Tell the four port-down states apart

short · 45 min · Objective 5.2

Task

"The port is down" has at least four distinct meanings, each pointing at a different cause. Produce each state on a lab interface and read how it presents, so that in an exam scenario the state name alone tells you where to look.

Steps

  1. Record the healthy state: ip link show eth1 reports the interface UP with LOWER_UP, meaning both the administrative state and the physical carrier are good. This is your reference.
  2. Produce administratively down: sudo ip link set eth1 down. Read it back — the flags no longer show UP. This state means someone disabled the port deliberately; the fix is to enable it, but only after finding out why it was disabled, because a port shut as a security response should not be casually re-enabled. Bring it back with sudo ip link set eth1 up.
  3. Produce down/down (no carrier): with the interface administratively up, disconnect the virtual cable in the hypervisor. ip link show eth1 now shows NO-CARRIER. This is the physical-signal-absent state — cable, far-end device off, wrong port, failed transceiver. Reconnect the virtual cable.
  4. Read the negotiated link with sudo ethtool eth1 and note that "up/down" on real gear — line up but protocol down — corresponds to a link with carrier but no working layer 2, caused by an encapsulation or VLAN mismatch or a duplex problem. Note what would produce it here.
  5. Summarise: for each state, write the one cause you would check first.

Verify

ip link show eth1
sudo ethtool eth1 | grep -E "Link detected|Speed|Duplex"
ip -br link show eth1

The ip -br link one-line output naming the state — UP, DOWN, or the carrier flag — is the single reading that distinguishes the four cases. Paired with ethtool's "Link detected: yes/no", you can separate an administrative shutdown (link would detect if enabled) from a genuine carrier loss (no link detected), which is the distinction the exam turns into a question.

Notes

Two more states complete the set on managed switches. Error-disabled (err-disabled) means the switch shut the port down itself in response to a detected condition — a port-security violation, a BPDU arriving on a PortFast port, link flapping, or a duplex mismatch. The log message names the trigger, and the important move is to fix the cause before re-enabling, or it happens again. Suspended refers to a port removed from a link-aggregation bundle because its configuration does not match the other members; the port is physically fine and the fix is to make the configuration match.

The reason to learn these precisely is that they are not degrees of the same problem — they are different problems that share the word "down". Administratively down is a decision, down/down is a physical fault, up/down is a layer 2 mismatch, and err-disabled is a protection that has already fired.