Troubleshooting a Network Switch down: Stack up from the bottom: Check for power & PoE budget, swap suspicious cables, review port LEDs & interface counters, then work up towards loops, VLAN configuration, & firmware issues. Save logs, then reboot. Swap in a new one if they indicate the hardware is broken.
Symptoms
- Entire VLAN or rack goes dark, uplink LED off or stuck amber
- Packet loss on one port only, neighboring ports pass traffic cleanly
- Switch CPU pegged near maximum, MAC address table flapping between interfaces
- Chassis hot to the touch, fan silent or spinning at full speed
- Console login refused, or the unit reboots on its own without a trigger
Common Causes
Failing PSU or overdrawn PoE budget
Power supplies degrade quietly for months before dropping the load. A PoE switch will shed ports the moment attached devices ask for more wattage than the budget allows, and neither failure mode announces itself cleanly at first.
Bad cable, dirty jack, or damaged port
Copper fails in slow motion. A cable pinched by a chair leg, a jack full of dust, or a port with a bent pin will pass link but drop packets under load, and the pattern points at one physical run rather than the switch as a whole.
Layer 2 loop or broadcast storm
Two access ports patched together, a rogue mini-switch under a desk, or STP disabled on an uplink will turn the network to soup in seconds. Expect CPU spikes, MAC flapping in the log, and every device slow at once.
Firmware bug or broken config:
Former Cisco firmware trains have memory leaks that are not released until the router has been up for weeks. Then a bad config push can make the unit susceptible to a freakout that only a rollback can fix, and the vendor advisories will usually specify what versions are affected.
Hardware/thermal failure:
A bad capacitor. Dust in the fan. An extra closet AC dies on a weekend. Any of these will put you into a safe shutdown, or worse, silent packet corruption on random ports.
Step-by-Step Fix
- Power and PoE check:
At the wall. Make sure the outlet is live with a test device that you know works, and check the switch's PSU status for one that is doubled up and quietly dropped out. For PoE units, sum the power draw of each end device, and compare this to the inline power budget indicated by show power inline. - Replace the patch cable and test a different port
Faulty cables can be indistinguishable from port issues from the desk side. Take a known good cable (preferably one that has been tested with a continuity tester) and move the device to a port that you are sure works. If the link comes back, then you've found your cause. - Read the interface counters, not just the LEDs
LEDs lie. Console into the switch and run `show interfaces status` and `show interfaces counters errors`, or the equivalent on your vendor (HPE `display interface`, Aruba `show int brief`). CRC errors point at cabling or duplex mismatch. Input drops suggest a speed or buffer issue. Err-disabled means the switch already fenced the port itself. - Hunt loops and confirm Spanning Tree is active
A loop turns a healthy switch into a broken one within seconds. Watch for MAC flapping in the log, CPU pinned near 100%, and every port LED blinking in unison. Verify STP is enabled on all VLANs with `show spanning-tree summary`, confirm BPDU guard is on for user ports, and make sure nobody patched two access ports together. - Review VLAN, trunk, and native VLAN config
A misassigned access VLAN or a trunk missing an allowed VLAN will look like a dead switch to whoever plugged in. Confirm the port's `switchport access vlan` matches the client's expectation, verify the trunk carries every required VLAN, and watch for native VLAN mismatches. CDP or LLDP will log complaints if the neighboring switch disagrees. - Check temperature, fans, and firmware version
Thermal shutdowns rarely announce themselves in advance. Run `show environment` for temperature and fan status, clear dust blocking the vents, and confirm the rack has airflow at the rear. While you are in the CLI, note the firmware version and cross-check the vendor's advisory list. Known bugs affecting your model often already have a fix in a stable release. - Capture logs, then reboot as a last resort
Before you power-cycle anything, copy the running-config and log buffer somewhere safe with `show logging` and `copy run tftp:`. A reboot may clear the symptom, but it also erases the evidence you need to prevent a repeat. If the unit recovers after reboot and the logs show a crash dump or memory leak, that is a hardware or firmware ticket. - Decide: RMA, cold spare, or return to service
If the switch fails power-on self-test, throws hardware errors after a cold boot, or leaves a single port dead after firmware update and factory reset, open an RMA or swap in a spare. Keep a cold spare of every model that supports more than a handful of users. Mean time to replacement matters more than mean time between failures.
Common switch symptoms and where to look first
| Symptom | Likely cause | First check |
|---|---|---|
| All ports dead, no LEDs at all | PSU or power feed failure | Swap PSU, test outlet with another device |
| One port dead, neighbors fine | Bad cable or damaged port | Move device to a known-good spare port |
| PoE devices dropping randomly | Overdrawn PoE power budget | Run `show power inline`, total the load |
| High CPU, network crawling | Layer 2 loop or broadcast storm | Check STP state and log for MAC flap |
| Unplanned reboots or lockups | Thermal issue or firmware bug | `show environment`, check vendor advisory |
| Only one VLAN affected | VLAN or trunk misconfiguration | Verify access VLAN and trunk allowed list |
| Link up but CRC errors climbing | Cable, jack, or duplex mismatch | Reseat cable, force matching speed/duplex |
Prevention
- Keep at least one cold spare of every switch model running in production
- Enable BPDU guard and root guard on every access port, no exceptions
- Patch firmware on a fixed quarterly cadence, not reactively after an outage
- Ship SNMP traps for temperature, PSU, and interface errors to a central collector
FAQ
Is there a way to differentiate between a dead switch and a dead uplink?
Log in to the console port on the switch and access it directly from the console port to bypass the network. If you power up the box and you see the interfaces are all up except for the uplink or the switch upstream from it, then it is your uplink or the upstream device.
Is a factory reset recommended for troubleshooting?
It may cause you to lose ALL VLANS and port trunk configuration and all port security configuration, STP tuning that has been done, and more! And when you reboot your new equipment, you will be greeted by all your ports assigned to VLAN 1, which itself is not good. Consider a reset as a repair procedure, not a shortcut for diagnosis. Plan accordingly.
Whom do you consider to be more of an expert when it comes to aswitch repair than to do the replacing.
The access switches are always returned to the vendor on an RMA if they are still under warranty. Old off-warranty equipment more than about 5 years old is not worth the labor. The old capacitors need replacing, the fans die, and newer models use less power and support newer PoE standards. Core and distribution switches need a closer cost analysis against a spare you already own.