show interfaces counters
Displays interface packet and byte counters for all interfaces or a specific interface, useful for monitoring traffic statistics and identifying errors or discards.
Definition: show interfaces counters is a Cisco IOS privileged exec command. Displays interface packet and byte counters for all interfaces or a specific interface, useful for monitoring traffic statistics and identifying errors or discards.
Overview
The `show interfaces counters` command is a powerful diagnostic tool in Cisco IOS that provides a high-level summary of packet and byte statistics for all interfaces or a specific interface. Unlike the more detailed `show interfaces` command, which includes line protocol status, IP address, and extensive error breakdowns, `show interfaces counters` focuses purely on traffic counts: total packets and bytes transmitted and received, as well as broadcast, multicast, and error counters. This command is invaluable for quickly assessing traffic load, identifying interfaces with excessive errors or discards, and monitoring for asymmetric routing or broadcast storms.
It is often the first command a network engineer runs when investigating performance issues or capacity planning because it consumes minimal CPU and returns concise, actionable data. The output is buffered, meaning it may not reflect real-time changes if the interface counters have been cleared recently; to get fresh data, use `clear counters` before running the command. The command requires privileged EXEC mode (enable) and does not modify the running configuration.
It fits into a broader troubleshooting workflow: start with `show interfaces counters` to spot anomalies, then drill down with `show interfaces` for detailed error types, and finally use `show interface stats` or `show interface accounting` for per-protocol breakdowns. Understanding the counters is essential for CCNA and CCNP candidates, as it directly relates to topics like interface errors, duplex mismatches, and network congestion. The command supports optional parameters to filter by interface type or specific interface, making it flexible for both quick checks and targeted analysis.
In modern networks, this command remains relevant for monitoring switch ports, router WAN links, and firewall interfaces, providing a baseline for normal traffic patterns and alerting engineers to potential issues like CRC errors, runts, or giants that indicate physical layer problems. The counters are cumulative since the last reload or clear, so tracking trends over time is key. For example, a sudden spike in output discards on a trunk port might indicate a buffer overflow due to microbursts, while increasing input errors on a serial link could point to a faulty cable or clocking issue.
The command also helps in verifying QoS policies: if a class-map is dropping packets, the output drop counters will rise. Overall, `show interfaces counters` is a fundamental command that every network engineer should master for efficient network monitoring and troubleshooting.
show interfaces countersWhen to Use This Command
- Check for excessive packet drops or errors on a specific interface to troubleshoot performance issues.
- Monitor traffic volume on an interface to verify bandwidth utilization or detect abnormal traffic patterns.
- Verify that interface counters are incrementing as expected after configuration changes or during testing.
- Compare input and output packet counts to identify asymmetric routing or unidirectional traffic.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface-type interface-number | e.g., GigabitEthernet0/1 | Specifies a particular interface to display counters for. If omitted, counters for all interfaces are shown. Common mistake: using an incorrect interface name or number, which results in an error message. Valid values include any configured interface on the device. |
Command Examples
Display counters for all interfaces
show interfaces countersInterface Input Packets Output Packets Input Bytes Output Bytes GigabitEthernet0/0 1234567 2345678 1234567890 2345678901 GigabitEthernet0/1 987654 876543 987654321 876543210 Serial0/0/0 12345 23456 12345678 23456789 Loopback0 0 0 0 0
The output shows each interface with its input/output packet and byte counters. 'Input Packets' counts packets received, 'Output Packets' counts packets sent. 'Input Bytes' and 'Output Bytes' are the total bytes. Use this to see traffic volume at a glance.
Display counters for a specific interface with errors
show interfaces counters GigabitEthernet0/0Interface Input Packets Output Packets Input Bytes Output Bytes GigabitEthernet0/0 1234567 2345678 1234567890 2345678901 5 minute input rate 1000 bits/sec, 2 packets/sec 5 minute output rate 2000 bits/sec, 3 packets/sec Input errors: 0, CRC errors: 0, Frame errors: 0, Overrun: 0, Ignored: 0 Output errors: 0, Collisions: 0, Interface resets: 0
For a specific interface, additional statistics are shown: 5-minute average input/output rates, and error counters. 'Input errors' include CRC, frame, overrun, ignored. 'Output errors' include collisions and interface resets. Zero errors indicate a healthy interface.
Understanding the Output
The 'show interfaces counters' command provides a summary of packet and byte counts for each interface. The main table has columns: Interface name, Input Packets, Output Packets, Input Bytes, Output Bytes. These counters are cumulative since the last reset (or router reload).
When specifying a specific interface, additional lines show the 5-minute average input/output rates in bits/sec and packets/sec, followed by error counters. Input errors (CRC, frame, overrun, ignored) indicate physical layer or framing issues. Output errors (collisions, interface resets) suggest contention or hardware problems.
High error counts or non-zero values typically indicate a problem that needs investigation. Compare input/output packet counts to verify bidirectional traffic; a large discrepancy may indicate a configuration issue or link asymmetry.
Configuration Scenarios
Monitor Traffic on a Router WAN Link
A network engineer needs to verify that a new 10 Mbps WAN link is not oversubscribed and to check for any errors that might indicate a physical issue.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Clear counters to start fresh: Router# clear counters
- 3.Step 3: Wait for a period (e.g., 5 minutes) to accumulate traffic.
- 4.Step 4: Display counters for the WAN interface: Router# show interfaces counters GigabitEthernet0/0
- 5.Step 5: Analyze the output: check 'Input packets' and 'Output packets' for total traffic, and 'Input errors' and 'Output errors' for any issues.
! No configuration needed; this is a monitoring command. Router# clear counters Router# show interfaces counters GigabitEthernet0/0
Verify: Expected output shows counters for Gi0/0 only. For a healthy link, input and output errors should be zero or very low relative to total packets.
Watch out: Forgetting to clear counters before monitoring can lead to misleading data, as counters accumulate from the last reload or clear.
Identify a Broadcast Storm on a Switch
Users report slow network performance, and the engineer suspects a broadcast storm caused by a loop or misconfigured end device.
Topology
SW1(Gi0/1)---PC1
SW1(Gi0/2)---PC2
SW1(Gi0/3)---PC3Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Display counters for all interfaces: Switch# show interfaces counters
- 3.Step 3: Look for interfaces with abnormally high 'Broadcast' or 'Multicast' packet counts relative to total packets.
- 4.Step 4: Identify the offending interface (e.g., Gi0/1) and investigate further with 'show interfaces Gi0/1' for errors or 'show spanning-tree' for loops.
- 5.Step 5: Take corrective action, such as enabling storm control or disabling the port.
! No configuration needed; use show commands. Switch# show interfaces counters ! Look for high broadcast counts. Switch# show interfaces Gi0/1
Verify: A healthy interface should have broadcast packets as a small percentage (e.g., <5%) of total packets. If an interface shows 50% or more broadcasts, it indicates a storm.
Watch out: Broadcast counters include all broadcast frames, including legitimate ones like ARP. A high broadcast count alone doesn't confirm a storm; correlate with CPU utilization and other symptoms.
Troubleshooting with This Command
When troubleshooting network issues, `show interfaces counters` is your first line of defense. Healthy output shows monotonically increasing packet and byte counters with minimal errors, discards, or unknown protocols. Key fields to focus on: 'Input packets' and 'Output packets' give total traffic volume; 'Input errors' and 'Output errors' indicate physical or data-link problems; 'Input discards' and 'Output discards' suggest buffer overruns or QoS drops; 'Broadcast' and 'Multicast' packets help detect storms.
A common symptom is high input errors on a switch port, which often points to a duplex mismatch or faulty cable. For example, if a server is set to half-duplex and the switch port to full-duplex, you'll see a steady increase in CRC errors and runts. Another symptom is output discards on a router interface, which may indicate that the interface is congested and packets are being dropped due to queue exhaustion.
To diagnose, follow this flow: 1) Run `show interfaces counters` to get a global view. 2) If errors are present, run `show interfaces` on the specific interface for detailed error types (e.g., CRC, frame, runts, giants). 3) For discards, check `show interface stats` to see per-protocol drops. 4) Correlate with `show processes cpu` to see if high CPU is causing input drops. 5) Use `show logging` to see if interface flaps or error messages appear. For broadcast storms, compare broadcast counters across interfaces; if one interface has orders of magnitude more broadcasts, it's likely the source. Also, `show interfaces counters` can help identify asymmetric routing: if input and output packet counts on a link are vastly different, traffic may be taking different paths.
Remember that counters are cumulative; to see real-time changes, clear counters first or use `show interfaces counters | include <interface>` to filter. In a troubleshooting scenario, always note the timestamp and compare with baseline data. This command is also useful for verifying that ACLs or QoS policies are working: if you apply an ACL that denies certain traffic, the input packet count on the interface should not increase for that traffic type, but the overall counters will still increment.
Finally, don't overlook the 'Unknown' field, which counts packets with unknown protocols—this can indicate misconfigured devices or security issues. By mastering `show interfaces counters`, you can quickly isolate many common network problems and reduce mean time to resolution.
CCNA Exam Tips
CCNA exam may ask which command shows interface packet counts without detailed errors; 'show interfaces counters' is the answer.
Remember that 'show interfaces' includes errors and rates, while 'show interfaces counters' is a quick summary.
The exam might test that counters are cumulative and reset only on reload or with 'clear counters'.
Know that 'show interfaces counters' can be filtered by interface name to see specific interface statistics.
Common Mistakes
Confusing 'show interfaces counters' with 'show interfaces' which provides more detailed output including errors and rates.
Assuming counters reset automatically; they do not unless explicitly cleared with 'clear counters'.
Misinterpreting high input errors as a switch issue when it could be a cable or duplex mismatch problem.
Forgetting to specify an interface name when only interested in one interface, leading to unnecessary output.
show interfaces counters vs show interfaces status
Both 'show interfaces counters' and 'show interfaces status' provide interface information, but they serve distinct purposes. 'show interfaces counters' focuses on traffic statistics like packet and byte counts, errors, and discards, while 'show interfaces status' offers a quick summary of operational state, VLAN, duplex, and speed. They are often confused because both are used for interface monitoring but yield different data.
| Aspect | show interfaces counters | show interfaces status |
|---|---|---|
| Scope | All interfaces or a specific interface | All switch interfaces only |
| Information type | Packet/byte counters, errors, discards, no collisions | Administrative/operational status, VLAN, duplex, speed, type |
| Format | Detailed line-by-line per interface | Concise table with one row per interface |
| Typical use | Traffic load analysis, error monitoring, capacity planning | Quick connectivity verification, interface configuration check |
| Impact | Reads counters; counters can be cleared manually | Reads status; no counters to clear |
Use show interfaces counters when you need to monitor traffic volume, identify error rates, or compare input/output bytes over time for capacity planning.
Use show interfaces status when you need a quick summary of which interfaces are up/down, their VLAN membership, and their negotiated speed and duplex.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `show interfaces counters` command is available with identical syntax and output format. However, IOS-XE also supports `show interfaces counters errors` for a more detailed error breakdown. On NX-OS (e.g., Nexus switches), the equivalent command is `show interface counters`, but note that NX-OS uses 'interface' singular and the output includes additional fields like 'Input with Drops' and 'Output with Drops'.
For ASA firewalls, the command `show interface` provides similar counter information but with a different output format; there is no direct `show interfaces counters` equivalent. In IOS-XR, the command is `show interfaces counters` but the output is more verbose and includes separate sections for each interface; also, IOS-XR requires the 'detail' keyword for per-queue statistics. Between IOS versions, the output format has remained largely consistent from 12.x to 15.x and 16.x, though newer versions may add fields like 'Input total drops' or 'Output total drops'.
On older IOS (12.x), the command may not show broadcast/multicast counters separately; they are included in the total packet count. Always check the specific platform documentation, as some features like 'clear counters' may require a different syntax on NX-OS (e.g., `clear counters interface ethernet 1/1`). For CCNA/CCNP studies, focus on the IOS syntax as it is the most common across exam topics.
Related Commands
clear counters
Resets all interface packet and error counters to zero without affecting the interface operational state, allowing a clean baseline for traffic monitoring or error rate measurement.
show interfaces
Displays detailed Layer 1 and Layer 2 statistics for all interfaces or a specific interface: line protocol state, hardware type, MAC address, MTU, bandwidth, duplex, speed, input/output rates, error counters, and queue statistics.
show interfaces status
Displays a summary of all switch interfaces including their status, VLAN, duplex, speed, and type, used to quickly verify interface connectivity and configuration.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions