Connectivity Guide

If you congure the flow-based enable command and do not apply an ACL on the source port or the monitored port, both ow-based
monitoring and port mirroring do not function. Flow-based monitoring is supported only for ingress trac.
The show monitor session session-id command displays output that indicates if a particular session is enabled for ow-
monitoring.
View ow-based monitoring
OS10# show monitor session 1
S.Id Source Destination Dir SrcIP DstIP DSCP TTL State Reason
----------------------------------------------------------------------------
1 ethernet1/1/1 ethernet1/1/4 both N/A N/A N/A N/A true Is UP
Trac matching ACL rule
OS10# show ip access-lists in
Ingress IP access-list testflow
Active on interfaces :
ethernet1/1/1
seq 5 permit icmp any any capture session 1
seq 10 permit ip 102.1.1.0/24 any capture session 1
seq 15 deny udp any any capture session 2
seq 20 deny tcp any any capture session 3
Enable ow-based monitoring
Flow-based monitoring conserves bandwidth by mirroring only specied trac, rather than all trac on an interface. It is available for L2
and L3 ingress and egress trac. Congure trac to monitor using ACL lters.
1 Create a monitor session in MONITOR-SESSION mode.
monitor session session-number type local
2 Enable ow-based monitoring for the mirroring session in MONITOR-SESSION mode.
flow-based enable
3 Dene ACL rules that include the keywords capture session session-id in CONFIGURATION mode. The system only
considers port monitoring trac that matches rules with the keywords capture session.
ip access-list
4 Apply the ACL to the monitored port in INTERFACE mode.
ip access-group access-list
Enable ow-based monitoring
OS10(config)# monitor session 1 type local
OS10(conf-mon-local-1)# flow-based enable
OS10(config)# ip access-list testflow
OS10(conf-ipv4-acl)# seq 5 permit icmp any any capture session 1
OS10(conf-ipv4-acl)# seq 10 permit ip 102.1.1.0/24 any capture session 1
OS10(conf-ipv4-acl)# seq 15 deny udp any any capture session 2
OS10(conf-ipv4-acl)# seq 20 deny tcp any any capture session 3
OS10(conf-ipv4-acl)# exit
OS10(config)# interface ethernet 1/1/1
OS10(conf-if-eth1/1/1)# ip access-group testflow in
OS10(conf-if-eth1/1/1)# no shutdown
View access-list conguration
OS10# show ip access-lists in
Ingress IP access-list testflow
Active on interfaces :
ethernet1/1/1
seq 5 permit icmp any any capture session 1
seq 10 permit ip 102.1.1.0/24 any capture session 1
seq 15 deny udp any any capture session 2
seq 20 deny tcp any any capture session 3
704
Access Control Lists