You can activate flow-based monitoring for a monitoring session by entering the
flow-based enable
command in the Monitor Session mode. When you enable
this capability, traffic with particular flows that are traversing through the ingress
and egress interfaces are examined and, appropriate ACLs can be applied in both
the ingress and egress direction. Flow-based monitoring conserves bandwidth by
monitoring only specified traffic instead all traffic on the interface. This feature is
particularly useful when looking for malicious traffic. It is available for Layer 2 and
Layer 3 ingress and egress traffic. You may specify traffic using standard or
extended access-lists. This mechanism copies all incoming or outgoing packets on
one port and forwards (mirrors) them to another port. The source port is the
monitored port (MD) and the destination port is the monitoring port (MG).
Related
Commands
deny
— assigns a IP ACL filter to deny IP packets.
ip access-list standard
— creates a standard ACL.
seq
Assign a sequence number to a deny or permit filter in an extended IP access list while creating the filter.
Syntax
seq
sequence-number
{deny | permit} {source [
mask
] | any | host
ip-address
}} [count [byte] [dscp
value
] [order] [fragments]
[log [interval
minutes
] [threshold-in-msgs [
count
] [monitor]
Parameters
sequence-
number
Enter a number from 0 to 4294967290. The range is from 0
to 65534.
deny
Enter the keyword
deny
to configure a filter to drop packets
meeting this condition.
permit
Enter the keyword
permit
to configure a filter to forward
packets meeting this criteria.
source
Enter an IP address in dotted decimal format of the network
from which the packet was received.
mask
(OPTIONAL) Enter a network mask in /prefix format (/x) or
A.B.C.D. The mask, when specified in A.B.C.D format, may be
either contiguous or non-contiguous.
any
Enter the keyword
any
to specify that all routes are subject
to the filter.
count
(OPTIONAL) Enter the keyword
count
to count packets the
filter processes.
byte
(OPTIONAL) Enter the keyword
byte
to count bytes the filter
processes.
dscp
(OPTIONAL) Enter the keyword
dcsp
to match to the IP
DCSCP values.
152
Access Control Lists (ACL)
