Switch interfaces: speed, duplex, error counters and err-disabled ports

Reading an interface

When a user says "the network is slow" and the problem is one device, start at the switch port. These commands give you most of what you need:

show interfaces status                  (speed, duplex, VLAN, connected or not)
show interfaces GigabitEthernet1/0/12   (full counters)
show interfaces counters errors
show logging | include 1/0/12
clear counters GigabitEthernet1/0/12    (then watch whether errors keep rising)

Line status shows up/up when Layer 1 and Layer 2 are working, down/down when no link is detected (cable, far device off), and administratively down when someone typed shutdown. Always clear counters and recheck: old errors from months ago may not mean anything now.

Speed, duplex and auto-negotiation

Ethernet devices agree speed and duplex with auto-negotiation. Leave it on at both ends; 1000BASE-T and faster copper links actually require it. Problems start when one end is fixed by hand, for example to 100 Mbit/s full duplex, and the other is left on auto. The auto side can sense the speed but not the duplex, so it falls back to half duplex: a duplex mismatch. The link comes up and small pings work, but throughput collapses under load.

The fix is to set both ends the same way, ideally both on auto. Some older devices need fixed settings; then fix both ends identically.

What the counters mean

Err-disabled ports

A port in err-disabled state has been shut down by the switch itself to protect the network. Common reasons are a port-security violation, BPDU Guard seeing a switch, a link flapping too often, UDLD detecting a one-way fibre, or a DHCP snooping rate limit being exceeded.

1. Find out why: show interfaces status err-disabled and show errdisable recovery, plus the log.
2. Fix the cause: remove the rogue switch, replace the cable, or adjust the port-security setting.
3. Re-enable the port with shutdown then no shutdown on the interface.
4. Optionally enable automatic recovery for chosen causes with errdisable recovery cause, so ports retry after a set interval.

Good habits for every port: a clear description, unused ports shut down and placed in an unused VLAN, and storm control on access ports to limit broadcast floods.

Real-world example: a CCTV recorder kept losing camera streams at busy times. The switch port had been set manually to 100/full during an old installation, while the recorder's new NIC was on auto and negotiated half duplex. The switch side showed rising CRC errors and runts, the recorder side late collisions. Returning both to auto negotiated 1 Gbit/s full duplex and the drop-outs stopped.

Record a baseline of error counters for important links so you can tell normal from abnormal later.