Chapter 40 Show Commands

Transcription

1 Chapter 40 Show Commands show 802-1w Displays a summary of 802.1W information. ProCurveRS(config)# show 802-1w --- VLAN 1 [ STP Instance owned by VLAN 1 ] VLAN 1 BPDU cam_index is 2 and the IGC and DMA master Are(HEX) Bridge IEEE 802.1W Parameters: Bridge Bridge Bridge Bridge Force tx Identifier MaxAge Hello FwdDly Version Hold hex sec sec sec cnt e Default 3 RootBridge RootPath DesignatedBri- Root Max Fwd Hel Identifier Cost dge Identifier Port Age Dly lo hex hex sec sec sec e0804c9c e0804c9c Port IEEE 802.1W Parameters: <--- Config Params --> < Current state > Port Pri PortPath P2P Edge Role State Designa- Designated Num Cost Mac Port ted cost bridge F F ROOT FORWARDING e0804c9c F F DESIGNATED FORWARDING e F F DESIGNATED FORWARDING e F F BACKUP DISCARDING e Syntax: show 802-1w [vlan <vlan-id>] The vlan <vlan-id> parameter displays 802.1W information for the specified port-based VLAN. June

2 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches The show 802.1w display command shows the information listed in Table Table 40.1: CLI Display of 802.1W Summary This Field... VLAN ID Displays... The port-based VLAN that owns the STP instance. VLAN 1 is the default VLAN. If you have not configured port-based VLANs on this device, all 802.1W information is for VLAN 1. Bridge IEEE 802.1W Parameters Bridge Identifier Bridge Max Age Bridge Hello Bridge FwdDly Force-Version txholdcnt Root Bridge Identifier Root Path Cost Designated Bridge Identifier Root Port Max Age The ID of the bridge. The configured max age for this bridge. The default is 20. The configured hello time for this bridge.the default is 2. The configured forward delay time for this bridge. The default is 15. The configured force version value. One of the following value is displayed: 0 The bridge has been forced to operate in an STP compatibility mode. 2 The bridge has been forced to operate in an 802.1W mode. (This is the default.) The number of BPDUs that can be transmitted per Hello Interval. The default is 3. ID of the Root bridge that is associated with this bridge The cost to reach the root bridge from this bridge. If the bridge is the root bridge, then this parameter shows a value of zero. The bridge from where the root information was received.it can be from the root bridge itself, but it could also be from another bridge. The port on which the root information was received. This is the port that is connected to the Designated Bridge. The max age is derived from the Root port. An 802.1W-enabled bridge uses this value, along with the hello and message age parameters to compute the effective age of an RST BPDU. The message age parameter is generated by the Designated port and transmitted in the RST BPDU. RST BPDUs transmitted by a Designated port of the root bridge contains a message value of zero. Effective age is the amount of time the Root port, Alternate port, or Backup port retains the information it received from its peer Designated port. Effective age is reset every time a port receives an RST BPDU from its Designated port. If a Root port does not receive an RST BPDU from its peer Designated port for a duration more than the effective age, the Root port ages out the existing information and recomputes the topology. If the port is operating in 802.1D compatible mode, then max age functionality is the same as in 802.1D (STP) June 2005

3 Show Commands Table 40.1: CLI Display of 802.1W Summary (Continued) This Field... Fwd Dly Hello Displays... The number of seconds a non-edge Designated port waits until it can apply any of the following transitions, if the RST BPDU it receives does not have an agreed flag: Discarding state to learning state Learning state to forwarding state This is also the number of seconds that a Root port waits for an RST BPDU with a proposal flag before it applies the state transitions listed above. If the port is operating in 802.1D compatible mode, then forward delay functionality is the same as in 802.1D (STP). The hello value derived from the Root port. It is the number of seconds between two Hello packets. Port IEEE 802.1W Parameters Port Num Pri Port Path Cost P2P Mac Edge port Role State Designated Cost The port number shown in a slot#/port# format. The configured priority of the port. The default is 128 or 0x80. The configured path cost on a link connected to this port. Indicates if the point-to-point-mac parameter is configured to be a point-to-point link: T The link is configured as a point-to-point link. F The link is not configured as a point-to-point link. This is the default. Indicates if the port is configured as an operational Edge port: T The port is configured as an Edge port. F The port is not configured as an Edge port. This is the default. The current role of the port: Root Designated Alternate Backup Disabled The port s current 802.1W state. A port can have one of the following states: Forwarding Discarding Learning Disabled The best root path cost that this port received, including the best root path cost that it can transmit. June

4 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches Table 40.1: CLI Display of 802.1W Summary (Continued) This Field... Designated Bridge Displays... The ID of the bridge that sent the best RST BPDU that was received on this port. Default values: N/A show 802-1w detail Display detailed information about 802-1W. ProCurveRS(config)# show 802-1w detail ====================================================================== VLAN 1 - MULTIPLE SPANNING TREE (MSTP - IEEE 802.1W) ACTIVE ====================================================================== BridgeId e , forceversion 2, txholdcount 3 Port 1 - Role: ROOT - State: FORWARDING PathCost , Priority 128, AdminOperEdge F, AdminPt2PtMac F DesignatedPriority - Root: 0x800000e0804c9c00, Bridge: 0x800000e ActiveTimers - rrwhile 4 rcvdinfowhile 4 MachineStates - PIM: CURRENT, PRT: ROOT_PORT, PST: FORWARDING TCM: ACTIVE, PPM: SENDING_STP, PTX: TRANSMIT_IDLE Received - RST BPDUs 0, Config BPDUs 1017, TCN BPDUs 0 Port 2 - Role: DESIGNATED - State: FORWARDING PathCost , Priority 128, AdminOperEdge F, AdminPt2PtMac F DesignatedPriority - Root: 0x800000e0804c9c00, Bridge: 0x800000e ActiveTimers - hellowhen 0 MachineStates - PIM: CURRENT, PRT: DESIGNATED_PORT, PST: FORWARDING TCM: ACTIVE, PPM: SENDING_RSTP, PTX: TRANSMIT_IDLE Received - RST BPDUs 0, Config BPDUs 0, TCN BPDUs 0 Syntax: show 802-1w detail [vlan <vlan-id>] The vlan <vlan-id> parameter displays 802.1W information for the specified port-based VLAN. show aaa Displays information about all TACACS+ and RADIUS servers identified on the device June 2005

5 Show Commands ProCurveRS# show aaa Tacacs+ key: HPhp Tacacs+ retries: 1 Tacacs+ timeout: 15 seconds Tacacs+ dead-time: 3 minutes Tacacs+ Server: Port:49: opens=6 closes=3 timeouts=3 errors=0 packets in=4 packets out=4 no connection Radius key: networks Radius retries: 3 Radius timeout: 3 seconds Radius dead-time: 3 minutes Radius Server: Auth Port=1645 Acct Port=1646: opens=2 closes=1 timeouts=1 errors=0 packets in=1 packets out=4 no connection Syntax: show aaa show access-list Displays information for ACLs. Here is an example of the output for hardware-based ACLs on an EP device running software release b or later. ProCurveRS(config)# show access-list all Extended IP access list 100 (Total flows: N/A, Total packets: N/A, Total rule cam use: 3) permit udp host any (Flows: N/A, Packets: N/A, Rule cam use: 1) permit icmp any any (Flows: N/A, Packets: N/A, Rule cam use: 1) deny ip any any (Flows: N/A, Packets: N/A, Rule cam use: 1) The following is an example of the output when a comment text has been configured for an ACL. ProCurveRS# show access-list TCP/UDP IP access list rate-limit 100 aaaa.bbbb.cccc Extended IP access list TCP/UDP (Total flows: N/A, Total packets: N/A) ACL Comments: The following line permits TCP packets permit tcp (Flows: N/A, Packets: N/A) ACL Comments: The following line permits UDP packets permit udp (Flows: N/A, Packets: N/A) deny ip any any (Flows: N/A, Packets: N/A) On devices running Enterprise software release and later, the display include line number for ACL entries: ProCurveRS# show access-list 99 Standard IP access list 99 June

6 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches 1. deny host deny host permit any Total number of entries in ACL 99: 3 Grand total number of entries in all ACLs: 200 Syntax: show access-list all <acl-number> begin <keyword> exclude <keyword> include <keyword> The Rule cam use field lists the number of CAM entries used by the ACL or entry. The number of CAM entries listed for the ACL itself is the total of the CAM entries used by the ACL s entries. For flow-based ACLs, the Total flows and Flows fields list the number of Layer 4 session table flows in use for the ACL. The Total packets and Packets fields apply only to flow-based ACLs. The all parameter displays the entire access list. Enter the <acl-number> to display the contents of a specific ACL. On devices running Enterprise software release and later, you can use the operator to display a portion of the access list on the device and you can use keywords to limit the ACLs on the output. Enter the begin <keyword> parameter to start the display beginning with the first line containing the text that matches the keyword. For example, if you enter begin Total, the displayed information begins with the line containing the word Total. Enter the exclude <keyword> parameter to exclude any lines containing text that match the keyword. For example, if you enter exclude Total, any line containing the word Total is excluded from the display. Enter the include <keyword> display only those lines containing text that match the keyword. For example, if you enter include Total, any line containing the word Total is included in the display. Possible values: see above show acl-on-arp Shows the ACLs that have been configured to filter ARP requests. ProCurveRS(config)# show acl-on-arp Port ACL ID Filter Count Syntax: show acl-on-arp [ ethernet [ <portnum> ] loopback [ <num> ] ve [ <num> ] ] If port number or the interface number is not specified, all ports on the device that use ACLs for ARP filtering will be included in the display. The Filter Count column shows how many ARP packets have been dropped on the interface since the last time the count was cleared. Possible values: see above show appletalk arp Displays the ARP Table for the AppleTalk routing protocol June 2005

7 Show Commands Index Node Address Mac Address Port e Syntax: show appletalk arp show appletalk cache Displays the forwarding table for the AppleTalk routing protocol. You can clear this cache by entering the CLI command, clear appletalk cache. ProCurveRS> show appletalk cache Total number of cache entries: 8 D:Dynamic P:Permanent F:Forward U:Us W:Wait ARP K:Drop Destination Next Hop MAC Type Fid Vlan c541.bc71 DF c541.bc71 DF PU c541.bc71 DF PU PU PU PU 0 Syntax: show appletalk cache show appletalk globals Displays the global configuration parameters for the AppleTalk routing protocol. ProCurveRS> show appletalk globals AppleTalk Routing Global Settings: enabled: Routing disabled: Glean Packets rtmp-update-interval: 10 zip-query-interval:10, arp-retransmit-interval: 1, arp-retransmit-count: 2 QOS Priority 0 Sockets: QOS Priority 1 Sockets: None Syntax: show appletalk globals show appletalk interface Displays the AppleTalk configuration for an individual interface or all interfaces. June

8 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches To view the configuration for all interfaces, enter show appletalk interface, as shown in the example below. To view the configuration of a specific interface, enter show appletalk interface ethernet <portnum>. To view the configuration of a virtual interface (VE), enter show appletalk interface ve <num>. ProCurveRS> show appletalk interface Interface Ethernet 15 port state: UP routing: Enabled operation mode:seed Router address: , cable-range: arp-age 10 Zone Filter List: Action: Permit Zone name: sales, no RTMP Filtering Additional Zones Action: Permit, No RTMP Filtering Interface Ethernet 16 port state: DOWN routing: Disabled operation mode:routing not enabled. address: , cable-range: arp-age 10 Zone Filter List: No zone filters are configured. Interface Ve 3 members: ethe 1 to 3 active: ethe 1 port state: UP routing: Enabled operation mode: Seed Router address: , cable-range: arp-age 10 Zone List: Finance Zone Filter List: No zone filters are configured. Syntax: show appletalk interface [ethernet <portnum> ve <num>] The ethernet <portnum> parameter lets you specify specific interface. The ve <num> parameter lets you specify a virtual interface (VE). show appletalk route Displays the AppleTalk routing table. You can clear learned routes stored in the routing table by entering the clear appletalk route command June 2005

9 Show Commands ProCurveRS> show appletalk route Index Cable Range Next Hop Distance State Port NOTE: Please note the following regarding the information displayed in the AppleTalk routing table: Index: Identifies the entry. Cable Range: Shows the network numbers to which the route information applies. Next Hop: Shows the address of the next hop router to which packets for that destination will be sent. Distance: Indicates the number of hops away that the destination is from this router State: Indicates the state of the entry. The possible states that may be displayed in this field are listed below with the numerical value that will appear in the table: Good route: 0 Suspect route: 2 Bad Route: 4 Port: References the port number upon which the next hop router is found. Syntax: show appletalk route show appletalk traffic Displays statistical information for RTMP, ZIP, AEP, DDP and AARP packets. June

10 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches ProCurveRS> show appletalk traffic RTMP Statistics: Received: 16038, Transmitted: 16032, Filtered: 0 ZIP Statistics: Query Received:16, Transmitted:6, GZL Received: 2, Transmitted: 1 NetInfo Statistics: Received: 10, Reply:8 AEP Statistics: Request Received: 0, Request Transmitted: 0 Reply Received: 0, Reply Transmitted: 0 DDP Statistics: Received: 55468, Transmitted: 55445, Forwarded: In-Delivered: 16092, Dropped-No-Route:0, Dropped-Bad-Hop-Counts: 0 Dropped-Other-Reasons: 0 AARP Statistics: Received: 14, Transmitted: 22 NOTE: Note the following regarding the information displayed in the AppleTalk traffic table. RTMP Statistics: Provides a count of all RTMP packets received, transmitted and filtered on the router. ZIP statistics: Provides a count of requests for zone information (Recv. Query) the system receives as well as a count of those ZIP queries made to other routers (Query, Transmitted). The 'Recv GZL' count lists those Get Zone List requests received from other routers and the 'Transmitted' field lists those GZL requests transmitted to other routers. NetInfo Statistics: The received and reply values of this field refer to the number of zone and network number requests made and received by the router. AEP Statistics: Provides a count of those AppleTalk Echo Protocol (pings) requests received or transmitted and a count of the replies received or transmitted. DDP Statistics: Displays the total count of those DDP packets transmitted, received and forwarded from the router; those packets received and forwarded up the AppleTalk protocol stack (in-delivered) and those packets dropped due to an unknown route (no-route), those packets that exceeded maximum hop count and those that were dropped due to unknown MAC address (other-reasons). AARP Statistics: Displays the total count of those AARP packets received and transmitted by the router. Syntax: show appletalk traffic show appletalk zone Displays the network numbers and zones learned on the network. You can clear all information stored in the zone table by entering the clear appletalk route command June 2005

11 Show Commands ProCurveRS> show appletalk zone Index Cable Range Zonename QA QARouter QA QALab account sales engineering HPhp HPhp marketing management gigabit gatethernet0 Syntax: show appletalk zone show arp Displays the ARP cache of the device. See the "Configuring IP" chapter of the Advanced Configuration and Management Guide for ProCurve 9300/9400 Series Routing Switches for information about the fields in this display. NOTE: This command displays dynamic entries and static entries. If you want to display only the static entries on a Routing Switch, see show ip static-arp on page ProCurveRS# show arp Total number of ARP entries: 5 IP Address MAC Address Type Age Port afc.ea21 Dynamic a0.24d2.04ed Dynamic a0.24ab.cd2b Dynamic c.a7fa Dynamic c ac9c Dynamic 0 6 Syntax: show arp [ethernet <portnum> mac-address <xxxx.xxxx.xxxx> [<mask>] <ip-addr> [<ip-mask>]] [<num>] Specify the MAC address mask as f s and 0 s, where f s are significant bits. Specify IP address masks in standard decimal mask format (for example, ). The ethernet <portnum> parameter lets you restrict the display to entries for a specific port. The mac-address <xxxx.xxxx.xxxx> parameter lets you restrict the display to entries for a specific MAC address. The <mask> parameter lets you specify a mask for the mac-address <xxxx.xxxx.xxxx> parameter, to display entries for multiple MAC addresses. Specify the MAC address mask as f s and 0 s, where f s are significant bits. June

12 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches The <ip-addr> and <ip-mask> parameters let you restrict the display to entries for a specific IP address and network mask. Specify the IP address masks in standard decimal mask format (for example, ). NOTE: The <ip-mask> parameter and <mask> parameter perform different operations. The <ip-mask> parameter specifies the network mask for a specific IP address, whereas the <mask> parameter provides a filter for displaying multiple MAC addresses that have specific values in common. The <num> parameter lets you display the table beginning with a specific entry number. Here are some examples of how to use these commands. The following command displays all ARP entries for MAC addresses that begin with abcd : ProCurveRS# show arp mac-address a.b.c.d ffff The following command displays all IP address entries for IP addresses that begin with " ": ProCurveRS# show arp Possible values: See above. show auth-mac-addresses authorized-mac Displays the MAC addresses that have been successfully authenticated. ProCurveRS# show auth-mac-addresses authorized-mac Syntax: show auth-mac-addresses authorized-mac show auth-mac-addresses unauthorized-mac Displays the MAC addresses for which authentication was not successful. ProCurveRS# show auth-mac-addresses unauthorized-mac Syntax: show auth-mac-addresses unauthorized-mac show authenticated-mac-address Displays information about authenticated MAC addresses on the ports where the MAC authentication feature is enabled. ProCurveRS# show authenticated-mac-address Port Vlan Accepted MACs Rejected MACs Attempted-MACs / / / / Syntax: show authenticated-mac-address June 2005

13 Show Commands The following table describes the information displayed by the show authenticated-mac-address command. Table 40.2: Output from the show authenticated-mac-address command This Field... Port Vlan Accepted MACs Rejected MACs Attempted-MACs Displays... The port number where the MAC authentication feature is enabled. The VLAN to which the port has been assigned. The number of MAC addresses that have been successfully authenticated The number of MAC addresses for which authentication has failed. The rate at which authentication attempts are made for MAC addresses. show authenticated-mac-address <address> Displays authentication information for a specific MAC address or port. ProCurveRS# show authenticated-mac-address 0007.e90f.eaa MAC/IP Address Port Vlan Authenticated Time Age CAM Index e90f.eaa1 : / Yes 00d01h10m06s 0 N/A Syntax: show authenticated-mac-address <mac-address> <ip-address> <portnum> The following table describes the information displayed by the show authenticated-mac-address command for a specified MAC address or port. Table 40.3: Output from the show authenticated-mac-address <address> command This Field... MAC/IP Address Port Vlan Authenticated Time Displays... The MAC address for which information is displayed. If the packet for which MAC authentication was performed also contained an IP address, then the IP address is displayed as well. The port on which the MAC address was learned. The VLAN to which the MAC address was assigned. Whether the MAC address was authenticated. The time at which the MAC address was authenticated. If the clock is set on the HP device, then the actual date and time are displayed. If the clock has not been set, then the time is displayed relative to when the device was last restarted. June

14 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches Table 40.3: Output from the show authenticated-mac-address <address> command (Continued) This Field... Age CAM Index Displays... The age of the MAC address entry in the authenticated MAC address list. If the MAC address is blocked, the index entry for the Layer 2 CAM entry created for this MAC address. If the MAC address is not blocked, either through successful authentication or through being placed in the restricted VLAN, then N/A is displayed. If the hardware aging period has expired, then ffff is displayed for the MAC address during the software aging period. Possible values: The <ip-address> parameter lists the MAC address associated with the specified IP address. The <portnum> parameter lists the MAC addresses on the specified port. show authenticated-mac-address configuration To display information about the Multi-Device Port Authentication configuration. ProCurveRS# show authenticated-mac-address configuration Feature enabled : Yes Number of Ports enabled : Port Fail-Action Fail-vlan Dyn-vlan MAC-filter /18 Block Traffic 1 No No 1/20 Block Traffic 1 No No 1/22 Block Traffic 1 No Yes 4/5 Block Traffic 1 No No Syntax: show authenticated-mac-address configuration The following table describes the information displayed by the show authenticated-mac-address configuration command. Table 40.4: Output from the show authenticated-mac-address configuration command This Field... Feature enabled Number of Ports enabled Port Fail-Action Displays... Whether the Multi-Device Port Authentication feature is enabled on the HP device. The number of ports on which the Multi-Device Port Authentication feature is enabled. Information for each Multi-Device Port Authentication-enabled port. What happens to traffic from a MAC address for which RADIUS authentication has failed: either block the traffic or assign the MAC address to a restricted VLAN June 2005

15 Show Commands Table 40.4: Output from the show authenticated-mac-address configuration command (Continued) This Field... Fail-vlan Dyn-vlan MAC-filter Displays... The restricted VLAN to which non-authenticated MAC addresses are assigned, if the Fail-Action is to assign the MAC address to a restricted VLAN. Whether RADIUS dynamic VLAN assignment is enabled for the port. Whether a MAC filter has been applied to this port to specify preauthenticated MAC addresses. show authenticated-mac-address detail Displays detailed information about the MAC authentication settings and authenticated MAC addresses for a port where the Multi-Device Port Authentication feature is enabled. ProCurveRS# show authenticated-mac-address detail e 1/18 Port : 1/18 Dynamic-Vlan Assignment : Disabled RADIUS failure action : Block Traffic Override-restrict-vlan : No Vlan : 100 ( RADIUS assigned: No) DOS attack protection : Disabled Accepted Mac Addresses : 1 Rejected Mac Addresses : 100 Authentication in progress : 0 Authentication attempts : 0 RADIUS timeouts : Aging of MAC-sessions : Enabled Max-Age of MAC-sessions : 120 seconds MAC Filter applied : No MAC/IP Address RADIUS Server Authenticated Time Age CAM Index e abd4 : No 00d06h32m50s d 00e abd5 : No 00d06h32m50s e abd6 : No 00d06h34m10s f 00e abd7 : No 00d06h34m50s e abd0 : No 00d06h34m10s d 00e abd1 : No 00d06h32m50s a 00e abd2 : No 00d06h38m50s e abd3 : No 00d06h32m50s e abdc : No 00d06h34m50s Syntax: show authenticated-mac-address detail [<portnum>] June

16 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches The following table describes the information displayed by the show authenticated-mac-address detail command. Table 40.5: Output from the show authenticated-mac-address detail command This Field... Port Dynamic-Vlan Assignment RADIUS failure action No-override-restrict-vlan Vlan DOS attack protection Accepted Mac Addresses Rejected Mac Addresses Authentication in progress Authentication attempts RADIUS timeouts Aging of MAC-sessions Max-Age of MAC-sessions MAC Filter applied MAC/IP Address RADIUS Server Authenticated Displays... The port to which this information applies. Whether RADIUS dynamic VLAN assignment has been enabled for the port. What happens to traffic from a MAC address for which RADIUS authentication has failed: either block the traffic or assign the MAC address to a restricted VLAN. Whether a port can be dynamically assigned to a VLAN specified by a RADIUS server, if the port had been previously placed in the restricted VLAN because a previous attempt at authenticating a MAC address on that port failed. The VLAN to which the port is assigned, and whether the port had been dynamically assigned to the VLAN by a RADIUS server. Whether denial of service attack protection has been enabled for MAC authentication, limiting the rate of authentication attempts sent to the RADIUS server. The number of MAC addresses that have been successfully authenticated. The number of MAC addresses for which authentication has failed. The number of MAC addresses for which authentication is pending. This is the number of MAC addresses for which an Access-Request message has been sent to the RADIUS server, and for which the RADIUS server has not yet sent an Access-Accept message. The total number of authentication attempts made for MAC addresses on an interface, including pending authentication attempts. The number of times the session between the HP device and the RADIUS server timed out. Whether software aging of MAC addresses is enabled. The configured software aging period. Whether a MAC filter has been applied to this port to specify preauthenticated MAC addresses. The MAC addresses learned on the port. If the packet for which MAC authentication was performed also contained an IP address, then the IP address is displayed as well. The IP address of the RADIUS server used for authenticating the MAC addresses. Whether the MAC address has been authenticated by the RADIUS server June 2005

17 Show Commands Table 40.5: Output from the show authenticated-mac-address detail command (Continued) This Field... Time Age CAM Index Displays... The time at which the MAC address was authenticated. If the clock is set on the HP device, then the actual date and time are displayed. If the clock has not been set, then the time is displayed relative to when the device was last restarted. The age of the MAC address entry in the authenticated MAC address list. If the MAC address is blocked, the index entry for the Layer 2 CAM entry created for this MAC address. If the MAC address is not blocked, either through successful authentication or through being placed in the restricted VLAN, then N/A is displayed. If the hardware aging period has expired, then ffff is displayed for the MAC address during the software aging period. Possible values: Omitting the <portnum> parameter displays information for all interfaces where the MAC authentication feature is enabled. show cam Displays the Layer 2, Layer 3, and Layer 4 entries in a Chassis device s Content Addressable Memory (CAM). To display Layer 2 entries in the CAM, enter a command such as the following at any level of the CLI: ProCurveRS> show cam ethernet 3/1 Slot Index MAC Age Source Port VLAN Out Port a0.23d2.04ed 2 ethe 3/16 3 ethe 3/ a0.23d7.05ed 1 ethe 3/1 1 ethe 3/ a0.23d2.08ed 4 ethe 3/2 1 ethe 3/ a0.25d2.08ed 2 ethe 3/5 1 ethe 3/9 Syntax: show cam ethernet <portnum> [mac-address <mac-addr>] To show information for a specific MAC address, enter the address as in the following example: ProCurveRS> show cam ethernet 3/1 00a0.23d2.04ed Slot Index MAC Age Source Port VLAN Out Port a0.23d2.04ed 2 ethe 3/16 3 ethe 3/14 This command shows the following information. Table 40.6: CLI Display of Layer 2 CAM Information This Field... Slot Index Displays... The chassis slot number. The entry number for this CAM entry. June

18 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches Table 40.6: CLI Display of Layer 2 CAM Information (Continued) This Field... MAC Age Source Port VLAN Out Port Displays... The MAC address of the entry. The age of the entry. The port on which the MAC address was learned. The port-based VLAN that contains the entry s MAC address. The port on which traffic from the MAC address gets forwarded. To display Layer 3 entries in the CAM, enter the following command at any level of the CLI: ProCurveRS> show cam ip 3/1 Slot Index IP_Address MAC Age Out Port VLAN / afc.ea21 3 ethe 3/ /24 00a0.24d2.04ed 2 ethe 3/ /24 00c ac9c 0 ethe 3/2 2 Syntax: show cam ip <portnum> [<ip-addr> <ip-mask> stat] To show information for a specific MAC address, enter the address as in the following example: ProCurveRS> show cam ip 3/ Slot Index IP_Address MAC Age Out Port VLAN / afc.ea21 3 ethe 3/4 2 This command shows the following information. Table 40.7: CLI Display of Layer 3 CAM Information This Field... Slot Index IP Address MAC Age Out Port VLAN Displays... The chassis slot number. The entry number for this CAM entry. The IP address of the entry. The MAC address of the entry. The age of the entry. The port on which traffic from the IP address gets forwarded. The port-based VLAN that contains the entry s MAC address June 2005

19 Show Commands To display Layer 4 entries in the CAM, enter the following command at any level of the CLI. This is an example of the command entered on an EP device. The first CAM entry is flow-based, while the next three are rule-based. (For Standard devices, only flow-based CAM entries are displayed.) ProCurveRS# show cam l4 3 Sl Index Src IP_Addr SPort Dest IP_Addr DPort Prot Age Out Port / /32 23 TCP 73 Use L2/L / /24 69 UDP dis Use L2/L3 Port Ranges --> / /24 69 UDP dis Use L2/L3 Port Ranges --> Any N/A Any N/A Any dis Discard The three rule-based CAM entries correspond to the following ACL: access-list 101 permit udp /24 range /24 eq tftp Syntax: show cam l4 <portnum> This command shows the following information. Table 40.8: CLI Display of Layer 4 CAM Information This Field... Sl Index Src IP_Addr SPort Port Ranges --> Dest IP_Addr DPort Prot Age Displays... The chassis slot number. The entry number for this CAM entry. The source IP address for the CAM entry. The port on which the source IP address was learned. For the SPort column, indicates the range of source ports for the CAM entry; for example, ports or The destination IP address for the CAM entry. The port on which the destination IP address was learned. The Layer 4 protocol. The age of the CAM entry. June

20 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches Table 40.8: CLI Display of Layer 4 CAM Information (Continued) This Field... Out Port Displays... Information about how the packet is to be forwarded. This can be one of the following: Discard <Fid value> mgmt Use L2/L3 Indicates that the CAM entry's corresponding PRAM entry is programmed to drop the packet. Indicates that the CAM entry's corresponding PRAM entry is programmed to use the specified FID value. Indicates that the CAM entry's corresponding PRAM entry is programmed to use the CPU FID. Indicates that the CAM entry's corresponding PRAM entry is programmed to allow the forwarding decision to be made at Layer 2 or Layer 3. Standard devices always display Use L2/L3 in the Out Port field. Possible values: See above June 2005

21 Show Commands show cam-partition Displays CAM partitioning information for each master DMA. ProCurveRS# show cam-partition brief ==== SLOT 1 CAM PARTITION ==== DMA: 0 (0x00) Number of CAM devices per DMA: 8 Number of hw entries per CAM: 0x00800 Total size of CAM = 1Mbits complete CAM index range per DMA: (sw) (1-0x03fff), total entries: (0x03fff) (hw) (0-0x03fff), total entries: (0x04000) Percentage of CAM hardware entries for each partition: Level3 l3 = 2047 ( Mbits) ( %) Level3 l3 = 2048 (0.125Mbits) (12.5%) Level3 l3 = 8192 (0.5Mbits) (50%) Level4 = 4096 (0.25Mbits) (25%) DMA: 2 (0x02) Number of CAM devices per DMA: 8 Number of hw entries per CAM: 0x00800 Total size of CAM = 1Mbits complete CAM index range per DMA: (sw) (1-0x03fff), total entries: (0x03fff) (hw) (0-0x03fff), total entries: (0x04000) Percentage of CAM hardware entries for each partition: Level3 l3 = 2047 ( Mbits) ( %) Level3 l3 = 2048 (0.125Mbits) (12.5%) Level3 l3 = 8192 (0.5Mbits) (50%) Level4 = 4096 (0.25Mbits) (25%) June

22 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches ProCurveRS# show cam-partition detail ==== SLOT 1 CAM PARTITION ==== DMA: 0 (0x00) Number of CAM devices per DMA: 8 Number of hw entries per CAM: 0x00800 Total size of CAM = 1Mbits complete CAM index range per DMA: (sw) (1-0x03fff), total entries: (0x03fff) (hw) (0-0x03fff), total entries: (0x04000) Percentage of CAM hardware entries for each partition: Level3 l3 = 2047 ( Mbits) ( %) Level3 l3 = 2048 (0.125Mbits) (12.5%) Level3 l3 = 8192 (0.5Mbits) (50%) Level4 = 4096 (0.25Mbits) (25%) DMA: 2 (0x02) Number of CAM devices per DMA: 8 Number of hw entries per CAM: 0x00800 Total size of CAM = 1Mbits complete CAM index range per DMA: (sw) (1-0x03fff), total entries: (0x03fff) (hw) (0-0x03fff), total entries: (0x04000) Percentage of CAM hardware entries for each partition: Level3 l3 = 2047 ( Mbits) ( %) Level3 l3 = 2048 (0.125Mbits) (12.5%) Level3 l3 = 8192 (0.5Mbits) (50%) Level4 = 4096 (0.25Mbits) (25%) L3 level 3 index range: (sw) (0x x007ff), free 2047 (0x007ff) (hw) (0x x007ff) L3 level 2 index range: (sw) (0x x00fff), free 2048 (0x00800) (hw) (0x x00fff) L3 index range: (sw) (0x x02fff), free 8189 (0x01ffd) (hw) (0x x02fff) L4 pool 0 index range: (sw) (0x x037ff), free 2044 (0x007fc) (hw) (0x x037ff) L2/L4 pool 1 index range: (sw) (0x x03fff), free 2047 (0x007ff) (hw) (0x x03fff) Syntax: show cam-partition brief detail Syntax: show cam-partition module <module> brief detail show chassis Displays the status of power supplies and fans in the chassis. ProCurveRS# show chassis power supply 1 ok power supply 2 not present June 2005

23 Show Commands power supply 3 not present power supply 4 not present power supply 1 to 4 from bottom to top fan 1 (rear/back panel, top fan) ok fan 2 (rear/back panel, bottom fan) ok fan 3 (top panel, fan) bad fan 4 (top panel, fan) ok Current temperature : 32.5 C degrees Warning level : 45 C degrees, shutdown level : 55 C degrees Boot Prom MAC: 00e0.52a9.bb00 Syntax: show chassis NOTE: In a 15-slot chassis, the state of fans 5 and 6 is listed as "unmanaged". The software is unable to read the status of these fans. show clock Displays the current settings for the on-board time counter and Simple Network Time Protocol (SNTP) clock, if configured. ProCurveRS# show clock Syntax: show clock [detail] show configuration Lists the operating configuration of an HP device and allows you to check configuration changes before saving them to flash.. In software releases and later, this command also displays the size of the running-config file. ProCurveRS# show configuration Syntax: show configuration Possible value: N/A show default Displays the defaults for system parameters. If you specify "default" but not the optional "values", the default states for parameters that can either be enabled or disabled are displayed. If you also specify "values", the default values for parameters that take a numeric value are displayed. You can reconfigure the system parameters displayed by the values option using the system-max command. See system-max on page June

24 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches Here are some examples of the information displayed by these commands. NOTE: If the information scrolls off the screen, you can enable page-display mode. See page-display on page ProCurveRS# show default spanning tree disabled auto sense port speed port untagged port flow control on no username assigned no password assigned boot sys flash primary system traps enabled sntp disabled radius disabled rip disabled ospf disabled bgp disabled when ip routing enabled : ip irdp enabled ip load-sharing enabled ip proxy arp enabled ip rarp enabled ip bcast forward enabled dvmrp disabled pim/dm disabled vrrp disabled when rip enabled : rip type:v2 only rip poison rev enabled ipx disabled appletalk disabled June 2005

25 Show Commands The following is an example of the command output when you use the values option. ProCurveRS#sh default value sys log buffers:50 mac age time:300 sec telnet sessions:5 ip arp age:10 min bootp relay max hops:4 ip ttl:64 hops ip addr per intf:24 when multicast enabled: igmp group memb.:140 sec igmp query:60 sec when ospf enabled : ospf dead:40 sec ospf hello:10 sec ospf retrans:5 sec ospf transit delay:1 sec when bgp enabled : bgp local pref.:100 bgp keep alive:60 sec bgp hold:180 sec bgp metric:10 bgp local as:1 bgp cluster id:0 bgp ext. distance:20 bgp int. distance:200 bgp local distance:200 System Parameters Default Maximum Current ip-arp ip-static-arp atalk-route atalk-zone-port atalk-zone-sys multicast-route dvmrp-route multicast-flow dvmrp-mcache pim-mcache igmp-max-group-addr ip-cache ip-filter-port ip-filter-sys ipx-forward-filter ipx-rip-entry ipx-rip-filter ipx-sap-entry ipx-sap-filter l3-vlan ip-qos-session l4-real-server l4-virtual-server l4-server-port mac ip-route ip-static-route vlan spanning-tree mac-filter-port mac-filter-sys June

26 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches ip-subnet-port session-limit view virtual-interface l2-mac Syntax: show default [values] show dot1x Displays information about the 802.1X configuration on the HP device. ProCurveRS# show dot1x Number of Ports enabled : 2 Re-Authentication : Enabled Authentication-fail-action : Restricted VLAN Authentication Failure VLAN : 111 Mac Session Aging : Disabled for permitted MAC sessions Mac Session max-age : 60 seconds Protocol Version : 1 quiet-period : 5 Seconds tx-period : 30 Seconds supptimeout : 30 Seconds servertimeout maxreq re-authperiod security-hold-time : 30 Seconds : 2 : 3600 Seconds : 60 Seconds re-authentication : Enable Flow based multi-user policy : Disable Syntax: show dot1x show dot1x config Displays information about the 802.1X configuration on an individual port June 2005

27 Show Commands ProCurveRS# show dot1x config e 1/3 Port 1/3 Configuration: Authenticator PAE state: AUTHENTICATED Backend Authentication state: IDLE AdminControlledDirections: BOTH OperControlledDirections: BOTH AuthControlledPortControl: Auto AuthControlledPortStatus: authorized quiet-period: 60 Seconds tx-period: 30 Seconds supptimeout: 30 Seconds servertimeout: 30 Seconds maxreq: 2 re-authperiod: 3600 Seconds security-hold-time: 60 Seconds re-authentication: Disable multiple-hosts: Disable filter-strict-security: Enable Protocol Version: 1 In release , the output of the show dot1x config command for an interface was changed so it displays only the configured port control for the interface. For example: ProCurveRS# show dot1x config e 1/3 Port-Control: control-auto Syntax: show dot1x config <portnum> Possible values: Port number show dot1x ip-acl Displays information about the user-defined and dynamically applied IP ACLs active on the device for 802.1X ports. To display information about the user-defined IP ACLs that apply to 802.1X ports, enter the following command: ProCurveRS# show dot1x ip-acl Port 1/3 (User defined IP ACLs): Extended IP access list Port_1/3_E_IN permit udp any any Extended IP access list Port_1/3_E_OUT permit udp any any Syntax: show dot1x ip-acl To display information about the dynamically applied IP ACLs active for an 802.1X-enabled interface, enter the following command: June

28 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches ProCurveRS# show dot1x ip-acl e 1/3 Port 1/3 IP ACL information: 802.1X dynamic IP ACL (user defined) in: ip access-list extended Port_1/3_E_IN in Port default IP ACL in: No inbound ip access-list is set 802.1X dynamic IP ACL (user defined) out: ip access-list extended Port_1/3_E_OUT out Port default IP ACL out: No outbound ip access-list is set Syntax: show dot1x ip-acl <portnum> all Possible values: Specifying a <portnum> displays the dynamically applied IP ACLs active for the port. The all keyword displays all 802.1X dynamically applied IP ACLs active on the device. show dot1x mac-address-filter Displays information about the user-defined and dynamically applied MAC address filters active on the device for 802.1X ports. To display information about the user-defined MAC address filters that apply to 802.1X ports, enter the following command: ProCurveRS# show dot1x mac-address-filter Port 1/3 (User defined MAC Address Filter): mac filter 1 permit any any Syntax: show dot1x mac-address-filter To display the dynamically applied MAC address filters active on an interface, enter a command such as the following: ProCurveRS# show dot1x mac-address-filter e 1/3 Port 1/3 MAC Address Filter information: 802.1X Dynamic MAC Address Filter : mac filter-group 2 Port default MAC Address Filter: No mac address filter is set Syntax: show dot1x mac-address-filter <portnum> all Possible values: Specifying a <portnum> displays the dynamically applied MAC address filters active for the port. The all keyword displays all 802.1X dynamically applied MAC address filters active on the device. show dot1x mac-session Displays information about the dot1x-mac-sessions on each port on the device June 2005

29 Show Commands ProCurveRS# show dot1x mac-session Port MAC/IP Address(username) Vlan Auth Age CAM State Index e90f.eb30 :kingcobra 102 permit 1 N/A e90f.eaa1 :cobra 102 permit 6 N/A Syntax: show dot1x mac-session Table 40.9 describes the information displayed by the show dot1x mac-session command. Table 40.9: Output from the show dot1x mac-session command This Field... Port MAC/IP Address(username) Vlan Auth-State Age CAM Index Displays... The port on which the dot1x-mac-session exists. The MAC address of the Client and the username used for RADIUS authentication. The VLAN to which the port is currently assigned. The authentication state of the dot1x-mac-session. This can be one of the following: permit The Client has been successfully authenticated, and traffic from the Client is being forwarded normally. blocked Authentication failed for the Client, and traffic from the Client is being dropped in hardware. restricted Authentication failed for the Client, but traffic from the Client is allowed in the restricted VLAN only. init - The Client is in is in the process of 802.1X authentication, or has not started the authentication process. The software age of the dot1x-mac-session. If the MAC address is blocked, the index entry for the Layer 2 CAM entry created for this MAC address. If the MAC address is not blocked, either through successful authentication or through being placed in the restricted VLAN, then N/A is displayed. If the hardware aging period has expired, then ffff is displayed for the MAC address during the software aging period. show dot1x mac-session brief Displays information about the ports in an 802.1X multiple-host configuration. June

30 Command Line Interface Reference for ProCurve 9300/9400 Series Routing Switches ProCurveRS# show dot1x mac-session brief Port Number of Number of Dynamic Dynamic users Authorized users VLAN Filters no no yes no Syntax: show dot1x mac-session brief The following table describes the information displayed by the show dot1x mac-session brief command. Table 40.10: Output from the show dot1x mac-session brief command This Field... Port Number of users Number of Authorized users Dynamic VLAN Dynamic Filters Displays... Information about the users connected to each port. The number of users connected to the port. The number of users connected to the port that have been successfully authenticated. Whether the port is a member of a RADIUS-specified VLAN. Whether RADIUS-specified IP ACLs or MAC address filters have been applied to the port. show dot1x statistics Displays 802.1X statistics for an individual port. ProCurveRS# show dot1x statistics e 3/3 Port 3/3 Statistics: RX EAPOL Start: 0 RX EAPOL Logoff: 0 RX EAPOL Invalid: 0 RX EAPOL Total: 0 RX EAP Resp/Id: 0 RX EAP Resp other than Resp/Id: 0 RX EAP Length Error: 0 Last EAPOL Version: 0 Last EAPOL Source: B83 TX EAPOL Total: 217 TX EAP Req/Id: 163 TX EAP Req other than Req/Id: 0 Syntax: show dot1x statistics <portnum> June 2005

31 Show Commands Possible values: Port number show fan-threshold Displays the current settings of the low and high temperature thresholds for modules and fan speeds. The following command checks the current settings of the low and high temperature thresholds for modules and fan speeds. ProCurveRS# show fan-threshold === Thermal Sensor Control Block (THERMAL_SENSOR_TEST_RULE_MP) === Fan Speed Low: Fan Speed Med: Fan Speed Med-Hi: Fan Speed Hi: state = 0 (FAN_STATE_LOW) max_ts_shut_off_count = 3 shut_off_count = === Thermal Sensor Control Block (THERMAL_SENSOR_TEST_RULE_SNM) === Fan Speed Low: Fan Speed Med: Fan Speed Med-Hi: Fan Speed Hi: state = 0 (FAN_STATE_LOW) max_ts_shut_off_count = 3 shut_off_count = === Thermal Sensor Control Block (THERMAL_SENSOR_TEST_RULE_LP) === Fan Speed Low: Fan Speed Med: Fan Speed Med-Hi: Fan Speed Hi: state = 0 (FAN_STATE_LOW) max_ts_shut_off_count = 3 shut_off_count = === Thermal Sensor Control Block (THERMAL_SENSOR_TEST_RULE_STANDBY_MP) === Fan Speed Low: Fan Speed Med: Fan Speed Med-Hi: Fan Speed Hi: state = 0 (FAN_STATE_LOW) max_ts_shut_off_count = 3 shut_off_count = Syntax: show fan-threshold show fdp entry Displays information about the HP device s HP or Cisco neighbors. NOTE: To obtain the information, you must enable the FDP, enable the HP device to intercept Cisco Discovery Protocol (CDP) packets, or both. See fdp run on page 6-42 and cdp run on page June