Diagnosing interface and cable problems: duplex, speed, errors, collisions and cable types

Why this matters

Most network faults that reach a help desk start at the bottom: a cable crushed under a desk, a patch lead in the wrong port, a fiber bent too tightly behind a cabinet door, or a server NIC that negotiated half duplex. A network technician or a junior network engineer meets these every week. The user reports "the network is slow" or "I have no connection", and the answer is sitting in a few lines of show interfaces output, if you know how to read them.

Without this skill, people chase the wrong layer. They change VLANs, reboot servers and open tickets with the internet provider while the real fault is a duplex mismatch that has been dropping frames for a month. A link that is up but full of CRC errors looks healthy on a monitoring dashboard that only checks "up or down". Knowing which counter points to which physical cause turns a day of guessing into a ten-minute fix.

The lesson

Diagnosing copper and fiber faults: status, counters, duplex, speed, distance, signal and pinouts

Every interface problem in this lesson leaves a fingerprint in one of three places: the interface status line, the error counters, or the optical signal levels on a fiber transceiver. Learn to read all three and match each fingerprint to its physical cause.

Start with the status line. show interfaces prints two states on its first line. The first is the physical layer (is there a link signal?). The second, line protocol, is the data link layer (are frames flowing?).

SW1#show interfaces GigabitEthernet1/0/5
GigabitEthernet1/0/5 is administratively down, line protocol is down (disabled)
  Hardware is Gigabit Ethernet, address is 00a3.d1e4.0b05 (bia 00a3.d1e4.0b05)

The four combinations you need to know:

Administratively down always means someone configured shutdown. An unplugged cable never produces it. notconnect means the switch sees no electrical or optical link at all, so the fault is physical: the cable, the jack, the far-end network card, or a device that is turned off. An access VLAN or spanning-tree setting cannot stop the physical link from coming up, so those are not where you start. An err-disabled port was shut down by a feature such as port security or BPDU guard (lessons 12 and 23). You recover it by fixing the cause and then entering shutdown followed by no shutdown.

SW1(config)#interface GigabitEthernet1/0/5
SW1(config-if)#no shutdown
SW1(config-if)#end
%LINK-3-UPDOWN: Interface GigabitEthernet1/0/5, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/5, changed state to up

show interfaces status gives the same picture for every port at once, plus the duplex and speed:

SW1#show interfaces status

Port      Name           Status       Vlan       Duplex  Speed Type
Gi1/0/5   Finance-PC     disabled     10           auto   auto 10/100/1000BaseTX
Gi1/0/7   Print-server   connected    10           full    100 10/100/1000BaseTX
Gi1/0/9                  notconnect   10           auto   auto 10/100/1000BaseTX
Gi1/0/11  Lobby-AP       err-disabled 10           auto   auto 10/100/1000BaseTX
Gi1/0/12  Reception-PC   connected    10         a-full a-1000 10/100/1000BaseTX
Te1/1/1   Uplink-Dist1   connected    trunk        full    10G SFP-10GBase-LR

Notice the a- prefix on Gi1/0/12. It means the value was auto-negotiated. Gi1/0/7 shows full and 100 with no prefix, which means someone hard-coded them. That detail is the start of the duplex story below.

Error counters and what each one points to

Further down show interfaces are the counters. Here is a port that is up but unhealthy:

SW1#show interfaces GigabitEthernet1/0/12
GigabitEthernet1/0/12 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is 00a3.d1e4.0b0c (bia 00a3.d1e4.0b0c)
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 241/255, txload 1/255, rxload 1/255
  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
     1523004 packets input, 210443211 bytes, 0 no buffer
     25 runts, 0 giants, 0 throttles
     1523 input errors, 1498 CRC, 0 frame, 0 overrun, 0 ignored
     2210334 packets output, 301223441 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier

Almost all of the input errors are CRC errors. Every Ethernet frame ends with a frame check sequence, a checksum of its contents. A CRC error means the frame arrived but the checksum no longer matched, so bits changed on the way. On a port where both ends auto-negotiated full duplex, so a duplex mismatch is ruled out, that points to the medium: a damaged cable, a bad connector or termination, or electrical interference from power cables, motors or fluorescent lighting. A wrong VLAN, a native VLAN mismatch or a spanning-tree loop does not corrupt frames, so none of those raise CRC counts.

The other counters, in plain words:

• Runts are frames shorter than the 64-byte Ethernet minimum, usually fragments left by collisions or by a duplex mismatch.
• Giants are frames larger than the maximum frame size the port accepts. They suggest an MTU mismatch, not a cable fault.
• Input errors is the total of the receive problems, including runts, giants, CRC, frame and overrun errors.
• Overruns count frames the hardware could not move into its buffers fast enough. Throttles count times the interface paused receiving because the system was busy. Neither is a cabling fault.
• Collisions count normal collisions on a half-duplex segment. On a full-duplex link the number should be zero.
• Late collisions are collisions detected after the first 64 bytes of a frame have been sent. On a correctly built network that cannot happen, so they point to a duplex mismatch or a cable longer than the standard allows.
• Output drops (shown on the queueing line) mean the port had more to send than its bandwidth allowed. That is congestion, not a broken cable.

Counters add up from the last reload. A port that had a bad cable last month still shows those errors today. Before you judge, run clear counters, wait, and look again. It zeroes the statistics so that new errors stand out. It does not reset the interface, renegotiate speed or touch the MAC address table.

SW1#clear counters GigabitEthernet1/0/12
Clear "show interface" counters on this interface [confirm]
SW1#

Duplex and speed mismatches

Half duplex means a device either sends or receives at one moment, and listens for collisions while it sends. Full duplex means it sends and receives at the same time and ignores collision detection. A duplex mismatch happens when the two ends of one link disagree.

The usual cause is a port hard-coded on one end while the other end is left on auto-negotiation. Auto-negotiation only works if both ends take part. When one end is fixed, the auto end can still sense the speed from the signal, which is called parallel detection, but it cannot learn the duplex. For 10 and 100 Mbps, the IEEE fallback is then half duplex.

Follow the example from the show interfaces status output. Gi1/0/7 is fixed:

SW1(config)#interface GigabitEthernet1/0/7
SW1(config-if)#speed 100
SW1(config-if)#duplex full

The print server's NIC is on auto. It detects 100 Mbps, cannot learn the duplex, and falls back to half duplex. The link comes up, so nothing looks wrong at first. Then the two sides behave differently:

• The half-duplex side (the server) sees the switch transmit while it is itself sending, believes that is a collision, and because it happens partway through a frame it counts late collisions.
• The full-duplex side (the switch port) does not stop when the server sends, and it receives the frames the server abandoned partway. It counts CRC errors and runts.

So you check the half-duplex end for late collisions and the full-duplex end for CRC errors and runts. Users notice a link that works but is slow, especially under load. The fix is to set both ends the same way. Best practice is auto on both ends; if a policy says hard-code, hard-code both.

A speed mismatch is different. If both ends are fixed at different speeds, say 100 on one and 10 on the other, no link forms and the port stays down/down. Gigabit copper (1000BASE-T) needs auto-negotiation to bring the link up at 1000, so do not disable it on gigabit ports without a good reason.

Copper cable types, pinouts and distance

Twisted-pair Ethernet standards you should recognise:

All of them allow a channel of up to 100 metres from switch to device. Past that, the signal weakens (attenuation) and picks up noise. A 140-metre run often still links, but the receiver logs CRC errors because frames arrive damaged. Long cables also delay signals, which can add late collisions on half-duplex links.

Pinouts matter for 10BASE-T and 100BASE-TX, which use two pairs. A PC transmits on pins 1 and 2 and receives on pins 3 and 6. A switch does the reverse. So:

• A straight-through cable has the same wiring at both ends (for example T568B at both ends). It connects unlike devices: PC to switch, router to switch.
• A crossover cable is T568A at one end and T568B at the other, so pins 1 and 2 at one end land on pins 3 and 6 at the other. It traditionally connects like devices: switch to switch, PC to PC, router to router.
• A rollover (console) cable reverses all eight pins: pin 1 to pin 8, pin 2 to pin 7, and so on. It connects a laptop's serial or USB adapter to a router or switch RJ-45 console port. It is not an Ethernet cable.

Modern ports remove most of this worry. Auto-MDIX detects that the pairs are the wrong way round and swaps transmit and receive inside the port. That is why two switches joined by a straight-through cable still link up. Auto-MDIX is a separate feature from auto-negotiation of speed and duplex; negotiation agrees settings, MDIX fixes pairs. Gigabit and 10-gigabit copper use all four pairs in both directions, and their ports handle the pair arrangement themselves.

Fiber types, distance and signal levels

Fiber has no electrical interference problem, but it has its own faults. There are two kinds of fiber:

• Multimode fiber has a wide core and uses short-wavelength light, usually 850 nm. It is cheaper and suits links inside a building, up to a few hundred metres.
• Single-mode fiber has a very narrow core and uses longer wavelengths, 1310 nm or 1550 nm. It reaches kilometres and suits links between buildings and sites.

Common transceivers:

So an 8 km link between two buildings at 10 Gbps needs 10GBASE-LR over single-mode fiber. SR optics would not reach, and copper stops at 100 metres.

A fiber link uses two strands, one for each direction. Each transceiver transmits on one strand and receives on the other. Modern optics report their own health through digital optical monitoring, and show interfaces transceiver displays it, including receive power in dBm:

SW1#show interfaces transceiver
++ : high alarm, +  : high warning, -  : low warning, -- : low alarm.

                                           Optical   Optical
           Temperature  Voltage  Current   Tx Power  Rx Power
Port       (Celsius)    (Volts)  (mA)      (dBm)     (dBm)
---------  -----------  -------  --------  --------  --------
Gi1/1/2       31.4       3.29      21.8      -5.6     -40.0 --
Te1/1/1       29.9       3.30      35.2      -2.1      -3.4

The dBm scale is logarithmic, and more negative means weaker. Te1/1/1 is receiving a healthy -3.4 dBm. Gi1/1/2 reads -40.0 dBm with a low alarm, which in practice means no light at all. show interfaces status does not show these values, so use the transceiver command for signal levels.

Reason about which strand is dark:

• One side dark, the other side normal: light reaches one switch but not the other, so only one path is broken. Suspect a break, a dirty or damaged connector, or a failed transmitter on that strand.
• Both sides dark, with both transmitters working: the strands are probably swapped at a patch panel, so each transmitter is facing the other side's transmitter.
• Receive power lower than before, with rising input errors: the light is getting through but weakened. After work in a cabinet, the usual causes are a fiber bent tighter than its minimum bend radius, or a dirty or scratched connector. Clean and inspect the connectors and re-route the patch lead.

A duplex mismatch, a VLAN change or a spanning-tree recalculation cannot change optical power, so ignore them when the dBm reading has dropped.

A troubleshooting order that works

1. Read the status line. Administratively down is configuration. notconnect is physical. err-disabled has a logged reason.
2. Check duplex and speed in show interfaces status. A hard-coded value facing an a- value on the other device is a warning.
3. Clear the counters, wait, and see which counters are still rising.
4. Match the counter to the cause: CRC on a full-duplex port with no collisions, once a duplex mismatch is ruled out, means cable, connector or interference. Late collisions mean duplex mismatch or excessive length. Giants mean MTU.
5. On fiber, read the receive power, and work out which strand is at fault.
6. Swap the patch lead or the optic with a known-good one to confirm.

What the exam is really asking

• Administratively down versus notconnect. Administratively down is always the shutdown command. notconnect is almost always physical; the exception is two ends hard-coded to different speeds. err-disabled is a feature shutting the port.
• Which side counts what in a duplex mismatch. Late collisions on the half-duplex side; CRC errors and runts on the full-duplex side. The hard-coded end usually stays full; the auto end falls back to half.
• Duplex mismatch versus speed mismatch. A duplex mismatch links up and performs badly. Two fixed, different speeds do not link at all.
• CRC errors versus Layer 2 settings. CRC errors come from the medium or a duplex mismatch, never from VLANs, native VLAN mismatches or spanning tree.
• Runts versus giants. Runts are under 64 bytes; giants are over the maximum size.
• Crossover versus rollover. Crossover swaps pins 1 and 2 with 3 and 6, for Ethernet. Rollover reverses all eight pins, for the console port. Auto-MDIX is why a straight-through cable works between switches.
• SX, LX, SR, LR. S means short wavelength (850 nm) on multimode. L means long wavelength (1310 nm) on single-mode. 10GBASE-T is the copper one, on Category 6A, up to 100 metres.
• Reading dBm. About -40 dBm is no light. One dark receiver points to one broken strand; a gradual drop points to bends or dirty connectors.
• clear counters zeroes statistics; it does not reset anything else.