A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
It's 2 a.m. and users on one floor are reporting intermittent drops. No config change. No software update. Link lights flicker normal. You have SSH access to the access switch. Where do you start?
Interface counters. That's the answer. Ethernet errors are honest — they tell you what the wire is doing, and by extension, which layer is broken. Read them properly and you'll find the root cause in minutes.
| Counter | Meaning | Likely cause |
|---|---|---|
| Input errors (total) | Sum of CRC, frame, overrun, ignored | Physical or duplex issue |
| CRC | Frame failed checksum check | Bad cable, EMI, dirty fiber |
| Frame | Frame was malformed (e.g. alignment) | Duplex mismatch, bad NIC |
| Runts | < 64-byte frames | Duplex mismatch, bad NIC |
| Giants | > 1518-byte frames (untagged) | MTU mismatch, jumbo misconfig |
| Late collisions | Collision after 512 bit-times | Duplex mismatch on full-duplex port |
| FCS / Alignment | Checksum or bit-boundary fail | Cable fault |
| Output drops | Egress queue overflow | Oversubscribed uplink |
Read them in context. A single CRC counter is a nuisance; a CRC counter climbing 1000 per minute is a broken cable. Two late collisions ever on a port is probably ancient history; a late collision counter that grows every time you look is an active duplex mismatch.
All eyes on Gi0/3. Alignment errors and FCS errors climbing together, plus undersize frames (runts). This is a cable or transceiver problem — the checksum failures mean bits are getting corrupted on the way.
Full-duplex, 1000 Mbps — so not a duplex issue. The errors are all inbound, CRC and runts climbing together. Cable or transceiver. The next move is physical: swap the patch cable, then reseat the SFP if the run is fiber, then test the permanent run if the first two don't fix it.
Before swapping cables, snapshot the counters. If you don't record the current values, you won't know whether your change fixed anything. `clear counters Gi0/3` resets them — do this after you've noted the numbers, then watch the rate over the next few minutes.
The instinct when things break is to log in and look at configs. Layer 2 problems are almost never config problems — they're physical. Counters first, config second.
Layer 2 troubleshooting is 80% reading counters and 20% physical action. Get the counter vocabulary cold, and you'll solve more tickets in a week than most juniors do in a quarter.
Section 2 complete. You understand frames, MAC learning, domain counting, interface states, duplex, and error counters. Section 3 dives into IPv4 addressing and subnetting — where most CCNA candidates lose points.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.
Select each vulnerable line, then classify the finding.
Findings
Review target: 19 lines · 1 expected finding