Users Guide

0 Te 1/1 Te 1/2 rx Port N/A N/A
Dell(conf)#monitor session 0
Dell(conf-mon-sess-0)#source po 10 dest ten 1/2 dir rx
Dell(conf-mon-sess-0)#do show monitor session
SessID Source Destination Dir Mode Source IP Dest IP
------ ------ ----------- --- ---- --------- --------
0 Te 1/1 Te 1/2 rx Port N/A N/A
0 Po 10 Te 1/2 rx Port N/A N/A
Dell(conf)#monitor session 1
Dell(conf-mon-sess-1)#source vl 40 dest ten 1/3 dir rx
Dell(conf-mon-sess-1)#flow-based enable
Dell(conf-mon-sess-1)#exit
Dell(conf)#do show monitor session
SessID Source Destination Dir Mode Source IP Dest IP
------ ------ ----------- --- ---- --------- --------
0 Te 1/1 Te 1/2 rx Port N/A N/A
0 Po 10 Te 1/2 rx Port N/A N/A
1 Vl 40 Te 1/3 rx Flow N/A N/A
NOTE: Source as VLAN is achieved via Flow based mirroring. Please refer section Enabling Flow-Based Monitoring.
In the following example, the host and server are exchanging trac which passes through the uplink interface 1/1. Port 1/1 is the
monitored port and port 1/42 is the destination port, which is congured to only monitor trac received on tengigabitethernet 1/1
(host-originated trac).
Figure 105. Port Monitoring Example
Enabling Flow-Based Monitoring
Flow-based monitoring conserves bandwidth by monitoring only specied trac instead of all trac on the interface. This feature is
particularly useful when looking for malicious trac. It is available for Layer 2 and Layer 3 ingress and egress trac. You can specify
trac using standard or extended access-lists.
1. Enable ow-based monitoring for a monitoring session.
640
Port Monitoring