Users Guide

If you congure the continue command at the end of a module, the next module processes even after a match is found. The example
shows a continue clause at the end of a route-map module — if a match is found in the route-map test module 10, module 30 processes.
Route-map continue clause
OS10(config)# route-map test permit 10
OS10(conf-route-map)# continue 30
ACL ow-based monitoring
Flow-based monitoring conserves bandwidth by selecting only the required ow to mirror instead of mirroring entire packets from an
interface. This feature is available for L2 and L3 ingress trac. Specify ow-based monitoring using ACL rules. Flow-based monitoring
copies incoming packets that match the ACL rules applied on the ingress port and forwards, or mirrors them to another port. The source
port is the monitored port (MD), and the destination port is the monitoring port (MG).
When a packet arrives at a monitored port, the packet validates against the congured ACL rules. If the packet matches an ACL rule, the
system examines the corresponding ow processor and performs the action specied for that port. If the mirroring action is set in the ow
processor entry, the port details are sent to the destination port.
Flow-based mirroring
Flow-based mirroring is a mirroring session in which trac matches specied policies that mirrors to a destination port. Port-based
mirroring maintains a database that contains all monitoring sessions, including port monitor sessions. The database has information
regarding the sessions that are enabled or not enabled for ow-based monitoring. Flow-based mirroring is also known as policy-based
mirroring.
To enable ow-based mirroring, use the flow-based enable command. Trac with particular ows that traverse through the ingress
interfaces are examined. Appropriate ACL rules apply in the ingress direction. By default, ow-based mirroring is not enabled.
To enable evaluation and replication of trac traversing to the destination port, congure the monitor option using the permit, deny, or
seq commands for ACLs assigned to the source or the monitored port (MD). Enter the keywords capture session session-id
with the seq, permit, or deny command for the ACL rules to allow or drop IPv4, IPv6, ARP, UDP, EtherType, ICMP, and TCP packets.
IPV4-ACL mode
seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte]]
[fragments] [threshold-in-msgs count] [capture session session-id]
If you congure the flow-based enable command and do not apply an ACL on the source port or the monitored port, both ow-based
monitoring and port mirroring do not function. Flow-based monitoring is supported only for ingress trac.
The show monitor session session-id command displays output that indicates if a particular session is enabled for ow-
monitoring.
View ow-based monitoring
OS10# show monitor session 1
S.Id Source Destination Dir SrcIP DstIP DSCP TTL State Reason
----------------------------------------------------------------------------
1 ethernet1/1/1 ethernet1/1/4 both N/A N/A N/A N/A true Is UP
Trac matching ACL rule
OS10# show ip access-lists in
Ingress IP access-list testflow
Active on interfaces :
ethernet1/1/1
1046
Access Control Lists