Enabling Flow-Based MonitoringFlow-based monitoring conserves bandwidth by monitoring only specified traffic instead of all traffic onthe interface. This feature is particularly useful when looking for malicious traffic. It is available for Layer 2and Layer 3 ingress and egress traffic. You can specify traffic using standard or extended access-lists.1. Enable flow-based monitoring for a monitoring session.MONITOR SESSION modeflow-based enable2. Define in access-list rules that include the keyword monitor. For port monitoring, Dell NetworkingOS only considers traffic matching rules with the keyword monitor.CONFIGURATION modeip access-listRefer to Access Control Lists (ACLs).3. Apply the ACL to the monitored port.INTERFACE modeip access-group access-listExample of the flow-based enable CommandTo view an access-list that you applied to an interface, use the show ip accounting access-listcommand from EXEC Privilege mode.Dell(conf)#monitor session 0Dell(conf-mon-sess-0)#flow-based enableDell(conf)#ip access-list ext testflowDell(config-ext-nacl)#seq 5 permit icmp any any count bytes monitorDell(config-ext-nacl)#seq 10 permit ip 102.1.1.0/24 any count bytes monitorDell(config-ext-nacl)#seq 15 deny udp any any count bytesDell(config-ext-nacl)#seq 20 deny tcp any any count bytesDell(config-ext-nacl)#exitDell(conf)#interface tengigabitethernet 1/1/1Dell(conf-if-te-1/1/1)#ip access-group testflow inDell(conf-if-te-1/1/1)#show config!interface TenGigabitEthernet 1/1/1ip address 10.11.1.254/24ip access-group testflow inshutdownDell(conf-if-te-1/1/1)#exitDell(conf)#do show ip accounting access-list testflow!Extended Ingress IP access list testflow on TenGigabitEthernet 1/1/1Total cam count 4seq 5 permit icmp any any monitor count bytes (0 packets 0 bytes)seq 10 permit ip 102.1.1.0/24 any monitor count bytes (0 packets 0 bytes)seq 15 deny udp any any count bytes (0 packets 0 bytes)seq 20 deny tcp any any count bytes (0 packets 0 bytes)Dell(conf)#do show monitor session 0SessionID Source Destination Direction Mode Type--------- ------ ----------- --------- ---- ----0 Te 1/1/1 Te 1/2/1 rx interface Flow-based682 Port Monitoring
