Dell Force10 E600i FTOS Version 8.4.1.5 Configuration Guide for ExaScale - Page 769

Figure 41-3. Port Monitoring Example Host Traffic 1/1 1/3 Server Traffic 1/2 Host Server FTOS(conf-if-gi-1/2)#show config ! interface GigabitEthernet 1/2 no ip address no shutdown Sniffer FTOS(conf )#monitor session 0 FTOS(conf-mon-sess-0)#source gig 1/1 destination gig 1/2 direction rx Port Monitoring 001 Flow-based Monitoring e Flow-based Monitoring is supported only on platform Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead all traffic on the interface. This feature is particularly useful when looking for malicious traffic. It is available for Layer 2 and Layer 3 ingress and egress traffic. You may specify traffic using standard or extended access-lists. To configure flow-based monitoring: Step 4 5 6 Task Command Syntax Enable flow-based monitoring for a monitoring session. Define in an access-list rules that include the keyword monitor. FTOS only considers for port monitoring traffic matching rules with the keyword monitor. Refer to Chapter 10, IP Access Control Lists (ACL), Prefix Lists, and Route-maps. Apply the ACL to the monitored port. Refer to Chapter 10, IP Access Control Lists (ACL), Prefix Lists, and Route-maps. flow-based enable ip access-list ip access-group access-list Command Mode MONITOR SESSION CONFIGURATION INTERFACE View an access-list that you applied to an interface using the command show ip accounting access-list from EXEC Privilege mode, as shown in the following example. Port Monitoring | 769