ROM Monitor Mode

As its name suggests, ROM Monitor is stored in ROM and is implemented in firmware. ROM Monitor mode is actually the bootstrap program that we talked about in previous chapters. The bootstrap program is responsible for initializing hardware and loading the Cisco IOS. As such, it is the first thing loaded by the router at power up.

The bootstrap program isn’t limited to just these tasks. It is also capable of providing a command-line environment that can be used to perform certain configuration tasks, such as downloading software over the console port, recovering a lost password, or changing the configuration registers that control the way in which a router will boot. ROM Monitor mode is accessed by issuing what is known as a break sequence, either when the router is booting, or potentially during normal operation.

In order to access ROM Monitor mode using a break sequence, you need to be physically connected to the console port. This is for security purposes, since we’ll see that this mode can be used to change the configuration register of the router. Issuing the break sequence on a router involves pressing a certain key combination, which differs depending on the terminal emulation program that you are using to access the router via the console port. Table 10-1 outlines the break sequences for common terminal emulation software.
Common break sequences for terminal emulation programs:

HyperTerminal Ctrl+Break (Windows 2000)Ctrl+6+Break (Windows 95)

Minicom (Linux) Ctrl+a, f

ProComm Plus Alt-b

The information above is provided mainly for references purposes – you certainly won’t need to remember the break sequences for all software. Since most users will use the version of HyperTerminal included with Windows, it is worth noting that the break sequence may not work with the version included with Windows NT.

To access ROM Monitor mode, issue the break sequence in the first 60 seconds of the router boot process. In other words, power-cycle (reboot) the router, and while connected to the console port in HyperTerminal, press Ctrl+Break. Issuing the break sequence and accessing ROM Monitor mode will generally provide output similar to what is shown below.

19:44:26: %SYS-5-RELOAD: Reload requested
System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
Copyright (c) 1986-1995 by cisco Systems
2500 processor with 16384 Kbytes of main memory

Abort at 0x10EA880 (PC)

After issuing the break sequence, you are presented with the abort message, followed by a prompt. The prompt will differ depending on the type of router you are working with. On a Cisco 2500, the ROM Monitor prompt is simply a flex bracket, as shown in the output above. On a Cisco 1600 or 2600, the ROM Monitor prompt is a little easier to recognize:

rommon 1>

There’s no need to worry about the number following the rommon> prompt. It will simply increment by 1 each time you press enter. The syntax of commands issued from ROM Monitor mode differs depending on whether you’re working from the > or rommon> prompt, as we’ll see a little later in the chapter. For now, it’s enough to know how to access ROM Monitor mode and be able to recognize the associated prompts.

Author: Dan DiNicolo

Dan DiNicolo is a freelance author, consultant, trainer, and the managing editor of He is the author of the CCNA Study Guide found on this site, as well as many books including the PC Magazine titles Windows XP Security Solutions and Windows Vista Security Solutions. Click here to contact Dan.