OS10 Enterprise Edition User Guide Release 10.4.0E(R3)


ACL flow-based monitoring

Flow-based monitoring conserves bandwidth by selecting only the required flow to be mirrored instead of mirroring entire packets from an interface. This feature is available for L2 and L3 ingress traffic. Specify flow-based monitoring using ACL rules. Flow-based monitoring copies incoming packets that match the ACL rules applied on the ingress port and forwards (mirrors) them to another port. The source port is the monitored port (MD), and the destination port is the monitoring port (MG).

When a packet arrives at a monitored port, the packet validates against the configured ACL rules. If the packet matches an ACL rule, the system examines the corresponding flow processor and performs the action specified for that port. If the mirroring action is set in the flow processor entry, the port details are sent to the destination port.

Flow-based mirroring

Flow-based mirroring is a mirroring session in which traffic matches specified policies that are mirrored to a destination port. Port-based mirroring maintains a database that contains all monitoring sessions, including port monitor sessions. The database has information regarding the sessions that are enabled or not enabled for flow-based monitoring. Flow-based mirroring is also known as policy-based mirroring.

To activate flow-based mirroring, use the flow-based enable command. Traffic with particular flows that are traversing through the ingress interfaces are examined. Appropriate ACL rules apply in the ingress direction. By default, flow-based mirroring is not enabled.

To enable the evaluation and replication of traffic traversing to the destination port, configure the monitor option with the permit, deny, or seq commands for ACLs assigned to the source or the monitored port (MD). Enter the keywords capture session session-id with the seq, permit, or deny command for the ACL rules to allow or drop IPv4, IPv6, ARP, UDP, EtherType, ICMP, and TCP packets.

IPV4-ACL mode

seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte]] [fragments] [threshold-in-msgs count] [capture session session-id]

If you configure the flow-based enable command and do not apply an ACL on the source port or the monitored port, both flow-based monitoring and port mirroring do not function. Flow-based monitoring is supported only for ingress traffic.

The show monitor session session-id command displays output which indicates if a particular session is enabled for flow-monitoring.

View flow-based monitoring

OS10# show monitor session 1
                                 S.Id  Source        Destination    Dir  SrcIP  DstIP  DSCP  TTL  State Reason
                                 1    ethernet1/1/1  ethernet1/1/4  both  N/A   N/A    N/A  N/A  true   Is UP

Traffic matching ACL rule

OS10# show ip access-lists in
                                 Ingress IP access-list testflow
                                 Active on interfaces :
                                 seq 5 permit icmp any any capture session 1 
                                 count (0 packets)
                                 seq 10 permit ip any capture session 1 
                                 count bytes (0 bytes)
                                 seq 15 deny udp any any capture session 2 
                                 count bytes (0 bytes)
                                 seq 20 deny tcp any any capture session 3 
                                 count bytes (0 bytes)

Rate this content

Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\