Nmap finished, the target answered HTTP and Suricata recorded zero alerts. One SPAN source was set to tx, so the sensor got 16 replies and none of the 16 scanner SYNs. Restoring both returned the SYNs and all 13 alerts.
IOL-L2 handled STP and IGMP snooping but its 802.1X probe never completed; IOSv-L2 completed EAP-TLS. Pick Cisco images by the behavior you need: IOL, IOSv, ASAv, FTDv, N9Kv and 9800, with tags, RAM and verified limits.
DHCP starvation filled a 12-address pool, then a rogue server handed out gateway .254. Enabling snooping with the server uplink untrusted broke DHCP with zero recorded drops; trusting the uplink fixed it, and rate limiting stopped the burst.
Seven faults on one working path: no route, a silent ACL drop, a missing return route, an admin reject, a TTL loop, an MTU limit with DF and a host firewall. Three gave the same silent ping summary; captures told them apart.
Calculate root ports on six switches: path cost settles SW4, neighbor bridge ID settles SW5 and neighbor port ID settles SW6. Check the real outputs, then change one cost to move SW4's root port.
Without protection one access port learned 17,991 MACs. With port security, 10,000 spoofed frames left three entries. Then a phone joined the PC port, a one-MAC limit shut it down, and maximum 2 fixed it.
The IKE SA stayed QM_IDLE while LAN pings failed. A wrong transform set, mismatched PFS groups, wrong proxy IDs and a missing NAT exemption each broke Phase 2. A lifetime mismatch did not: IOS used the lower value.
FreeRADIUS sent Access-Accept, yet the contractor port stayed in parking VLAN 190 with Authc Success and Unauthorized. The reply asked for VLAN 311, which did not exist. Fix the reply, reauthenticate and verify the session VLAN.
The client sent EAPOL, the switch sent RADIUS requests and the port stayed unauthorized, with no Access-Reject. FreeRADIUS logged eight invalid Message-Authenticator drops. Restoring the switch key brought back EAP-TLS and traffic.
The static NAT rule and the outside ACL were unchanged, yet the published website timed out. A stale section 1 manual rule mapped the same address to an old backend, and syslog 106023 named it. Removing the rule fixed HTTP.
The 9800-CL serial console went quiet during first boot because the usable console was VGA, and a later boot dropped the management address to DHCP. A custom build, VGA access and a static management fix got SSH and the GUI working.
Suricata alerted on the SYN of a connection that Zeek logged as a completed HTTP 200. Community ID joined the two. A different hash seed broke the join with the capture unchanged, and DNS counts and byte units differed by design.