Administrator Guide

seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte]]
[monitor]
If the number of monitoring sessions increases, inter-process communication (IPC) bandwidth utilization will be high. The ACL
manager might require a large bandwidth when you assign an ACL, with many entries, to an interface.
The ACL agent module saves monitoring details in its local database and also in the CAM region to monitor packets that match the
specied criterion. The ACL agent maintains data on the source port, the destination port, and the endpoint to which the packet
must be forwarded when a match occurs with the ACL entry.
If you congure the flow-based enable command and do not apply an ACL on the source port or the monitored port, both
ow-based monitoring and port mirroring do not function. Flow-based monitoring is supported only for ingress trac and not for
egress packets.
The port mirroring application maintains a database that contains all monitoring sessions (including port monitor sessions). It has
information regarding the sessions that are enabled for ow-based monitoring and those sessions that are not enabled for ow-
based monitoring. It downloads monitoring conguration to the ACL agent whenever the ACL agent is registered with the port
mirroring application or when ow-based monitoring is enabled.
The show monitor session session-id command has been enhanced to display the Type eld in the output, which
indicates whether a particular session is enabled for ow-monitoring.
Example Output of the show Command
#show running-config monitor session
!
monitor session 11
flow-based enable
source GigabitEthernet 13/0 destination GigabitEthernet 13/1 direction both
The show running-config monitor session command displays whether ow-based monitoring is enabled for a particular
session.
The show config command has been modied to display monitoring conguration in a particular session.
Example Output of the show Command
(conf-mon-sess-11)#show config
!
monitor session 11
flow-based enable
source GigabitEthernet 13/0 destination GigabitEthernet 13/1 direction both
The show ip | mac | ipv6 accounting commands have been enhanced to display whether monitoring is enabled for
trac that matches with the rules of the specic ACL.
Example Output of the show Command
Dell# show ip accounting access-list
!
Extended Ingress IP access list kar on GigabitEthernet 10/0
Total cam count 1
seq 5 permit ip 192.168.20.0/24 173.168.20.0/24 monitor
Dell#show mac accounting access-list kar in gi 10/0 out
Egress Extended mac access-list kar on GigabitEthernet 10/0
seq 5 permit host 11:11:11:11:11:11 host 22:22:22:22:22:22 monitor
seq 10 permit host 22:22:22:22:22:22 any monitor
seq 15 permit host 00:0f:fe:1e:de:9b host 0a:0c:fb:1d:fc:aa monitor
Dell#show ipv6 accounting access-list
!
118
Access Control Lists (ACLs)