Deployment Guide

The port mirroring application maintains a database that contains all monitoring sessions (including port monitor sessions). It has
information regarding the sessions that are enabled for ow-based monitoring and those sessions that are not enabled for ow-based
monitoring. It downloads monitoring conguration to the ACL agent whenever the ACL agent is registered with the port mirroring
application or when ow-based monitoring is enabled.
The show monitor session session-id command has been enhanced to display the Type eld in the output, which indicates
whether a particular session is enabled for ow-monitoring.
Example Output of the show Command
#show running-config monitor session
!
monitor session 11
flow-based enable
source GigabitEthernet 13/0 destination GigabitEthernet 13/1 direction both
The show running-config monitor session command displays whether ow-based monitoring is enabled for a particular
session.
The show config command has been modied to display monitoring conguration in a particular session.
Example Output of the show Command
(conf-mon-sess-11)#show config
!
monitor session 11
flow-based enable
source GigabitEthernet 13/0 destination GigabitEthernet 13/1 direction both
The show ip | mac | ipv6 accounting commands have been enhanced to display whether monitoring is enabled for trac that
matches with the rules of the specic ACL.
Example Output of the show Command
Dell# show ip accounting access-list
!
Extended Ingress IP access list kar on GigabitEthernet 10/0
Total cam count 1
seq 5 permit ip 192.168.20.0/24 173.168.20.0/24 monitor
Dell#show mac accounting access-list kar in gi 10/0 out
Egress Extended mac access-list kar on GigabitEthernet 10/0
seq 5 permit host 11:11:11:11:11:11 host 22:22:22:22:22:22 monitor
seq 10 permit host 22:22:22:22:22:22 any monitor
seq 15 permit host 00:0f:fe:1e:de:9b host 0a:0c:fb:1d:fc:aa monitor
Dell#show ipv6 accounting access-list
!
Ingress IPv6 access list kar on GigabitEthernet 10/0
Total cam count 1
seq 5 permit ipv6 22::/24 33::/24 monitor
Enabling Flow-Based Monitoring
Flow-based monitoring conserves bandwidth by monitoring only specied trac instead of all trac on the interface. This feature is
particularly useful when looking for malicious trac. It is available for Layer 2 and Layer 3 ingress and egress trac. You can specify trac
using standard or extended access-lists.
1 Enable ow-based monitoring for a monitoring session.
MONITOR SESSION mode
Access Control Lists (ACLs)
135