Command to list 'last change' of each port?

[Mottok]

Hi - hoping this will be simple enough. We are moving from Nortel to Cisco, we have a field on each port on the Nortel's called "Last change" which basically tells us when the port was last used.

Can someone please provide me with the correct command to list each and every port name and the corresponding equivalent "Last change" date/time please?

I have played around with some commands but can't quite get to the above.

Many thanks, much appreciated.

[Georg Pauwen · Accepted solution]

Hello,

you could use the pipe (|) command, e.g.:

R1#sh int | i Gigabit|Last

would render:

GigabitEthernet0/0 is up, line protocol is up
Last input 00:02:12, output 00:00:00, output hang never
Last clearing of "show interface" counters never
GigabitEthernet0/1 is up, line protocol is up
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
GigabitEthernet0/2 is administratively down, line protocol is down
Last input never, output never, output hang never
Last clearing of "show interface" counters never
GigabitEthernet0/3 is administratively down, line protocol is down
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Last input never, output never, output hang never
Last clearing of "show interface" counters never

[Mottok]

That's great many thanks, now going in to the book as one to keep :-)

Can I ask - we plugged in all cables to these switches last night between 5 and 7pm, there was nobody in until today at around 7am, why do you think most of the ports tell me that last input was at around "00:00"? Some at other times but loads around 00:00.

Thanks.

[Georg Pauwen]

Hello,

I think the 'Last' counters are not synchronized with the clock but rather reflect the last reboot, which is 00:00...

[paul driver]

Hello

FYI - my understanding is these counters do not tell you when the interface was actived -they only tell you when the last packet packet was received-transmitted on that interface and only then if they were processed switched by the cpu - so in reality it could be actually quite a while before any counter value is ever recorded /reset after the interface has been actived.

[Mottok]

Thanks for your reply's. Still a wee bit confused, are these counters rather than actual times?

I have two live examples below, are they saying, the last packet packet received-transmitted on that interface was 18 hours, 3mins and 36 seconds ago and for the other one, 14 secs ago? Sorry for my lack of understanding.

Last input 18:03:36, output never, output hang never
and

Last input 00:00:14, output never, output hang never

Thanks.

[paul driver]

Hello

Not a problem asking on here that what these forums are all about -

Correct these are interface counters  and what you are seeing is statistics relating to traffic that has hit the interface which was processed by the router/switch.

Now if you shut any interface down these counters should increase until activity is resumed on that particular interface and the counter is reset.

[Mottok]

Resurrecting this thread again - the "sh int | inc line protocol is|Last input" command, we have some confusion around what exactly this is telling us in terms of layer 2/ layer 3 traffic on a 3650 switch. Can anyone explain this clearly? For example, we have some ports that are shown as 'Connected' however the 'Last input' shows 'Never', how can this be? Many thanks.

[Georg Pauwen]

Hello,

depending on your platform, I think it is a bug on the lower end switches:

Last Input never on switch with traffic incoming on interface
CSCtu32041
Description
Symptom:
The last input field in show interface output says never, even when there is traffic ingressing the port

Last Input
Number of hours, minutes, and seconds since the last packet was successfully received by an interface. This counter is updated only when packets are process switched, not when packets are fast switched

[Mottok]

Thanks for that. I'm new to networking so to confirm, the below would confirm this error right? The example port g2/0/33 shows "Last input never" but we also see "815216 packets input", so that doesn't tie up, is it is as simple as that? Many thanks.

RM3102-3650#sh int g2/0/33
GigabitEthernet2/0/33 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 1880.9022.a321 (bia 1880.9022.a321)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 10000 bits/sec, 15 packets/sec
815216 packets input, 63219679 bytes, 0 no buffer
Received 1372 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
4 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
177846681 packets output, 16615835498 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

[Georg Pauwen]

Hello,

that output could indeed point to the bug. Nothing fast switched would show up, only process switched packets would change the Last input counter...

Which means if you disable cef (or dcef) with the global command 'no ip cef' that input counter would start...

[Mottok]

Hi, ok thanks for that. Some new concepts for me there :-) Thanks all