Diagnose

4.1 Diagnose network problems using such as debugs, conditional debugs, traceroute, ping, SNMP, and syslog

6 min read ENCOR 350-401 v1.2 Updated Jul 27, 2026

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

The exam gives you a symptom and asks which tool proves the cause. Know what each tool shows, what it misses, and how to use it without causing an outage.

Tool	Best question	Weakness
`ping`	Can packets reach the destination and return?	Shows no path and no reason for failure.
`traceroute`	Where does the path stop or change?	Depends on ICMP and control-plane replies.
`debug`	What is the device doing right now?	Can overload a busy device.
Conditional debug	Can I debug only one interface or peer?	Needs a correct filter.
SNMP	What counters does the NMS see over time?	Polling can miss short events.
Syslog	What happened and when?	Weak without good timestamps.

A structured troubleshooting procedure

Do these steps in order. Stop when the evidence proves or clears a layer.

Define the symptom. Name the source, destination, and application that fail.
Test reachability with ping from the correct source address.
Find the break point with traceroute from the same source.
Check Layer 3 and Layer 2 state on the last good hop: routes, CEF, ARP, interface counters.
Read the syslog for recent events on that hop.
Run a conditional debug during a short test window if state looks correct.
Change one thing, then test again with the same ping.

show ip interface brief
show ip route 10.10.20.2
show ip cef 10.10.20.2
show arp | include 10.10.20.2
show interfaces GigabitEthernet0/0 counters errors

Read ping output

Use ping to test if packets leave and return. Use the correct source address. A router can reach a destination from its egress interface while the user subnet cannot.

R1# ping 10.10.20.2 source 10.10.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.2, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/5 ms

Read the reply characters like this:

Character	Meaning
`!`	Reply received.
`.`	Timeout, no reply.
`U`	Destination unreachable.
`M`	Could not fragment.
`?`	Unknown packet type.

Read traceroute output

Traceroute shows the hop-by-hop path. Each line lists the hop address and three round-trip times.

R1# traceroute 10.10.20.2 source 10.10.10.1
Type escape sequence to abort.
Tracing the route to 10.10.20.2
  1 10.10.12.2 4 msec 4 msec 5 msec
  2 10.10.23.3 8 msec 7 msec 8 msec
  3 10.10.20.2 10 msec 9 msec 9 msec

A * * * line means the hop did not reply. If traceroute stops at hop 2, that does not convict hop 2. Hop 3 may have no return route. A firewall may filter the probes. Control Plane Policing may limit the replies. Treat traceroute as a clue, not a verdict.

Use conditional debugs

Debugs show live behavior. That makes them useful and dangerous. A broad packet debug on a busy production router can cause an outage.

Warning: debug ip packet without a filter can stop a busy router. Always filter, and know undebug all before you start.

A conditional debug limits the output to one interface. This example watches only Internet Control Message Protocol (ICMP) on one interface:

R1# debug condition interface GigabitEthernet0/0
Condition 1 set
R1# debug ip icmp
ICMP packet debugging is on
R1# show debug condition
Condition 1: interface Gi0/0 (Enabled)

Now ping from a host that crosses GigabitEthernet0/0. The output shows each echo and echo reply:

*Jul 19 12:15:04.123: ICMP: echo reply rcvd, src 10.10.20.2, dst 10.10.10.1

Stop the debug and clear the condition when the test ends:

R1# no debug all
R1# clear debug condition all

Safe debug habits:

Run terminal monitor if you work over a remote session.
Run show debugging to see what is active.
Set a condition before you enable the debug.
Run one test and capture the output.
Run no debug all and clear the conditions.

Note: debug ip packet may not show all CEF-forwarded or hardware-switched traffic. Use SPAN, RSPAN, or ERSPAN or a packet capture for packet contents. Use counters, SNMP, or syslog for trends.

Syslog severity levels

Syslog is the event timeline. Configure it before you need it:

conf t
service timestamps log datetime msec localtime show-timezone
logging source-interface Loopback0
logging host 10.10.10.50
logging trap informational
logging buffered 100000 warnings
end

Learn the eight severity levels. Lower numbers are more severe:

Level	Name	Meaning
0	Emergency	System unusable
1	Alert	Immediate action required
2	Critical	Critical condition
3	Error	Error condition
4	Warning	Warning condition
5	Notification	Normal but significant
6	Informational	Normal information
7	Debug	Debug-level detail

logging trap informational sends levels 0-6 to the server. logging buffered warnings keeps levels 0-4 in local memory. Verify with show logging.

SNMPv2c vs SNMPv3

Simple Network Management Protocol (SNMP) lets a monitoring system poll device state and counters. Know the version differences:

Feature	SNMPv2c	SNMPv3
Authentication	Community string (plaintext)	Username with auth protocol (MD5 or SHA)
Encryption	None	Optional, with priv (DES, 3DES, or AES)
Security levels	Community only	noAuthNoPriv, authNoPriv, authPriv
Bulk retrieval	Yes	Yes
Recommended use	Labs only	Production networks

SNMPv3 example with authPriv:

conf t
snmp-server group NMS v3 priv
snmp-server user nms-user NMS v3 auth sha AUTH_PASSWORD priv aes 128 PRIV_PASSWORD
snmp-server host 10.10.10.50 version 3 priv nms-user
end

Verify with show snmp user and show snmp group. SNMP is good for interface counters, CPU, memory, and inventory. It can miss events that happen between polling intervals.

Lab: find the broken hop

Topology:

PC1 10.10.10.10/24 -- R1 -- 10.10.12.0/30 -- R2 -- 10.10.23.0/30 -- R3 -- PC2 10.10.30.10/24

Goal: PC1 cannot reach PC2. Prove where the failure is and what evidence each tool gives.

Do these steps:

From R1, ping PC2 with the PC1-facing source address: ping 10.10.30.10 source 10.10.10.1.
Trace the path from the same source: traceroute 10.10.30.10 source 10.10.10.1.
On the last good hop, check state: show ip route 10.10.30.10, show ip cef 10.10.30.10, show interfaces counters errors.
Read the event log: show logging | include LINEPROTO|LINK|OSPF|ACL.
If the route exists but traffic fails, set a conditional debug: debug condition interface GigabitEthernet0/0, then debug ip icmp.
Run one ping from PC1 and read the ICMP debug output.
Run no debug all and clear debug condition all.

Expected result: ping shows the failure. Traceroute shows the last replying hop. The debug shows if echoes arrive and if replies leave. Syslog shows if a link or protocol event matches the failure time.

Exam traps

Pinging without source tests the wrong path. The router may reach the target while the user subnet cannot.
A traceroute that stops at hop 2 does not convict hop 2. Check the return path and filtering first.
A conditional debug filters by interface or peer. An ACL-filtered debug filters by traffic. Know the difference.
logging trap debugging sends everything to the server. On a busy device this can flood the syslog server.
SNMPv2c community strings cross the network in plaintext. SNMPv3 authPriv is the secure answer.
One counter read proves nothing. Read error counters twice and look for increments during the failure.

Pass check

You are ready when you can do these things:

Pick the correct first tool for a given symptom.
Read ping characters and traceroute output and say what they prove.
Configure a conditional debug with debug condition interface and debug ip icmp, then stop it safely.
Name the syslog severity level from its number.
Explain why SNMPv3 authPriv replaces SNMPv2c.