Configuring the EFC Module

On all supported IBM eServer xSeries devices, the EFC module is accessed through the ethernet port labeled ETH3, and optionally on the copper or fiber gigabit ethernet ports GE4 and GE5 on the x335 and labeled GE0 and GE1 on the x345.

By default, the CNA system listens for Netflow data on ETH0 and SPAN data on ETH1 on CNA systems, although you can reverse these assignments with the CLI commands monitor interface and netflow interface.

The steps needed to configure endpoint collection are as follows:

• configure IP addresses for the EFC fastethernet ports
• specify the UDP port that should be listened to for Netflow data and the router’s Netflow interface IP address
• configure access lists to filter the incoming streams for flows of interest
• configure individual active-measurement groups to accept flows and selectively turn acquired endpoints into probe targets
• enable the process

Commands used to configure EFC are:

efc enable
 
efc filter
 
efc bytes minimum
 
efc bytes top
 
efc exclude-prefix
 
efc last-update-within
 
efc source
 
ip flow export
 
module efc
 
monitor enable
 
monitor interface
 
netflow enable
 
netflow filter
 
netflow interface
 
netflow port
 
netflow source
 
resync efc filter