debug ip eigrp
This command enables real-time debugging of EIGRP packets and events on a Cisco router, used to troubleshoot EIGRP neighbor relationships, route exchanges, and metric calculations.
Definition: debug ip eigrp is a Cisco IOS privileged exec command. This command enables real-time debugging of EIGRP packets and events on a Cisco router, used to troubleshoot EIGRP neighbor relationships, route exchanges, and metric calculations.
Overview
The `debug ip eigrp` command is a powerful diagnostic tool used in Cisco's IOS to enable real-time debugging of Enhanced Interior Gateway Routing Protocol (EIGRP) packets and events. This command is essential for network engineers troubleshooting EIGRP neighbor relationships, route exchanges, metric calculations, and convergence issues. EIGRP is a Cisco-proprietary advanced distance-vector routing protocol that uses Diffusing Update Algorithm (DUAL) to ensure loop-free and fast convergence.
Unlike simpler routing protocols such as RIP, EIGRP supports unequal-cost load balancing, summarization, and authentication, making it widely deployed in enterprise networks. When you encounter problems like flapping neighbors, missing routes, or suboptimal path selection, `debug ip eigrp` provides granular insight into the protocol's internal operations. It captures every EIGRP packet (Hello, Update, Query, Reply, and Ack) and logs events such as neighbor state changes, route insertions, and DUAL computations.
This command is typically used in a lab or maintenance window because it generates high CPU overhead and can flood the console with output, potentially disrupting production traffic. It is often paired with `show ip eigrp neighbors`, `show ip eigrp topology`, and `show ip route eigrp` to correlate events. In the troubleshooting workflow, you would first verify basic connectivity and neighbor status with `show` commands, then enable `debug ip eigrp` to capture transient issues.
The command requires privileged EXEC mode (enable) and does not affect the running configuration; however, output is sent to the console by default and can be buffered using `logging buffered` or redirected to a syslog server. It is crucial to disable debugging after use with `undebug all` or `no debug ip eigrp` to avoid performance degradation. Understanding the output fields—such as sequence numbers, K-values, and metric components—is key to interpreting EIGRP behavior.
This command is indispensable for CCNA and CCNP candidates learning EIGRP internals and for engineers maintaining complex routed networks.
debug ip eigrpWhen to Use This Command
- Troubleshooting why an EIGRP neighbor is flapping or not forming adjacency
- Investigating missing routes in the routing table that should be learned via EIGRP
- Verifying EIGRP update, query, and reply packet exchanges during convergence
- Diagnosing EIGRP metric or K-value mismatches between neighbors
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| A.B.C.D | A.B.C.D | Optional IP address of a specific neighbor. When specified, only EIGRP packets to/from that neighbor are displayed. This reduces output clutter when troubleshooting a single adjacency. Common mistake: using an incorrect or unreachable IP address, which results in no output. |
| as-number | <1-65535> | Optional EIGRP autonomous system number. When specified, only events for that AS are shown. Useful when multiple EIGRP processes run on the same router. Common mistake: forgetting to match the AS number configured under router eigrp. |
Command Examples
Basic EIGRP debug for neighbor 10.1.1.2
debug ip eigrp 10.1.1.2EIGRP: Received HELLO on FastEthernet0/0 nbr 10.1.1.2 EIGRP: New peer 10.1.1.2 EIGRP: Sending HELLO to 224.0.0.10 on FastEthernet0/0 EIGRP: Received UPDATE on FastEthernet0/0 nbr 10.1.1.2 EIGRP: Update contains 3 routes EIGRP: Installing route 192.168.2.0/24 via 10.1.1.2
Line 1: Received a HELLO packet from neighbor 10.1.1.2 on FastEthernet0/0. Line 2: A new EIGRP neighbor adjacency is formed. Line 3: Router sends its own HELLO to the multicast address 224.0.0.10. Line 4: Received an UPDATE packet from the neighbor. Line 5: The update contains 3 routes. Line 6: A specific route is installed in the routing table via that neighbor.
Debug EIGRP packets with access list filtering
debug ip eigrp packetsEIGRP: Sending HELLO on FastEthernet0/0 EIGRP: Received HELLO on FastEthernet0/0 nbr 10.1.1.2 EIGRP: Sending UPDATE on FastEthernet0/0 nbr 10.1.1.2 EIGRP: Received ACK on FastEthernet0/0 nbr 10.1.1.2 EIGRP: Sending QUERY on FastEthernet0/0 nbr 10.1.1.2 EIGRP: Received REPLY on FastEthernet0/0 nbr 10.1.1.2
This shows the sequence of EIGRP packet types: HELLO for neighbor discovery, UPDATE for route exchange, ACK for reliable delivery, QUERY for route query, and REPLY for response. Each line indicates the direction (sending/receiving), interface, and neighbor IP.
Understanding the Output
The debug ip eigrp command outputs real-time messages about EIGRP events. Each line starts with 'EIGRP:' followed by the action (Received/Sending), packet type (HELLO, UPDATE, ACK, QUERY, REPLY), interface, and neighbor IP. Key fields: 'nbr' indicates the neighbor router ID; 'Update contains X routes' shows how many routes are in an update; 'Installing route' means the route is added to the routing table.
Good signs: consistent HELLO exchanges and successful route installations. Bad signs: 'Retransmission limit exceeded' or 'Neighbor not on common subnet' indicate problems. Watch for 'K-value mismatch' or 'AS mismatch' which prevent adjacency.
High retransmission counts suggest unreliable links or MTU issues.
Configuration Scenarios
Troubleshoot EIGRP Neighbor Flapping Between Two Routers
Two routers, R1 and R2, are connected via a serial link. The EIGRP neighbor relationship is unstable, going up and down intermittently. You need to identify the cause of the flapping.
Topology
R1(Se0/0/0)---10.0.12.0/30---(Se0/0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode on R1: enable
- 2.Step 2: Clear the EIGRP neighbor table to start fresh: clear ip eigrp neighbors
- 3.Step 3: Enable debugging for EIGRP packets to/from R2's IP: debug ip eigrp 10.0.12.2
- 4.Step 4: Observe the console output for Hello packet failures, retransmissions, or hold-time expirations.
- 5.Step 5: After capturing enough data, disable debugging: undebug all
! No configuration change is needed for debugging; the command is executed in privileged EXEC mode. Router> enable Router# debug ip eigrp 10.0.12.2 Router# undebug all
Verify: Check neighbor status with 'show ip eigrp neighbors'. Expected output shows neighbor 10.0.12.2 in state 'Init' or 'Pending' if flapping. Debug output will show 'Hold time expired' or 'Retransmission limit exceeded' messages.
Watch out: Forgetting to specify the neighbor IP address can flood the console with all EIGRP traffic, causing high CPU and potential packet loss.
Debug EIGRP Route Exchange After a Network Change
A new subnet 192.168.100.0/24 is added to R3's loopback interface. You want to verify that R1 learns this route via EIGRP and check the metric calculation.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2---(Gi0/1)10.0.23.0/30---(Gi0/0)R3
R3(Lo0): 192.168.100.1/24Steps
- 1.Step 1: On R1, enable debugging for EIGRP updates: debug ip eigrp
- 2.Step 2: On R3, configure the loopback and redistribute connected into EIGRP (or advertise under router eigrp).
- 3.Step 3: On R1, watch for Update packets containing the new prefix and note the metric components (bandwidth, delay, reliability, load, MTU).
- 4.Step 4: Verify the route appears in the routing table: show ip route eigrp
- 5.Step 5: Disable debugging: undebug all
! On R3: R3(config)# interface loopback0 R3(config-if)# ip address 192.168.100.1 255.255.255.0 R3(config-if)# exit R3(config)# router eigrp 100 R3(config-router)# network 192.168.100.0 0.0.0.255
Verify: On R1, 'show ip route eigrp' should show 192.168.100.0/24 via next-hop 10.0.12.2. Debug output will show 'Update: 192.168.100.0/24 metric 158720'.
Watch out: If the route does not appear, check that EIGRP is enabled on all interfaces and that there are no passive interfaces blocking updates.
Troubleshooting with This Command
When using `debug ip eigrp` for troubleshooting, it is critical to understand what healthy output looks like versus indicators of problems. In a stable network, you should see periodic Hello packets (every 5 seconds by default on high-speed links) with sequence numbers incrementing smoothly. Neighbor state transitions should be minimal, typically only 'Init' to 'Up' during initial adjacency.
Healthy Update packets are acknowledged quickly, and DUAL computations are rare. Problem indicators include repeated 'Hold time expired' messages, which suggest packet loss or high latency; 'Retransmission limit exceeded' errors, indicating that the router is not receiving ACKs for its Updates; and 'Neighbor change' events with state 'Down' followed by 'Init', signaling flapping. Focus on the 'K-values' in Hello packets—mismatched K-values (e.g., K1 through K6) prevent neighbor formation.
Also watch for 'Stuck in Active' (SIA) messages, which occur when a router waits too long for a Reply to a Query, often due to a network partition or slow convergence. A step-by-step diagnostic flow: 1) Verify physical connectivity and IP addressing. 2) Use `show ip eigrp neighbors` to check neighbor state. 3) If neighbors are missing, enable `debug ip eigrp` with the neighbor IP to see Hello packet exchange. 4) If routes are missing, enable `debug ip eigrp` and trigger a route update (e.g., clear ip eigrp neighbors) to capture Update packets. 5) Analyze metric components: high delay or low bandwidth can cause suboptimal path selection. 6) Correlate with `show ip eigrp topology` to see feasible successors and DUAL events. 7) Use `show ip eigrp traffic` to see packet counts and retransmissions. 8) Always disable debugging after troubleshooting to avoid performance impact. Common symptoms this command helps diagnose include: neighbor not forming (Hello mismatch, authentication failure, or access list blocking), routes not appearing (split horizon, route filtering, or passive interface), and route flapping (unstable link or metric oscillation).
By correlating debug output with `show` commands, you can pinpoint the root cause efficiently.
CCNA Exam Tips
CCNA exam tip: Remember that 'debug ip eigrp' is a privileged EXEC command and can generate heavy CPU load; always use with caution and disable with 'undebug all'.
CCNA exam tip: The exam may ask you to identify why EIGRP neighbors are not forming; look for K-value mismatch, AS number mismatch, or passive interface configuration.
CCNA exam tip: Be able to interpret debug output to determine if a route is being learned via EIGRP and whether it is feasible successor or successor.
CCNA exam tip: Know that EIGRP uses multicast 224.0.0.10 for HELLO and UPDATE packets; debug will show this address.
Common Mistakes
Mistake 1: Leaving debug enabled on a production router, causing high CPU usage and potential crashes. Always disable with 'undebug all' or 'no debug ip eigrp'.
Mistake 2: Forgetting to specify an access list to filter debug output, resulting in overwhelming amount of messages. Use 'debug ip eigrp [neighbor-ip]' to limit.
Mistake 3: Misinterpreting 'Sending QUERY' as a problem; QUERY packets are normal during convergence when a route is lost.
debug ip eigrp vs undebug all
These two commands are commonly paired during troubleshooting: debug ip eigrp enables targeted EIGRP debugging, while undebug all disables all active debugs to prevent CPU overload. They are often confused because one activates a specific debug and the other globally stops all debugs.
| Aspect | debug ip eigrp | undebug all |
|---|---|---|
| Scope | EIGRP-specific (packets, events, neighbors) | All debug types on the router |
| Effect | Generates real-time EIGRP debug output to console/log | Terminates all active debug sessions |
| CPU Impact | Moderate to high during active EIGRP events | Immediately reduces CPU load by stopping all debugs |
| Persistence | Disabled after reload; no running-config entry | No effect on configuration; immediate action |
| Typical Use | Troubleshooting EIGRP neighbor flapping or route problems | Emergency stop to avoid router overload after a debug session |
Use debug ip eigrp when you need to isolate EIGRP-specific issues like neighbor adjacency failures or route advertisement problems.
Use undebug all when you must immediately disable all debugging to prevent performance degradation or to clear the debug output before starting a new targeted debug.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `debug ip eigrp` command syntax and output are largely identical to classic IOS, but the output may be slightly reformatted for readability. On NX-OS (e.g., Nexus 9000), the equivalent command is `debug eigrp packets` and `debug eigrp events`, with additional options like `debug eigrp adjacency` for neighbor-specific debugging. NX-OS also supports `debug ip eigrp` for backward compatibility but recommends the newer syntax.
On ASA firewalls, EIGRP is not supported; instead, use `debug ospf` or `debug rip` as applicable. In IOS-XR (e.g., ASR 9000), the command is `debug eigrp` with sub-options like `debug eigrp neighbor` and `debug eigrp route`. Behavior differences across IOS versions: In IOS 12.x, the output includes verbose DUAL state transitions; in 15.x and 16.x, the output is more concise but still detailed.
The `debug ip eigrp` command is available in all IOS versions but may have additional parameters in newer releases, such as `vrf` for VRF-aware debugging. Always check the specific platform documentation for exact syntax. On some platforms, enabling debugging may require the `service internal` command for hidden debugs.
Remember that debugging is CPU-intensive; on high-end platforms like ASR 1000, the impact is lower due to dedicated control plane processors, but on older routers like the 2600 series, it can cause severe performance degradation.
Related Commands
show ip eigrp neighbors
Displays all EIGRP neighbours with their addresses, interfaces, hold time, uptime, SRTT (smooth round-trip time), RTO, queue count, and sequence numbers.
show ip eigrp topology
Displays the EIGRP topology table, showing all learned routes and their feasible successors, used to verify EIGRP convergence and path selection.
show ip route
Displays the IP routing table showing all known routes, their source protocols, administrative distances, metrics, next-hops, and outgoing interfaces.
undebug all
Disables all active debug operations on the router, used to stop debugging output and reduce CPU load.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions