# VyOS Operation Mode

> VyOS operation mode guide: show commands, system monitoring, network diagnostics, and CLI navigation for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/admin-guide/vyos-operation-mode/


Operation mode in VyOS provides commands for monitoring system health, diagnosing problems, and performing operational tasks without changing the configuration. It is the primary working mode for day-to-day VyOS administration.

## Core Concepts

### Operation vs Configuration Mode

**Operation Mode**:
- The default mode after logging in
- Read-only and monitoring
- Runs operational commands (show, monitor, reset, clear)
- Does not change the configuration
- Prompt: `vyos@router:~$`

**Configuration Mode**:
- For changing the configuration
- The set, delete, commit, and rollback commands
- Transactional approach
- Prompt: `vyos@router#`
- Entry: the `configure` command

### Command Categories

1. **show** - Viewing information (state, statistics, configuration)
2. **monitor** - Real-time monitoring
3. **reset** - Resetting state (not the configuration)
4. **clear** - Clearing counters and caches
5. **ping/traceroute** - Network diagnostics
6. **generate/add/delete** - System operations

## Show Commands

### System Information

```bash
# General system information
show version

# Output:
# Version:          VyOS 1.5.x
# Release train:    current
# Built by:         autobuild@vyos.net
# Built on:         Mon 14 Oct 2024 12:00 UTC
# Build UUID:       ...
# Architecture:     x86_64

# Hardware information
show system hardware

# Resource usage
show system memory
show system cpu
show system storage

# Uptime and load average
show system uptime

# Processes
show system processes
show system processes summary
show system processes extensive
```

### Network Interfaces

```bash
# All interfaces
show interfaces

# A specific interface
show interfaces ethernet eth0
show interfaces bridge br0
show interfaces bond bond0

# Brief format
show interfaces brief

# Interface statistics
show interfaces ethernet eth0 statistics
show interfaces ethernet eth0 counters

# Physical state
show interfaces ethernet eth0 physical

# Interface queues
show interfaces ethernet eth0 queue
```

### IP Configuration and Routing

```bash
# IP addresses
show interfaces addresses

# ARP table
show arp
show arp interface eth0

# Routing table
show ip route
show ip route summary
show ip route 192.168.1.0/24

# A specific route
show ip route 8.8.8.8

# IPv6 routes
show ipv6 route
show ipv6 route summary

# Neighbor table (IPv6)
show ipv6 neighbors
```

### Routing Protocols

```bash
# OSPF
show ip ospf neighbor
show ip ospf database
show ip ospf interface
show ip ospf route

# BGP
show ip bgp summary
show ip bgp neighbors
show ip bgp
show ip bgp neighbor 10.0.0.1 advertised-routes
show ip bgp neighbor 10.0.0.1 received-routes

# Route maps and prefix lists
show route-map
show ip prefix-list
show ip community-list
```

### VPN

```bash
# IPsec
show vpn ipsec sa
show vpn ipsec state
show vpn ipsec status

# WireGuard
show interfaces wireguard
show interfaces wireguard wg01

# OpenVPN
show openvpn server
show openvpn client
show openvpn status server server1
```

### Firewall and NAT

```bash
# Firewall rules
show firewall
show firewall name WAN_IN
show firewall statistics

# NAT
show nat source statistics
show nat destination statistics
show nat source rules
show nat destination rules

# Connection tracking
show conntrack table ipv4
show conntrack table ipv6
show conntrack statistics
```

### Services

```bash
# DHCP server
show service dhcp-server leases
show service dhcp-server statistics
show service dhcp-server leases pool LAN

# DHCPv6 server
show service dhcpv6-server leases

# DNS forwarding
show dns forwarding statistics
show dns forwarding nameservers

# NTP
show ntp
show system ntp

# SNMP
show snmp community
show snmp v3
```

### System Services

```bash
# SSH
show service ssh

# Users
show users
show users recent

# Logs
show log
show log tail
show log tail 50
show log | match error
show log | match eth0

# Services
show system services
```

### Configuration

```bash
# Current configuration
show configuration

# A specific section
show configuration interfaces
show configuration service dhcp-server

# Commands for reproduction
show configuration commands
show configuration commands | match interface

# Saved configuration
show configuration file /config/config.boot

# Commit history
show system commit
show system commit diff 5
```

## Monitor Commands

### Real-Time Monitoring

```bash
# Logs in real time
monitor log
monitor log colored

# Interface traffic
monitor interfaces
monitor interfaces eth0
monitor interfaces eth0 traffic

# Firewall
monitor firewall
monitor firewall name WAN_IN

# BGP neighbors
monitor protocol bgp

# Bandwidth usage
monitor bandwidth interface eth0
```

### Traffic Capture

```bash
# Traffic capture (tcpdump)
monitor traffic interface eth0
monitor traffic interface eth0 filter "port 80"
monitor traffic interface eth0 save /tmp/capture.pcap

# With additional filters
monitor traffic interface eth0 filter "host 192.168.1.100 and port 443"

# Verbose output
monitor traffic interface eth0 verbose
```

## Reset Commands

### Connection and Session Reset

```bash
# Reset a BGP neighbor
reset ip bgp 10.0.0.1

# Reset the OSPF process
reset ip ospf process

# Reset an IPsec SA
reset vpn ipsec-peer 203.0.113.1

# Reset conntrack connections
reset conntrack-sync external
reset conntrack-sync internal
```

### Terminal Reset

```bash
# Reset the terminal
reset terminal
```

## Clear Commands

### Clearing Counters and Cache

```bash
# Clear interface counters
clear interfaces ethernet eth0 counters

# Clear firewall counters
clear firewall name WAN_IN counters
clear firewall statistics

# Clear the ARP cache
clear arp

# Clear the route cache
clear ip route cache

# Clear the DNS cache
clear dns forwarding cache

# Clear the conntrack table
clear conntrack table ipv4
clear conntrack table ipv6
```

### Clearing System State

```bash
# Clear system logs
clear system login history user vyos

# Clear a DHCP lease
clear service dhcp-server lease 192.168.1.100
```

## Network Diagnostic Commands

### Connectivity Testing

```bash
# Ping
ping 8.8.8.8
ping 8.8.8.8 count 5
ping 8.8.8.8 size 1400
ping 8.8.8.8 source-address 192.168.1.1

# Ping IPv6
ping 2001:4860:4860::8888
ping6 2001:4860:4860::8888

# Traceroute
traceroute 8.8.8.8
traceroute 8.8.8.8 source-address 192.168.1.1

# Traceroute IPv6
traceroute6 2001:4860:4860::8888

# MTU path discovery
ping 8.8.8.8 do-not-fragment size 1500
```

### DNS and Network Tools

```bash
# DNS lookup
nslookup google.com
nslookup google.com 8.8.8.8

# Dig
dig google.com
dig google.com @8.8.8.8 +short
dig google.com MX

# Host
host google.com
host 8.8.8.8

# Telnet
telnet 192.168.1.1 22
telnet smtp.gmail.com 25
```

### Network Scanning

```bash
# Port scan (if nmap is installed)
scan port 192.168.1.1
scan port 192.168.1.0/24 port 22

# ARP scan
scan arp interface eth1
```

## System Operation Commands

### Power Management

```bash
# Reboot
reboot
reboot now
reboot in 10

# Power off
poweroff
poweroff now
poweroff in 30

# Cancel a scheduled reboot
shutdown -c
```

### Image Management

```bash
# List images
show system image

# Install a new image
add system image https://downloads.vyos.io/...

# Delete an image
delete system image 1.4.0

# Set the default boot image
set system image default-boot 1.5.0
```

### Configuration Management

```bash
# Copy the configuration
copy file /config/config.boot to /config/config.boot.backup
copy running-config file /tmp/running.conf

# Load a configuration
load /config/config.boot.backup

# Save the configuration
save
save /config/config.boot.backup
```

### PKI Operations

```bash
# Generate keys
generate pki key-pair
generate pki key-pair install my-key

# Generate a certificate
generate pki certificate sign my-ca install my-cert

# Generate a CSR
generate pki certificate-request install my-csr

# View certificates
show pki ca
show pki certificate
```

### SSH Keys

```bash
# Generate SSH keys
generate ssh-key user vyos

# Show SSH keys
show ssh fingerprints
show ssh server-key
```

## Advanced Operational Commands

### System Debugging

```bash
# Enable debugging for a protocol
debug ospf events
debug bgp updates

# View the debug output
show log | match debug

# Disable debugging
no debug ospf events
no debug all
```

### Hardware Information

```bash
# PCI devices
show hardware pci

# CPU information
show hardware cpu

# Memory banks
show hardware mem

# Sensors (temperature, fans)
show hardware sensors
```

### Container Operations

```bash
# List containers
show container

# Container details
show container name my-container

# Container logs
show container log name my-container

# Container statistics
show container name my-container statistics
```

## Practical Usage Examples

### 1. Diagnosing Connectivity Problems

```bash
# Step 1: Check the interfaces
show interfaces brief

# Step 2: Check IP addresses
show interfaces addresses

# Step 3: Check routing
show ip route 8.8.8.8

# Step 4: Check conntrack
show conntrack table ipv4 | match 8.8.8.8

# Step 5: Ping test
ping 8.8.8.8 source-address <your-ip>

# Step 6: Traceroute
traceroute 8.8.8.8
```

### 2. Checking VPN Status

```bash
# IPsec
show vpn ipsec sa
show vpn ipsec status

# If the tunnel is down - check the logs
show log | match ipsec

# VTI interface statistics
show interfaces vti vti0 statistics

# Routing over the VPN
show ip route | match vti0
```

### 3. Performance Monitoring

```bash
# CPU and memory
show system uptime
show system cpu
show system memory

# Network throughput
show interfaces eth0 statistics

# Connection tracking usage
show conntrack statistics

# Top processes
show system processes extensive | head -20
```

### 4. BGP Diagnostics

```bash
# BGP neighbor state
show ip bgp summary

# Neighbor details
show ip bgp neighbors 10.0.0.1

# Received routes
show ip bgp neighbor 10.0.0.1 received-routes

# Advertised routes
show ip bgp neighbor 10.0.0.1 advertised-routes

# BGP table
show ip bgp

# Path to a specific network
show ip bgp 203.0.113.0/24
```

### 5. Firewall Analysis

```bash
# All firewall rules
show firewall

# Statistics for a specific ruleset
show firewall name WAN_IN statistics

# Connection tracking
show conntrack table ipv4 | wc -l

# Top conntrack sources
show conntrack table ipv4 | awk '{print $5}' | cut -d= -f2 | sort | uniq -c | sort -rn | head -10

# Check a specific connection
show conntrack table ipv4 | match "192.168.1.100"
```

### 6. DHCP Troubleshooting

```bash
# Active leases
show service dhcp-server leases

# DHCP statistics
show service dhcp-server statistics

# Leases for a specific pool
show service dhcp-server leases pool LAN

# DHCP logs
show log | match dhcp
```

## Useful Techniques

### Filtering Output

```bash
# Grep (match)
show configuration | match interface
show log | match error

# Exclude
show configuration | no-more | grep -v "!"

# Head/Tail
show log tail 50
show log | head -20

# Pipe to less for long output
show configuration | no-more
```

### Formatting Output

```bash
# JSON format (for the API)
show interfaces format json
show configuration format json

# Without pagination
show log | no-more

# With timestamps
show log | match error | tail
```

### Copying and Saving Output

```bash
# Save to a file
show configuration > /tmp/config.txt
show running-config | cat > /tmp/running.txt

# SCP copy
scp /tmp/config.txt user@server:/backup/
```

### Aliases for Frequent Commands

In configuration mode:
```bash
configure
set system login user vyos alias sh="show"
set system login user vyos alias si="show interfaces"
set system login user vyos alias sir="show ip route"
commit
save
```

Now, in operation mode:
```bash
sh version      # instead of show version
si brief        # instead of show interfaces brief
sir summary     # instead of show ip route summary
```

## Command Cheat Sheet

### Top 20 Commands for Daily Work

1. `show interfaces brief` - Brief interface status
2. `show ip route` - Routing table
3. `show configuration` - Current configuration
4. `show system uptime` - System uptime
5. `show log tail 50` - Last 50 log lines
6. `ping 8.8.8.8` - Connectivity test
7. `show service dhcp-server leases` - DHCP leases
8. `show vpn ipsec sa` - IPsec tunnels
9. `show ip bgp summary` - BGP status
10. `show firewall` - Firewall rules
11. `show conntrack table ipv4` - Connection tracking
12. `monitor log` - Logs in real time
13. `show system memory` - Memory usage
14. `show system cpu` - CPU usage
15. `show interfaces statistics` - Interface statistics
16. `show nat source statistics` - NAT statistics
17. `show version` - System version
18. `show users` - Logged-in users
19. `show system commit` - Commit history
20. `save` - Save the configuration

## Best Practices

1. **Regular monitoring**
   - Check `show system uptime` daily
   - Monitor `show system memory` and CPU
   - Track `show conntrack statistics`
   - Check `show log | match error`

2. **Documentation**
   - Save the output of important commands
   - Take screenshots when problems occur
   - Keep an operations log book
   - Document changes

3. **Troubleshooting workflow**
   - Start with `show interfaces brief`
   - Check `show log tail 100`
   - Use `monitor log` for real-time visibility
   - Collect all diagnostics before contacting support

4. **Performance monitoring**
   - Regularly check `show system resources`
   - Monitor interface statistics
   - Track conntrack usage
   - Keep an eye on routing table size

5. **Security**
   - Regularly check `show users`
   - Monitor `show system login`
   - Review firewall statistics
   - Analyze conntrack for anomalies

6. **Automation**
   - Use scripts for regular checks
   - Collect metrics into monitoring systems
   - Automate routine tasks
   - Create health check scripts

7. **Backup awareness**
   - Run `save` regularly
   - Periodically run `show configuration commands > backup.txt`
   - Store backups off the device
   - Test the restore procedure

8. **Learning path**
   - Start with the basic show commands
   - Study command output
   - Experiment with filters
   - Create your own aliases

9. **Remote management**
   - Use SSH instead of telnet
   - Set up tmux/screen for long sessions
   - Maintain out-of-band access
   - Document recovery procedures

10. **Command history**
    - Use the command history (up/down arrows)
    - Ctrl+R to search the history
    - Save frequently used commands
    - Create command templates

## Conclusion

VyOS operation mode provides a powerful set of commands for monitoring, diagnosing, and managing the system. Mastering these commands is critical for efficient VyOS administration and for quickly resolving problems in production environments.

**Key takeaways**:
- Operation mode is for monitoring, not for changes
- Show commands are the foundation of diagnostics
- Monitor commands give real-time visibility
- Reset/Clear are for operational tasks
- Hands-on practice is the key to mastery

**Additional resources**:
- [VyOS Command Reference](https://docs.vyos.io/)
- [Configuration Guide](/docs/vyos/) - for changing the configuration
- [Troubleshooting](/docs/vyos/admin-guide/vyos-troubleshooting/) - problem-solving methodology