Enabling Flow-Based MonitoringFlow-based monitoring is supported only on the S-Series platform.Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead of all traffic on the interface. This feature isparticularly useful when looking for malicious traffic. It is available for Layer 2 and Layer 3 ingress and egress traffic. You can specifytraffic using standard or extended access-lists.1. Enable flow-based monitoring for a monitoring session.MONITOR SESSION modeflow-based enable2. Define in access-list rules that include the keyword monitor. For port monitoring, Dell Networking OS only considers trafficmatching rules with the keyword monitor.CONFIGURATION modeip access-listRefer to Access Control Lists (ACLs).3. Apply the ACL to the monitored port.INTERFACE modeip access-group access-listExample of the flow-based enable CommandTo view an access-list that you applied to an interface, use the show ip accounting access-list command from EXECPrivilege mode.Dell(conf)#monitor session 0Dell(conf-mon-sess-0)#flow-based enableDell(conf)#ip access-list ext testflowDell(config-ext-nacl)#seq 5 permit icmp any any count bytes monitorDell(config-ext-nacl)#seq 10 permit ip 102.1.1.0/24 any count bytes monitorDell(config-ext-nacl)#seq 15 deny udp any any count bytesDell(config-ext-nacl)#seq 20 deny tcp any any count bytesDell(config-ext-nacl)#exitDell(conf)#interface tengigabitethernet 1/1Dell(conf-if-te-1/1)#ip access-group testflow inDell(conf-if-te-1/1)#show config!interface TenGigabitEthernet 1/1ip address 10.11.1.254/24ip access-group testflow inshutdownDell(conf-if-te-1/1)#exitDell(conf)#do show ip accounting access-list testflow!Extended Ingress IP access list testflow on TenGigabitEthernet 1/1Total cam count 4seq 5 permit icmp any any monitor count bytes (0 packets 0 bytes)seq 10 permit ip 102.1.1.0/24 any monitor count bytes (0 packets 0 bytes)seq 15 deny udp any any count bytes (0 packets 0 bytes)seq 20 deny tcp any any count bytes (0 packets 0 bytes)Dell(conf)#do show monitor session 0SessionID Source Destination Direction Mode Type--------- ------ ----------- --------- ---- ----0 Te 1/1 Te 1/2 rx interface Flow-based548 Port Monitoring
