Dell Force10 S25N-S50N FTOS Configuration Guide FTOS 8.4.2.7 E-Series TeraScal - Page 820

www.dell.com | support.dell.com Figure 38-7. Port Monitoring Example Host Traffic 1/1 1/3 Server Traffic 1/2 Host Server Force10(conf-if-gi-1/2)#show config ! interface GigabitEthernet 1/2 no ip address no shutdown Sniffer Force10(conf )#monitor session 0 Force10(conf-mon-sess-0)#source gig 1/1 destination gig 1/2 direction rx Port Monitoring 001 Flow-based Monitoring e Flow-based Monitoring is supported only on platform Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead all traffic on the interface. This feature is particularly useful when looking for malicious traffic. It is available for Layer 2 and Layer 3 ingress and egress traffic. You may specify traffic using standard or extended access-lists. To configure flow-based monitoring: Step 1 2 Command Syntax flow-based enable ip access-list Command Mode MONITOR SESSION CONFIGURATION 3 ip access-group access-list INTERFACE Task Enable flow-based monitoring for a monitoring session. Define in an access-list rules that include the keyword monitor. FTOS only considers for port monitoring traffic matching rules with the keyword monitor. See Chapter 8, IP Access Control Lists (ACL), Prefix Lists, and Route-maps. Apply the ACL to the monitored port. See Chapter 8, IP Access Control Lists (ACL), Prefix Lists, and Route-maps. View an access-list that you applied to an interface using the command show ip accounting access-list from EXEC Privilege mode, as shown in Figure 38-8. 820 | Port Monitoring