%CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.
An err-disabled port stays down forever by default, because nothing auto-recovers until you arm it. The full cause list from IOS XE 17.18.2, how to identify which one fired in ten seconds, and the captured proof that auto-recovery is a retry loop rather than a fix.
MAB with no ISE node and no licence: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
The NAT config looks correct and nothing is translating. One command splits the problem in two: no entry means the traffic never matched, an entry means the failure is downstream. Captured on IOS XE 17.18.2 in CML, where a single missing ip nat inside leaves the table empty at 0 hits.
Dual-active HSRP is invisible from one router: each end looks like a healthy Active gateway until you put both outputs side by side and see Standby=unknown on each. Captured live on IOS XE 17.18.2 in CML, plus the preempt behaviour that silently inverts your design.
A traceroute whose hop addresses repeat until the TTL runs out is a routing loop, and nothing else. Captured on CML with IOS XE 17.18.2: the symptom signature, why TTL keeps a routing loop from behaving like a Layer 2 loop, the four causes ranked by real frequency, and the Null0 discard route...
Two equal links, one carrying everything. CEF picks a path per flow, not per packet, and when every router in a tier runs the same hash you get polarization. Proven on real route, CEF and exact-route output from a CML lab on IOS XE 17.18.2.
An IPv6 host with only an FE80:: address is waiting on a Router Advertisement that never came. Captured on CML with IOS XE 17.18.2: the five NDP messages, the neighbor cache states, the A/M/O flags in a real RA, and why filtering ICMPv6 unplugs a segment.
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.