Flow-Based Monitoring - Dell Force10 C150 Configuration Manual

Figure 38-7. Port Monitoring Example
Force10(conf-if-gi-1/2)#show config
!
interface GigabitEthernet 1/2
no ip address
no shutdown
Force10(conf )#monitor session 0
Force10(conf-mon-sess-0)#source gig 1/1 destination gig 1/2 direction rx

Flow-based Monitoring

Flow-based Monitoring
Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead all traffic on the
interface. This feature is particularly useful when looking for malicious traffic. It is available for Layer 2
and Layer 3 ingress and egress traffic. You may specify traffic using standard or extended access-lists.
To configure flow-based monitoring:
Step Command Syntax
flow-based enable
1
ip access-list
2
ip access-group
3
access-list
View an access-list that you applied to an interface using the command
EXEC Privilege mode, as shown in
820 | Port Monitoring
Host Traffic
1/1
Server Traffic
Host
is supported only on platform
Command Mode
MONITOR SESSION
CONFIGURATION
INTERFACE
1/3
1/2
Sniffer
e
Task
Enable flow-based monitoring for a monitoring session.
Define in an access-list rules that include the keyword
monitor
. FTOS only considers for port monitoring traffic
matching rules with the keyword
See Chapter 8, IP Access Control Lists (ACL),
Prefix Lists, and
Apply the ACL to the monitored port. See
Access Control Lists (ACL), Prefix Lists, and
Figure 38-8.
Server
Port Monitoring 001
monitor
.
Route-maps.
Chapter 8, IP
show ip accounting access-list
Route-maps.
from