Users Guide

ACL flow-based monitoring
Flow-based monitoring conserves bandwidth by selecting only the required flow to mirror instead of mirroring entire packets
from an interface. This feature is available for L2 and L3 ingress traffic. Specify flow-based monitoring using ACL rules.
Flow-based monitoring copies incoming packets that match the ACL rules applied on the ingress port and forwards, or mirrors
them to another port. The source port is the monitored port (MD), and the destination port is the monitoring port (MG).
When a packet arrives at a monitored port, the packet validates against the configured ACL rules. If the packet matches an
ACL rule, the system examines the corresponding flow processor and performs the action specified for that port. If the mirroring
action is set in the flow processor entry, the port details are sent to the destination port.
Flow-based mirroring
Flow-based mirroring is a mirroring session in which traffic matches specified policies that mirrors to a destination port.
Port-based mirroring maintains a database that contains all monitoring sessions, including port monitor sessions. The database
has information regarding the sessions that are enabled or not enabled for flow-based monitoring. Flow-based mirroring is also
known as policy-based mirroring.
To enable flow-based mirroring, use the flow-based enable command. Traffic with particular flows that traverse through
the ingress interfaces are examined. Appropriate ACL rules apply in the ingress direction. By default, flow-based mirroring is not
enabled.
To enable evaluation and replication of traffic traversing to the destination port, configure the monitor option using the
permit, deny, or seq commands for ACLs assigned to the source or the monitored port (MD). Enter the keywords capture
session session-id with the seq, permit, or deny command for the ACL rules to allow or drop IPv4, IPv6, ARP, UDP,
EtherType, ICMP, and TCP packets.
IPV4-ACL mode
seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte]]
[fragments] [threshold-in-msgs count] [capture session session-id]
If you configure the flow-based enable command and do not apply an ACL on the source port or the monitored port, both
flow-based monitoring and port mirroring do not function. Flow-based monitoring is supported only for ingress traffic.
The show monitor session session-id command displays output that indicates if a particular session is enabled for
flow-monitoring.
View flow-based monitoring
OS10# show monitor session 1
S.Id Source Destination Dir SrcIP DstIP DSCP TTL State Reason
----------------------------------------------------------------------------
1 ethernet1/1/1 ethernet1/1/4 both N/A N/A N/A N/A true Is UP
Traffic matching ACL rule
OS10# show ip access-lists in
Ingress IP access-list testflow
Active on interfaces :
ethernet1/1/1
seq 5 permit icmp any any capture session 1 count (0 packets)
seq 10 permit ip 102.1.1.0/24 any capture session 1 count bytes (0 bytes)
seq 15 deny udp any any capture session 2 count bytes (0 bytes)
seq 20 deny tcp any any capture session 3 count bytes (0 bytes)
Enable flow-based monitoring
Flow-based monitoring conserves bandwidth by mirroring only specified traffic, rather than all traffic on an interface. It is
available for L2 and L3 ingress and egress traffic. Configure traffic to monitor using ACL filters.
1. Create a monitor session in MONITOR-SESSION mode.
monitor session session-number type {local | rspan-source}
Access Control Lists
1451