<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I'm having an issue trying to match traffic based on IP source of a multicast group. Traffic is flowing through a VE interface if that makes any difference. I know the traffic is actually moving because I'm watching the video broadcast on my laptop right now via VLC. I'm also seeing traffic that should match coming through the port in our sFlow monitoring system. Any suggestions would be appreciated.<div><br></div><div>Here's the ACL:</div><div><div>!</div><div>ip access-list extended internet2_in</div><div> remark deny traffic with bogus source or destination addresses</div><div> deny ip any 10.0.0.0 0.255.255.255</div><div> deny ip 10.0.0.0 0.255.255.255 any</div><div> deny ip 172.16.0.0 0.15.255.255 any</div><div> deny ip any 192.168.0.0 0.0.255.255</div><div> deny ip 192.168.0.0 0.0.255.255 any</div><div> deny ip any host 0.0.0.0</div><div> deny ip host 0.0.0.0 any</div><div> deny ip any 127.0.0.0 0.255.255.255</div><div> deny ip 127.0.0.0 0.255.255.255 any</div><div> deny ip any 192.0.2.0 0.0.0.255</div><div> deny ip 192.0.2.0 0.0.0.255 any</div><div> deny ip any 169.254.0.0 0.0.255.255</div><div> deny ip 169.254.0.0 0.0.255.255 any</div><div> remark deny all off-network SNMP access to Internal Networks</div><div> deny udp any <internal>192.0 0.0.7.255 eq snmp</div><div> deny udp any <internal>208.0 0.0.7.255 eq snmp</div><div> deny udp any <internal>192.0 0.0.7.255 eq snmp-trap</div><div> deny udp any <internal>208.0 0.0.7.255 eq snmp-trap</div><div> remark allow traffic with microsoft windows networking destination ports to storage system</div><div> permit tcp any <internal>33.240 0.0.0.15 eq loc-srv</div><div> permit udp any <internal>33.240 0.0.0.15 eq loc-srv</div><div> permit tcp any <internal>33.240 0.0.0.15 range 137 netbios-ssn</div><div> permit udp any <internal>33.240 0.0.0.15 range netbios-ns netbios-ssn</div><div> permit tcp any <internal>33.240 0.0.0.15 eq microsoft-ds</div><div> remark deny traffic with microsoft windows networking source or destination ports</div><div> deny tcp any any eq loc-srv</div><div> deny udp any any eq loc-srv</div><div> deny tcp any any range 137 netbios-ssn</div><div> deny udp any any range netbios-ns netbios-ssn</div><div> deny tcp any any eq microsoft-ds</div><div> remark prioritize traffic from NSF TV station</div><div> permit ip host 192.12.209.53 any drop-precedence-force 1 priority-force 4</div><div> permit ip any any drop-precedence-force 1 priority-force 1</div><div>!</div></div><div><br></div><div>And here's output from the show access-list accounting command after being applied for several minutes:</div><div><div> 27: permit ip host 192.12.209.53 any drop-precedence-force 1 priority-force 4</div><div> Hit count: (1 sec) 0 (1 min) 0</div><div> (5 min) 0 (accum) 0</div></div><div><br></div><div>There's no other allow ACL lines with matches but I'm receiving roughly 30-40 packets per second from the stream.</div></body></html>