Interface counters and what they actually tell you

Interface counters are the cheapest diagnostic available and the most frequently skimmed. Each one means something specific, and reading them precisely narrows a problem faster than any capture.

Input errors

CRC errors — the frame arrived corrupted. Physical: cable, connector, transceiver, interference. Rarely a configuration issue; the one exception is a duplex mismatch, which produces them on the full-duplex side.

Runts — frames shorter than 64 bytes. Usually collisions, which on a full-duplex link means a duplex mismatch.

Giants — frames larger than the configured MTU. Someone at the far end is sending jumbo frames you are not expecting.

Input queue drops — the interface received faster than the device could process. A capacity or CPU problem, not a cable one.

Output errors

Output drops — the transmit queue was full. The link is congested, or a QoS policy is doing exactly what you told it to. This is the counter to watch when users report slowness.

Late collisions — a collision after the first 64 bytes. On modern links this means duplex mismatch, almost without exception.

Deferred — the interface waited before transmitting. Normal on half duplex; suspicious on full.

Read rates, not totals

A counter showing 40,000 CRC errors means nothing without a time base. An interface up for three years with 40,000 errors is healthy. The same count accumulated since yesterday is a fault in progress.

clear counters GigabitEthernet0/12
# wait, then measure the rate of change
show interface GigabitEthernet0/12 | include error|drop

The one to graph

If you can only trend one thing, trend output drops alongside utilisation. Together they distinguish a link that is full from a link that is broken, which is the most common question you will be asked about any interface.