Cisco Catalyst 9500

PurposeCommand or Action
Specifies a match to the transport port of the
server.
match connection server transport port
Example:
Step 10
Device(config-flow-record)# match
connection server transport port
Specifies to collect the direction — Ingress or
Egress — of the relevant side — Initiator or
collect flow direction
Example:
Step 11
Responder — of the bi-directional flow that is
Device(config-flow-record)# collect flow
direction
specified by the initiator keyword in the
collect connection initiator command in the
step below. Depending on the value specified
by the initiator keyword, the flow direction
keyword takes the following values :
• 0x01 = Ingress Flow
• 0x02 = Egress Flow
When the initiator keyword is set to initiator,
the flow direction is specified from the initiator
side of the flow. When the initiator keyword
is set to responder, the flow direction is
specified from the responder side of the flow.
For wired AVC, the initiator keyword is
always set to initiator.
Specifies to collect the time, in milliseconds,
when the first packet was seen in the flow.
collect timestamp absolute first
Example:
Step 12
Device(config-flow-record)# collect
timestamp absolute first
Specifies to collect the time, in milliseconds,
when the most recent packet was seen in the
flow.
collect timestamp absolute last
Example:
Device(config-flow-record)# collect
timestamp absolute last
Step 13
Specifies to collect the side of the flow —
Initiator or Responder — relevant to the
collect connection initiator
Example:
Step 14
direction of the flow specified by the collect
Device(config-flow-record)# collect
connection initiator
flow direction command. The initiator
keyword provides the following information
about the direction of the flow :
• 0x01 = Initiator - the flow source is the
initiator of the connection
For wired AVC, the initiator keyword is
always set to initiator.
System Management Configuration Guide, Cisco IOS XE Amsterdam 17.2.x (Catalyst 9500 Switches)
140
Configuring Application Visibility and Control in a Wired Network
Flow Record 5 - DNS Flow Record