Exam Objective 1.1: Diagnose interface and cable (copper and fiber) issues such as collisions, errors, mismatched duplex, speed, distance, interface, signal levels, pin out, and cable types.
Most "the network is down" tickets trace back to Layer 1. Before troubleshooting routing protocols or ACLs, rule out the cable, the transceiver, and the interface itself. A misbehaving routing protocol is dramatic, but far more support tickets resolve to a bad patch cable, a cracked fiber connector, a duplex mismatch, or a switchport that disabled itself after detecting a problem. This topic covers two worlds: copper Ethernet (UTP/STP cabling, RJ-45 connectors, electrical signaling, collision domains) and fiber optics (light-based signaling, connector types, optical power budgets, SFP/SFP+ modules). You need to diagnose both, and know which diagnostic command applies to each.
A collision occurs when two devices transmit onto a shared Ethernet segment at the same time, corrupting both signals. Collisions are normal and expected only in half-duplex environments using CSMA/CD (Carrier Sense Multiple Access with Collision Detection). On a modern full-duplex switched network, collisions should never occur — if you see any collision counters on a switch-to-switch link or a full-duplex host NIC, that's a red flag.
How CSMA/CD works:
Carrier Sense — a station listens to the wire before transmitting to confirm it's idle.
Multiple Access — any station on the shared segment may attempt to transmit.
Collision Detection — if two stations transmit at once, the signal corruption is detected mid-transmission.
Both stations send a jam signal, stop transmitting, and each waits a random period (the backoff algorithm) before retrying.
CSMA/CD only applies to shared media — legacy hubs or half-duplex links. A switch forwarding frames only to the destination port, on a full-duplex link, eliminates the shared-medium collision domain entirely.
Collision-related counters:
Collision — normal on a half-duplex shared segment when two stations transmit at once, detected within the first 512 bits ("slot time") of the frame. Expected in moderate numbers on legitimate half-duplex links; a symptom of duplex mismatch or a NIC problem anywhere else.
Late collision — a collision detected after the first 512 bits of the frame have already been sent. This is never normal. It almost always indicates a duplex mismatch, or that a cable segment exceeds the maximum allowed distance for the technology.
Exam Alert: If show interfaces reports a nonzero late collisions counter, suspect a duplex mismatch first, then excessive cable length. Late collisions on a properly configured full-duplex switched link should be zero.
Collision domain vs. broadcast domain: A collision domain is the set of devices whose frames can collide — historically everything on a hub or coax segment. Each switchport is its own collision domain, and with full duplex enabled, collisions are structurally impossible. A broadcast domain is a much larger scope — all ports in the same VLAN — and is bounded by Layer 3 devices, not switches. It's unrelated to collisions.
These appear in show interfaces output and each maps to a distinct root cause.
CRC errors — a Cyclic Redundancy Check error means the frame arrived with a checksum that doesn't match the data — it was corrupted in transit. High CRC counts point to a physical-layer problem: EMI (electromagnetic interference), a damaged or poor-quality cable, a bad connector/crimp, excessive cable length, or duplex mismatch. This is one of the most commonly tested symptoms.
Runts — a frame smaller than the 64-byte minimum valid frame size, usually with a bad CRC too. Typically produced by collisions (a frame cut short mid-transmission) or a failing NIC.
Giants — a frame larger than the maximum allowed size (over 1518 bytes standard, more if jumbo frames are involved) with a bad CRC. Often indicates a misconfigured MTU/jumbo-frame setting somewhere in the path, or a malfunctioning NIC.
Input errors — a summary counter: the sum of runts, giants, CRC errors, frame errors, overruns, and ignored packets. Always check the specific sub-counter that's actually incrementing rather than stopping at the summary.
Output errors — problems the interface had while transmitting, commonly late collisions or a "babbling" transmitter — can indicate an interface or duplex problem on the sending side.
Frame errors — a frame with a CRC error that also doesn't end on an even byte boundary. Like CRC errors, this points to a physical signaling problem, often duplex mismatch or noise.
Overruns / ignored / throttles — an overrun happens when the receive buffer fills faster than the CPU can process incoming frames, forcing drops — a performance/CPU issue rather than a cabling issue. Ignored packets are dropped due to lack of buffer space. Throttles mean the interface temporarily disabled itself because internal buffers were full.
Quick diagnosis map:
Collisions (normal amount) → expected on half-duplex shared media only
Late collisions → duplex mismatch, or cable exceeds max distance
CRC errors + collisions rising together → duplex mismatch
CRC errors alone, no collisions → bad cable/connector, EMI, faulty transceiver
Runts → collisions or failing NIC
Giants → MTU/jumbo frame misconfiguration, failing NIC
Input errors rising, no other counter → check sub-counters individually
Half-duplex vs. full-duplex: Half-duplex means a device can send or receive at any moment, but not both simultaneously — required by CSMA/CD on shared media. Full-duplex means a device can send and receive at the same time on separate transmit/receive pairs, the norm on any modern switched point-to-point link, which completely eliminates collisions.
Auto-negotiation: Ethernet auto-negotiation (IEEE 802.3u/802.3ab) lets two connected devices advertise supported speeds/duplex modes via Fast Link Pulses and automatically agree on the highest mutually supported combination. Cisco recommends auto-negotiation for virtually all modern links, since manual configuration is now the primary source of mismatch problems.
The classic duplex mismatch scenario: Happens when one side of a link is full-duplex and the other half-duplex — most commonly because one side was manually hard-coded while the other stayed on auto-negotiation, or negotiation failed and a device fell back to its default. When negotiation fails entirely, IEEE-standard behavior is to default to half-duplex.
Symptoms of duplex mismatch (memorize these):
The link comes up — it does NOT go down. This is not an easy "interface is down" ticket.
Performance is severely degraded, especially under load — the connection feels slow or intermittently unresponsive.
The full-duplex side reports late collisions and possibly CRC/frame errors, because it transmits whenever it wants (no CSMA/CD) while the half-duplex side is still using carrier sense.
The half-duplex side reports ordinary collisions along with runts.
Common Pitfall: Duplex mismatch will NOT put the interface into a down/down or err-disabled state. The link status shows up/up. Don't assume a physical-layer problem must show "down" — duplex mismatch is the counter-example the exam loves to test.
Speed mismatch: Unlike duplex, a genuine speed mismatch (one side hard-set to 100 Mbps, the other to 1000 Mbps) generally prevents the link from coming up at all — it shows down/down because the two ends can't agree on a common bit rate. If auto-negotiation is enabled on both sides, they typically settle on the highest common speed; problems arise when one side is hard-coded to a speed the other can't match.
Exam Alert: Duplex mismatch → link stays up, performance degrades, late collisions appear. Speed mismatch → link typically fails to come up at all. Cisco best practice: configure both ends of a link identically — either both auto-negotiate, or both hard-coded to the same speed and duplex. Never mix "auto" on one end with "hard-coded" on the other.
UTP (Unshielded Twisted Pair) — the standard Ethernet cable for most LAN cabling. Each pair of conductors is twisted to cancel electromagnetic interference between pairs — tighter twist means higher category rating and higher supported bandwidth/distance.
Category ratings:
Cat3 — legacy voice/10 Mbps Ethernet, largely obsolete
Cat5 — supports 10/100 Mbps (100BASE-TX) over 100 m
Cat5e — enhanced Cat5, reduced crosstalk, supports Gigabit Ethernet (1000BASE-T) over 100 m
Cat6 — supports Gigabit over 100 m, and 10 Gigabit (10GBASE-T) up to roughly 55 m depending on conditions
Cat6a — improved shielding/twist specs, supports 10 Gigabit over the full 100 m
Cat7/Cat8 — higher-frequency, individually shielded pairs, used for 10G–40G in short data-center runs
STP (Shielded Twisted Pair) — adds a foil or braided shield around individual pairs and/or the overall cable to further reduce EMI susceptibility. Used in electrically noisy environments (near motors, fluorescent ballasts, industrial equipment) where UTP would pick up interference and generate CRC errors. STP requires proper grounding — an improperly grounded shield can make interference worse.
Straight-through vs. crossover cables: A straight-through cable wires each pin to the identical pin at the other end and connects unlike devices — a PC or router to a switch. A crossover cable swaps the transmit and receive pairs so the transmit pins on one end line up with the receive pins on the other, and connects like devices directly — switch to switch, PC to PC, router to router.
Modern note — Auto-MDIX: Most modern Cisco switch ports support Auto-MDIX (Automatic Medium-Dependent Interface Crossover), which automatically detects whether a straight-through or crossover cable is connected and internally swaps the pairs as needed. On modern hardware, using the "wrong" cable type usually still works. The exam still expects you to know the traditional distinction, since Auto-MDIX can't always be assumed on older equipment.
Coaxial cable — a single center conductor surrounded by insulation, a metallic shield, and an outer jacket. Largely legacy in LAN Ethernet (10BASE2/10BASE5) but still relevant for cable-modem (DOCSIS) broadband access and RF/video distribution.
Both standards use the same 8 conductors (4 twisted pairs) in the same RJ-45 connector — the only difference is which pair lands on which pin position. Consistency matters more than which standard you pick, as long as both ends of a straight-through cable use the same standard.
T568A pin assignments:
Pin 1: White/Green
Pin 2: Green
Pin 3: White/Orange
Pin 4: Blue
Pin 5: White/Blue
Pin 6: Orange
Pin 7: White/Brown
Pin 8: Brown
T568B pin assignments:
Pin 1: White/Orange
Pin 2: Orange
Pin 3: White/Green
Pin 4: Blue
Pin 5: White/Blue
Pin 6: Green
Pin 7: White/Brown
Pin 8: Brown
Key rules:
Straight-through cable = T568B (or T568A) on both ends
Crossover cable = T568A on one end, T568B on the other end
T568B is more common in U.S. commercial installations; T568A is required in some government/older installations
Exam Alert: You don't need to memorize wire colors for their own sake, but you must recognize that a crossover cable has one end T568A and the other T568B, while a straight-through cable uses the same standard on both ends. Pin pairs used for 10/100 Mbps Ethernet are 1-2 and 3-6 (transmit/receive); Gigabit Ethernet uses all four pairs (1-2, 3-6, 4-5, 7-8).
Symptoms of a bad pin-out / miswired cable:
No link light at all — often completely wrong wiring order or a wire not making contact
Link up, but no traffic passes, or traffic is one-directional — a "split pair" fault, where two wires from different twisted pairs are incorrectly paired together, breaking noise cancellation even though continuity tests pass
Use a cable tester to verify each of the 8 conductors maps correctly end-to-end; a simple continuity tester can miss split-pair faults that a wire-map tester catches
Single-mode fiber (SMF):
Very small core (~9 microns)
Uses a laser light source
Light travels as a single ray with minimal reflection/dispersion
Supports long distances — kilometers, up to tens of km with the right optics
Typically yellow jacket
Higher equipment cost, used for long-haul/campus/WAN links
Multimode fiber (MMF):
Larger core (50 or 62.5 microns)
Uses an LED or VCSEL light source
Multiple light "modes" bounce down the core, causing modal dispersion
Shorter maximum distance — typically a few hundred meters
Typically orange (OM1/OM2) or aqua (OM3/OM4) jacket
Lower-cost optics, used for in-building/data-center runs
Common fiber connector types:
SC (Subscriber/Square Connector) — push-pull square connector, older but still common
LC (Lucent Connector) — small-form-factor, most common on modern SFP/SFP+ transceivers
ST (Straight Tip) — bayonet-style twist-lock connector, mostly legacy
MPO/MTP — multi-fiber push-on connectors used for high-density 40G/100G parallel-fiber links
SFP/SFP+ transceivers: Fiber (and some copper) links on Cisco switches typically terminate in a modular, hot-swappable SFP or SFP+ (10 Gbps) transceiver rather than a fixed port. Common issues: installing an SFP rated for MMF into a link that needs SMF (or vice versa), mixing incompatible transceiver types on the two ends, and using a non-Cisco/uncoded SFP that IOS refuses to recognize.
Warning: Both ends of a fiber link must use compatible transceiver types and matching fiber type (SMF-to-SMF or MMF-to-MMF). Plugging an SMF transceiver into a multimode fiber run (or vice versa) typically prevents the link from coming up, or produces marginal/unreliable signal levels even if it does.
Signal levels — optical power / dB loss: Unlike copper, fiber troubleshooting is fundamentally about optical power budget: how much light (measured in dBm) leaves the transmitter, and how much is lost before it reaches the receiver's minimum sensitivity threshold. Loss (measured in dB) accumulates from:
Attenuation over distance — signal naturally weakens the farther light travels
Connector loss — every mated connector pair introduces a small amount of loss (often ~0.3–0.5 dB per connection); dirty or improperly polished connectors introduce much more
Splice loss — fusion splices where fiber segments are joined
Bend radius violations — fiber bent tighter than its minimum bend radius leaks light and increases loss dramatically; a very common real-world cause of "flaky" fiber links
Contaminated end-faces — dust or oil on the connector tip is one of the single most common causes of fiber signal problems, fixed with a proper fiber-optic cleaning tool
If cumulative loss exceeds the transceiver's optical power budget, the receiver can't reliably distinguish the signal, and you'll see interface flapping, CRC errors, or complete failure to establish light (Rx power alarms/loss-of-signal on the transceiver). Cisco IOS can report per-transceiver optical diagnostics (transmit power, receive power, temperature, voltage) via DOM (Digital Optical Monitoring), viewable with "show interfaces transceiver detail."
Exam Alert: "Signal levels" on the exam objective refers to optical power/light levels on fiber (and to a lesser extent, electrical signal levels/attenuation on copper). Know that dB loss accumulates from distance, connectors, splices, bends, and contamination, and that exceeding the optics' power budget causes the link to fail or become unreliable even though the fiber itself isn't physically broken.
Every media type has a maximum supported distance beyond which signal integrity can't be guaranteed. Exceeding these limits produces the same symptoms already discussed: CRC errors, late collisions, intermittent flapping, or a link that never comes up.
Typical maximum distances (know the order of magnitude, not exact numbers):
UTP (Cat5e/6/6a), 100BASE-TX / 1000BASE-T — 100 meters
10GBASE-T over Cat6 — approximately 55 meters (reduced due to crosstalk at 10G speeds)
10GBASE-T over Cat6a/7 — full 100 meters
Multimode fiber (OM3, 1000BASE-SX) — up to roughly 550 meters
Multimode fiber (OM1/OM2, legacy) — roughly 220–275 meters at Gigabit speeds
Single-mode fiber (1000BASE-LX/LH) — several kilometers, up to 70+ km with long-haul optics
Exam Tip: Exact meter figures vary by transceiver model — the exam is more likely to test the relationship: copper is short-range (~100 m), multimode fiber is medium-range (hundreds of meters), single-mode fiber is long-range (kilometers+). If a link that used to work suddenly fails after a cable was re-routed to a longer path, exceeding maximum distance is a prime suspect alongside excessive connector/bend loss.
"show interfaces" is the single most important command for this exam objective.
Example output (annotated):
GigabitEthernet0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0011.2233.4455
MTU 1500 bytes, BW 1000000 Kbit/sec
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
1024503 packets input, 987654321 bytes
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
998234 packets output, 456789123 bytes
0 output errors, 0 collisions, 1 interface resets
0 late collision, 0 deferred, 0 lost carrier, 0 no carrier
This is a clean interface: full-duplex, zero errors, zero collisions of any kind.
Key fields to read every time:
Line status — up/up means Layer 1 and Layer 2 are both healthy; down/down means no signal at Layer 1; up/down (line protocol down while physical line is up) suggests a Layer 2 encapsulation mismatch or keepalive problem rather than a cabling fault.
Duplex and speed line — confirm it reads what you expect; compare against the far-end device's reported duplex/speed.
Error counters — apply the diagnosis map from section 2.
"5 minute input/output rate" — sanity-check for unexpectedly saturated or completely idle links.
Useful commands:
"clear counters [interface]" — clear counters before a controlled test to get a clean baseline
"show interfaces [interface] transceiver detail" — check optical power levels on a fiber SFP
"speed 1000" / "duplex full" (in interface config mode) — manually set speed/duplex if you must override auto-negotiation (match both ends!)
"speed auto" / "duplex auto" — force auto-negotiation back on (Cisco best practice for most links)
"show interfaces status" — confirm physical layer status across all interfaces
"show interfaces [interface] status err-disabled" — check for an error-disable reason
Practical tip: Always run "clear counters" before conducting a repeatable test (e.g., a sustained file transfer), then check show interfaces again afterward. This isolates errors from your test window from historical errors that may already have been resolved.
Check link lights and cable seating — reseat the connector at both ends; check for a link/activity LED.
Check show interfaces status — up/up, up/down, or down/down, and note which side of the link is failing.
Check duplex and speed on both ends — mismatches here are silent (up/up) and degrade performance rather than break the link outright.
Check the error counters — runts, giants, CRC, frame, late collisions — and map them using the diagnosis table from section 2.
Swap the cable — a known-good patch cable quickly rules out a physical cable fault.
Check distance and cable category against the media/speed in use.
For fiber — inspect and clean connector end-faces, verify SMF/MMF match on both ends, and check optical Rx/Tx power via "show interfaces transceiver detail" against the transceiver's rated power budget.
Check for EMI sources near the cable run (fluorescent lighting, motors, elevators, power cabling) if CRC errors persist despite a known-good cable.
Verify pin-out with a cable tester for a suspect run, watching specifically for split-pair faults that basic continuity testers miss.
Q1. A switch interface shows a steadily increasing "late collisions" counter. The link is up/up and both sides report a link. What is the MOST likely cause?
A. The cable exceeds the 100-meter UTP limit only
B. Duplex mismatch between the two connected devices
C. The switchport is configured for the wrong VLAN
D. A failing power supply on the switch
Answer: B. Late collisions — a collision detected after the first 512 bits of a frame — are the classic signature of a duplex mismatch (one side full-duplex, one side half-duplex). While excessive cable length can also contribute, duplex mismatch is far more common and more directly tested. VLAN misconfiguration and power supply issues don't produce late collision counters.
Q2. Which statement correctly differentiates a duplex mismatch from a speed mismatch?
A. Both always bring the interface to a down/down state
B. Speed mismatch usually keeps the link up while duplex mismatch brings it down
C. Duplex mismatch typically leaves the link up/up with degraded performance; speed mismatch typically prevents the link from coming up at all
D. Neither can be diagnosed using show interfaces
Answer: C. A duplex mismatch is "silent" — the link status shows up/up while performance quietly degrades and late collisions/CRC errors accumulate. A speed mismatch generally prevents the two ends from establishing a common bit rate, so the interface typically shows down/down.
Q3. An administrator needs to directly connect two Cisco switches back-to-back using a UTP cable on ports without Auto-MDIX support. Which cable and pin-out combination should be used?
A. Straight-through, T568B on both ends
B. Crossover, T568A on one end and T568B on the other
C. Straight-through, T568A on one end and T568B on the other
D. Rollover cable
Answer: B. Connecting two "like" devices (switch-to-switch) without Auto-MDIX requires a crossover cable, wired T568A on one end and T568B on the other. A straight-through cable (same standard both ends) is for unlike devices such as a PC to a switch. A rollover cable is for console connections, not Ethernet data links.
Q4. A fiber link between two buildings has recently started flapping intermittently. The fiber run was re-routed through a new conduit during a construction project. Which two factors should be investigated first? (Choose two.)
A. Whether the new routing introduced bend-radius violations
B. Whether the VLAN database was corrupted
C. Whether connector end-faces became contaminated during the re-route
D. Whether the switch's IOS version changed
Answer: A and C. Physical fiber problems introduced by a re-route are almost always mechanical: tight bends beyond the fiber's minimum bend radius leak light and increase loss, and handling connectors during the move commonly introduces dust/contamination on the end-faces. Both directly raise optical dB loss and can push the link past its power budget, causing flapping. VLAN database corruption and IOS version have no direct relationship to a physical fiber re-route.
Q5. Which counter, if elevated, most directly suggests electromagnetic interference along a copper cable run rather than a duplex problem?
A. Collisions rising in tandem with late collisions
B. CRC errors rising with collisions at or near zero
C. Output errors matching input errors exactly
D. Ignored packets only
Answer: B. CRC errors accumulating while collision counters stay near zero point toward a physical signal-integrity problem unrelated to duplex — commonly EMI, a marginal/damaged cable, a bad connector, or a cable run exceeding maximum supported distance. If collisions and late collisions rose together with the CRC errors, duplex mismatch would move to the top of the list instead.
Q6. A technician runs show interfaces and finds a nonzero "giants" counter on a server-facing switchport. Which is the most likely explanation?
A. The port is configured for half-duplex
B. An MTU/jumbo-frame mismatch or a malfunctioning NIC is generating oversized frames
C. The cable exceeds the maximum distance for copper Ethernet
D. The switch's collision domain is too large
Answer: B. Giants are frames larger than the standard maximum Ethernet frame size with a bad CRC, typically produced by a jumbo-frame/MTU misconfiguration somewhere in the path or a failing NIC — not by duplex settings, cable distance, or collision domain size.