The operating system behind nearly every capture on this site. Articles tagged Cisco IOS XE cover configuration syntax, show command output, platform behavior and version quirks.
%CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.
An err-disabled port stays down forever by default, because nothing auto-recovers until you arm it. The full cause list from IOS XE 17.18.2, how to identify which one fired in ten seconds, and the captured proof that auto-recovery is a retry loop rather than a fix.
MAB with no ISE node and no license: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
The NAT config looks correct and nothing is translating. One command splits the problem in two: no entry means the traffic never matched, an entry means the failure is downstream. Captured on IOS XE 17.18.2 in CML, where a single missing ip nat inside leaves the table empty at 0 hits.
Dual-active HSRP is invisible from one router: each end looks like a healthy Active gateway until you put both outputs side by side and see Standby=unknown on each. Captured live on IOS XE 17.18.2 in CML, plus the preempt behavior that silently inverts your design.
A traceroute whose hop addresses repeat until the TTL runs out is a routing loop, and nothing else. Captured on CML with IOS XE 17.18.2: the symptom signature, why TTL keeps a routing loop from behaving like a Layer 2 loop, the four causes ranked by real frequency, and the Null0 discard route...
Two equal links, one carrying everything. CEF picks a path per flow, not per packet, and when every router in a tier runs the same hash you get polarization. Proven on real route, CEF and exact-route output from a CML lab on IOS XE 17.18.2.
An IPv6 host with only an FE80:: address is waiting on a Router Advertisement that never came. Captured on CML with IOS XE 17.18.2: the five NDP messages, the neighbor cache states, the A/M/O flags in a real RA, and why filtering ICMPv6 unplugs a segment.
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
The prefix is in the BGP table and show ip route says % Network not in table. The leading status characters are the whole diagnosis. Captured live on IOS XE 17.18.2 in CML, where a missing next-hop-self leaves an iBGP path valid, inaccessible and never installed.
Active is a failure state and Idle is where the FSM gives up. Organized by the state you are looking at right now, with a lab finding that matters: on IOS XE 17.18.2 both "no route to peer" and "TCP 179 blocked" showed up as Idle.