Concept Guide

DellEMC(conf)#monitor session 1
DellEMC(conf-mon-sess-1)#source vl 40 dest ten 1/3 dir rx
DellEMC(conf-mon-sess-1)#flow-based enable
DellEMC(conf-mon-sess-1)#exit
DellEMC(conf)#do show monitor session
SessID Source Destination Dir Mode Source IP Dest IP DSCP TTL Drop Rate
Gre-Protocol FcMonitor
------ ------ ----------- --- ---- --------- -------- ---- --- ---- ----
----------- ---------
0 Te 1/1 Te 1/2 rx Port 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
0 Po 10 Te 1/2 rx Port 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
1 Vl 40 Te 1/3 rx Flow 0.0.0.0 0.0.0.0 0 0 No N/
A N/A No
NOTE: Source as VLAN is achieved via Flow based mirroring. Please refer section Enabling Flow-Based Monitoring.
In the following example, the host and server are exchanging trac which passes through the uplink interface 1/1. Port 1/1 is the monitored
port and port 1/42 is the destination port, which is congured to only monitor trac received on tengigabitethernet 1/1 (host-originated
trac).
Figure 103. Port Monitoring Example
Enabling Flow-Based Monitoring
Flow-based monitoring conserves bandwidth by monitoring only specied trac instead of all trac on the interface. This feature is
particularly useful when looking for malicious trac. It is available for Layer 3 ingress trac. You can specify trac using standard or
extended access-lists.
NOTE
: Flow-based monitoring is supported for known unicast egress trac.
1 Create a monitoring session.
696
Port Monitoring