVRP is disabled by default, this means that GVRP should be disabled and all of its dynamic VLANs should be deleted.

clear vlan

Mode: Privileged EXEC

This command closes the current Telnet/SSH connection or resets the current serial connection.

logout

Mode: Privileged EXEC

Use this command to determine whether another computer is on the network. Ping provides a synchronous response when initiated from the CLI and web interfaces.

ping {address | hostname | {ipv6 {interface {slot/port | vlan 1-4093 | network} link-local-address} | ipv6-address | hostname} [count count] [interval 1-60] [size size] [source ip-address | ipv6-address | {slot/port | vlan 1-4093 | network}]

Modes: User / Privileged EXEC

Default: count: 3 / interval: 3 seconds / size: 0 bytes

Parameters:

 

address	The IPv4 or IPv6 address to ping.
hostname	The hostname of the host to ping.
ipv6	The optional keyword ipv6 can be used before the ipv6-address or hostname argument. Using the ipv6 optional keyword before hostname tries to resolve it directly to the IPv6 address. Also used for pinging a link-local IPv6 address.
count	Use the count parameter to specify the number of ping packets (ICMP Echo Requests) that are sent to the destination address specified by the address field. The range for count is 1 to 15 requests.
interval	Use the interval parameter to specify the time between Echo Requests, in seconds. Range is 1 to 60 seconds.
size	Use the size parameter to specify the size, in bytes, of the payload of the Echo Requests sent. Range is 0 to 65507 bytes.
source	Use the source keyword to specify the source IP/IPv6 address or interface to use when sending the Echo Request packets.
interface	Use the interface keyword to ping a link-local IPv6 address over an interface.
link-local-address	The link-local IPv6 address to ping over an interface.

This command closes the current Telnet/SSH connection or resets the current serial connection. The system asks you whether to save configuration changes before quitting.

quit

Mode: Privileged EXEC

This command restarts the switch. Use the optional in parameter to restart the switch after a specified interval. The configuration keyword allows you to gracefully reload a configuration file or script.

reload [in hh:mm] [configuration]

Mode: Privileged EXEC

The copy command uploads and downloads files to and from the switch. You can also use the copy command to manage the dual images (active and backup) on the file system. To upload and download files from a server you can use FTP, TFTP, Xmodem, Ymodem, or Zmodem. If FTP is used, a password is required.

The verify and noverify parameters are only available if the image/configuration verify options feature is enabled. The verify parameter specifies that digital signature verification will be performed for the specified downloaded image or configuration file. The noverify parameter specifies that no verification will be performed.

copy source destination {verify | noverify}

Mode: Privileged EXEC

Parameters:

 

source	destination
system:running-config	nvram:factory-defaults	Saves the running configuration to NVRAM to the factory-defaults file.
system:image	url	Saves the system image to a server.
url	nvram:clibanner	Downloads the CLI banner to the system.
url	nvram:fastpath.cfg	Downloads the binary config file to the system.
url	nvram:publickey-config	Downloads the Public Key for Configuration Script validation.
url	nvram:publickey-image	Downloads Public Key for Image validation.
url	nvram:script destfilename	Downloads a configuration script file to the system. During the download of a configuration script, the copy command validates the script. In case of any error, the command lists all the lines at the end of the validation process and prompts you to confirm before copying the script file.
url	nvram:script destfilename noval	When you use this option, the copy command will not validate the downloaded script file.
url	nvram:sshkey-dsa	Downloads an SSH key file.
url	nvram:sshkey-rsa1	Downloads an SSH key file.
url	nvram:sshkey-rsa2	Downloads an SSH key file.
url	nvram:sslpem-dhweak	Downloads an HTTP secure-server certificate.
url	nvram:sslpem-dhstrong	Downloads an HTTP secure-server certificate.
url	nvram:sslpem-root	Downloads an HTTP secure-server certificate.
url	nvram:sslpem-server	Downloads an HTTP secure-server certificate.
url	nvram:startup-config	Downloads the startup configuration file to the system.
url	ias-users	Downloads an IAS users database file to the system. When the IAS users file is downloaded, the switch IAS user’s database is replaced with the users and their attributes available in the downloaded file.
url	{active | backup}	Download an image from the remote server to either image.
{active | backup}	url	Upload either image to the remote server.
active	backup	Copy the active image to the backup image.
backup	active	Copy the backup image to the active image.

This command enables digital signature verification while an image and/or configuration file is downloaded to the switch.

file verify {all | image | none | script}

Mode: Global Config

Parameters:

 

all	Verifies the digital signature of both image and configuration files.
image	Verifies the digital signature of image files only.
none	Disables digital signature verification for both images and configuration files.
script	Verifies the digital signature of configuration files.

This command sets the poll interval for SNTP broadcast clients in seconds as a power of two where poll-interval can be a value from 6-10.

sntp broadcast client poll-interval poll-interval

Mode: Global Config

Default: 6

This command enables Simple Network Time Protocol (SNTP) client mode and may set the mode to either broadcast or unicast.

sntp client mode [broadcast | unicast]

Mode: Global Config

Default: Enabled

This command sets the SNTP client port ID to a value from 1-65535. The default value is 0, which means that the SNTP port is not configured by the user. In the default case, the actual client port value used in SNTP packets is assigned by the underlying OS.

sntp client port portid

Mode: Global Config

Default: 0

This command sets the poll interval for SNTP unicast clients in seconds as a power of two where poll-interval can be a value from 6-10.

sntp unicast client poll-interval poll-interval

Mode: Global Config

Default: 6

This command will set the poll timeout for SNTP unicast clients in seconds to a value from 1 to 30.

sntp unicast client poll-timeout poll-timeout

Mode: Global Config

Default: 5

This command will set the poll retry for SNTP unicast clients to a value from 0 to 10.

sntp unicast client poll-retry poll-retry

Mode: Global Config

Default: 1

Use this command to specify the physical or logical interface to use as the source interface (source IP address) for SNTP unicast server configuration. If configured, the address of source Interface is used for all SNTP communications between the SNTP server and the SNTP client. The selected source-interface IP address is used for filling the IP header of management protocol packets. This allows security devices (firewalls) to identify the source packets coming from the specific switch.

If a source-interface is not specified, the primary IP address of the originating (outbound) interface is used as the source address. If the configured interface is down, the SNTP client falls back to its default behavior.

sntp source-interface {slot/port | vlan vlan-id}

Mode: Global Config

Default: 6

This command configures an SNTP server (a maximum of three). The server address can be either an IPv4 address or an IPv6 address. The optional priority can be a value of 1-3, the version a value of 1-4, and the port-id a value of 1-65535.

sntp server {ipaddress | ipv6address | hostname} [priority [version [port-id]]]

Mode: Global Config

This command is used to display SNTP settings and status.

show sntp

Mode: Privileged EXEC

Parameters:

 

Last Update Time	Time of last clock update.
Last Attempt Time	Time of last transmit query (in unicast mode).
Last Attempt Status	Status of the last SNTP request (in unicast mode) or unsolicited message (in broadcast mode).
Broadcast Count	Current number of unsolicited broadcast messages that have been received and processed by the SNTP client since last reboot.
Multicast Count	Current number of unsolicited multicast messages that have been received and processed by the SNTP client since last reboot.

This command is used to display SNTP client settings.

show sntp client

Mode: Privileged EXEC

Parameters:

 

Client Supported Modes	Supported SNTP Modes (Broadcast, Unicast, or Multicast).
SNTP Version	The highest SNTP version the client supports.
Port	SNTP Client Port. The field displays the value 0 if it is default value. When the client port value is 0, if the client is in broadcast mode, it binds to port 123; if the client is in unicast mode, it binds to the port assigned by the underlying OS.
Client Mode	Configured SNTP Client Mode.

This command is used to display SNTP server settings and configured servers.

show sntp server

Mode: Privileged EXEC

Parameters:

 

Server IP Address / Hostname	IP address or hostname of configured SNTP Server.
Server Type	Address type of server (IPv4, IPv6, or DNS).
Server Stratum	Claimed stratum of the server for the last received valid packet.
Server Reference ID	Reference clock identifier of the server for the last received valid packet.
Server Mode	SNTP Server mode.
Server Maximum Entries	Total number of SNTP Servers allowed.
Server Current Entries	Total number of SNTP configured.
Address Type	Address Type of configured SNTP server (IPv4, IPv6, or DNS).
Priority	IP priority type of the configured server.
Version	SNTP Version number of the server. The protocol version used to query the server in unicast mode.
Port	Server Port Number.
Last Attempt Time	Last server attempt time for the specified server.
Last Update Status	Last server attempt status for the server.
Total Unicast Requests	Number of requests to the server.
Failed Unicast Requests	Number of failed requests from server.

Use this command to display the SNTP client source interface configured on the switch.

show sntp source-interface

Mode: Privileged EXEC

Parameters:

 

SNTP Client Source Interface	The interface ID of the physical or logical interface configured as the SNTP client source interface.
SNTP Client Source IPv4 Address	The IP address of the interface configured as the SNTP client source interface.

This command sets the system time and date.

clock set hh:mm:ss

clock set mm/dd/yyyy

Mode: Global Config

Use this command to set the summer-time offset to Coordinated Universal Time (UTC). If the optional parameters are not specified, they are read as either 0 or \0, as appropriate.

clock summer-time date {date month year hh:mm date month year hh:mm} [offset offset] [zone acronym]

Mode: Global Config

Parameters:

 

date	Day of the month. Range is 1 to 31.
month	Month. Range is the first three letters by name; for example, “jan” for January.
year	Year. The range is 2010 to 2079.
hh:mm	Time in 24-hour format in hours and minutes.
offset	The number of minutes to add during the summertime. The range is 1 to 1440.
acronym	The time zone acronym to display when summer-time is in effect. Up to four characters are allowed.

This command sets the summer-time recurring parameters.

clock summer-time recurring {week day month hh:mm week day month hh:mm} [offset offset] [zone acronym]

Mode: Global Config

Parameters:

 

week	Week of the month. The range is 1 to 5, first, last.
day	Day of the week. The range is the first three letters by name; sun, for example.
month	Month. The range is the first three letters by name; jan, for example.
hh:mm	Time in 24-hour format in hours and minutes. The range is hours: 0 to 23, minutes: 0 to 59.
offset	The number of minutes to add during summer-time. The range is 1 to 1440.
acronym	The time zone acronym to display when summer-time is in effect. Up to four characters are allowed.

Use this command to set the offset to Coordinated Universal Time (UTC). If the optional parameters are not specified, they will be read as either 0 or \0 as appropriate.

clock timezone {hours} [minutes minutes] [zone acronym]

Mode: Global Config

Parameters:

 

hours	Hours difference from UTC. The range is -12 to 13.
minutes	Minutes difference from UTC. The range is 0 to 59.
acronym	The acronym for the time zone. Up to four characters are allowed.

Use this command to display the time and date from the system clock.

show clock

Mode: Privileged EXEC

Use this command to display the detailed system time along with the time zone and the summer-time configuration.

show clock detail

Mode: Privileged EXEC

This command configures a DHCP address pool name on a DHCP server and enters DHCP pool configuration mode.

ip dhcp pool name

Mode: Global Config

This command specifies the unique identifier for a DHCP client. The unique-identifier is a valid notation in hexadecimal format. The unique-identifier is a concatenation of the media type and the MAC address, where 01 represents the Ethernet media type. 

client-identifier unique-identifier

Mode: DHCP Pool Config

This command specifies the name for a DHCP client. Name is a string consisting of standard ASCII characters.

client-name name

Mode: DHCP Pool Config

This command specifies the default router address(es) for the DHCP pool. Up to 8 addresses can be specified.

default-router address

Mode: DHCP Pool Config

This command specifies the DNS server address(es) for the DHCP pool. Up to 8 addresses can be specified.

dns-server address

Mode: DHCP Pool Config

This command specifies the hardware address of a DHCP client. Hardware-address is the MAC address of the hardware platform of the client consisting of 6 bytes in dotted hexadecimal format. The type parameter indicates the protocol of the hardware platform. It is 1 for 10 MB Ethernet (default) and 6 for IEEE 802.

hardware-address hardwareaddress type

Mode: DHCP Pool Config

This command specifies the IP address and network mask for a manual binding to a DHCP client.

host address [{mask | prefix-length}]

Mode: DHCP Pool Config

This command configures the duration of the lease for an IP address that is assigned from a DHCP server to a DHCP client. The overall lease time should be between 1-86400 minutes. If you specify infinite, the lease is set for 60 days. You can specify a lease duration in days (0-59), hours (0-23), and minutes (0-59).

lease [{days [hours] [minutes] | infinite}]

Mode: DHCP Pool Config

Default: 1 day (1 0 0)

This command configures the network (for example 192.168.1.0) and mask for a DHCP address pool on the server. 

network network [{mask | prefixlength}]

Mode: DHCP Pool Config

This command specifies the name (filename parameter) of the default boot image for a DHCP client.

bootfile filename

Mode: DHCP Pool Config

This command specifies the domain name (domain parameter) for a DHCP client.

domain-name domain

Mode: DHCP Pool Config

This command enables the domain name functionality.

domain-name enable [name name]

Mode: Global Config

This command configures NetBIOS Windows Internet Naming Service (WINS) name servers that are available to DHCP clients. You can specify up to eight addresses.

netbios-name-server address

Mode: DHCP Pool Config

The command configures the NetBIOS node type for Microsoft Dynamic Host Configuration Protocol (DHCP) clients.

The type specifies the NetBIOS node type. Valid types are:
- b-node: Broadcast
- p-node: Peer-to-peer
- m-node: Mixed
- h-node: Hybrid (recommended)

netbios-node-type type

Mode: DHCP Pool Config

Default: None

This command configures the next server in the boot process of a DHCP client.The address parameter is the IP address of the next server in the boot process, which is typically a TFTP server.

next-server address

Mode: DHCP Pool Config

This command configures DHCP Server options. The code parameter specifies the DHCP option code and ranges from 1-254. The ascii parameter specifies an NVT ASCII character string.

ASCII character strings that contain white space must be delimited by quotation marks. The hex parameter specifies hexadecimal data. In hexadecimal, character strings are two hexadecimal digits. 

option code {ascii string | hex string | ip address

Mode: DHCP Pool Config

This command specifies the IP addresses that a DHCP server should not assign to DHCP clients.

ip dhcp excluded-address low-address high-address

Mode: Global Config

Use this command to specify the number, in a range from 2-10, of packets a DHCP server sends to a pool address as part of a ping operation. By default the number of packets sent to a pool address is 2, which is the smallest allowed number when sending packets. Setting the number of packets to 0 disables this command.

ip dhcp ping packets 0,2-10

Mode: Global Config

Default: 2

This command enables the DHCP server.

service dhcp

Mode: Global Config

Default: Disabled

This command enables allocation of addresses to the bootp client from the automatic address pool.

ip dhcp bootp automatic

Mode: Privileged EXEC

Default: Disabled

This command enables conflict logging on DHCP server.

ip dhcp conflict logging

Mode: Privileged EXEC

Default: Enabled

This command deletes an automatic address binding from the DHCP server database. If an asterisk (*) is specified for the address parameter, the bindings corresponding to all the addresses are deleted. 

clear ip dhcp binding {address | *}

Mode: Privileged EXEC

This command clears DHCP server statistics counters.

clear ip dhcp server statistics

Mode: Privileged EXEC

The command is used to clear an address conflict from the DHCP Server database. The server detects conflicts using a ping. The DHCP server clears all conflicts if an asterisk (*) is used as the address parameter.

clear ip dhcp conflict {address | *}

Mode: Privileged EXEC

This command displays address bindings for the specific IP address on the DHCP server. If no IP address is specified, the bindings corresponding to all the addresses are displayed.

show ip dhcp binding [address]

Modes: User / Privileged EXEC

Parameters:

 

IP address	The IP address of the client.
Hardware Address	The MAC Address or the client identifier.
Lease expiration	The lease expiration time of the IP address assigned to the client.
Type	The manner in which IP address was assigned to the client.

This command displays address bindings for the specific IP address on the DHCP server. If no IP address is specified, the bindings corresponding to all the addresses are displayed.

show ip dhcp global configuration

Modes: User / Privileged EXEC

Parameters:

 

Service DHCP	The field to display the status of dhcp protocol.
Number of Ping Packets	The maximum number of Ping Packets that will be sent to verify that an ip address id not already assigned.
Conflict Logging	Shows whether conflict logging is enabled or disabled.
BootP Automatic	Shows whether BootP for dynamic pools is enabled or disabled.

This command displays pool configuration. If all is specified, configuration for all the pools is displayed.

show ip dhcp pool configuration {name | all}

Modes: User / Privileged EXEC

Parameters:

 

Pool Name	The name of the configured pool.
Pool Type	The pool type.
Lease Time	The lease expiration time of the IP address assigned to the client.
DNS Servers	The list of DNS servers available to the DHCP client.
Default Routers	The list of the default routers available to the DHCP client
Network	The network number and the mask for the DHCP address pool.
Client Name	The name of a DHCP client.
Client Identifier	The unique identifier of a DHCP client.
Hardware Address	The hardware address of a DHCP client.
Hardware Address Type	The protocol of the hardware platform.
Host	The IP address and the mask for a manual binding to a DHCP client.

This command displays DHCP server statistics.

show ip dhcp server statistics

Modes: User / Privileged EXEC

Parameters:

 

Automatic Bindings	The number of IP addresses that have been automatically mapped to the MAC addresses of hosts that are found in the DHCP database.
Expired Bindings	The number of expired leases.
Malformed Bindings	The number of truncated or corrupted messages that were received by the DHCP server.
DHCP DISCOVER	The number of DHCPDISCOVER messages the server has received.
DHCP REQUEST	The number of DHCPREQUEST messages the server has received.
DHCP DECLINE	The number of DHCPDECLINE messages the server has received.
DHCP RELEASE	The number of DHCPRELEASE messages the server has received.
DHCP INFORM	The number of DHCPINFORM messages the server has received.
DHCP OFFER	The number of DHCPOFFER messages the server sent.
DHCP ACK	The number of DHCPACK messages the server sent.
DHCP NACK	The number of DHCPNACK messages the server sent.

This command displays address conflicts logged by the DHCP Server. If no IP address is specified, all the conflicting addresses are displayed.

show ip dhcp conflict [ip-address]

Modes: User / Privileged EXEC

Parameters:

 

IP address	The IP address of the host as recorded on the DHCP server.
Detection Method	The manner in which the IP address of the hosts were found on the DHCP Server.
Detection time	The time when the conflict was found.

Use this command to enable the DNS client.

ip domain lookup

Mode: Global Config

Default: Enabled

Use this command to define a default domain name that EdgeSwitch software uses to complete unqualified host names (names with a domain name). By default, no default domain name is configured in the system. The name may not be longer than 255 characters and should not include an initial period. This name should be used only when the default domain name list, configured using the ip domain list command, is empty.

ip domain name name

Mode: Global Config

Use this command to define a list of default domain names to complete unqualified names. By default, the list is empty. Each name must be no more than 256 characters, and should not include an initial period. The default domain name, configured using the ip domain name command, is used only when the default domain name list is empty. A maximum of 32 names can be entered in to this list.

ip domain list name

Mode: Global Config

Use this command to configure the available name servers. Up to eight servers can be defined in one command or by using multiple commands. The parameter server-address is a valid IPv4 or IPv6 address of the server. The preference of the servers is determined by the order they are entered.

ip name-server server-address1 [server-address2...server-address8]

Mode: Global Config

Use this command to specify the physical or logical interface to use as the DNS client (IP name) source interface (source IP address) for DNS client management application. If configured, the source interface address is used for all DNS communications between the DNS server and the DNS client.

The selected source-interface IP address is used for filling the IP header of management protocol packets. This allows security devices (firewalls) to identify the source packets coming from the specific switch. If a source interface is not specified, the primary IP address of the originating (outbound) interface is used as the source address. If the configured interface is down, the DNS client falls back to its default behavior.

ip name source-interface {slot/port | vlan vlan-id}

Mode: Global Config

Use this command to define static host name-to-address mapping in the host cache. The parameter name is the hostname and ipaddress is the IP address of the host. The host name can include 1-158 alphanumeric characters, periods, hyphens, underscores, and non-consecutive spaces. Hostnames that include one or more space must be enclosed in quotation marks.

ip host name ipaddress

Mode: Global Config

Use this command to define static host name-to-IPv6 address mapping in the host cache. The name is the hostname and v6address is the IPv6 address of the host. The hostname can include 1-158 alphanumeric characters, periods, hyphens, and spaces. Hostnames that include one or more space must be enclosed in quotation marks.

ipv6 host name v6address

Mode: Global Config

Use this command to specify the number of times to retry sending Domain Name System (DNS) queries. The number indicates the number of times to retry sending a DNS query to the DNS server, and ranges from 0-100.

ip domain retry number

Mode: Global Config

Default: 2

Use this command to specify the amount of time to wait for a response to a DNS query. The seconds specifies the time, in seconds, to wait for a response to a DNS query, and ranges from 0-3600.

ip domain timeout seconds

Mode: Global Config

Default: 3

Use this command to delete entries from the host name-to-address cache. This command clears the entries from the DNS cache maintained by the software. This command clears both IPv4 and IPv6 entries.

clear host {name | all}

Mode: Privileged EXEC

Use this command to display the default domain name, a list of name server hosts, the static and the cached list of host names and addresses. The parameter name ranges from 1-255 characters. This command displays both IPv4 and IPv6 entries.

show hosts name

Modes: User / Privileged EXEC

Parameters:

 

Host name	Domain host name.
Default domain	Default domain name.
Default domain list	Default domain list.
Domain Name lookup	DNS client enabled/disabled.
Number of retries	Number of time to retry sending Domain Name System (DNS) queries.
Retry timeout period	Amount of time to wait for a response to a DNS query.
Name servers	Configured name servers.
DNS Client Source Interface	Shows the configured source interface (source IP address) used for a DNS client. The IP address of the selected interface is used as source IP for all communications with the server.

Use this command to display the configured source interface details used for a DNS client. The IP address of the selected interface is used as source IP for all communications with the server.

show ip name source-interface

Mode: Privileged EXEC

This command triggers the switch to run active address conflict detection by sending gratuitous ARP packets for IPv4 addresses on the switch.

ip address-conflict-detect run

Mode: Global Config

This command displays the status information corresponding to the last detected address conflict.

show ip address-conflict

Modes: User / Privileged EXEC

Parameters:

 

Address Conflict Detection Status	Identifies whether the switch has detected an address conflict on any IP address.
Last Conflicting IP Address	The IP Address that was last detected as conflicting on any interface.
Last Conflicting MAC Address	The MAC Address of the conflicting host that was last detected on any interface.
Time Since Conflict Detected	The time in days, hours, minutes and seconds since the last address conflict was detected.

This command clears the detected address conflict status information.

clear ip address-conflict-detect

Modes: User / Privileged EXEC

Use this command capture start to manually start capturing CPU packets for packet trace. The packet capture operates in three modes: capture file, remote capture, and capture line. The command is not persistent across a reboot cycle.

capture start [{all|receive|transmit}]

Mode: Privileged EXEC

Parameters:

 

all	Capture all traffic.
receive	Capture only received traffic.
transmit	Capture only transmitted traffic.

Use the command capture stop to manually stop capturing CPU packets for packet trace.

capture stop

Mode: Privileged EXEC

Use the command start or stop the capture sniffer.

capture sniffer start | stop

Mode: Privileged EXEC

Use this command to configure file capture options. The command is persistent across a reboot cycle.

capture {file|remote|line}

Mode: Global Config

Parameters:

 

file	In the capture file mode, the captured packets are stored in a file on NVRAM. The maximum file size defaults to 524288 bytes. The switch can transfer the file to a TFTP server via TFTP, SFTP, SCP via CLI, and SNMP. The file is formatted in .pcap format, is named cpuPktCapture.pcap, and can be examined using network analyzer tools such as Wireshark. Starting a file capture automatically terminates any remote capture sessions and line capturing. After the packet capture is activated, the capture proceeds until the capture file reaches its maximum size, or until the capture is stopped manually using the CLI command capture stop.
remote	In the remote capture mode, the captured packets are redirected in real time to an external PC running the Wireshark tool. A packet capture server runs on the switch side and sends the captured packets via a TCP connection to the Wireshark tool. When using the remote capture mode, the switch does not store any captured data locally on its file system. You can configure the IP port number for connecting Wireshark to the switch. The default port number is 2002. Starting a remote capture session automatically terminates the file capture and line capturing.
line	In the capture line mode, the captured packets are saved into the RAM and can be displayed on the CLI. Starting a line capture automatically terminates any remote capture session and capturing into a file. There is a maximum 128 packets of maximum 128 bytes that can be captured and displayed in line mode.

Use this command to configure file capture options. The command is persistent across a reboot cycle.

capture remote port portid

Mode: Global Config

Use this command to configure file capture options. The command is persistent across a reboot cycle.

capture file size max-file-size

Mode: Global Config

This command enables wrapping of captured packets in line mode when the captured packets reach full capacity.

capture line wrap

Mode: Global Config

Use this command to display packets captured and saved to RAM. It is possible to capture and save into RAM, packets that are received or transmitted through the CPU. A maximum 128 packets can be saved into RAM per capturing session. A maximum 128 bytes per packet can be saved into the RAM.

If a packet holds more than 128 bytes, only the first 128 bytes are saved; data more than 128 bytes is skipped and cannot be displayed in the CLI.

Capturing packets is stopped automatically when 128 packets are captured and have not yet been displayed during a capture session. Captured packets are not retained after a reload cycle.

show capture packets

Mode: Privileged EXEC

This command is useful to debug accounting configuration and functionality in User Manager.

debug aaa accounting

Mode: Privileged EXEC

Use this command to enable the tracing for AAA in User Manager. This is useful to debug authorization configuration and functionality in the User Manager. Each of the parameters are used to configure authorization debug flags.

debug aaa authorization commands|exec

Mode: Privileged EXEC

Use this command to enable ARP debug protocol messages.

debug arp

Mode: Privileged EXEC

This command displays either the debug trace for either a single event or all events for an interface

debug authentication packet {all | event} interface

Mode: Privileged EXEC

Use this command to enable Auto VOIP debug messages. Use the optional parameters to trace H323, SCCP, or SIP packets respectively.

debug auto-voip [H323|SCCP|SIP|oui]

Mode: Privileged EXEC

This command disables all previously enabled “debug” traces.

debug clear

Mode: Privileged EXEC

This command enables the display of debug trace output on the login session in which it is executed. Debug console display must be enabled in order to view any trace output. The output of debug trace commands will appear on all login sessions for which debug console has been enabled. The configuration of this command remains in effect for the life of the login session. The effect of this command is not persistent across reboots.

debug console

Mode: Privileged EXEC

Default: Disabled

Use this command to view information contained in the crash log file that the system maintains when it experiences an unexpected reset.

The crash log file contains the following information:
- Call stack information in both primitive and verbose forms
- Log Status
- Buffered logging
- Event logging
- Persistent logging
- System Information (output of sysapiMbufDump)
- Message Queue Debug Information
- Memory Debug Information
- Memory Debug Status
- OS Information (output of osapiShowTasks)
- /proc information (meminfo, cpuinfo, interrupts, version and net/sockstat)

debug crashlog {[kernel] crashlog-number [upload url] | proc | verbose | deleteall}

Mode: Privileged EXEC

Default: Disabled

Parameters:

 

kernel	View the crash log file for the kernel
crashlog-number	Specifies the file number to view. The system maintains up to four copies, and the valid range is 1 – 4.
upload url	To upload the crash log to a TFTP server, use the upload keyword and specify the required TFTP server information.
proc	View the application process crashlog.
verbose	Enable the verbose crashlog.
deleteall	Delete all crash log files on the system.

Use this command to download or upload the debug-config.ini file. This file executes CLI commands (including devshell and drivshell commands) on specific predefined events. The debug config file is created manually and downloaded to the switch.

debug debug-config {download url | upload url}

Mode: Privileged EXEC

This command displays debug information about DHCPv4 client activities and traces DHCPv4 packets to and from the local DHCPv4 client.

debug dhcp packet [transmit | receive]

Mode: Privileged EXEC

Use this command to enable 802.1X packet debug trace.

debug dot1x packet

Mode: Privileged EXEC

This command enables tracing of IGMP Snooping packets received and transmitted by the switch.

debug igmpsnooping packet

Mode: Privileged EXEC

This command enables tracing of IGMP Snooping packets transmitted by the switch. Snooping should be enabled on the device and the interface in order to monitor packets for a particular interface.

debug igmpsnooping packet transmit

Mode: Privileged EXEC

This command enables tracing of IGMP Snooping packets received by the switch. Snooping should be enabled on the device and the interface in order to monitor packets for a particular interface.

debug igmpsnooping packet receive

Mode: Privileged EXEC

Use this command to enable debug of IP Protocol packets matching the ACL criteria.

debug ip acl acl-number

Mode: Privileged EXEC

This command displays “debug” information about DHCPv6 client activities and traces DHCPv6 packets to and from the local DHCPv6 client.

debug ipv6 dhcp

Mode: Privileged EXEC

This command enables tracing of LACP packets received and transmitted by the switch.

debug lacp packet

Mode: Privileged EXEC

This command enables tracing of ICMP echo requests and responses. The command traces pings on the network port or service port for switching packages. For routing packages, pings are traced on the routing ports as well.

debug ping packet

Mode: Privileged EXEC

This command enables tracing of spanning tree BPDUs received and transmitted by the switch.

debug spanning-tree bpdu

Mode: Privileged EXEC

This command enables tracing of spanning tree BPDUs received by the switch. Spanning tree should be enabled on the device and on the interface in order to monitor packets for a particular interface.

debug spanning-tree bpdu receive

Mode: Privileged EXEC

This command enables tracing of spanning tree BPDUs transmitted by the switch. Spanning tree should be enabled on the device and on the interface in order to monitor packets on a particular interface.

debug spanning-tree bpdu transmit

Mode: Privileged EXEC

Use the debug tacacs packet command to turn on TACACS+ debugging.

debug tacacs {packet {receive | transmit}} | accounting | authentication

Mode: Privileged EXEC

Parameters:

 

packet receive	Turn on TACACS+ receive packet debugs.
packet transmit	Turn on TACACS+ transmit packet debugs.
accounting	Turn on TACACS+ authentication debugging.
authentication	Turn on TACACS+ authorization debugging.

This command enables debugging for file transfers.

debug transfer

Mode: Privileged EXEC

Use the show debugging command to display enabled packet tracing configurations.

show debugging

Mode: Privileged EXEC

Use this command to specify the protocol used to store the core dump file.

exception protocol {nfs | tftp | none}

Mode: Global Config

Default: none

Use this command to configure the IP address of a remote TFTP server in order to dump core files to an external server.

exception dump tftp-server {ip-address}

Mode: Global Config

Use this command to configure an NFS mount point in order to dump core file to the NFS file system.

exception dump nfs ip-address/dir

Mode: Global Config

Use this command to configure a file-path to dump core file to a TFTP server, NFS mount or USB device subdirectory.

exception dump filepath dir

Mode: Global Config

Use this command to configure a prefix for a core-file name. If hostname is configured the core file name takes the hostname, otherwise the core-file names uses the MAC address when generating a core dump file. The prefix length is 15 characters.

The core file name is generated with the prefix as follows:
- If hostname is selected: file-name-prefix_hostname_Time_Stamp.bin
- If hostname is not selected: file-name-prefix_MAC_Address_Time_Stamp.bin

exception core-file {file-name-prefix | [hostname] | [time-stamp]}

Mode: Global Config

Default: Core

This command enables or disables the switch-chip-register dump in case of an exception. The switch-chip- register dump is taken only for a master unit and not for member units

exception switch-chip-register {enable | disable}

Mode: Global Config

Default: Disabled

Use the write core command to generate a core dump file on demand. The write core test command is helpful when testing the core dump setup. For example, if the TFTP protocol is configured, write core test communicates with the TFTP server and informs the user if the TFTP server can be contacted.

Similarly, if protocol is configured as nfs, this command mounts and unmounts the file system and informs the user of the status.

Write core reloads the switch which is useful when the device malfunctions, but has not crashed. For write core test, the destination file name is used for the TFTP test. Optionally, you can specify the destination file name when the protocol is configured as TFTP.

write core [test [dest_file_name]]

Mode: Privileged EXEC

Use this command to display the configuration parameters for generating a core dump file.

show exception

Mode: Privileged EXEC

Use this command to configure memory buffer (MBUF) threshold limits and generate notifications when MBUF limits have been reached.

mbuf {falling-threshold | rising-threshold | severity}

Mode: Global Config

Parameters:

 

falling-threshold	The percentage of memory buffer resources that, when usage falls below this level for the configured interval, triggers a notification. The range is 1 to 100. The default is 0 (disabled).
rising-threshold	The percentage of the memory buffer resources that, when exceeded for the configured rising interval, triggers a notification. The range is 1 to 100. The default is 0 (disabled).
severity	The severity level at which Mbuf logs messages. The range is 1-7; default is 5 (L7_LOG_SEVERITY_NOTICE).

Use this command to display the memory buffer (MBUF) Utilization Monitoring parameters.

show mbuf

Mode: Privileged EXEC

Parameters:

 

Rising Threshold	The percentage of the memory buffer resources that, when exceeded for the configured rising interval, triggers a notification. The range is 1 to 100. The default is 0 (disabled).
Falling Threshold	The percentage of memory buffer resources that, when usage falls below this level for the configured interval, triggers a notification. The range is 1 to 100. The default is 0 (disabled).
Severity	The severity level.

Use this command to display memory buffer (MBUF) information.

show mbuf total

Mode: Privileged EXEC

Parameters:

 

Mbufs Total	Total number of message buffers in the system.
Mbufs Free	Number of message buffers currently available.
Mbufs Rx Used	Number of message buffers currently in use.
Total Rx Norm Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class RX Norm.
Total Rx Mid2 Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class RX Mid2.
Total Rx Mid1 Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class RX Mid1.
Total Rx Mid0 Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class RX Mid0.
Total Rx High Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class RX High.
Total Tx Alloc Attempts	Number of times the system tried to allocate a message buffer allocation of class TX.
Total Rx Norm Alloc Failures	Number of message buffer allocation failures for RX Norm class of message buffer.
Total Rx Mid2 Alloc Failures	Number of message buffer allocation failures for RX Mid2 class of message buffer.
Total Rx Mid1 Alloc Failures	Number of message buffer allocation failures for RX Mid1 class of message buffer.
Total Rx Mid0 Alloc Failures	Number of message buffer allocation failures for RX Mid0 class of message buffer.
Total Rx High Alloc Failures	Number of message buffer allocation failures for RX High class of message buffer.
Total Tx Alloc Failures	Number of message buffer allocation failures for TX class of message buffer.

This command returns the status of the specified port.

cablestatus slot/port

Mode: Privileged EXEC

Parameters: 

 

Normal	The cable is working correctly.
Open	The cable is disconnected or there is a faulty connector.
Short	There is an electrical short in the cable.
Cable Test Failed	The cable status could not be determined. The cable may in fact be working.
Cable Length	If this feature is supported by the PHY for the current link speed, the cable length is displayed as a range between the shortest estimated length and the longest estimated length. Note that if the link is down and a cable is attached to a 10/100 Ethernet adapter, then the cable status may display as Open or Short because some Ethernet adapters leave unused wire pairs unterminated or grounded. Unknown is displayed if the cable length could not be determined.

This command sets the RMON alarm entry in the RMON alarm MIB group.

rmon alarm alarm-number variable sample-interval {absolute|delta} rising-threshold value [rising-event-index] falling-threshold value

Mode: Global Config

Parameters:

 

alarm-number	An index that uniquely identifies an entry in the alarm table. Each entry defines a diagnostic sample at a particular interval for an object on the device. The range is 1 to 65535.
variable	The object identifier of the particular variable to be sampled. Only variables that resolve to an ASN.1 primitive type of integer.
sample-interval	The interval in seconds over which the data is sampled and compared with the rising and falling thresholds. The range is 1 to 2147483647. The default is 3600.
Alarm Absolute Value	The value of the statistic during the last sampling period. This object is a read-only, 32-bit signed value.
rising-threshold value	The rising threshold for the sample statistics. The range is -2147483648 to 2147483647. The default is 1.
rising-event-index	The index of the eventEntry that is used when a rising threshold is crossed. The range is 1 to 65535. The default is 1.
falling-threshold value	The falling threshold for the sample statistics. The range is -2147483648 to 2147483647. The default is 1.
falling-event-index	The index of the eventEntry that is used when a falling threshold is crossed. The range is 1 to 65535. The default is 2.
startup	The alarm that may be sent. Possible values are rising, falling, or both rising-falling. The default is rising-falling.
owner string	The owner string associated with the alarm entry. The default is monitorAlarm.

This command sets the RMON hcalarm entry in the High Capacity RMON alarm MIB group.

rmon hcalarm alarm-number variable sample-interval {absolute|delta} rising-threshold high value low value status {positive|negative} [rising-event-index] falling-threshold high value low value status {positive|negative} [falling-event-index] [startup {rising|falling|rising-falling}] [owner string]

Mode: Global Config

Parameters:

 

High Capacity Alarm Index	An arbitrary integer index value used to uniquely identify the high capacity alarm entry. The range is 1 to 65535.
High Capacity Alarm Variable	The object identifier of the particular variable to be sampled. Only variables that resolve to an ASN.1 primitive type of integer.
High Capacity Alarm Interval	The interval in seconds over which the data is sampled and compared with the rising and falling thresholds. The range is 1 to 2147483647. The default is 1.
High Capacity Alarm Sample Type	The method of sampling the selected variable and calculating the value to be compared against the thresholds. Possible types are Absolute Value or Delta Value. The default is Absolute Value.
High Capacity Alarm Absolute Value	The absolute value (that is, the unsigned value) of the hcAlarmVariable statistic during the last sampling period. The value during the current sampling period is not made available until the period is complete. This object is a 64-bit unsigned value that is Read-Only.
High Capacity Alarm Absolute Alarm Status	This object indicates the validity and sign of the data for the high capacity alarm absolute value object (hcAlarmAbsValueobject). Possible status types are valueNotAvailable, valuePositive, or valueNegative. The default is valueNotAvailable.
High Capacity Alarm Startup Alarm	High capacity alarm startup alarm that may be sent. Possible values are rising, falling, or rising-falling. The default is rising-falling.
High Capacity Alarm Rising-Threshold Absolute Value Low	The lower 32 bits of the absolute value for threshold for the sampled statistic. The range is 0 to 4294967295. The default is 1.
High Capacity Alarm Rising-Threshold Absolute Value High	The upper 32 bits of the absolute value for threshold for the sampled statistic. The range is 0 to 4294967295. The default is 0.
High Capacity Alarm Rising-Threshold Value Status	This object indicates the sign of the data for the rising threshold, as defined by the objects hcAlarmRisingThresAbsValueLow and hcAlarmRisingThresAbsValueHigh. Possible values are valueNotAvailable, valuePositive, or valueNegative. The default is valuePositive.
High Capacity Alarm Falling-Threshold Absolute Value Low	The lower 32 bits of the absolute value for threshold for the sampled statistic. The range is 0 to 4294967295. The default is 1.
High Capacity Alarm Falling-Threshold Absolute Value High	The upper 32 bits of the absolute value for threshold for the sampled statistic. The range is 0 to 4294967295. The default is 0.
High Capacity Alarm Falling-Threshold Value Status	This object indicates the sign of the data for the falling threshold, as defined by the objects hcAlarmFallingThresAbsValueLow and hcAlarmFallingThresAbsValueHigh. Possible values are valueNotAvailable, valuePositive, or valueNegative. The default is valuePositive.
High Capacity Alarm Rising Event Index	The index of the eventEntry that is used when a rising threshold is crossed. The range is 1 to 65535. The default is 1.
High Capacity Alarm Falling Event Index	The index of the eventEntry that is used when a falling threshold is crossed. The range is 1 to 65535. The default is 2.
High Capacity Alarm Failed Attempts	The number of times the associated hcAlarmVariable instance was polled on behalf of the hcAlarmEntry (while in the active state) and the value was not available. This object is a read-only 32-bit counter value.
High Capacity Alarm Owner	The owner string associated with the alarm entry. The default is monitorHCAlarm.
High Capacity Alarm Storage Type	The type of non-volatile storage configured for this entry. This object is read-only. The default is volatile.

This command sets the RMON event entry in the RMON event MIB group.

rmon event event-number [description string|log|owner string|trap community]

Mode: Global Config

Parameters:

 

Event Index	An index that uniquely identifies an entry in the event table. Each such entry defines one event that is to be generated when the appropriate conditions occur. The range is 1 to 65535.
Event Description	A comment describing the event entry. The default is alarmEvent.
Event Type	The type of notification that the probe makes about the event. Possible values are None, Log, SNMP Trap, Log and SNMP Trap. The default is None.
Event Owner	Owner string associated with the entry. The default is monitorEvent.
Event Community	The SNMP community specific by this octet string which is used to send an SNMP trap. The default is public.

This command sets the history control parameters of the RMON historyControl MIB group.

This command is not supported on interface range. Each RMON history control collection entry can be configured on only one interface. If you try to configure on multiple interfaces, DUT displays an error.

rmon collection history index-number [buckets number | interval interval-in-sec | owner string]

Mode: Interface Config

Parameters:

 

History Control Index	An index that uniquely identifies an entry in the historyControl table. Each such entry defines a set of samples at a particular interval for an interface on the device. The range is 1 to 65535.
History Control Data Source	The source interface for which historical data is collected.
History Control Buckets Requested	The requested number of discrete time intervals over which data is to be saved. The range is 1 to 65535. The default is 50.
History Control Buckets Granted	The number of discrete sampling intervals over which data shall be saved. This object is read-only. The default is 10.
History Control Interval	The interval in seconds over which the data is sampled. The range is 1 to 3600. The default is 1800.
History Control Owner	The owner string associated with the history control entry. The default is monitorHistoryControl.

This command displays the entries in the RMON alarm table.

show rmon {alarms | alarm alarm-index}

Mode: Privileged EXEC

Parameters:

 

Alarm Index	An index that uniquely identifies an entry in the alarm table. Each entry defines a diagnostic sample at a particular interval for an object on the device. The range is 1 to 65535.
Alarm Variable	The object identifier of the particular variable to be sampled. Only variables that resolve to an ASN.1 primitive type of integer.
Alarm Interval	The interval in seconds over which the data is sampled and compared with the rising and falling thresholds. The range is 1 to 2147483647. The default is 1.
Alarm Absolute Value	The value of the statistic during the last sampling period. This object is a read-only, 32-bit signed value.
Alarm Rising Threshold	The rising threshold for the sample statistics. The range is 2147483648 to 2147483647. The default is 1.
Alarm Rising Event Index	The index of the eventEntry that is used when a rising threshold is crossed. The range is 1 to 65535. The default is 1.
Alarm Falling Threshold	The falling threshold for the sample statistics. The range is 2147483648 to 2147483647. The default is 1.
Alarm Falling Event Index	The index of the eventEntry that is used when a falling threshold is crossed. The range is 1 to 65535. The default is 2.
Alarm Startup Alarm	The alarm that may be sent. Possible values are rising, falling or both rising-falling. The default is rising- falling.
Alarm Owner	The owner string associated with the alarm entry. The default is monitorAlarm.

This command displays the entries in the RMON history control table.

show rmon collection history [interfaces slot/port]

Mode: Privileged EXEC

Parameters:

 

History Control Index	An index that uniquely identifies an entry in the historyControl table. Each such entry defines a set of samples at a particular interval for an interface on the device. The range is 1 to 65535.
History Control Data Source	The source interface for which historical data is collected.
History Control Buckets Requested	The requested number of discrete time intervals over which data is to be saved. The range is 1 to 65535. The default is 50.
History Control Buckets Granted	The number of discrete sampling intervals over which data shall be saved. This object is read-only. The default is 10.
History Control Interval	The interval in seconds over which the data is sampled. The range is 1 to 3600. The default is 1800.
History Control Owner	The owner string associated with the history control entry. The default is monitorHistoryControl.

This command displays the entries in the RMON event table.

show rmon events

Mode: Privileged EXEC

Parameters:

 

Event Index	An index that uniquely identifies an entry in the event table. Each such entry defines one event that is to be generated when the appropriate conditions occur. The range is 1 to 65535.
Event Description	A comment describing the event entry. The default is alarmEvent.
Event Type	The type of notification that the probe makes about the event. Possible values are None, Log, SNMP Trap, Log and SNMP Trap. The default is None.
Event Owner	Owner string associated with the entry. The default is monitorEvent.
Event Community	The SNMP community specific by this octet string which is used to send an SNMP trap. The default is public.
Owner	Event owner. The owner string associated with the entry.
Last time sent	The last time over which a log or a SNMP trap message is generated.

This command displays the specified entry in the RMON history table.

show rmon history index {errors [period seconds] | other [period seconds] | throughput [period seconds]}

Mode: Privileged EXEC

Parameters:

 

History Control Index	An index that uniquely identifies an entry in the historyControl table. Each such entry defines a set of samples at a particular interval for an interface on the device. The range is 1 to 65535.
History Control Data Source	The source interface for which historical data is collected.
History Control Buckets Requested	The requested number of discrete time intervals over which data is to be saved. The range is 1 to 65535. The default is 50.
History Control Buckets Granted	The number of discrete sampling intervals over which data shall be saved. This object is read-only. The default is 10.
History Control Interval	The interval in seconds over which the data is sampled. The range is 1 to 3600. The default is 1800.
History Control Owner	The owner string associated with the history control entry. The default is monitorHistoryControl.
Maximum Table Size	Maximum number of entries that the history table can hold.
Time	Time at which the sample is collected, displayed as period seconds.
CRC Align	Number of CRC align errors.
Undersize Packets	Total number of undersize packets. Packets are less than 64 octets long (excluding framing bits, including FCS octets).
Oversize Packets	Total number of oversize packets. Packets are longer than 1518 octets (excluding framing bits, including FCS octets).
Fragments	Total number of fragment packets. Packets are not an integral number of octets in length or had a bad Frame Check Sequence (FCS), and are less than 64 octets in length (excluding framing bits, including FCS octets).
Jabbers	Total number of jabber packets. Packets are longer than 1518 octets (excluding framing bits, including FCS octets), and are not an integral number of octets in length or had a bad Frame Check Sequence (FCS).
Octets	Total number of octets received on the interface.
Packets	Total number of packets received (including error packets) on the interface.
Broadcast	Total number of good Broadcast packets received on the interface.
Multicast	Total number of good Multicast packets received on the interface.
Util	Port utilization of the interface associated with the history index specified.
Dropped Collisions	Total number of dropped collisions.