This article explains how to identify an interface which has changed state on an EX series switch.

• Packet drops

• Network traffic disruption

To identify an interface that has flapped, perform the following steps:

1. Run the following command to verify if the interface has flapped:

show interfaces <interface-name>

Example:

labroot@Switch> show interfaces | match "Physical|flapped" 
Physical interface: gr-0/0/0, Enabled, Physical link is Up
Physical interface: ae13 (MC-AE-14, active), Enabled, Physical link is Down
  Last flapped   : 2022-01-19 15:34:34 IST (4d 23:13 ago)
Physical interface: ae14 (MC-AE-15, active), Enabled, Physical link is Down
  Last flapped   : 2022-01-19 15:34:34 IST (4d 23:13 ago)
Physical interface: ae15 (MC-AE-16, active), Enabled, Physical link is Down
  Last flapped   : 2022-01-19 15:34:34 IST (4d 23:13 ago)
Physical interface: ae16 (MC-AE-17, active), Enabled, Physical link is Down
  Last flapped   : 2022-01-19 15:34:34 IST (4d 23:13 ago)
Physical interface: ae17 (MC-AE-18, active), Enabled, Physical link is Down
  Last flapped   : 2022-01-19 15:34:34 IST (4d 23:13 ago)

You can analyze the Last flapped field in the output of the above example. The Last flapped field provides details related to the interface flap and how long ago the flap occurred.

2. Run the following command to review the switch's log messages:

root@Switch> show log messages | match ge-0/0/0 
Dec 27 08:26:30  r001 mib2d[38304]: SNMP_TRAP_LINK_DOWN: ifIndex 512, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/0

In the above example, the ge-0/0/0  interface has physically gone down, which is shown by the IfOperStatus output. The timestamp also matches with the operational command output mentioned in the step.

3. In case it was a flap due to disabling the interface via configuration, the log would look as follows:

root@Switch> show log messages | match ge-0/0/1
Dec 27 08:31:38  JNPR mib2d[38304]: SNMP_TRAP_LINK_DOWN: ifIndex 514, ifAdminStatus down(2), ifOperStatus down(2), ifName ge-0/0/1

4. Cross verify with the current time in the switch by checking the following output:

root@Switch> show system uptime 
fpc0:
--------------------------------------------------------------------------
Current time: 2021-12-27 09:03:01 PST
Time Source:  NTP CLOCK 
System booted: 2021-10-15 16:21:09 PDT (10w2d 17:41 ago)
Protocols started: 2021-12-07 15:42:55 PST (2w5d 17:20 ago)
Last configured: 2021-12-27 08:31:36 PST (00:31:25 ago) by root
 9:03AM  up 72 days, 17:42, 1 user, load averages: 0.01, 0.01, 0.00

In the above example, the switch's current time is verified. The current date and time of the switch is 2021-12-27 09:03:01 and the interface has flapped at 2021-12-27 08:32:01 .

By analyzing the above output, the port that flapped and the time at which the flap occurred can be identified. More information about the flap can be found in the log messages.

For more troubleshooting steps if the interface does not turn on, refer to  KB19797- Resolution Guide - EX - Verify/Troubleshoot Physical Interface [juniper.net] .

2020-01-30: Article reviewed for accuracy. No changes made. Article is correct and complete.

2021-12-27: Updated outputs and added more information on detecting interface flap cause

2022-03-14: Updated the correct command to find all the last flap for all the interfaces

• KB22832 - Sample Spanning Tree Network Topology with EX switches [juniper.net]