CNC Logo

Miscellaneous Topics

Peter J. Welcher


Introduction

I'm having a hectic month. Coincidentally, I have a few small topics for you, including a neat router trick (thanks to Kennedy for spotting this), an SNMP tip, some real world feedback on CiscoWorks 2000, and some book reviews.

CLI String Search

IOS 12.0 lets you filter or search any show or more command output using regular expressions. (UNIX people: grep in a router!) This helps with finding interesting lines when there is copious output. This is an absolutely slick feature someone asked for on the spot list not too long ago -- and here it is!

Online, see http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t1/cliparse.htm.

Filtering allows you to include or exclude lines matching a regular expression. When you see the --More-- prompt, you can then search the filtered output. Limitations: you cannot back up, and filtering doesn't work with the Web (HTTP) interface.

Let's take a look at how this works.

show command | begin regular-expression       Begin unfiltered output with the first line matching regular-expression .
show command | exclude regular-expression   Display lines not matching regular-expression.
show command | include regular-expression   Display lines matching regular-expression.

more command | begin regular-expression       Begin unfiltered output with the first line matching regular-expression .
more command | exclude regular-expression   Display lines not matching regular-expression.
more command | include regular-expression   Display lines matching regular-expression.

/regular-expression                                                      Search for regular-expression from a --More-- prompt.
-regular-expression                                                      Exclude further lines with regular-expression from --More-- prompt.
+regular-expression                                                     Include further lines with regular-expression from --More-- prompt.

Ctrl+Shift+6 (aka Ctrl-^)                                               Interrupt output.

Examples:

To jump to the first line in the startup-config containing "ip":

more nvram:startup-config | begin ip

To show the lines containing "ip" instead:

more nvram:startup-config | include ip

To jump to the first Ethernet interface in "show interface" output:

show interface | begin Ethernet
...
--More--

To then show just the lines with Serial (and up/down):

+Serial

I'll leave regular expressions for your documentation reading pleasure, after a very quick introduction. A dot '.' matches any single character, a '*' (asterisk) matches 0 or more patterns, a '?' matches 0 or 1 occurrence, a '+' matches 1 or more occurrence of a pattern. The character '^' matches the beginning of a line, and '$' the end. You can specify characters from sets of characters, or not in sets, and you can escape the above characters for a literal asterisk, caret, etc. You can also repeat previous patterns, but that starts getting messy.

Example: to find routes involving a certain network, 170\.10 matches the characters 170 followed by a literal dot, followed by 10. There's no real point to wildcarding the end of this.

Enjoy!

Tech Tip: RFC 1573

RFC 1573 is a little-known RFC that makes for interesting reading. It discusses some problems with RFC 1213, MIB-II, and how interfaces are handled. It then discusses what to do about logical interfaces, such as loopback, subinterfaces, the null interface, and so on. It also goes into what to do when the number of interfaces can change, as it can with hot-swappable interface cards. And it adds high-capacity counters for fast interface counters that might wrap too quickly.

You might also look at RFC 1573 for its definition of ifName. Those who have used SNMP-based software know that ifDescr on Cisco routers is  pretty useful -- the name of the interface. But on Catalyst switches, you just get back a description like 10BaseT, not very useful in reporting. IfName is supposed to tell you the name of the port. If you have custom reporting software, this might be what you're looking for. Using the Cisco local variable lifDescr lets you pull out a configured router description line, another alternative.

By the way, one reason you might need to use ifName or lifDescr is that the ifIndex can change. New IOS releases or new loopback interfaces or other logical interfaces may cause renumbering after a reboot.

CiscoWorks 2000 in the Real World

A reader wrote that they're trying to run RME on a WAN of several thousand routers. And CWSI on a campus with about 10000 end nodes. This is on a Sun E10K domain with 4 CPUs & 1 Gig RAM). Apparently the RME reports are very slow. That doesn't surprise me too much, that's really pushing the database engine that's being used. The reports probably have to grind through some pretty huge tables on disk.

They're also seeing some interesting bugs with CWSI, like EtherChannels connected to Frame Relay subinterfaces. Since CWSI doesn't tell you how or why it discovered things the way it did, that's an interesting one! I'd conjecture addressing confusion. The reader also sent some CWSI screen captures. They have lots of ATM devices, and the result might best be described at "furball".

For this reader, words like "beta" came to mind. Well, that sounds like pushing the system somewhat. I'd expect or hope RME to work reasonably well on say a couple of hundred routers, depending on box hardware. At some point with all network management software you have to scale by putting it on multiple machines. In this case, it sounds like polling performance and RAM are not the key, but perhaps database performance is.

With CWSI, the EtherChannel to FrameRelay looks like a bug, although I'd be looking for anything that might have confused it. The ATM furball is probably something most packages would do -- they generally aren't smart enough to stop trying to draw if things are massively cluttered. I'd certainly agree that CWSI is still in its early stages. I personally find the lack of information on why it failed the worst feature. Is the map current? What's CWSI doing? Why's this device got a red X: CWSI didn't get some piece of info, what do I have to go fix (access, community string, unknown OID, etc.). Why is the link not shown? When is it going to show up? Etc.

Some Books

I'd like to mention a couple of books in the hopes you'll like them.
BGP4, Inter-Domain Routing in the Internet, by John W. Stewart III, Addison-Wesley, 137 pages, ISBN 0-201-37951-1, $19.95.
This is a slim and very well-written volume on BGP. I'm impressed -- it's harder to write good brief clear text than to write at great length. There are few frills or side-tracks, just lucid explanation and simple diagrams, no router configuration or diagnostics. If the Bassam Halabi Cisco Press book on BGP is too thick or Cisco-centric for you, Mr. Stewart's book is a great alternative. Even if you have the Halabi book, you might want to start with this book for the overall picture and some solid understanding, and then get Halabi's take on things in detail. I particularly liked the explanations around page 93 of how route reflectors and how AS confederations avoid iBGP routing loops. I also agree with the amazon.com reviewers of the book, it sure beats reading RFC's (particularly in view of the lucidity and conciseness John achieves).
Top-Down Network Design, by Priscilla Oppenheimer, Cisco Press, 560 pages, ISBN 1-57870-069-8.
Ms. Oppenheimer and I have known each other via email for a couple of years. She wrote a prior version of the Cisco CID Design course which I reviewed, and I did my best to get her to comment on the SE Design Workshop course I did. This book is her version of the design wisdom she accumulated in years inside Cisco, Apple, and Network General (now Network Associates). I've only made it to Chapter 3 so far, but I've skimmed the book and really like what I see. Priscilla is fond of checklists and tables to fill out, but that renders concrete the kind of information you should be gathering. There's a lot of practical wisdom too. I found the Examples on pages 305-326 and pages 395-407 to be reasonably simple but with enough facts and details to preserve the flavor (confusion?) a design consultant feels when learning about a new network.

The book is organized into four parts:

If you're beginning to design data networks, and want an overall guide, this is the book you should start with. If you're preparing for CCDA or CCDP certification, this ought to be a very good book to read: it supplements the recommended (for CCDP) CID course with additional information! Amazon.com rates it 5 stars, with reviewers like Howard Berkowitz (author of Designing Addressing Architectures, Macmillan Press) and Tom Thomas (OSPF Network Design Solutions, Cisco Press).

There's also Mentor Technologies' own:

Advanced IP Routing with Cisco Networks, by Terry Slattery and Bill Burton, McGraw-Hill, 400 pages.
I've got a copy I paid good money for. (No, contrary to rumor you don't get issued a copy when you join Mentor Technologies). I haven't read it, just skimmed it, since I know most of the contents already. But it sure looks like the introduction to routers I sometimes wish I'd written! I like the balance the authors struck between being concise and being thorough enough you can use it instead of the IOS manuals in getting your routers up and running. This is at about the ACRC course level of difficulty. On amazon.com, I've been noticing that with almost any other networking book I look at, it suggests that you might like this book too -- which says to me it's pretty popular (or else Terry and Bill got a Web link magnet into the outline on amazon.com somehow).
Cisco Certification : Bridges, Routers, and Switches for CCIEs (Cisco Technology Series), by Andrew Bruce Caslow, Valeriy Pavlichenko (Editor), Prentice-Hall, 840 pages.
I don't have my autographed copy of this book yet. Bruce has a knack for cutting through the baloney to the heart of what you need to know to configure, understand, or troubleshoot a protocol. Mentor Technologies is now offering a week-long high-end course, ECP1, based on this book, aimed at CCIE prep. It has some pre-requisites, so that it can move at a intense pace. There's an absolute pile of equipment with high student-router ratio. Bruce teaches the course currently, with extremely high energy and fervor I gather. This challenging limited-enrollment course has been very well received and seats are going fast. Marty Adkins has revamped our CITO course into ECP2, a two-day build-it yourself course, intended to get you the feel of the CCIE exam, with a CCIE instructor there if you get stuck or want some clarification.

By the way, I understand our Kennedy Clark (CCIE) and Kevin Hamilton's Switching book is getting closer to completion. And John Albritton (CCIE) has to be getting near completion on his introduction to Cisco routers. I'm looking forward to seeing these.

OSPF and BGP

Mentor Technologies has also put together a course consisting of 2 days of OSPF and 2 days of beginning BGP. This course is aimed at those in between the ACRC and CIT courses, in terms of difficulty levels. Both this and the ECP1 course attempt to fill the gap between the Cisco-provided courses and the high degree of knowledge needed for the CCIE. See our Web page for details, prices, dates, etc.

Congrats!

We've just hired two CCIE's, one who passed the test only a couple of days before starting work! We also have some longer-term employees who've been working away in preparation and just passed the test. Congratulations, Chris, Shawn, Gary -- and welcome aboard, Bruce and Val! Shawn, Gary, and Bruce are doing training with some consulting, and Chris and Val are doing solely consulting.


Dr. Peter J. Welcher (CCIE #1773, CCSI #94014) is a Senior Consultant with Chesapeake NetCraftsmen. NetCraftsmen is a high-end consulting firm and Cisco Premier Partner dedicated to quality consulting and knowledge transfer. NetCraftsmen has nine CCIE's, with expertise including large network high-availability routing/switching and design, VoIP, QoS, MPLS, network management, security, IP multicast, and other areas. See http://www.netcraftsmen.net for more information about NetCraftsmen. Pete's links start at http://www.netcraftsmen.net/welcher . New articles will be posted under the Articles link. Questions, suggestions for articles, etc. can be sent to pjw@netcraftsmen.net . 



3/31/99
Copyright 1999, Peter J. Welcher