Troubleshooting Tools疑難排解工具

Network administrators spend a lot of time troubleshooting the network. Tools that are used for troubleshooting are capable of generating outputs with a lot of information. In troubleshooting, one challenge is to know how and what to look for in an output command—because you want to check only for specific information relevant to the case. You can focus on specific information with Cisco IOS troubleshooting tools and Microsoft Windows tools, if appropriate for your network.

網路管理員花費大量時間在網路疑難排解上。用於疑難排解的工具能夠產生包含大量資訊的輸出。在疑難排解中，一項挑戰是知道要在輸出指令中如何尋找及尋找什麼，因為你只想檢查與案例相關的特定資訊。你可以使用 Cisco IOS 疑難排解工具，以及適用時的 Microsoft Windows 工具，來聚焦於特定資訊。

During operation, network devices generate messages about different events. These messages are sent to an operating system process. This process is responsible for sending these messages to various destinations, as directed by the device configuration. Logging messages are also sent to the console by default. Even if the global logging process is disabled, logging messages are nevertheless sent to the console. You can decide about the severity level of the logged messages and their destination.

在運作期間，網路裝置會針對不同事件產生訊息。這些訊息會被送往作業系統的處理程序。此處理程序負責依裝置設定，將訊息送往各種目的地。記錄訊息預設也會送到主控台。即使全域記錄處理程序已停用，記錄訊息仍會送到主控台。你可以決定所記錄訊息的嚴重性等級及其目的地。

You can verify logging settings on networking devices by using a show logging command.

你可以使用 show logging 指令驗證網路裝置上的記錄設定。

From the output of the command, you can chronologically see the events that have triggered the logging messages.

從指令輸出中，你可以按時間順序看到觸發記錄訊息的事件。

The logging messages may be sent to the console, the monitor, and the memory buffer, which has a size of 4096 bytes. There are eight levels of severity of logging messages. Levels are numbered from 0 to 7, from most severe to debugging messages: emergency, alert, critical, error, warning, notification, informational, and debugging. Time stamps show the time when each event occurred. By default, system logging is on, and the default severity level is debugging, which means that all messages are logged.

記錄訊息可能會被送往主控台、監視器，以及大小為 4096 位元組的記憶體緩衝區。記錄訊息共有八個嚴重性等級。等級由 0 到 7 編號，從最嚴重到偵錯訊息依序為：緊急、警報、嚴重、錯誤、警告、通知、資訊、偵錯。時間戳記顯示每個事件發生的時間。預設情況下，系統記錄功能為開啟，且預設嚴重性等級為偵錯，這表示所有訊息都會被記錄。

In the output, you can see that the system was restarted once. After the restart, the interfaces and the line protocols changed the state to "up." This message was logged as a notification message—level 5.

在輸出中，你可以看到系統曾重新啟動一次。重新啟動後，介面與線路協定的狀態變更為「up」。此訊息以通知訊息（等級 5）記錄。

Cisco IOS doesn't send log messages to a terminal session over IP (Telnet or Secure Shell Protocol [SSH] connections) by default. In the output this is shown by logging to the monitor setting, which is set to off (disabled). If you need to enable logging to terminal sessions, you need to use the terminal monitor command. After using the terminal monitorcommand, monitor logging enablement can be verified by a show logging command:

Cisco IOS 預設不會將記錄訊息透過 IP（Telnet 或安全殼層協定 [SSH] 連線）傳送到終端工作階段。在輸出中，這由監視器記錄設定顯示為 off（停用）。若你需要啟用對終端工作階段的記錄功能，需要使用 terminal monitor 指令。使用 terminal monitor指令後，可透過 show logging 指令驗證監視器記錄是否已啟用：

Logging to the monitor (all tty lines) shows "disabled" or, if enabled, the severity level limit, number of messages logged, and whether XML formatting or filtering is enabled.

傳送到監視器（所有 tty 線路）的記錄會顯示「disabled」，或者若已啟用，則顯示嚴重性等級上限、已記錄訊息數量，以及是否啟用 XML 格式化或篩選。

Internet Control Message Protocol (ICMP) is a supporting protocol in the TCP/IP protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached. ICMP differs from transport protocols such as TCP and UDP. It is not typically used to exchange data between systems, nor is it regularly employed by end-user network applications (except for some diagnostic tools, such as ping and traceroute).

網際網路控制訊息協定（ICMP）是 TCP/IP 協定套組中的一個支援性協定。網路裝置（包括路由器）使用它來傳送錯誤訊息與操作資訊，例如指出所要求的服務無法使用，或主機或路由器無法連通。ICMP 與 TCP、UDP 等傳輸協定不同，它通常不用於系統間交換資料，也不常被終端使用者的網路應用程式使用（某些診斷工具除外，例如 ping 與 traceroute）。

ICMP messages are typically used for diagnostic or control purposes or generated in response to errors in IP operations. ICMP errors are directed to the source IP address of the originating packet. For example, every device (such as an intermediate router) forwarding an IPv4 datagram first decrements the Time to Live (TTL) field in the IPv4 header by one. If the resulting TTL is 0, the packet is discarded, and an ICMP time exceeded in transit message is sent to the packet's source address.

ICMP 訊息通常用於診斷或控制目的，或因 IP 操作發生錯誤而產生。ICMP 錯誤會被導向原始封包的來源 IP 位址。舉例來說，每個轉送 IPv4 資料包的裝置（例如中介路由器）會先將 IPv4 標頭中的存活時間（TTL）欄位減一。若結果 TTL 為 0，則封包會被丟棄，並將 ICMP 傳輸中逾時（time exceeded）訊息傳送給封包的來源位址。

Other situations in which network devices use ICMP are when a datagram cannot reach its designated destination, when a network device does not have enough buffering capacity to accommodate the datagram, or when a gateway can redirect the host to use a shorter path to the destination. Because IP was not designed with absolute reliability, ICMP allows the devices to receive feedback on the traffic they are sending and any problems that might occur.

網路裝置使用 ICMP 的其他情況包括：資料包無法到達指定目的地時、網路裝置沒有足夠緩衝容量容納資料包時，或閘道可以重新導向主機使用較短路徑到達目的地時。由於 IP 在設計上並非絕對可靠，ICMP 讓裝置能對其傳送的流量以及可能發生的問題取得回饋。

ICMP does not guarantee that a datagram will be sent to its destination or that a control message will be returned to the source. Some datagrams may be lost in transit to their destination without a report on their loss being sent back to the source. Therefore, higher-level protocols using IP must implement their own reliability mechanisms if reliability is needed in transmission of data. Because ICMP is usually used to report errors in datagrams, reporting on lost ICMP messages using ICMP itself would cause an infinite loop of ICMP messages. Therefore, ICMP messages will not report on the loss of other ICMP messages.

ICMP 不保證資料包會被送達其目的地，也不保證控制訊息一定會回傳到來源端。有些資料包在傳送到目的地途中可能遺失，而不會有遺失報告送回來源端。因此，若傳輸資料需要可靠性，使用 IP 的較高層協定必須自行實作其可靠性機制。由於 ICMP 通常用於回報資料包中的錯誤，若再用 ICMP 本身來回報 ICMP 訊息的遺失，將造成 ICMP 訊息的無窮迴圈。因此，ICMP 訊息不會回報其他 ICMP 訊息的遺失。

ICMP messages are sent by using a basic IP header as seen in the table below:

ICMP 訊息使用如下表所示的基本 IP 標頭來傳送：

In the first scenario in the preceding image, the blue workstation issues the ping command towards the green workstation. The blue workstation generates an ICMP Echo Request message with its source IP address and the destination IP address of the green workstation. After successful routing towards the green workstation, the green workstation generates an ICMP Echo Reply message to indicate successful receipt of the ICMP Echo Request message. ICMP Echo Reply message will have source IP of green workstation and destination IP of blue workstation. This means that ICMP Echo Request and Echo Reply provide a simple method of checking if you have proper routing and reachable destination between two IP addresses.

在前圖的第一種情境中，藍色工作站向綠色工作站發出 ping 指令。藍色工作站產生一則 ICMP Echo Request 訊息，內含其來源 IP 位址及綠色工作站的目的 IP 位址。成功路由至綠色工作站後，綠色工作站產生一則 ICMP Echo Reply 訊息，表示已成功收到 ICMP Echo Request 訊息。ICMP Echo Reply 訊息的來源 IP 為綠色工作站，目的 IP 為藍色工作站。這表示 ICMP Echo Request 與 Echo Reply 提供了一種簡單的方法，可檢查兩個 IP 位址之間是否有正確的路由與可連通的目的地。

In the second scenario, the blue workstation issues the ping command towards the green workstation, set with a lower TTL value. Because the TTL value decreases with every routing hop, it eventually reaches a zero value before reaching its destination. The router RB detects the TTL=0 condition and generates ICMP Time Exceeded message from its IP to the blue workstation, the original sender of the ICMP Echo Request message.

在第二種情境中，藍色工作站向綠色工作站發出 ping 指令，並設定較低的 TTL 值。由於 TTL 值會隨每次路由跳躍遞減，它會在到達目的地之前就降為零。路由器 RB 偵測到 TTL=0 的情況，並從其 IP 位址產生 ICMP Time Exceeded 訊息，傳送給原始發出 ICMP Echo Request 訊息的藍色工作站。

In the third scenario, the blue workstation issues the ping command towards the green destination, which is an unknown network from the perspective of the first routing hop, router RA. Because router RA does not have a routing entry in its routing table for the green destination, it generates the ICMP Network unreachable message and sends it to the blue workstation, the sender of the ICMP Echo Request message.

在第三種情境中，藍色工作站向綠色目的地發出 ping 指令，但就第一個路由跳點路由器 RA 而言，該目的地屬於未知網路。由於路由器 RA 的路由表中沒有通往綠色目的地的路由項目，它會產生 ICMP Network unreachable 訊息，並將其傳送給發出 ICMP Echo Request 訊息的藍色工作站。

The remaining part of the header depends on the ICMP message type. The ICMP control messages are identified by the value in the type field. The code field gives additional context information for the message.

標頭其餘部分則取決於 ICMP 訊息類型。ICMP 控制訊息由類型欄位中的值來識別，代碼欄位則為該訊息提供額外的上下文資訊。

The following table lists commonly used ICMP-type values during troubleshooting

下表列出疑難排解時常用的 ICMP 類型值

For example, after sending ICMP echo requests, if an ICMP echo reply packet is received within the default, 2-second (configurable) timeout, an exclamation point (!) is the output, meaning that the reply was received before the timeout expired. A period (.) is the output if the reply was not received before the timeout expired.

舉例來說，在傳送 ICMP echo request 之後，若在預設（可設定）的 2 秒逾時內收到 ICMP echo reply 封包，輸出會顯示驚嘆號（!），代表回覆在逾時到期前已收到。若在逾時到期前未收到回覆，則輸出會顯示句點（.）。

The device also outputs the min/avg/max RTT in milliseconds.

裝置也會輸出以毫秒為單位的最小／平均／最大 RTT。

When a normal ping command is sent from a device, the source address of the ping is the IPv4 address of the interface that the packet uses to exit the device. The source address can be changed to the address of any interface on the device.

當從某裝置傳送一般的 ping 指令時，ping 的來源位址是封包離開該裝置所使用介面的 IPv4 位址。此來源位址可以變更為該裝置上任一介面的位址。

You can also perform an extended ping, and adjust parameters such as the source IPv4 address, as follows:

你也可以執行延伸 ping，並如下調整參數（例如來源 IPv4 位址）：

If ping fails or returns an unusual RTT, you can use the traceroute command to help narrow down the problem. You can also vary the size of the ICMP echo payload to test problems that are related to the MTU.

若 ping 失敗或傳回異常的 RTT，你可以使用 traceroute 指令協助縮小問題範圍。你也可以改變 ICMP echo 承載資料的大小，以測試與 MTU 相關的問題。

On a Microsoft Windows device, by default, four packets are sent; information displayed is similar to the Cisco IOS output, as shown in the example:

在 Microsoft Windows 裝置上，預設會傳送四個封包；顯示的資訊與 Cisco IOS 的輸出類似，如範例所示：

Traceroute is used to test the path that packets take through the network. It sends out either an ICMP echo request (Microsoft Windows) or UDP (most implementations) messages, gradually increasing IPv4 TTL values to probe the path by which a packet traverses the network. The first packet with the TTL set to 1 will be discarded by the first-hop router, which will send an ICMP "time exceeded" message sourced from its IPv4 address. The device that initiated the traceroute therefore knows the address of the first-hop router. When the TTL is set to 2, the packets will arrive at the second router, which will respond with an ICMP "time exceeded" message from its IPv4 address. This process continues until the message reaches its final destination; the destination device will return either an ICMP echo reply (Windows) or an ICMP port unreachable, indicating that the request or message has reached its destination.

Traceroute 用於測試封包在網路中所經過的路徑。它會發出 ICMP echo request（Microsoft Windows）或 UDP（大多數實作）訊息，逐漸增加 IPv4 TTL 值，以探測封包經過網路的路徑。第一個 TTL 設為 1 的封包會被第一跳路由器丟棄，該路由器會傳送一則以其 IPv4 位址為來源的 ICMP「time exceeded」訊息。因此，發起 traceroute 的裝置便得知第一跳路由器的位址。當 TTL 設為 2 時，封包會到達第二個路由器，該路由器會以其 IPv4 位址回應一則 ICMP「time exceeded」訊息。此程序會持續進行，直到訊息到達最終目的地為止；目的裝置會傳回 ICMP echo reply（Windows）或 ICMP port unreachable，表示要求或訊息已到達其目的地。

Cisco traceroute works by sending a sequence of three packets for each TTL value, with different destination UDP ports, which allows it to report routers that have multiple, equal-cost paths to the destination. For example, the first three packets with TTL 1 use UDP ports 33434 (first packet), 33435 (second packet), and 33436 (third packet). The next three UDP datagrams are sent with a TTL of 2 to destination ports 33437, 33438, and 33439.

Cisco traceroute 的運作方式是針對每個 TTL 值傳送三個封包，各使用不同的目的 UDP 連接埠，讓它能夠回報具有多條等成本路徑通往目的地的路由器。舉例來說，TTL 為 1 的前三個封包會使用 UDP 連接埠 33434（第一個封包）、33435（第二個封包）與 33436（第三個封包）。接下來的三個 UDP 資料包則以 TTL 值 2 傳送，目的連接埠分別為 33437、33438 與 33439。

The table below lists the characters that can appear in the Cisco IOS traceroute command output.

下表列出 Cisco IOS traceroute 指令輸出中可能出現的字元。

The tracert command is a Windows implementation of traceroute (and will not work on Cisco devices).

tracert 指令是 Windows 版本的 traceroute 實作（無法在 Cisco 裝置上使用）。

One way to obtain information about a remote network device is to connect to it using either the Telnet or SSH applications. Telnet and SSH are virtual terminal protocols that are part of the TCP/IP suite. The protocols allow connections and remote console sessions from one network device to one or more remote devices.

取得遠端網路裝置資訊的方法之一，是使用 Telnet 或 SSH 應用程式連線到該裝置。Telnet 與 SSH 是 TCP/IP 套組中的虛擬終端機協定，可讓一台網路裝置對一台或多台遠端裝置建立連線與遠端主控台工作階段。

When you use Telnet to connect to a remote device, the default port number is used. The default port for Telnet is 23. You can use a different port number, from 1 to 65,535, to test if a remote device is listening to the port.

當你使用 Telnet 連線到遠端裝置時，會使用預設連接埠號。Telnet 的預設連接埠為 23。你可以使用 1 到 65,535 之間的其他連接埠號，以測試遠端裝置是否在監聽該連接埠。

Although Telnet can be used as a troubleshooting tool to check transport layer functionality, it should not be used in a production environment to administer network devices. Nowadays, SSH is used as it is a secure access method.

雖然 Telnet 可作為疑難排解工具，用於檢查傳輸層功能，但不應在正式環境中用於管理網路裝置。現今普遍使用 SSH，因為它是一種安全的存取方式。

To log on to a host that supports Telnet, use the telnet EXEC command:

若要登入支援 Telnet 的主機，請使用 telnet EXEC 指令：

The telnet command in the output tests if HTTP, which listens on TCP port 80, is open. Since we get an Open response, we can assume that the remote device is reachable and listens to TCP port 80. On a Cisco router, to exit the established connection, you must enter a control+C (^C) hotkey as shown in the output. The hotkey that closes the connection on a Cisco device is "ctrl+shift+6 and x."

輸出中的 telnet 指令用於測試監聽 TCP 連接埠 80 的 HTTP 是否開啟。由於我們得到 Open 回應，可推知遠端裝置是可連通的，並在監聽 TCP 連接埠 80。在 Cisco 路由器上，若要結束已建立的連線，如輸出所示，你必須輸入 control+C（^C）快速鍵。在 Cisco 裝置上關閉連線的快速鍵是「ctrl+shift+6 再按 x」。

To start an encrypted session with a remote networking device, use the ssh EXEC command:

若要與遠端網路裝置開始一個加密工作階段，請使用 ssh EXEC 指令：

Devices use ARP to perform IPv4 address resolution for IPv4 to MAC address mapping. The show ip arp or (show arp) command displays the ARP table on a Cisco router.

裝置使用 ARP 執行 IPv4 位址解析，將 IPv4 對應到 MAC 位址。show ip arp 或（show arp）指令會顯示 Cisco 路由器上的 ARP 表。

The arp -a command displays IPv4-to-MAC-address mappings on a Windows Host.

arp -a 指令會顯示 Windows 主機上 IPv4 對應到 MAC 位址的對照表。

Commands ipconfig and ipconfig /all (Microsoft Windows) are command-line utilities that are available on all versions of Microsoft Windows, starting with Windows NT. This utility allows you to get the IPv4 address information of a Windows computer. The ipconfig /all option displays the IP address, subnet mask, and gateway for all physical and virtual network adapters. It also displays the Domain Name Service and Microsoft Windows Internet Name Service (Microsoft WINS) settings for each adapter.

ipconfig 與 ipconfig /all（Microsoft Windows）指令是自 Windows NT 起，在所有 Microsoft Windows 版本上都可使用的命令列公用程式。此公用程式可讓你取得 Windows 電腦的 IPv4 位址資訊。ipconfig /all 選項會顯示所有實體與虛擬網路介面卡的 IP 位址、子網路遮罩與閘道，也會顯示每個介面卡的網域名稱服務與 Microsoft Windows 網際網路命名服務（Microsoft WINS）設定。

For a brief overview of interface IPv4 addressing and status information on a Cisco device, use the show ip interface brief command

若要簡要檢視 Cisco 裝置上介面的 IPv4 定址與狀態資訊，請使用 show ip interface brief 指令