Setup Guide

Enabling Flow-Based Monitoring
Flow-based monitoring is supported on the platform.
Flow-based monitoring conserves bandwidth by monitoring only specied trac instead of all trac on the interface. This feature is
particularly useful when looking for malicious trac. It is available for Layer 2 and Layer 3 ingress and egress trac. You can specify trac
using standard or extended access-lists.
1 Enable ow-based monitoring for a monitoring session.
MONITOR SESSION mode
flow-based enable
2 Dene access-list rules that include the keyword monitor. Dell Networking OS only considers port monitoring trac that matches
rules with the keyword monitor.
CONFIGURATION mode
ip access-list
For more information, see Access Control Lists (ACLs).
3 Apply the ACL to the monitored port.
INTERFACE mode
ip access-group access-list
Example of the flow-based enable Command
To view an access-list that you applied to an interface, use the show ip accounting access-list command from EXEC Privilege
mode.
DellEMC(conf)#monitor session 0
DellEMC(conf-mon-sess-0)#flow-based enable
DellEMC(conf)#ip access-list ext testflow
DellEMCconfig-ext-nacl)#seq 5 permit icmp any any count bytes monitor
DellEMC(config-ext-nacl)#seq 10 permit ip 102.1.1.0/24 any count bytes monitor
DellEMC(config-ext-nacl)#seq 15 deny udp any any count bytes
DellEMC(config-ext-nacl)#seq 20 deny tcp any any count bytes
DellEMC(config-ext-nacl)#exit
DellEMC(conf)#interface gig 1/1
DellEMC(conf-if-gi-1/1)#
ip access-group testflow in
DellEMC(conf-if-gi-1/1)#show config
!
interface GigabitEthernet 1/1
ip address 10.11.1.254/24
ip access-group testflow in
shutdown
DellEMC(conf-if-gi-1/1)#exit
DellEMC(conf)#do show ip accounting access-list testflow
!
Extended Ingress IP access list testflow on GigabitEthernet 1/1
Total cam count 4
seq 5 permit icmp any any monitor count bytes (0 packets 0 bytes)
seq 10 permit ip 102.1.1.0/24 any monitor count bytes (0 packets 0 bytes)
seq 15 deny udp any any count bytes (0 packets 0 bytes)
seq 20 deny tcp any any count bytes (0 packets 0 bytes)
DellEMC(conf)#do show monitor session 0
DellEMC(conf-mon-sess-0)#do show monitor session 0
SessID Source Destination Dir Mode Source IP Dest IP DSCP TTL Drop Rate Gre-
Protocol FcMonitor
------ ------ ----------- --- ---- --------- -------- ---- --- ---- ----
----------- ---------
Access Control Lists (ACLs)
137