SkarpChapter 6 of 29
Ethernet, Interfaces, and Troubleshooting Physical Issues
Look under the hood of Ethernet links to understand cabling types, duplex and speed mismatches, and common interface errors that can cripple performance.
Ethernet Overview and Where Physical Issues Fit
Where This Module Fits
This module connects your IP knowledge down to the physical Ethernet links that carry packets. Many "network is slow" problems are actually Layer 1–2 issues: bad cables, wrong duplex, or physical errors.
Modern Ethernet Reality
Today Ethernet is almost always switched, full-duplex, point-to-point. Legacy hubs and half-duplex are rare in production but still appear in exam questions, so you must understand both models.
CCNA Focus Areas
You must recognize cabling types, understand interface status, speed, and duplex, read interface counters (collisions, CRCs), and fix mismatches with the right Cisco IOS commands.
Bottom-Up Troubleshooting
Troubleshoot from the bottom up: Layer 1 (is the cable/light OK?), Layer 2 (are frames error-free?), then Layer 3 (are IP and the default gateway configured correctly?).
Copper vs Fiber: Types, Distances, and Use Cases
Copper (UTP) Basics
Copper twisted-pair (UTP) uses RJ-45 connectors and standards like 100BASE-TX, 1000BASE-T, and 10GBASE-T. It usually supports up to 100 m, is cheap, easy to work with, and supports PoE.
Multimode Fiber (MMF)
Multimode fiber has a larger core and carries multiple light paths. It is common for short to medium campus runs, with LC or SC connectors, and distances typically a few hundred meters.
Single-Mode Fiber (SMF)
Single-mode fiber has a tiny core and carries a single light mode. It is used for long-distance campus and WAN links, often several kilometers or more, but optics are more expensive.
Typical Deployment Pattern
In real networks, copper connects access switches to end devices, while fiber connects switches to each other and to data centers, using MMF for short and SMF for long links.
Connectors, Transceivers, and Visual Clues
RJ-45 Copper Connectors
RJ-45 connectors are clear plastic 8P8C plugs used for twisted-pair Ethernet. Switch ports and patch panels present RJ-45 jacks; patch cables have RJ-45 plugs with 8 visible gold pins.
Common Fiber Connectors
LC connectors are small and common on SFPs; SC are larger squares; ST are older round bayonet types. Orange or aqua jackets usually indicate multimode; yellow usually indicates single-mode.
Transceiver Modules
SFP and SFP+ modules slide into switch slots and provide the optical or copper interface. You then plug the fiber or copper patch into the module. `show inventory` reveals module types.
Physical Inspection Tips
Check that fiber type matches the optic, connectors are clean and fully seated, and copper cables are firmly clicked in with no sharp bends or visible damage.
Shared vs Switched Ethernet, Half vs Full Duplex
Shared-Media Ethernet
With hubs, all devices share one collision domain. Only one can talk at a time. This is half-duplex and uses CSMA/CD; collisions are expected and handled by backoff and retransmission.
Switched Ethernet
With switches, each access port is its own collision domain. Links are point-to-point and usually full-duplex, so devices can send and receive at the same time with no collisions.
Duplex Modes
Half-duplex means send or receive, not both, and collisions occur. Full-duplex means simultaneous send and receive with collisions disabled. Modern links should be full-duplex.
Key Exam Trap
On modern networks, collisions usually indicate a duplex mismatch, not a hub. Collisions belong to half-duplex; CRC or input errors without collisions point to cabling or speed/duplex issues.
Interface Status, Speed, and Duplex on Cisco Devices
Admin vs Line Status
`show ip interface brief` shows each interface with Status and Protocol. Up/up means working link; administratively down/down means shutdown; down/down often means no or bad cable.
Viewing Speed and Duplex
`show interfaces` and `show interfaces status` reveal duplex and speed. Look for lines like "Full-duplex, 1000Mb/s" and columns labeled Duplex and Speed for many ports at once.
Configuring Interfaces
In interface config mode you can set `speed` and `duplex`, and use `shutdown` or `no shutdown`. Autonegotiation is common, but mismatched manual settings can create problems.
Operational Practices
Access ports to PCs often use auto/auto at both ends. Switch-to-switch or switch-to-server links are frequently hard-set to matching speed and duplex on both sides.
Common Physical and Duplex Problems in Practice
Scenario 1: Unplugged Cable
If a cable is unplugged or bad, `show ip interface brief` shows down/down, and `show interfaces` may say notconnect. The link LED is off and pings fail. Fix by checking and replacing the cable.
Scenario 2: Duplex Mismatch
With full on one side and half on the other, the link stays up but runs badly. The full-duplex side shows many input and CRC errors; the half-duplex side shows lots of collisions.
Fixing Duplex Mismatch
Resolve duplex mismatches by making both ends match: either both `auto` or both hard-set to the same speed and duplex. After fixing, errors and collisions should stop increasing.
Scenario 3: Speed/Optic Mismatch
If speeds or optic types are incompatible, the interface often stays down/down. For example, 1G SX on one side and 10G SR on the other will not link. Use matching speeds and optics.
Thought Exercise: Reading Interface Symptoms
Work through these scenarios mentally. Try to decide the most likely cause before looking up commands or notes.
Scenario A
- `show ip interface brief` on a switch shows:
- `Gi0/5 192.168.10.2 YES manual up down`
- `show interfaces gi0/5` shows:
- `line protocol is down (err-disabled)`
- Last error: `link-flap` or `port security` violation.
Questions:
- Is this a physical cabling problem, a configuration problem, or both?
- What command would you use to see why the port is err-disabled?
- How would you bring the port back into service after fixing the root cause?
Scenario B
- `show interfaces gi0/10`:
- `Full-duplex, 1000Mb/s`
- `0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored`
- `0 collisions, 0 late collisions`
- Users on that port complain of slowness, but interface counters look clean.
Questions:
- Is this likely a Layer 1–2 problem, or should you look higher in the stack?
- What next checks would you perform? (Think: IP addresses, default gateway, DNS, server load.)
Scenario C
- `show interfaces gi0/3`:
- `Half-duplex, 100Mb/s`
- `input errors: 2000, CRC: 1500, late collisions: 300`
Questions:
- What is the most likely root cause?
- Which device(s) would you reconfigure, and to what speed/duplex values?
Use these as practice to build a habit: always map symptoms → layer → likely cause → fix.
Configuring and Verifying Interfaces on Cisco IOS
Practice these commands in a lab or simulator. They are core CCNA skills for fixing physical issues.
```bash
! 1. Check overall interface status
show ip interface brief
! 2. Check detailed counters and duplex/speed
show interfaces gigabitEthernet0/1
! 3. Check many ports at once (if supported by platform)
show interfaces status
! 4. Enter interface configuration mode
configure terminal
interface gigabitEthernet0/1
! 5. Enable the interface
no shutdown
! 6. Set speed and duplex explicitly (example: 1000 Mbps, full-duplex)
speed 1000
duplex full
! Or let the interface autonegotiate
speed auto
duplex auto
! 7. Verify changes
end
show interfaces gigabitEthernet0/1
! 8. Example: troubleshooting a suspected duplex mismatch
! Step A: Look at counters over time
show interfaces gigabitEthernet0/2
! Wait 30–60 seconds, run again to see if input errors/CRC/late collisions increase
show interfaces gigabitEthernet0/2
! Step B: Fix by matching both sides (assuming the other side is auto)
configure terminal
interface gigabitEthernet0/2
speed auto
duplex auto
no shutdown
end
! Step C: Confirm that errors stop increasing
show interfaces gigabitEthernet0/2
! 9. Example: bringing up a fiber uplink
show inventory ! identify SFP type
show interfaces status ! check notconnect vs connected
configure terminal
interface gigabitEthernet1/0/1
no shutdown
! Speed may be fixed by the SFP (e.g., 1000 only)
end
show interfaces gigabitEthernet1/0/1
```
Focus on the workflow: show → interpret → configure → show again. That loop is at the heart of physical-layer troubleshooting.
Quick Check: Media and Duplex Concepts
Test your understanding of cabling types and duplex behavior.
Which statement is MOST accurate for a modern Ethernet link between a switch and a PC in 2026?
- It uses half-duplex over a shared hub, so collisions are normal.
- It is a point-to-point full-duplex link, and collisions should not occur.
- It must use single-mode fiber to avoid duplex mismatches.
- It cannot use autonegotiation; speed and duplex must always be hard-set.
Show Answer
Answer: B) It is a point-to-point full-duplex link, and collisions should not occur.
Modern access links are almost always point-to-point connections between a NIC and a switch port, running full-duplex. In full-duplex, collisions do not occur. Hubs and half-duplex are legacy, fiber is optional (copper is still common), and autonegotiation is widely used and usually works well.
Quick Check: Reading Interface Errors
Apply what you have learned to a realistic interface output.
You run `show interfaces gi0/2` and see: `Full-duplex, 100Mb/s`, `input errors: 3500`, `CRC: 3200`, `0 collisions`. What is the MOST likely cause?
- The link is operating normally; these counters are expected.
- A duplex mismatch between this device and the far end.
- A speed mismatch where one side is 100 Mb/s and the other is 10 Mb/s.
- Incorrect IP address and default gateway configuration.
Show Answer
Answer: B) A duplex mismatch between this device and the far end.
High input and CRC errors with zero collisions on a full-duplex link strongly suggest a duplex mismatch. The other side is likely running half-duplex, causing frame corruption. Speed mismatches usually prevent the link from coming up at all, and IP misconfiguration would not create Layer 1/2 CRC errors.
Key Term Review: Ethernet and Interfaces
Flip through these cards to reinforce terminology before moving on.
- Collision domain
- A set of network devices in which a frame sent by one can collide with frames sent by others. In modern networks, each switch port is typically its own collision domain.
- Half-duplex
- An Ethernet mode where a device can either send or receive at a given time, but not both simultaneously. Collisions can occur, and CSMA/CD is used to manage access.
- Full-duplex
- An Ethernet mode where a device can send and receive simultaneously on a point-to-point link. Collisions do not occur and CSMA/CD is effectively disabled.
- CRC error
- A frame whose checksum does not match its contents, indicating corruption in transit. Often caused by duplex mismatches, bad cabling, or electrical interference.
- Late collision
- A collision detected after the first 64 bytes of a frame have been transmitted. Commonly associated with duplex mismatches or cabling problems in half-duplex environments.
- Multimode fiber (MMF)
- Fiber optic cable with a larger core that carries multiple light paths. It is typically used for short to medium distances within buildings or campuses.
- Single-mode fiber (SMF)
- Fiber optic cable with a very small core that carries a single light path. It supports much longer distances, often used for campus backbones and WAN links.
- Autonegotiation
- An Ethernet mechanism where devices exchange capabilities and agree on the highest common speed and duplex settings. Widely used on copper links.
- SFP (Small Form-factor Pluggable)
- A modular transceiver used in network devices to provide fiber or copper interfaces. SFP typically supports 1 Gbps; SFP+ supports 10 Gbps.
- err-disabled state
- A switch port state where the port is shut down by the switch due to an error condition such as link flapping, BPDU guard, or port security violations. It must be manually or automatically recovered.
Key Terms
- SFP
- A modular transceiver used in network devices to provide fiber or copper interfaces. SFP typically supports 1 Gbps; SFP+ supports 10 Gbps.
- CRC error
- A frame whose checksum does not match its contents, indicating corruption in transit. Often caused by duplex mismatches, bad cabling, or electrical interference.
- Full-duplex
- An Ethernet mode where a device can send and receive simultaneously on a point-to-point link. Collisions do not occur and CSMA/CD is effectively disabled.
- Half-duplex
- An Ethernet mode where a device can either send or receive at a given time, but not both simultaneously. Collisions can occur, and CSMA/CD is used to manage access.
- Late collision
- A collision detected after the first 64 bytes of a frame have been transmitted. Commonly associated with duplex mismatches or cabling problems in half-duplex environments.
- Autonegotiation
- An Ethernet mechanism where devices exchange capabilities and agree on the highest common speed and duplex settings. Widely used on copper links.
- Collision domain
- A set of network devices in which a frame sent by one can collide with frames sent by others. In modern networks, each switch port is typically its own collision domain.
- err-disabled state
- A switch port state where the port is shut down by the switch due to an error condition such as link flapping, BPDU guard, or port security violations. It must be manually or automatically recovered.
- Multimode fiber (MMF)
- Fiber optic cable with a larger core that carries multiple light paths. It is typically used for short to medium distances within buildings or campuses.
- Single-mode fiber (SMF)
- Fiber optic cable with a very small core that carries a single light path. It supports much longer distances, often used for campus backbones and WAN links.