show ip interface
Displays the status and configuration of all IP interfaces on a Cisco router, including IP address, protocol status, and interface statistics, used for verifying interface IP configuration and troubleshooting connectivity issues.
Definition: show ip interface is a Cisco IOS privileged exec command. Displays the status and configuration of all IP interfaces on a Cisco router, including IP address, protocol status, and interface statistics, used for verifying interface IP configuration and troubleshooting connectivity issues.
Overview
The `show ip interface` command is a fundamental diagnostic tool in Cisco IOS that displays the IP-related status and configuration of every interface on a router. It provides a comprehensive view of each interface's IP address, subnet mask, protocol status (line protocol and IP protocol), helper addresses, access lists, and various IP-specific parameters such as broadcast address, MTU, and whether the interface is configured for features like NAT, policy routing, or multicast. This command is essential for verifying that IP addresses are correctly assigned, interfaces are up and operational, and that IP processing is enabled. Without it, engineers would struggle to isolate Layer 3 issues from Layer 1/2 problems.
The networking concept behind this command is the IP protocol stack's interface layer. Each interface on a router can have multiple IP addresses (secondary addresses) and must have IP processing enabled to forward packets. The command reveals the state of the IP protocol on the interface, which can be 'up' (IP is operational) or 'down' (IP is not operational, often due to a missing 'ip address' command or a shutdown interface). It also shows whether the interface is configured for features like directed broadcast forwarding, proxy ARP, or ICMP unreachables. Understanding these details is critical for troubleshooting connectivity: if an interface shows 'IP is down', no IP traffic will be forwarded even if the line protocol is up.
Network engineers reach for `show ip interface` when verifying initial configuration, after making changes to an interface's IP address or features, or when troubleshooting end-to-end connectivity. It is often the first command after `show ip interface brief` (which gives a summary) to drill into a specific interface. Alternatives include `show interfaces` (which focuses on Layer 1/2 statistics) and `show ip interface brief` (which provides a one-line summary per interface). The command fits into a broader workflow: after configuring an interface, you verify with `show ip interface` to confirm the IP address and status; then you might ping a neighbor; if ping fails, you check `show ip interface` again to ensure IP is up and no ACLs are blocking. In troubleshooting, it is used alongside `show ip route` to verify that the interface is in the routing table and `show access-lists` to check for applied ACLs.
Important IOS behaviors: The output can be lengthy on routers with many interfaces; you can filter by interface name (e.g., `show ip interface gigabitethernet 0/0`). The command requires privileged EXEC mode (enable). It does not affect the running configuration. In some IOS versions, the output includes a line 'IP address is ...' and 'IP is up/down' which is the key status. The command also shows 'Helper address' for DHCP relay, 'Directed broadcast forwarding' (default disabled), 'Outgoing access list' and 'Inbound access list' (if any), and 'Proxy ARP' status. Understanding these fields helps in advanced troubleshooting.
show ip interfaceWhen to Use This Command
- Verify that an interface has the correct IP address and subnet mask after configuration.
- Troubleshoot why an interface is showing 'up' but 'down' at the protocol level.
- Check if an interface is administratively down due to a shutdown command.
- Review interface statistics like input/output errors or broadcast traffic for performance issues.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface-type interface-number | e.g., GigabitEthernet0/0, Serial1/0, Loopback0 | Specifies a particular interface to display detailed IP information. If omitted, the command shows information for all interfaces. Common mistake: using incorrect interface naming (e.g., 'G0/0' instead of 'GigabitEthernet0/0') or forgetting the space between type and number. |
Command Examples
Basic show ip interface output for a single interface
show ip interface GigabitEthernet0/0GigabitEthernet0/0 is up, line protocol is up Internet address is 192.168.1.1/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is not set Proxy ARP is enabled Local Proxy ARP is disabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP flow switching is disabled IP CEF switching is enabled IP CEF switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled IP route-cache flags are Fast, CEF Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled RTP/IP header compression is disabled Probe proxy name replies are disabled Policy routing is disabled Network address translation is disabled WCCP Redirect outbound is disabled WCCP Redirect inbound is disabled WCCP Redirect exclude is disabled BGP Policy Mapping is disabled Input features: MCI Check IPv4 WCCP Redirect outbound is disabled IPv4 WCCP Redirect inbound is disabled IPv4 WCCP Redirect exclude is disabled
Line 1: 'GigabitEthernet0/0 is up, line protocol is up' indicates the interface is operational. 'Internet address is 192.168.1.1/24' shows the configured IP and subnet mask. 'Broadcast address' is the broadcast IP for the subnet. 'MTU' is the maximum transmission unit. 'Helper address' is used for DHCP relay. 'Directed broadcast forwarding' is disabled by default. 'Proxy ARP' is enabled, allowing the router to respond to ARP requests for other hosts. 'Split horizon' is enabled for routing protocols. 'ICMP redirects' and 'unreachables' are sent. 'IP fast switching' and 'CEF switching' are enabled for performance.
Show ip interface brief for a quick overview
show ip interface briefInterface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES NVRAM up up GigabitEthernet0/1 unassigned YES NVRAM administratively down down Serial0/0/0 10.0.0.1 YES manual up up Loopback0 1.1.1.1 YES NVRAM up up
This command provides a summary of all interfaces. 'Interface' is the interface name. 'IP-Address' shows the configured IP or 'unassigned'. 'OK?' indicates if the interface is valid. 'Method' shows how the IP was assigned (NVRAM, manual, DHCP). 'Status' shows line status (up, down, administratively down). 'Protocol' shows line protocol status (up, down). An 'administratively down' status means the interface was manually shut down with the 'shutdown' command.
Understanding the Output
The 'show ip interface' command provides detailed information about IP configuration and status for each interface. The first line shows the interface line status and protocol status: 'up/up' means operational, 'up/down' indicates a layer 1 issue (e.g., cable problem), 'down/down' means the interface is disabled or no cable, and 'administratively down/down' means the interface was manually shut down. The 'Internet address' field shows the IP and subnet mask.
'Broadcast address' is the subnet broadcast. 'MTU' is the maximum packet size. 'Helper address' is used for DHCP relay.
'Directed broadcast forwarding' should be disabled for security. 'Proxy ARP' can be a security concern if enabled. 'Split horizon' is important for routing loops.
'ICMP redirects' and 'unreachables' are sent by default. 'IP fast switching' and 'CEF' indicate hardware acceleration. Look for 'up/up' for operational interfaces; any other status indicates a problem.
High error counts (not shown here but available with 'show interfaces') indicate physical issues.
Configuration Scenarios
Verify IP Configuration on a Newly Configured Interface
After configuring an IP address on a router interface, you need to confirm that the IP address is correctly assigned and that the interface is operational for IP traffic.
Topology
R1(Gi0/0)---192.168.1.0/24---(Gi0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: View IP interface details for GigabitEthernet0/0: R1# show ip interface gigabitethernet 0/0
- 3.Step 3: Verify that the output shows 'IP address is 192.168.1.1/24' and 'IP is up, line protocol is up'.
- 4.Step 4: Check that 'IP is up' and 'line protocol is up' appear, indicating the interface is operational.
! Configuration on R1 interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 no shutdown
Verify: R1# show ip interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up Internet address is 192.168.1.1/24 Broadcast address is 192.168.1.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is not set Proxy ARP is enabled ...
Watch out: If the interface shows 'IP is down' even though line protocol is up, you may have forgotten to assign an IP address or the interface is administratively down (shutdown). Always check for 'no shutdown'.
Troubleshoot Missing IP Connectivity Due to ACL Blocking
A host on a subnet cannot ping the router's interface IP. The interface is up, but the ping fails. You suspect an inbound ACL is blocking ICMP.
Topology
Host(192.168.1.100)---(Gi0/0)R1(Gi0/1)---10.0.0.0/30---R2Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Check IP interface details for the interface facing the host: R1# show ip interface gigabitethernet 0/0
- 3.Step 3: Look for 'Inbound access list is 100' in the output. If an ACL is applied, note its number or name.
- 4.Step 4: Display the ACL to see if ICMP is permitted: R1# show access-list 100
- 5.Step 5: If ICMP is denied, modify the ACL to permit echo requests and replies.
! Current ACL on R1 access-list 100 deny icmp any any echo access-list 100 permit ip any any interface GigabitEthernet0/0 ip access-group 100 in
Verify: R1# show ip interface gigabitethernet 0/0 ... Inbound access list is 100 ... R1# show access-list 100 Extended IP access list 100 10 deny icmp any any echo 20 permit ip any any After fix: access-list 100 permit icmp any any echo access-list 100 permit icmp any any echo-reply access-list 100 deny icmp any any access-list 100 permit ip any any
Watch out: ACL order matters: the first matching rule is applied. Ensure permit rules for desired traffic appear before deny rules. Also, remember that ACLs are processed in sequence; a deny all at the end will block everything not explicitly permitted.
Troubleshooting with This Command
When using `show ip interface` for troubleshooting, the key fields to examine are the interface status line (e.g., 'GigabitEthernet0/0 is up, line protocol is up'), the IP address and subnet mask, and the 'IP is up/down' line. A healthy interface will show 'IP is up, line protocol is up' and a valid IP address. If the interface is administratively down, you will see 'administratively down' in the status. If the line protocol is down, it indicates a Layer 1 or Layer 2 problem (e.g., cable unplugged, no carrier detect). If the line protocol is up but IP is down, it means IP routing is not enabled on the interface (e.g., no 'ip address' configured) or the interface is in a state where IP processing is disabled (e.g., due to a 'shutdown' command).
Common symptoms and their meanings: - 'IP is down' with line protocol up: Usually indicates no IP address configured or the interface is in a 'down' state due to a feature like 'ip routing' being disabled globally (rare) or the interface being placed in a VRF without an IP address. - 'IP is up' but line protocol down: Physical or data link problem (e.g., no cable, wrong encapsulation). - 'Internet address is ...' shows a different IP than expected: Misconfiguration or duplicate address detection (if enabled). - 'Inbound access list is ...' or 'Outbound access list is ...': ACLs may be blocking traffic; check the ACL rules. - 'Helper address is set': Indicates DHCP relay is configured; if not intended, it may cause unexpected broadcast forwarding.
Step-by-step diagnostic flow: 1. Start with `show ip interface brief` to get a quick overview of all interfaces and their IP status. 2. For the problematic interface, run `show ip interface <interface>` to get detailed information. 3. Check the status line: If down, troubleshoot Layer 1/2 (cables, duplex, speed). If administratively down, issue 'no shutdown'. 4. Check the 'IP is' line: If down, verify that an IP address is configured and that the interface is not in a VRF without an address. 5. Check for ACLs: If an ACL is applied, examine it with `show access-lists` to see if it is blocking desired traffic. 6. Check for features like NAT, policy routing, or multicast that might affect traffic. 7. Correlate with `show ip route` to ensure the interface's subnet appears in the routing table (directly connected). 8. Use `ping` and `traceroute` to test connectivity; if they fail, revisit the `show ip interface` output for clues.
Correlating with other commands: `show interfaces` provides error counters (CRC, collisions) that can indicate physical issues. `show ip interface` does not show errors; it focuses on IP configuration. `show running-config interface <interface>` shows the exact configuration. `debug ip packet` can be used to see if packets are being processed, but use with caution on production networks.
CCNA Exam Tips
CCNA exam tip: Remember that 'show ip interface brief' is the quickest way to see interface status and IP addresses; the 'Status' column shows line status, 'Protocol' shows layer 2 status.
CCNA exam tip: An interface showing 'administratively down' means it was manually disabled with the 'shutdown' command; use 'no shutdown' to enable it.
CCNA exam tip: The 'show ip interface' command shows 'Proxy ARP is enabled' by default; the exam may ask about disabling it for security with 'no ip proxy-arp'.
CCNA exam tip: If the line protocol is 'down' but the interface is 'up', suspect a layer 2 problem (e.g., no keepalives, mismatched encapsulation).
Common Mistakes
Mistake 1: Confusing 'show ip interface brief' with 'show interfaces' — the former shows only IP info, the latter shows all interface details including errors.
Mistake 2: Forgetting that 'show ip interface' without an interface name shows all interfaces; using 'show ip interface brief' is more efficient for a summary.
Mistake 3: Misinterpreting 'administratively down' as a physical problem; it is a configuration issue fixed with 'no shutdown'.
show ip interface vs show interfaces
The 'show ip interface' and 'show interfaces' commands are often confused because both display interface information but at different layers of the OSI model. 'show ip interface' focuses on Layer 3 IP parameters, while 'show interfaces' provides Layer 1 and Layer 2 details.
| Aspect | show ip interface | show interfaces |
|---|---|---|
| Scope | IP interface parameters only | All interfaces (physical and logical) with L1/L2 stats |
| Layer Focus | Layer 3 (IP) | Layers 1 and 2 |
| Output Detail | IP address, protocol status, helper-address | MAC, MTU, bandwidth, duplex, speed, counters |
| Error Counters | None | Input/output errors, CRC, collisions |
| Typical Use | Verify IP address assignment and interface up/down at L3 | Troubleshoot physical connectivity and performance issues |
Use show ip interface when you need to verify IP configuration and Layer 3 status of an interface.
Use show interfaces when you need to inspect physical and data-link layer statistics, such as errors or duplex mismatches.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ASR 1000), the `show ip interface` command syntax and output are largely identical to classic IOS. However, on some IOS-XE platforms, the command may show additional fields like 'IP CEF switching' or 'IP route-cache' flags. On NX-OS (Cisco Nexus switches), the equivalent command is `show ip interface` as well, but the output format differs: it uses a more structured, tabular style and may include fields like 'IP address', 'Interface status', 'VRF', and 'MTU'.
For example, on NX-OS, `show ip interface brief` is more commonly used for a summary, and `show ip interface <interface>` provides detailed info. There is no exact equivalent on ASA firewalls; the closest is `show interface ip brief` or `show ip address` to display IP addresses. On IOS-XR, the command is `show ip interface <interface>` but the output is different, focusing on operational state and configured addresses; it also supports XML output.
For IOS versions, the command has remained consistent from 12.x through 16.x, but newer versions may include additional fields like 'IPv6 address' if IPv6 is configured. Always check the specific platform documentation for any minor variations.
Related Commands
show interfaces
Displays detailed Layer 1 and Layer 2 statistics for all interfaces or a specific interface: line protocol state, hardware type, MAC address, MTU, bandwidth, duplex, speed, input/output rates, error counters, and queue statistics.
show ip interface brief
Displays a one-line summary of all interfaces showing the IP address assigned, operational status (up/down), and line protocol status. The fastest way to get a device health overview.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions