show access-lists

ACL contents with per-rule hit counters.

security

What it does

The hit counters are the useful part: a rule with zero matches is either unreachable, or the traffic you expected is not arriving. It turns an ACL review from reading into measuring.

Per vendor

PlatformCommand
Cisco IOS / NX-OSshow access-lists
Juniper JunOSshow firewall
MikroTik RouterOS/ip firewall filter print stats
FortiOSshow firewall policy

Useful variations

  • One listshow access-lists BLOCK_GUEST
  • Reset counters before a testclear access-list counters

Pitfalls

The misreadings that actually cost people time.

  • Zero hits on a permit rule usually means an earlier rule already matched the traffic.
  • Counters do not increment for traffic switched in hardware on some platforms.
  • The implicit deny at the end has no visible counter unless written explicitly.

Related

show running-configshow ip interface brief