The three commands I run before I believe anything

Every outage I have ever worked has had a moment where somebody — often me — started theorising before checking. The theory is always more interesting than the fault, which is the problem.

So: three commands, in this order, before any idea is allowed out loud.

`show ip interface brief`. Is the interface up, and does it have the address you think? Two columns, and I have lost whole mornings to the second one. "administratively down" means somebody typed shutdown, which means somebody meant to.

`show ip route`. Not "is there a route" — which route, and out of which interface. Longest prefix wins, so the default route you are looking at may not be the one that matches. Read the line that actually matches your destination.

`show ip arp` or `show mac address-table`. This is the one people skip. The route says where the router will send it; the ARP table says whether anything answered. An incomplete ARP entry for the next hop means the route is fine and the neighbour is not there.

Three commands, maybe ninety seconds. I have fixed more problems with those than with anything I know about protocols, and the times I have skipped them are the times the fix took four hours and turned out to be a cable.