Users Guide

Dell(conf)#monitor session 1
Dell(conf-mon-sess-1)#source vl 40 dest ten 1/3 dir rx
Dell(conf-mon-sess-1)#flow-based enable
Dell(conf-mon-sess-1)#exit
Dell(conf)#do show monitor session
SessID Source Destination Dir Mode Source IP Dest IP DSCP TTL Drop Rate
Gre-Protocol FcMonitor
------ ------ ----------- --- ---- --------- -------- ---- --- ---- ----
----------- ---------
0 Te 1/1 Te 1/2 rx Port 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
0 Po 10 Te 1/2 rx Port 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
1 Vl 40 Te 1/3 rx Flow 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
NOTE: Source as VLAN is achieved via Flow based mirroring. Please refer section Enabling Flow-Based Monitoring.
In the following example, the host and server are exchanging trac which passes through the uplink interface 1/1. Port 1/1 is the monitored
port and port 1/42 is the destination port, which is congured to only monitor trac received on tengigabitethernet 1/1 (host-originated
trac).
Figure 101. Port Monitoring Example
Enabling Flow-Based Monitoring
Flow-based monitoring conserves bandwidth by monitoring only specied trac instead of all trac on the interface. This feature is
particularly useful when looking for malicious trac. It is available for Layer 2 and Layer 3 ingress trac. You can specify trac using
standard or extended access-lists.
NOTE
: Flow-based monitoring is not supported for egress trac.
1 Enable ow-based monitoring for a monitoring session.
672
Port Monitoring