CLI Guide
You can activate flow-based monitoring for a monitoring session by entering the
flow-based enable command in the Monitor Session mode. When you enable
this capability, traffic with particular flows that are traversing through the ingress
and egress interfaces are examined and, appropriate ACLs can be applied in both
the ingress and egress direction. Flow-based monitoring conserves bandwidth by
monitoring only specified traffic instead all traffic on the interface. This feature is
particularly useful when looking for malicious traffic. It is available for Layer 2 and
Layer 3 ingress and egress traffic. You may specify traffic using standard or
extended access-lists. This mechanism copies all incoming or outgoing packets on
one port and forwards (mirrors) them to another port. The source port is the
monitored port (MD) and the destination port is the monitoring port (MG).
Related
Commands
deny — configures a MAC ACL filter to drop packets.
seq —configure a MAC ACL filter with a specified sequence number.
seq
To a deny or permit filter in a MAC access list while creating the filter, assign a sequence number.
Syntax
seq sequence-number {deny | permit} {any | mac-source-address
[mac-source-address-mask]} [count [byte]] [log [interval
minutes] [threshold-in-msgs [count]] [monitor]
To remove this filter, use the no seq sequence-number command.
Parameters
sequence-
number
Enter a number from 0 to 65535.
deny Enter the keyword deny to configure a filter to drop packets
meeting this condition.
permit Enter the keyword permit to configure a filter to forward
packets meeting this criteria.
any Enter the keyword any to filter all packets.
mac-source-
address
Enter a MAC address in nn:nn:nn:nn:nn:nn format.
mac-source-
address-mask
(OPTIONAL) Specify which bits in the MAC address must
match. If no mask is specified, a mask of 00:00:00:00:00:00
is applied (in other words, the filter allows only MAC
addresses that match).
count (OPTIONAL) Enter the keyword count to count packets the
filter processes.
byte (OPTIONAL) Enter the keyword byte to count bytes the
filter processes.
214
Access Control Lists (ACL)