One device's own output in. A change window's work out.
Paste show running-config and show interfaces from one Cisco IOS or
IOS-XE switch or router — together, in either order, prompts and all. The browser does the
subnet arithmetic, proves which access-list rules can never match, validates every wildcard
mask, and turns raw error counters into rates per million frames, before the model is asked
anything. Then you get the findings with the exact lines to type, a rollback for each one, and
a read-only way to check it worked.
Both examples ship with a saved model run for both lanes, so you can see the whole answer — including the generated configuration — without signing in and without spending a credit.
What this does, and what it does not
The prescan is arithmetic and parsing, not opinion. When it says two interfaces overlap, it has
masked both addresses to the shorter prefix and compared them. When it says rule 2 of an access
list can never match, it has converted both rules' wildcard masks to prefix lengths and proved
that rule 1 contains rule 2 on both the source and the destination — a check that text
comparison cannot make, because 10.10.10.64 0.0.0.63 and
10.10.10.0 0.0.0.255 share not one character. And when it reports CRC errors it
reports them per million frames received, because 18,401 errors across 800 million frames is
background noise and the same 18,401 across 40,000 frames is a dead cable. Those are facts, and
they are handed to the run as facts it must reconcile one by one.
Two checks are worth calling out because they are the ones an experienced engineer makes and a
generic reviewer does not. A netmask is only a netmask when its bits are contiguous from the
top, so 255.255.0.255 is reported as the typo it is instead of being quietly
misread — and the same rule, inverted, catches 0.255.0.255 in an access list. And
because the two halves of the paste describe the same hardware, they can be held against each
other: a port configured duplex full whose show output reports half duplex is a
mismatch by definition, and no amount of reading either half alone would find it.
It reads. It does not reach your device, it does not send a packet, and it does not execute the
configuration it generates — that is text for you to read before you paste it, and every block
is checked first for a destructive command and for a shutdown aimed at an interface
this device's own description calls an uplink or a management port. Verification blocks are
checked for read-only commands only. It cannot see your topology, your neighbours, your logs or
your traffic, so a finding about the far end of a link is always a hypothesis with a test
attached. Credentials that arrive inside the paste are named by location and never echoed, and
type-7 strings are never decoded here — they are reversible, which is the whole reason to rotate
every one of them.
Nothing to hand? Load the , whose uplink is fine and whose last port is wired to a hub through a failing cable, or the , whose access list has a rule that can never match and whose WAN interface is quietly dropping. Both replay saved runs for both lanes, for free.