Troubleshooting
A short decision path for the failures that actually occur, plus the flow trace that answers most of the rest.
Subscribers cannot connect
Check discovery counters first: if frames are not arriving, the problem is VLAN tagging or physical. If they arrive but authentication fails, check RADIUS reachability, the shared secret, the User-Name format, and the bad-msg-authent counter — a signature mismatch and a wrong secret look identical from the subscriber’s side.
show pppoe discovery counters show radius statistics debug pppoe vlan 120
Subscriber reports slow speed
Compare the resolved QoS binding against the intended plan, then check whether the aggregate above the subscriber is saturated, then check per-core drops. Remember overhead compensation: a shaped pipe measured by a speed test reads below plan by design unless compensation is set.
show qos bindings show qos sub <id> show drops access0 show health
Packet flow trace
The trace follows a packet through the fast path and works like tcpdump -G: one command filters, captures for a fixed window, prints the matching flow, then auto-disarms. Each packet carries per-flow L4 detail captured at RX, so it reflects the real segment sizes and TCP behaviour the flow negotiated.
debug trace packet src 100.64.0.2 for 10 debug trace packet src 100.64.0.3 drops for 15 show debug packets # re-read the last capture show debug trace # per-stage pipeline path
Filter direction matters with NAT
Capture happens at RX, before NAT. Upstream packets carry the subscriber’s inside address; downstream replies are addressed to the public pool address and are only un-NAT’d after capture. To see a subscriber’s download, filter on their public address, not the inside one.
Finding a rare drop under load
Without the drops modifier a high-volume forwarded flow floods the capture ring and overwrites the rare dropped packets. With it, only dropped packets are captured with their real source, destination and reason — which is how you find the flows hitting ttl-expired, nat-fail or no-route.