Cisco Debug Command Explained

The debug command displays information about the Cisco device operations, generated or received traffic, and any error messages. The information is provided in real-time until the user disables debugging or the device is restarted.
The debug operation takes a lot of CPU resources and should not be used often in production environments. It is meant to be used as a troubleshooting tool for only a short period of time. You can choose to debug only specific events – for example, EIGRP information, received ICMP messages, etc.

Consider the following example:

R1#debug ip icmp
ICMP packet debugging is on
R1#
R1#
ICMP: echo reply sent, src 10.0.0.2, dst 10.0.0.1

ICMP: echo reply sent, src 10.0.0.2, dst 10.0.0.1

In the example above you can see that I’ve enabled debugging only for the ICMP events (such as pings). In the output, you can see that R1 has responded to the device with the IP address of 10.0.0.1 with two ping reply packets.

To disable debugging of the ICMP events, simply re-enter the command with the no keyword in front of it:

R1#no debug ip icmp
ICMP packet debugging is off

To debug only RIP messages, we would run the following command:

R1#debug ip rip
RIP protocol debugging is on
R1#
R1#RIP: received v2 update from 10.0.0.1 on GigabitEthernet0/0
172.16.0.0/16 via 0.0.0.0 in 2 hops
192.168.5.0/24 via 0.0.0.0 in 1 hops
RIP: received v2 update from 10.0.0.1 on GigabitEthernet0/0
172.16.0.0/16 via 0.0.0.0 in 16 hops
192.168.5.0/24 via 0.0.0.0 in 16 hops

You can enable debugging of everything happening on your device by issuing the debug all command (VERY IMPORTANT: do not use this command on production devices, since it can produce so much output it crashes the device!):

R1#debug all

This may severely impact network performance. Continue? (yes/[no]): yes
All possible debugging has been turned on

*Mar  1 00:00:44.303: corvil trace: "40492 cdkContext_TraceControl() return 0"
*Mar  1 00:00:44.307: IP routecache flags changed on Null0,
         added No CEF; now No CEF
*Mar  1 00:00:44.311: fh_fd_syslog_event_match: num_matches = 0
*Mar  1 00:00:44.311: fh_fd_data_syslog: num_matches = 0
*Mar  1 00:00:44.315: fh_fd_syslog_event_match: num_matches = 0
*Mar  1 00:00:44.315: fh_fd_data_syslog: num_matches = 0
*Mar  1 00:00:45.263: CEF: background resolution thread state:
*Mar  1 00:00:45.263: Thread fast_thread: Empty
*Mar  1 00:00:45.263: Thread todothread: Empty
*Mar  1 00:00:45.263: Thread slow_thread: Empty
*Mar  1 00:00:45.267: fh_fd_syslog_event_match: num_matches = 0
*Mar  1 00:00:45.267: fh_fd_data_syslog: num_matches = 0
*Mar  1 00:00:45.267: fh_fd_syslog_event_match: num_matches = 0

To disable this command, type the undebug all command (or the u all shortcut). You will quite possibly be getting so much output that it is nearly impossible to enter a command, and the shortest u all is your best chance. If you cannot enter the command then you can try connecting from a different PC and entering the command there.

R1#u all
All possible debugging has been turned off

Download our Free CCNA Study Guide PDF for complete notes on all the CCNA 200-301 exam topics in one book.

We recommend the Cisco CCNA Gold Bootcamp as your main CCNA training course. It’s the highest rated Cisco course online with an average rating of 4.8 from over 30,000 public reviews and is the gold standard in CCNA training: