Skip to content

Show command reference

The complete show family in one place, plus the operational actions and diagnostics that run immediately without a commit. show reads running state and live tables — it never touches the candidate.

Platform and sessions

One command per question about the box itself and the subscribers on it.

cli
show version                    # build version
show topology                   # lcore / worker / port plan
show system                     # control-cores, workers, ht-policy
show health                     # uptime, per-core CPU, memory, power
show sessions                   # PPPoE + IPoE in one table
show license [detail|usage|server]
show mempool                    # mbuf pool utilisation
show history                    # recent state-changing commands
show drops [<interface>]        # fast-path forward + drop counters
show statistics [<interface>]   # alias for show drops

Interfaces

The interface commands form a hierarchy in the style of IOS, JunOS and VRP: a summary table, a full page per port, and a live counter table. Type is EEPROM-backed when a module answers and falls back to a driver-family guess for copper. Admin reflects an operator shutdown; Oper is the live PMD link state.

cli
show interface                  # one line per physical port
show interfaces                 # + VLAN/QinQ sub-interfaces + bonds
show interface <name>           # full per-port page (below)
show interface stats            # live per-port NIC counters
show interface vlan             # configured sub-interfaces
show interface vlan stats       # per-VLAN rx/tx
show vlan  |  show vlan stats   # the same two, shorter
show interface bonding          # mode, TX policy, members, LACP

show ip address [<if>]
show ipv6 address [<if>]
show ip dns  |  show ipv6 dns

The per-interface page

show interface <name> returns the complete health picture of one port, so nobody has to stitch several commands together. General covers description, admin and oper state, port id, driver, PCI address, NUMA node, MAC, MTU, speed, duplex, autoneg, flow control, media and any bound IPv4 address. DPDK covers queue counts, ring sizes, socket, RSS, promiscuous and all-multicast. Total Counters are the ethdev basic stats including ring-missed and no-mbuf drops. RX/TX Statistics are curated per-PMD hardware xstats — CRC, length, undersize, oversize, fragment, jabber, pause, broadcast and multicast; a counter the PMD does not provide shows a dash, and any remaining non-zero hardware counter is listed under Other Non-Zero Hardware Counters so nothing is hidden.

Transceiver diagnostics

For an SFP or SFP+ the same page reports module type, vendor and OUI, part number, serial, revision, date code, connector, wavelength and reach; then live DDM — temperature, voltage, TX bias and TX/RX optical power in dBm — with active alarm flags and the full alarm and warning threshold table. A DAC is identified as passive or active with vendor and length; a copper port shows no module. EEPROM identity and thresholds are cached per port for an hour and warmed at boot, because the NIC reads them over slow I2C; only the small live-DDM block is read per call, so the page returns in milliseconds. That makes it a first-line optical diagnostic: a weak or dirty fibre shows immediately as a low RX-power reading and an rxpwr-low alarm, without leaving the CLI.

cli
show interface ether1           # state + optics + thresholds

Subscriber services

Access, addressing, translation, filtering and policy.

cli
show ppp                        # running PPP/PPPoE config
show dhcp                       # running IPoE/DHCP config
show dhcpv6                     # DHCPv6 config
show pool                       # framed-IP pools + DNS
show ipv6 pool                  # prefix pool utilisation

show nat                        # conntrack, timeouts, pools, policy
show nat session [<ip>]         # per-flow conntrack dump
show nat flow [<ip>]            # active per-peer connections
show nat statistics [detail]    # counters + recent misses
show nat dstnat                 # port-forward rules + hit counts
show cgnat fragments            # also: show nat fragments

show firewall [drops]           # v4 state + per-rule counters
show firewall address-list [<name>]
show firewall6 [drops]          # v6 — separate, stateless

show qos [bindings]             # profiles, or resolved per subscriber
show qos sub <id>               # rates, octets, drops, queue depth
show qos generations            # commit-rebuild drain state
show subscribers                # alias of show qos bindings

Routing and AAA

The RIB, what was actually programmed into the data plane, and the RADIUS client.

cli
show ip route [detail]          # gateway, source, distance, metric
show ipv6 route [detail]
show ip fib  |  show ipv6 fib   # selected route per prefix
show ip nexthop | show ipv6 nexthop
show nexthops                   # default-gw + next-hop summary
show arp [cache|config]         # watch table, cache, or tunables
show ipv6 neighbor              # v6 neighbour table

show radius [statistics]        # servers + scalars, or counters + RTT
show aaa                        # delegated operator login state

Logging, API and accounts

Diagnostic logging is separate from compliance logging; both have their own show.

cli
show logging                    # level, sink, per-module levels
show log [<module>] [last <n>]  # in-memory diagnostic buffer
show ipdr                       # compliance + per-flow log config
show api                        # state, listen address, source ACL

show users                      # local operator accounts
show user-sessions              # active operator logins
show history                    # recent state-changing commands
show audit log [<n>]            # who / what / when / source / result
show audit session <sid>
show audit user <name>
show auth log [<n>]             # login, logout, denied, timeout

Operational actions

These act on live state immediately, outside the candidate and commit transaction. clear session tears down live subscriber sessions and reuses the RADIUS Disconnect-Message path, so Acct-Stop is sent and the address and NAT state are released. Single selectors are synchronous; all and interface tear down in bounded batches and return immediately, so watch progress with show sessions. clear session all prompts for confirmation first.

cli
clear counters firewall|firewall6|nat [<n>]
clear log

clear session ip <a.b.c.d>             # by framed IPv4
clear session user <name>              # PPPoE user or IPoE MAC
clear session acct-session-id <id>     # PPPoE only
clear session interface <name>         # every session on an interface
clear session all                      # confirms first

Diagnostics

Both run straight from the user-view prompt. The source address is auto-selected by route — the egress interface address — unless source overrides it. df sets the don't-fragment bit; fast uses a 100 ms interval and blocks until done.

cli
ping <dst> [source <ip>] [count <n>] [interval <ms>] [size <bytes>] \
           [ttl <n>] [timeout <ms>] [df] [fast]

traceroute <dst> [source <ip>] [max-hops <n>] [queries <n>] \
                 [timeout <ms>] [size <bytes>]
Previous CLI & transactions Next Monitoring & API