FTOS Configuration Guide for the C-Series - Force10 Networks

Command Syntax Command Mode Purpose
{deny | permit} udp {source mask | any | host
ip-address} [operator port [port]] {destination
mask | any | host ip-address} [operator port
[port]] | log]
Figure 84 illustrates a Trace list in which the sequence numbers were assigned by the software. The filters
were assigned sequence numbers based on the order in which they were configured (for example, the first
filter was given the lowest sequence number). The show config command in the TRACE LIST mode
displays the two filters with the sequence numbers 5 and 10.
Figure 84 Trace list Example
To view all configured Trace lists and the number of packets processed through the Trace list, use the show
ip accounting trace-list command (Figure 83) in the EXEC privilege mode.
Applying trace lists
After you create a Trace list, you must enable it. Without enabling the Trace list, no traffic is filtered.
You can enable one Trace list.
TRACE LIST Configure a deny or permit filter to
examine UDP packets. Configure the
following required and optional
parameters:
• source: An IP address as the
source IP address for the filter to
match.
• mask: a network mask
• any: to match any IP source
address
• host ip-address: to match IP
addresses in a host.
• destination: An IP address as the
source IP address for the filter to
match.
• precedence precedence range: 0 to
7.
• tos tos-value range: 0 to 15
• count: count packets processed by
the filter.
• byte: count bytes processed by the
filter.
• log: is supported.
Force10(config-trace-acl)#deny tcp host 123.55.34.0 any
Force10(config-trace-acl)#permit udp 154.44.123.34 0.0.255.255 host 34.6.0.0
Force10(config-trace-acl)#show config
!
ip trace-list nimule
seq 5 deny tcp host 123.55.34.0 any
seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.0
172 Security