Cisco Systems 5 manual

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230

Go to page of

A good user manual

The rules should oblige the seller to give the purchaser an operating instrucion of Cisco Systems 5, along with an item. The lack of an instruction or false information given to customer shall constitute grounds to apply for a complaint because of nonconformity of goods with the contract. In accordance with the law, a customer can receive an instruction in non-paper form; lately graphic and electronic forms of the manuals, as well as instructional videos have been majorly used. A necessary precondition for this is the unmistakable, legible character of an instruction.

What is an instruction?

The term originates from the Latin word „instructio”, which means organizing. Therefore, in an instruction of Cisco Systems 5 one could find a process description. An instruction's purpose is to teach, to ease the start-up and an item's use or performance of certain activities. An instruction is a compilation of information about an item/a service, it is a clue.

Unfortunately, only a few customers devote their time to read an instruction of Cisco Systems 5. A good user manual introduces us to a number of additional functionalities of the purchased item, and also helps us to avoid the formation of most of the defects.

What should a perfect user manual contain?

First and foremost, an user manual of Cisco Systems 5 should contain:
- informations concerning technical data of Cisco Systems 5
- name of the manufacturer and a year of construction of the Cisco Systems 5 item
- rules of operation, control and maintenance of the Cisco Systems 5 item
- safety signs and mark certificates which confirm compatibility with appropriate standards

Why don't we read the manuals?

Usually it results from the lack of time and certainty about functionalities of purchased items. Unfortunately, networking and start-up of Cisco Systems 5 alone are not enough. An instruction contains a number of clues concerning respective functionalities, safety rules, maintenance methods (what means should be used), eventual defects of Cisco Systems 5, and methods of problem resolution. Eventually, when one still can't find the answer to his problems, he will be directed to the Cisco Systems service. Lately animated manuals and instructional videos are quite popular among customers. These kinds of user manuals are effective; they assure that a customer will familiarize himself with the whole material, and won't skip complicated, technical information of Cisco Systems 5.

Why one should read the manuals?

It is mostly in the manuals where we will find the details concerning construction and possibility of the Cisco Systems 5 item, and its use of respective accessory, as well as information concerning all the functions and facilities.

After a successful purchase of an item one should find a moment and get to know with every part of an instruction. Currently the manuals are carefully prearranged and translated, so they could be fully understood by its users. The manuals will serve as an informational aid.

Table of contents for the manual

  • Page 1

    Americas Headquarters Cisco Systems, In c. 170 West Tasman Drive San Jose, CA 951 34-1706 USA http://www.ci sco.com Tel: 408 526-4000 800 553-NETS (638 7) Fax: 408 527-0883 Cisco Netw ork Anal ysis Module (NAM) T raf fic Analyz er User Guide, 5.0 January 20 1 1 Text Part Number: OL -22617-01[...]

  • Page 2

    THE SPECIFICATION S AND INFORMATION REGARDING TH E PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITH OUT NOTICE. ALL STATEMENTS , INFORMATION, AND RECOMMENDATI ONS IN THI S MANUAL ARE BE LIEVED TO BE A CCURATE BUT ARE PRESENTED WI THOUT WARRANTY OF ANY KIND, EX PRESS OR IMPLIED. USERS MUST TAKE FULL RESPO NSIBILITY FOR THEIR APPLICATION OF ANY PRO[...]

  • Page 3

    iii User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 CONTENTS About This Guide xi CHAPTER 1 Overview 1-1 Introducing NAM Traffic Analyzer 5. 0 1-1 Dashboards 1-2 Logical Site 1-2 New Application Classification Architecture 1-3 Standards-Based NBI 1-3 NetFlow v9 Data Export 1-4 Historical Ana lysis 1-4 SNMP v[...]

  • Page 4

    Contents iv User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Cisco WAAS NAM Virtual Service Blade 1-20 CHAPTER 2 Setting Up The NAM Traffic Analyzer 2-1 Default Functions 2-1 Traffic Analysis 2-1 Application Response Time Metrics 2-2 Voice Signaling /RTP Stream Monitoring 2-2 Traffic Usage Statistics 2-3 Tra[...]

  • Page 5

    Contents v User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Setting RTP Strea m Thresholds 2-45 Setting Voice Signaling Thresholds 2-46 Setting NDE Interface Thresholds 2-47 Editing an Alarm Threshold 2-48 Deleting a NAM Threshold 2-48 User Scenario 2-49 Data Export 2-49 NetFlow 2-49 Viewing Configured NetFlo[...]

  • Page 6

    Contents vi User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 URL-based Applicatio ns 2-71 Example 2-72 Editing a URL-Based Application 2-73 Deleting a UR L-based Ap plication 2-73 Encapsulatio ns 2-73 Monitoring 2-74 Aggregation Intervals 2-74 Response Time 2-76 Voice 2-76 RTP Filter 2-78 URL 2-78 Enabling a[...]

  • Page 7

    Contents vii User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Filtering a URL Collection List 3-14 Host Conversations 3-15 Network Conversation 3-15 Top Applicatio n Traffic 3-15 Application Traffic By Host 3-17 WAN Optimization 3-17 Top Talkers Detail 3-17 Application Performance Analysis 3-18 Transaction Ti[...]

  • Page 8

    Contents viii User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 RTP Conversatio n 3-42 CHAPTER 4 Capturing and Decoding Packet D ata 4-1 Sessions 4-2 Viewing Capture Sessions 4-3 Configuring Capture Sessions 4-4 Software Filters 4-7 Creating a Software F ilter 4-8 Editing a Software Capture Filter 4-11 Hardwa[...]

  • Page 9

    Contents ix User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Capture Data Storage 5-8 Creating NFS Storage Locations 5-9 Editing NFS Storage Locations 5-10 Creating iSCSI Storage Locations 5-11 Editing iSCSI Storage Locations 5-11 Syslog Setting 5-12 SNMP Trap Setting 5-12 Creating a NAM Trap Destination 5-12[...]

  • Page 10

    Contents x User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Understanding Traffic Patterns at the Network Layer 6-4 Understanding Traffic pattern s for DiffServ-Enabled Networks 6-4 Using NAM to Evaluate Application-Lev el Performance Monitoring for TCP-Interactiv e Applications 6-4 Using NAM to Evaluate App[...]

  • Page 11

    xi User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide This guide describes ho w to use Cisco Netw ork An alysis Module T raf f ic Analyzer 5.0 (N AM 5.0) software. This pref ace has the following sectio ns: • Chapter Over vie w , page xi • Audience, p age xii • Con ventions, page xii •[...]

  • Page 12

    xii User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide Audience This guide is designed for net work administrato rs who are responsible for setting up and configu ring Network Analy sis Modules (N AMs) to monitor traf fic and diag nose emergin g problems on netw ork segments. As a netw ork adm[...]

  • Page 13

    xiii User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide Obtaining Documentation and Submitting a Service Request For info rmation on obtaining documentation, sub mitting a service request, and gatheri ng additional information, see the mont hly What’ s New in Cisco Pr oduct Documentation , w[...]

  • Page 14

    xiv User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide[...]

  • Page 15

    CH A P T E R 1-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 1 Overview This chapter pro vides information about the Cisco Netw ork Analysis Module T raff ic Analyzer , Release 5.0 and describes the ne w features and ho w to navigate the int erface. This chapter contains t he follo wing sections: • I[...]

  • Page 16

    1-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Introducing NAM Tr affic Analyzer 5.0 Cisco N AM includes an embedded, we b-based T raffic Analyzer GUI that provides quick access to the configuration menus and presents eas y-to-read performance monitoring and analysis on web, v oice,[...]

  • Page 17

    1-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Introducing NAM Traffic Analyzer 5.0 a set of subnets specified by an address prefix and ma sk, or using other criter ia such as a remote de vice data source (for e xample, remote W AE device and se gment information). If you want to li[...]

  • Page 18

    1-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Introducing NAM Tr affic Analyzer 5.0 W ith NAM 5.0, t he NBI is expanded to inclu de a Re presentational State T ransfer (REST) web service for conf iguration, and retrie val of data pertainin g to sites. Also introduced is the capabil[...]

  • Page 19

    1-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Overview of the NAM Platforms SNMP v3 Support -- NAM to Router/Switch Support Simple Network Management Prot ocol V ersion 3 (SNMPv3) is an interoperable stand ards-based protocol for network m anagement. The sec urity features provided[...]

  • Page 20

    1-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Logging In Logging In Log into the N AM by using the username and password that the N AM installer provided you, and cl ick the Login b utton. If you are ha ving problems logging in: • Make sure you are us ing a browser that is curren[...]

  • Page 21

    1-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Monitor : See “summary” vie ws that allow you to vie w network traf fic, appli cation performance, site performance, and alarms at a glance. Analyze : See various “o ver -time” vie ws for traff ic,[...]

  • Page 22

    1-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Navigating the User Interface Context Menus On most charts that appear on the dashboards , you can left-click on a colored bar of data to get a context menu, with which you can get mor e detailed information about that it em. The exampl[...]

  • Page 23

    1-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Interactive Report On most Monitoring and Analyze scr eens, you can use the Interacti ve Re port on the left side of the screen to view and change the parameters of the in formation displayed in the charts[...]

  • Page 24

    1-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Navigating the User Interface Mouse-Over for Details When in Chart vie w , you can mouseo ver the ch art to get more detailed i nformation about what occurred at a specific time. Many of t he line charts in N AM are “dual-axis, ” m[...]

  • Page 25

    1-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Sort Grid When looking at informati on in Grid vie w , you can sort the information b y clicking the heading of any column. Click it ag ain to sort in re verse order . Bytes / Packets On most Analyze char[...]

  • Page 26

    1-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks Abov e the Statistics leg end is a dropdo wn selector , which allo ws you to choose which of the metrics sho wn in the “ov e r -time” chart you would lik e reflected in the Statistics legend. F or e[...]

  • Page 27

    1-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Understanding How the NAM Works • Adv anced T roubleshooting. The N AM provides rob u st capture a nd decode capabilities for packet traces that can be triggered or termin ated based on user-d efined thresh olds. • Open instrumenta[...]

  • Page 28

    1-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks • Understanding Ho w the NAM Uses NDE, page 1-15 • Understanding Ho w the N AM Uses W AAS, page 1-16 Understanding How the NAM Uses SPAN A switched po rt analyzer (SP AN) se ssion is an associ ation[...]

  • Page 29

    1-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Understanding How the NAM Works A V A CL can provide access control for all packets that are bridged wi thin a VL AN or that are routed into or out of a VLAN or , with Release 12.1(13)E or later releases , a W AN interface. Unlik e reg[...]

  • Page 30

    1-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks T o use an NDE data source for the N AM, you must conf igure the remote de vice to export the NDE packets. The defa ult UDP port is 3000, b ut you can configure it from th e N AM CLI as follo ws: root@n[...]

  • Page 31

    1-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Configuration Overview Configuration Overview Ta b l e 1-3 . “Confi guration Ov erview” le ads you through the basic confi guration steps you can follo w for the N AM T raff ic Analyz er 5.0. These are not necessarily in the order [...]

  • Page 32

    1-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Configuration Overview V e rify that V o ice/RTP Stream T raffi c is being gathered After the N AM T raff ic An alyzer is started, V oic e/R TP stream traffic will automatically start being monitored. The N AM enables you to monito r a[...]

  • Page 33

    1-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Configuration Overview Configuring and Viewing Data Some of the N AM 5.0 features require conf iguration of sites. A si te is a collection of hosts, or network endpoints, partition ed into vie ws that help you monitor traf fic an d tro[...]

  • Page 34

    1-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Configuration Overview Cisco WAAS NAM Virtual Service Blade T o set up the N AM T raff ic Analyzer , Release 5.0 on a Cisco W AAS N AM V irtual Service Blade, you need to foll o w these ste ps: Step 1 Confir m that you hav e completed [...]

  • Page 35

    CH A P T E R 2-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 2 Setting Up The NAM Traffic Analyzer This chapter pro vides information about functions th at will begin automati cally , and other setup tasks you will need to perform for N AM T raff ic Analyz er Release 5.0. It contains th e follo wing se[...]

  • Page 36

    2-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Default Functions Application Response Time Metrics The N AM T raff ic A nalyzer software provides response time measurements and v arious user-e xperience-related metrics, which a re computed by moni toring a[...]

  • Page 37

    2-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Traffic Usage Statistics The N AM T raff ic Analyzer provides traf fic statistic s brok en out by ap plication, host, con versation, VLAN, and DSCP code point. Summary dashboards sho w T op N charts br[...]

  • Page 38

    2-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Before you can monitor data, y ou must direct specif ic traff ic flo wing through a switch to t he N AM for monitoring purposes. Use the methods d escribed in Ta b l e 2-1 , Methods of Directing T raff[...]

  • Page 39

    2-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Ta b l e 2-3 , Acti ve SP AN Sessions Dialog , describes the fields on the SP AN Sessions screen. Note IOS supports only two SP AN sessions, but each SP AN session can ha ve more than one destination. [...]

  • Page 40

    2-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Note Deleting or editing a SP AN session that has multiple SP AN destinations will af fect all SP AN destination s. Ta b l e 2-4 lists the possible SP AN sta tes. The SP AN s tate di splays in parenthe[...]

  • Page 41

    2-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 2 Click the Cre ate bu tt o n. The Create SP AN Session Dialog displays (the f ields are described in Ta b l e 2-5 , Create SP AN Session Dialog ). Switch P ort is the default f or the SP AN T ype[...]

  • Page 42

    2-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Editing a SPAN Session Y ou can only edit SP AN sessions that have been directed to the N AM. Note This section applies to WS- SVC-N AM-1 and WS-SVC-N AM-2 devices, and the N AM 2220 and 2204 appliance[...]

  • Page 43

    2-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Deleting a SPAN Session Note This section does not apply t o NME-N AM de vices. Note Deletin g a SP AN session th at has multipl e SP AN destinations will af fect all destinations. T o delete a SP AN s[...]

  • Page 44

    2-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic The fields are e xplained in Ta b l e 2-7 , N AM Data Sources . SPAN A switched po rt analyzer (SP AN) se ssion is an associ ation of a dest ination port wi th a set of sourc e ports, confi gured with[...]

  • Page 45

    2-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic • Deleting ERSP AN Data Sources Using the W eb GUI, page 2-14 • Deleting ERSP AN Data Sources Using the CLI, page 2-15 • Config uring ERSP AN on Devices, pag e 2-16 Enabling Auto-Creation of ERS[...]

  • Page 46

    2-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic The N AM will now automatically create a ERSP AN da ta source for each device that sends ERSP AN packets to it. The da ta source will ha ve the specif ic Session ID that is populat ed by the de vice i[...]

  • Page 47

    2-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Creating ERSPAN Data Sources Using the CLI T o manually conf igure a ERSP AN data source on the N AM using the CLI (for e xample if the auto-creation feature is tur ned of f), use the follo wing steps[...]

  • Page 48

    2-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 7 Enter ? to see all the command optio ns av ailable, as in the example below: root@172-20-104-107.cisco.com(sub-data-source-erspan)# ? ? - display help cancel - discard changes and exit from sub[...]

  • Page 49

    2-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 3 Click the Delete b utton along the bottom of the windo w . Deleting ERSPAN Data Sources Using the CLI T o delete a ERSP AN data source usin g the CLI, use the follo wing steps. Note that when u[...]

  • Page 50

    2-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 4 Use the no device command to delete the de vice: root@172-20-104-107.cisco.com# no device 1 Sucessfully deleted device 1 root@172-20-104-107.cisco.com# Note that if the auto-creation mode i s o[...]

  • Page 51

    2-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic • aa.bb .cc.dd is the IP address defi ned at the destination Y ou can no w connect to the N AM to monitor and cap ture traf fic of the Data Port 2 data source. Sending ERSPAN Data Directly to the NA[...]

  • Page 52

    2-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Cat6509(config)# vlan access-map wan 100 Cat6509(config-access-map)# match ip address 100 Cat6509(config-access-map)# action forward capture Cat6509(config-access-map)# exit Cat6509(config)# vlan filt[...]

  • Page 53

    2-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic As a consumer , the N AM can receiv e NetFlow packets on its management port from devices such as Cisco routers and switches. Those records are stored in its collection database as if that traf fic ha[...]

  • Page 54

    2-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Figur e 2-2 Sample NetFlow Netw or k Ta b l e 2-8 , Reporting Flo w Records lists the reported flo ws if NetFlo w is enabled on interface a. Managing NetFlow Data Sources A data source entry must e xi[...]

  • Page 55

    2-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic For Devices Running Cisco IOS Step 1 Select the interface on which you wish to turn on routed flow cache. Prompt# configure terminal Prompt(config)# interface <type slot/port> Prompt(config-if)#[...]

  • Page 56

    2-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic • protocol-port • prefix Step 2 Enable the aggregation cache. Prompt(config-flow-cache)# enable Step 3 Export the flo w entries in the aggr egation cache to N AM UDP port 3000. Prompt(config-flow-[...]

  • Page 57

    2-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 4 Click the Submit b utton. Enabling Auto-Creation of NetFlow Da ta Sources Using the CLI Configuration of the auto-create feature is also possible using the N AM CLI. Remember that the auto-crea[...]

  • Page 58

    2-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 6 (Optional) If you kno w the specific v alue of the Engine ID on the de vice you would like to mo nitor , check the “Engine” check box, and enter the value of the Engine ID. If the “Eng in[...]

  • Page 59

    2-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Creating NetFlow Data Sources Using the CLI T o manually config ure a NetFlow data sour ce on the N AM using the CLI, for example if the auto-creation feature is turned of f, use the follo wing steps.[...]

  • Page 60

    2-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic V3 SECURITY LEVEL : No authentication, no privacy V3 AUTHENTICATION : MD5 V3 AUTH PASSPHRASE : V3 PRIVACY : DES V3 PRIV PASSPHRASE : root@172-20-104-107.cisco.com(sub-device-netflow)# Step 6 Ty p e ex[...]

  • Page 61

    2-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 13 Ty p e exit to come out of the subcommand mode and create the data sour ce: root@172-20-104-107.cisco.com(sub-data-source-netflow)# exit Data source created successfully, ID = 3 The data sourc[...]

  • Page 62

    2-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic root@172-20-104-107.cisco.com# Step 2 Use the no data-source command to de lete the dat a source: root@172-20-104-107.cisco.com# no data-source 3 Successfully deleted data source 3 root@172-20-104-107[...]

  • Page 63

    2-29 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic If the de vice is sending Net Flow V ersion 9 (V9) and the N AM has received t he NDE templates, then a V9 T emplates button appears belo w the De vice System Information windo w . Note NetFlo w v9 te[...]

  • Page 64

    2-30 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic For more inf ormation about W AAS and configuring the W AAS components, see the document: Cisco W ide Ar ea Application Services Conf iguration Guide , OL-16376-01 http://www .cisco.com/en/US/docs/app[...]

  • Page 65

    2-31 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Y ou can also conf igure a data source to use Expo rt Passthrough data. F or more information about configuring W AAS data source s, see Editing W AAS Data Source s, page 2-34 . Monitoring Client Data[...]

  • Page 66

    2-32 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Deployment Scenarios Ta b l e 2-12 , W AAS Data Source Conf igurations lists six dif fe rent deployment scenarios you might consider to monitor the optimized traf fic on your W AAS network. Scenario #[...]

  • Page 67

    2-33 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Y ou must then co nfigu re the W AAS segments you wa nt to monitor as W AAS data sources: Cli ent, Client W AN, Server W AN, and/or Server . See Ed iting W AAS Data Sources, pa ge 2-34 , for more deta[...]

  • Page 68

    2-34 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Editing WAAS Data Sources The N AM uses W AAS data sources to monitor traf fic coll ected from dif ferent W AAS segments: Client, Client W AN, Server W AN, and Server . Each W AAS segment is represent[...]

  • Page 69

    2-35 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Auto Create of New WAAS Devices If you ha ve num erous W A E de vices, you can set up the N AM to confi gure ne wly discovered W AE devices using a predefined configuratio n template usi ng the NAM Au[...]

  • Page 70

    2-36 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms The default inspects the entire p acket. The second option inspects a ll segments e xcept the ISL portion of the packet. The third op tion inspects all se gments except the ISL, MA C, and VLAN portions[...]

  • Page 71

    2-37 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note Y ou could see two alarms for the same occurrence if both the source and the destination are in the same site. When you choose Setup > Alarms > Actions , you will see e vents that have been [...]

  • Page 72

    2-38 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms T o conf igure e-mail alarm actions: Step 1 Choose Setup > Alarms > Actions . The Alarm Action page displays an y configured actions. If none of th e four actions (e-mail, trap, capture, or syslo[...]

  • Page 73

    2-39 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Step 1 Choose Setup > Alarms > Actions . The Alarm Action table displays an y configured Alarms. Step 2 Choose the alarm e vent you want to remove, and click the Delete b utton. Thresholds The N [...]

  • Page 74

    2-40 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Y ou can set up alarm thresholds b y defin ing threshold condition s for monitored v ariables on the NAM T raff ic Analyzer . Figure 2-5 shows the threshold ty pes you can configure: Figur e 2-5 Creat [...]

  • Page 75

    2-41 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 76

    2-42 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 77

    2-43 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 78

    2-44 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 79

    2-45 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 80

    2-46 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

  • Page 81

    2-47 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Step 2 Click the Cre ate but ton and choose V oice Signaling tab. Step 3 The V oice Signaling Alarm Threshold Conf iguration windo w displays. Fill in the f ields as appropriat e. Ta b l e 2-21 , V oic[...]

  • Page 82

    2-48 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 3 Cli[...]

  • Page 83

    2-49 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export User Scenario If you want t he N AM to notify you of an y violations of Response T ime metrics for a particular server , and then initiate a packet capture, complete the follo wing steps: Step 1 S[...]

  • Page 84

    2-50 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export NetFlo w collects traff ic statistics by monitoring packets that flow t hrough the de vice and storing the statistics in the NetFlo w table. NDE con verts the NetFlo w table statistics into record[...]

  • Page 85

    2-51 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export Figur e 2-6 NetFlow Expor ts Screen Already defined NetFlow Exports will be li sted on the screen. If yo u hover o ver the “quick view” arro w icon ne xt to the Record T ype, as shown in Figur[...]

  • Page 86

    2-52 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export Export Record Ty p e The record types supported b y NAM for NetFlo w are: • Applic ation • Host • AR T Client Server Application • Application Con versations • Network Con versations •[...]

  • Page 87

    2-53 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export Step 4 Click the Submit b utton t o sav e the co nfiguration, or cl ick the Reset button to clear the f ields, or click the Cancel button to e x it the screen without conf iguration. Editing NetFl[...]

  • Page 88

    2-54 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export Note W ith N AM Traf fic Analyzer 5.0, you ca n only configure one e-mail address. Step 6 Choose the deli very option (HTML or CSV). Step 7 Enter the report descript ion, which will appear at the [...]

  • Page 89

    2-55 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Managed Device Custom Export Y ou can enable Custom Expor t to send response time data to an ex ternal reporting console su ch as NetQoS SuperAgent. After you enable Custom Export, you may also want to enable[...]

  • Page 90

    2-56 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Managed Device Note For the WS-SVC-N AM-1 and WS-SVC-N AM-2 pl atforms, SNMPv3 is not requi red. SNMP requests and responses are communicated over an internal interface with in the chassis, and SNMPv3 is not [...]

  • Page 91

    2-57 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Managed Device Step 2 Click the T est Connectivity b utton to perform an SNMP t est. Click Close when f inished. Step 3 Click Submit to submit the informati on and close the windo w . NBAR Protocol Discovery [...]

  • Page 92

    2-58 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network If NB AR Protocol Discov ery is en abled, the NB AR Interfaces window lists kno w n interfaces b y name and type. Ta b l e 2-26 , NB AR Interface Details describes the f ields on the screen. T o narro[...]

  • Page 93

    2-59 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network The site definition is very flexible and c an accommoda te various scenarios. The site definition is u sed not only for vie wing of data, bu t for data export and data retention as well. Normally , a [...]

  • Page 94

    2-60 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network Specifying a Site Using Multiple Rules Y ou can def ine a site using a combination o f multiple rules described abo ve. F or example, if a site has both optimized and non-optimized traf fic, it can be[...]

  • Page 95

    2-61 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network The f ields on this sc reen are descri bed in Ta b l e 2-27 , Sites Screen . Defining a Site The “Def inition Rules” section on page 2-59 gi ves sp ecific i nformation ab out v arious sc enarios. [...]

  • Page 96

    2-62 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network See Figure 2-7 for an e xample. Figur e 2-7 Site Configuration Screen The fields are def ined below in Ta b l e 2-28 , Site Configu ration Screen Fields . Ta b l e 2-28 Sit e Configurat ion Scr een Fi[...]

  • Page 97

    2-63 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network Step 4 Click the Submit b utton. Note The “Unassigned” site (with a de sc ription of “Unclassified hosts” ) includes any that do not match any of your si te conf igurations. Sites are classifi[...]

  • Page 98

    2-64 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network NDE Interface Capacity After you ha ve set up NetFlo w data sources (see NetFlo w , page 2-18 ), you can go to th e NDE Interface Capaci ty screen at Setup > Network > NDE Interface Cap acity to[...]

  • Page 99

    2-65 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network These topics help you set up and manage the DSCP groups: • Creating a DSCP Group, page 2-64 • Editing a DSCP Group, page 2- 66 • Deleting a DSCP Group, page 2-66 Creating a DSCP Group T o create[...]

  • Page 100

    2-66 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Step 4 Click Submit to sa ve your changes, or cl ick Reset to cancel. Editing a DSCP Group T o edit a DSCP gr oup: Step 1 Choose Setup > N etwork > DSCP Gr oups . The DSCP groups windo w [...]

  • Page 101

    2-67 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification The N AM enables the selection of the "better" application identifier , wh erein "better" is def ined as the deeper inspection to be used for ap plication classification. Y [...]

  • Page 102

    2-68 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Ta b l e 2-33 , Applications describes the f ields on the Applications setup page. This section provides the follo w ing procedures: • Creating a Ne w Application, page 2-68 • Editing an Ap[...]

  • Page 103

    2-69 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification This allo ws you to configure appl ications consis tently across mult iple N A Ms, so that the same user-created application is exported with the same v alue. Step 5 Choose a protocol f amily f[...]

  • Page 104

    2-70 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification T o edit an ap plication: Step 1 Choose Setup > Classification > A pplications . Step 2 Select the applicatio n to edit, and click Edit . The Application Co nfigurati on windo w displays.[...]

  • Page 105

    2-71 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification Editing an Application Group T o edit an ap plication group: Step 1 Choose Setup > Classif ication > Applicat ion Groups . Step 2 Select the Application Group b y clicking the radio butto[...]

  • Page 106

    2-72 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Step 1 Choose Setup > Classif ication > URL-based Appl ications . Step 2 Click Cr eate . The Create URL-based Application w indow disp lays. Enter v alues in the f ields according to Ta b[...]

  • Page 107

    2-73 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification See Figure 2-9 for an example of creating a URL-based application. Figur e 2-9 Example of Cr eating a URL -Based Application Editing a URL-Based Application T o edit URL- based applic ations: S[...]

  • Page 108

    2-74 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring Encapsulations Using Encapsulati on gi ves you incr eased flexib ility when trying to mo nitor (such as counting or grouping) dif ferent types of application traf fic. The encapsu lation settings a[...]

  • Page 109

    2-75 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring • URL, page 2-78 • W AAS Monitored Servers, page 2-80 Aggregation Intervals The N AM Traf fic Analyzer has short-t erm and long-t erm aggre gation intervals (referred to as long-term reporting [...]

  • Page 110

    2-76 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring The aggreg ation interv als determine ho w much da ta can be stored in the N A M database. See Ta b l e 2-3 5 , Data Reten tion for information about data retention. Response Time T o conf igure th[...]

  • Page 111

    2-77 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring Step 5 Accept the default set tings or change the sett ings to the v alues you want to monitor . Click Submit to sav e your changes, or click Reset to cancel. Voice After you set up the N AM to mon[...]

  • Page 112

    2-78 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring Note T o report jitter and packet lo ss for the SCCP protocol, you must enable CDR on Cisco Unif ied CallManager . For more i nformation on Cisco Unifie d CallManager , see the Cisco Unified CallMa[...]

  • Page 113

    2-79 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring • Disabling a URL Coll ection Enabling a URL Collection T o enable a URL collection: Step 1 Choose Setup > Monitoring > URL. The URL screen displays. Figur e 2-1 0 URL Collection Configur a[...]

  • Page 114

    2-80 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring : Step 4 Check the Recycle Entries check box to recycle entries. Step 5 Check the check box for one of the follo wing: • Collect complete URL (Host, P ath and Arguments) • Collect Host only (i [...]

  • Page 115

    2-81 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring Disabling a URL Collection T o disable a URL collec tion: Step 1 Choose Setup > Monitoring > URL Collection . Step 2 Uncheck the En able check box . Step 3 Click Submit . WAAS Monitored Serve[...]

  • Page 116

    2-82 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring The Add W AAS Server(s) dialog box displays . Step 4 Enter the server IP address in the Serv er Address fiel d. Y ou can paste multip le IP addresses here as well. Step 5 Click Submit . Deleting a [...]

  • Page 117

    CH A P T E R 3-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 3 Monitoring and Analysis The Cisco N AM T raff ic Analyzer R elease 5.0 introduces a redesigned interface and user experience, with more intuiti ve workflo ws and interactiv e reporting capabilities. There are two types of dashboards in N AM[...]

  • Page 118

    3-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Navigation Navigation Context Menus On most of the dashboards, you can left-cl ick on the colored bar of data to get a context men u, with which you can get more detai led information about one parti cular application. Th[...]

  • Page 119

    3-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Navigation • Maximum interv al for up to 1 hour is supported for the follo wing dashboards: R TP Streams, V oice Call Statistics, Calls T ables, R TP Con versations, Host Con versations, Con versations, and Response T [...]

  • Page 120

    3-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Traffic Summary Traffic Summary The T raff ic Summary Dashboard all ows you to vie w the T op N Applications, T op N Application Groups, T op N Hosts (In and Out) , IP Distrib ution by Byt es, T op N DSCP , and T op N VLA[...]

  • Page 121

    3-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Summary T o see a chart in table format, use the “V iew as Char t / V iew as Grid” toggle b utton on the bottom right corner of the chart. Y ou can also click the “V iew as Image” b utton to vie w t[...]

  • Page 122

    3-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Site Summary Note T o change from bytes to bits, choose Administration > System > Prefer ences and change the “Data d isplayed in ” selection. Site Summary The Site Summary Dashboard (accessed by choosi ng Monit[...]

  • Page 123

    3-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Alarm Summary Note Y ou could see a count of two alarms for the same occurre nce if: - both the source and th e destination are in the same site i n the T op N Site - Host Pair chart. - both the source and the destin ati[...]

  • Page 124

    3-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Analyzing Traffic The charts av ailable under the “ Analyze” me nu show statistics that occur o ver time. Ta b l e 3-1 Field Description Site This contain site or source and destinat ion sites (sourc[...]

  • Page 125

    3-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Y ou can use the Zoom/P an feature, in which you can drag the be ginning or end to change the time interv al, as sho wn belo w . The time interval change on the zoom/p an chart wil l af fect the data p[...]

  • Page 126

    3-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Host The Host T raff ic Analysis Screen will sho w you at a qui ck glance the i nput and outpu t of a particula r host ov er time. It is av ailable under the menu option Analyze > T raffic > Host [...]

  • Page 127

    3-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic NDE Interface Traffic Analysis The NDE Interface Ana lysis page enables you to view da ta collected for indi vidual interfaces on a switch or router that is e xporting Netflo w packets to the N AM. Th[...]

  • Page 128

    3-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic • T op N Applications - Egress • To p N H o s t s - I n g r e s s • T op N Hosts - Egress • T op N DSCP Aggr - Ingress • T op N DSCP Aggr - Egress The interface speed can be entered manually t[...]

  • Page 129

    3-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Figur e 3-5 DSCP Gr oup T raffic Over Time On this screen, you will see: • T raff ic volume o ver time for the selected DSCP group • T op N applications and application groups usin g that DSCP gro[...]

  • Page 130

    3-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic URL Hits Y ou can analyze the URLs collect ed by the NAM (for setup, see URL, page 2-78 ) . This sect ion contai ns the follo wing procedures: • V iewing Collected U RLs • Filtering a URL Collecti o[...]

  • Page 131

    3-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Host Conversations If you choose Analyze > T r affi c > Detailed V iews > Hos t Con versations , and click on “Host” in the host cov ersation tables, you can se e detailed lists of all th[...]

  • Page 132

    3-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Applications Ov er T ime, as shown in Figure 3- 7 , will show you all of the applications that ha ve been running for the time p eriod interv al. The color -coded legend sho ws you what the applications[...]

  • Page 133

    3-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis WAN Optimization Application Traffic By Host When you choose Analyze > T raffic > Detailed V iews > Application T raffic By Hosts , you will see the traff ic for a giv en application broken out by individual ho[...]

  • Page 134

    3-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis WAN Optimization Application Performance Analysis T o analyze the W AAS traff ic, c hoose Analyze > W AN Optimization > A pplication Perf ormance Analysis . The charts av ailable on this page are: • T ransaction [...]

  • Page 135

    3-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Response Time The N AM T raf fic Analyzer monitors TCP packet flo w between clie nt an d server , and measure s response time data to pro vide more visibility into appli cation response times (AR T) and ne[...]

  • Page 136

    3-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Figur e 3-1 1 T ransaction Time versus Response Time Measurements Ta b l e 3-7 lists and describes the AR T metrics measured b y N AM 5.0. Client request Ser ver response Application response time T otal t[...]

  • Page 137

    3-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Number of unresponsi ve connections Number o f TCP connection requ ests (SYN) that are not respond ed during the monitoring interv al Number of refused connections Number of TCP connection requ ests (SYN) [...]

  • Page 138

    3-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Application Response T ime Metrics are a vailabl e on the response Response T i me Summary Dashboard ( Monitor > Response Time Summary ), which allo ws you to see a “summary” vie w of the data. T o [...]

  • Page 139

    3-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Note If you do not specify any ap plication, the chart wil l sho w the network time instead of tr ansaction time. The Other Metrics chart allows you to see informat ion about th e network link b etween sit[...]

  • Page 140

    3-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Ta b l e 3-8 , Server Appl ication Responses Metrics , pro vides definitions of each f ield of the Server Application Responses windo w . Server Application Transactions The Server Appli cation T ransactio[...]

  • Page 141

    3-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

  • Page 142

    3-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

  • Page 143

    3-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Client-Server Application Transactions The Client-Server Application T ransactions window provides a summary o f the server applicat ion transaction response ti mes (AR T ) per serv er application displayi[...]

  • Page 144

    3-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

  • Page 145

    3-29 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device T o view the Client-Server Netw ork Responses windo w , choose Analyze > Response Ti me > Detailed V iew s > Client-Server Network Responses . N AM uses the TCP three-way handshake to calcu late [...]

  • Page 146

    3-30 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device • Health, page 3-3 1 • NB AR, page 3-37 Interface Interfaces Stats Table T o view packet distrib ution details on the interfaces, choose An alyze > Managed Device > Interfa ce . The Interfaces St[...]

  • Page 147

    3-31 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Interface Statistics Over Time When you select an interface in the Interface Stats T abl e, the statistics for that interf ace will be graphed in the area below , as shown in Figure 3-13 . Figur e 3-13 In[...]

  • Page 148

    3-32 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Chassis Health The Chassis Health windo w displays two real-time grap hs: CP U usage and Backplane U tilization. CPU usage CPU type • Usage for last 1 minute (%) • Usage for last 5 minutes (%) Backplan[...]

  • Page 149

    3-33 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Crossbar Switching Fabric This option sho ws the Crossbar Switching F abric information. UpT ime The time (in hundredths of a second) since the network management portion of the system wa s last re-initia[...]

  • Page 150

    3-34 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Ternary Content Addressable Memory Informatio n Sho ws the T ernary Content Addressable Memory ( TCAM) usage informatio n. Ta b l e 3-18 lists and describes the TC AM information. Ta b l e 3-17 Crossbar Sw[...]

  • Page 151

    3-35 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Router Health If your de vice is a router , the Router Health windo w displays with a drop -do wn box that provi des the follo wing options: • Router Health, page 3-35 • Router Information, page 3-36 [...]

  • Page 152

    3-36 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Router Information The Router Informat ion windo w displays rout er information. Ta b l e 3-20 lists and describes the f ields of the Router Informat ion windo w . T emper ature Status The current state of[...]

  • Page 153

    3-37 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media NBAR Y ou can use the N AM Tr af fic An alyzer to vie w Network Based Application Recognit ion (NB AR) data. T o view the NB AR data collected for a switch or router , select Analyze > Managed D evice > NB A[...]

  • Page 154

    3-38 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media RTP Streams Purpose The R TP Streams w indo w shows y ou three pieces of information: RTP Stream Information • Source IP Address and Port: IP ad dress and UDP port of the originator o f the R TP stream. • Desti[...]

  • Page 155

    3-39 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media RTP Stream Stats Details This table shows the per-interval stats calculated by N AM at each interval. The columns of the tables are: • Report T ime: time when the stats were calcul ated. This is the end time of [...]

  • Page 156

    3-40 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media • V oice Call Statistics : Number of calls per signali ng protocol (SCC P , SIP , MGCP , and H.323) at each interv al during the selected in terval . • T op N End Points by Jitter (ms) : Endp oints that ha ve t[...]

  • Page 157

    3-41 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media If you click on a call ro w in the table, in the R TP Streams for the Select ed Call display at the bottom of the page you will see all streams that are associated with the call. It will display the R TP streams t[...]

  • Page 158

    3-42 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media Y ou can see more detailed in formation about each R TP stream by selectin g the R TP stream and clicking on the RT P S t r e a m D e t a i l s bu tton. A pop up wi ndo w will sho w more detailed information of th [...]

  • Page 159

    3-43 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media SSRC Synchronization sour ce number as it appear in the R TP header Duration Weighted MOS N AM calc ulated score that takes into account of the duration of the stream T able 3-23 RTP Con versations T able (continu[...]

  • Page 160

    3-44 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media[...]

  • Page 161

    CH A P T E R 4-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 4 Capturing and Decoding Packet Data The Capture feature of the NAM T raff ic Analyzer allo ws you to set up multiple sessions for capturing, filt ering, and decoding pack et data, manage the data in a fil e control system, and display the co[...]

  • Page 162

    4-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Figur e 4-1 Quic k Captur e Sessions The purpose of Ca pture Sessions is t o capture, filter , a nd decode packet da ta, manage the d ata in a file control system, and display the cont ents of the pack[...]

  • Page 163

    4-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Figur e 4-2 NAM Captur e Sessions This section contains the following subjects: • V iewing Capture Sessions, page 4-3 • Config uring Capture Sessions, page 4-4 • Software Filters, page 4-7 View[...]

  • Page 164

    4-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Ta b l e 4-2 , Buttons in th e Capture Session Operations Windo w describes the operations that you can perform from the Capture Sessi ons window . Configuring Capture Sessions Y ou can conf igure up t[...]

  • Page 165

    4-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Figur e 4-3 Configure Captur e Sessi on Window Step 3 Enter information in t he Capture Settings Fields ( Ta b l e 4-3 ) as ap propriate. Ta b l e 4-3 Captur e Settings Fields Field Description Usage[...]

  • Page 166

    4-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Ta b l e 4-4 lists the hardware platforms N AM 5.0supports and their maximum session si ze. This is the maximum capture memory b uffer size for all capture session s together , not individ ually . Stor[...]

  • Page 167

    4-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s When capturing to multip le files, a suff ix is added to the f ile name. For e xample, the f irst file for a capture named Captur eA would be labeled as Capt ureA_1 the second Captur eA_2 , and so on[...]

  • Page 168

    4-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Creating a Software Filter Y ou can def ine a software f ilter to filter based on any o f the follo wing: • Source host address • Destination host address • Network enc apsulation • VLAN or VLA[...]

  • Page 169

    4-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Ta b l e 4-5 Softwar e Filter Dialog Bo x Field Description Usage Notes Name Enter a name of the ne w filter . Source Address / Mask Source address of the packets. • For IP , IPIP4, GRE.IP , or GTP[...]

  • Page 170

    4-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Destination Address / Mask Destination address of the packets. • F or IP , IPIP4, GRE.IP , or GTP .IPv4 addresses, enter a valid IPv4 address in dotted-quad form at n.n.n.n, where n is 0 to 255. The[...]

  • Page 171

    4-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Note The parameters described in the table abov e are independently ev aluated by the N AM. Therefore, the N AM will allo w you to enter parame ters that are contradictory , but you will not be able[...]

  • Page 172

    4-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions • T o cancel the changes, click Cancel . Hardware Assisted Filters Hardware Assisted Capture enables you to improv e capture performance by providing hardwa re-specific filt ers to help you elimin a[...]

  • Page 173

    4-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s The list is also shown in Figure 4-5 . Figur e 4-5 Hardw are Filt er T ype Step 5 Data fields will then appear that correspond with th e type of hardw are filt er you selected. Fill in the desired f[...]

  • Page 174

    4-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Step 7 Click Submit . IP T o configure an IP hardw are filter: Step 1 Enter a Filter N ame. Step 2 From the T ype drop-down menu , choose IP . Step 3 Enter a Source Address / Mask (optional). Step 4 E[...]

  • Page 175

    4-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files • Enter a Mask of up to four b ytes (eight hex charact ers). Step 7 Repeat Step 6 for up to four payload dat a segments. Note Only one payload seg ment (one ro w) is required. Be careful not to create[...]

  • Page 176

    4-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Files • Name: • Size: • Date: • State: • Location: If you are using a Cisco 2200 Ser ies appliance, the N AM will create a xxx.pcap f ile. If you click on the do wnload b utton, a xxx.pcap f ile wi l[...]

  • Page 177

    4-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files Note Capture files on the NAM 2200 Series appliances ar e stored in nati ve N AM format. Y ou can con vert the capture file format to .pcap using the Conv ert/Rename/Merge button on the Capture > P a[...]

  • Page 178

    4-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Files The Error Scan screen is sho w n in Figure 4-6 . Figur e 4-6 Er ror Scan Scr een The fields are described in Ta b l e 4-8 . Downloading Capture Files The follo wing procedure describes ho w to do wnload [...]

  • Page 179

    4-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files Step 2 Choose a capture file from the list of captures. Step 3 Click Download . A File Download dialog box displays and asks “ Do you want to sa ve this f ile? ” Figur e 4-7 Download Capture File Di[...]

  • Page 180

    4-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Step 3 Click the Delete b utton. A dialog box displays and asks “ Delete all captur e file(s)? ” Step 4 Click OK to delete all the f iles or Cancel to allo w them to rema[...]

  • Page 181

    4-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Ta b l e 4-10 describes the columns displayed in the pack et browser pane. Browsing Packets in the Packet Decoder Y ou can use t he packet brows er to bro wse the list o f ca[...]

  • Page 182

    4-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information – Destinatio n allows y ou to specify the destinati on address, or lea ve it bl ank if not applicab le. – Both Directions allo ws you to match of packets tra velling in b[...]

  • Page 183

    4-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information • T o adjust the s ize of an y of the panes , click and drag the pane frame up or do wn. Using Alarm-Triggered Captures Y ou can con figure multip le alarm-tr iggered cap t[...]

  • Page 184

    4-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Ta b l e 4-1 1 Custom Decode Filter Dialog Bo x Field Description Usage Notes Filter Name The name of the capture filter . Enter the name of the filt er to be created. Descri[...]

  • Page 185

    4-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Step 4 Do one of the foll ow ing: • T o create the fi lter , click Submit . • T o cancel filter creation, click Cancel . Tips for Creating Custom Decode Filt er Expressio[...]

  • Page 186

    4-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Examples of Custom Decode Filter Expressions • T o match SNMP packets from 111.122.133.1 44, enter: snmp and (ip.src == 111.122.133.144) • T o match IP packets from the 1[...]

  • Page 187

    4-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Step 4 Do one of the foll ow ing: • T o apply the ch anges, clic k Submit . • T o clear the page of your changes, click Reset . • T o exit the page without ap plying th[...]

  • Page 188

    4-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information[...]

  • Page 189

    CH A P T E R 5-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 5 User and System Administration This chapter pr ovides infor mation about performing u s er and system administration tasks and generating diagnostic informat ion for obt aining technical assistance. This chapter contains t he follo wing sec[...]

  • Page 190

    5-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Resources Choose Administration > System > Resources to vie w the System Overvie w windo w . Ta b l e 5-1 describes the f ields of the System Overvie w windo w for a N AM Traf fic Analy[...]

  • Page 191

    5-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Note N AM 5.0 does not supp ort using IPv6 for the n etwork parameter IP add ress. Step 3 Do one of the foll ow ing: • T o sav e the changes, click Submit . • T o cancel the changes, cli[...]

  • Page 192

    5-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration T o view and set the N AM SNMP Agent: Step 1 Choose Administration > System > SNMP Agent . Step 2 Enter or change the infor mation on the N AM SNMP screen. The fields are detailed in Ta[...]

  • Page 193

    5-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Deleting NAM Community Strings T o delete the N AM community strings: Step 1 Choose Administration > System > SNMP Agent . At the botto m of the window , th e N AM Community Strings Di[...]

  • Page 194

    5-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration • Cisco 2200 Series appliances ca n get their time from a local CLI clock set command. Caution Both the client computer and the N AM server must ha ve the ti me set accurately for their res[...]

  • Page 195

    5-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Step 6 Do one of the foll ow ing: • T o sav e the changes click Submit . • T o leav e the configuration unchanged, choose Reset . Configuring the NAM System Time with an NTP Server T o c[...]

  • Page 196

    5-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 7 Click Submit to sa ve your mo difications, or click Reset to clear the dialog of any characters you entered or restore the pre vious settings. Web Data Publication W eb Data Publicatio[...]

  • Page 197

    5-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion • Creating iSCSI Storage Locations, page 5-11 • Editing iSCSI Storag e Locations, page 5-11 Creating NFS Storage Locations The NFS server must be conf igured properly to al lo w NAM to w[...]

  • Page 198

    5-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 4 Click Submit to create the NFS storage location. Othe rwise click Reset to remo ve your entr ies or Cancel to cancel the chan ge. Editing NFS Storage Locations The follo wing procedur[...]

  • Page 199

    5-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Creating iSCSI Storage Locations The follo wing procedure describes ho w to create an iSCSI storage l ocation for storing N AM capture data. Step 1 Choose Administration > System > Ca[...]

  • Page 200

    5-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 4 Click Submit to change the iSCSI storage lo cation parameters. Otherwise click Re set to remov e your entries or Cancel to cancel the change. Note Before the changes to the iSCSI stor[...]

  • Page 201

    5-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Step 2 Click the Cre ate bu tt o n. Step 3 In the “Community” f i eld, enter the community stri ng set in the N AM Thresholds. Step 4 In the “IP Address” field, enter the IP address[...]

  • Page 202

    5-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration Diagnostics Diagnostics The Diagnostics option of the Administration menu pro vides tools to aid in tro ubleshooting. Y ou can use these tools when you have a problem that might require assistance from the Cisco T[...]

  • Page 203

    5-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration Diagnostics • User ID • T ime stamp • IP address (in case of remote web access) • Acti vity description T o access the audit trail window: Step 1 Choose Administration > Diagnostics > A udit T rail .[...]

  • Page 204

    5-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration User Administration The User Administration optio n of the Administration menu provides the fol lowin g options: • Local Databa se, page 5-16 • Establishing T A CA CS+ Authentication and Au[...]

  • Page 205

    5-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration For info rmation on resetting t he N AM passwords on 6500 Series N A Ms, see Catalyst 6500 Se ries Switch and Cisco 7600 Series Internet Router Network Analysis Mod ule Installation and Con fig[...]

  • Page 206

    5-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Usernames and passwords cannot exceed 32 characters and can be alphanumeri c. The follo wing special characters are not allowed: '!' '@' '#' '$' '%&[...]

  • Page 207

    5-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration Step 2 Select the username. Step 3 Click Delete . Note If you delete user acco unts while users are logged in , they remain logged in and retain their pri vileges. The session remains in ef fec[...]

  • Page 208

    5-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Step 3 Do one of the foll ow ing: • T o sav e the changes, click Submit . • T o cancel, clic k Reset . Ti p If you cannot log into the N AM T raff ic Analyzer with T A CACS+ con figur ed, v[...]

  • Page 209

    5-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration Adding a NAM User or User Group T o add a N AM user or user group: Step 1 Click User Setup . Step 2 Enter the user login name. Step 3 Click Add/Edit . Step 4 Enter the user data . Step 5 Select[...]

  • Page 210

    5-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Current User Sessions The Current User Sessions table is a record of the users who are logged into the application. The user session times out after 30 minut es of inacti vity . After a user se[...]

  • Page 211

    CH A P T E R 6-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 6 NAM Traffic Analyzer 5.0 Usage Scenarios This chapte r describes usag e scenarios for t he Ci sco Network Analysis Module T raff ic Analyzer, Release 5.0. This chapter contains the following sections: Deployment • Deploying NAMs in the Br[...]

  • Page 212

    6-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Deployment Deployment Deploying NAMs in the Branch A N AM T raff ic Analyz er deployed in the b ranch will provide a de tailed view of the traff ic traversing to and from the branch. The N A M can monitor [...]

  • Page 213

    6-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Deployment See related content Data Export , NetFlow , page 2-49 . Autodiscovery Capabilities of NAM If you ar e an e xisting N AM 4.x user , you will not need t o conf igure the SP AN sessions, and the y[...]

  • Page 214

    6-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Monitoring Integrating NAM with LMS The N AM Traf fic Analyz er GUI can be placed on the LMS (LAN Management Suite) 4.0 dashboard and accessed thru the LMS GUI. See technic al documentation for LMS on http[...]

  • Page 215

    6-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Troubleshooting Using NAM to Evaluate Application-Level Performance Monitoring for UDP Realtime Applications The N AM Traf fic Analyzer monitors R TP streams: Wh en a phone call ends, th e endpoints calcu[...]

  • Page 216

    6-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Troublesho oting If the alarm is for an Application Response T ime issue, you can access Monitor > Response Time Summary or Analyze > Response Time > A pplication to drill-do wn on what hosts are [...]

  • Page 217

    A-1 User Guide for the Cisco Network Analysis Module Traffic Analyzer, 4.1 OL-19530-02 APPENDIX A Troubleshooting This appendix addresses some co mmon issues you might encounter wh ile using N AM Traf fic Analyzer 5.0. It contains th e follo wing sections: • General NAM Issues, page A-1 • Error Messages, page A-2 • Packet Drops, page A-2 • [...]

  • Page 218

    A-2 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troublesho oting Error Messages Error Messages Q. I’m waiting fo r the graphical data to populat e on a dashboard. What does this red er ror “Request Error -- Please T ry Again” mean? A. This means an inter nal error has occurred, or the login [...]

  • Page 219

    A-3 User Guide for the Cisco Network An alysis Module Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troubleshooting NAM Behavior • Does a ping to N AM mgmt IP address work? • What is the module status on Sup/router? show modules CLI NAM Behavior Q. Why is the bro w ser beha ving strangely? It is displaying data for no apparent reason. A. Clear t[...]

  • Page 220

    A-4 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troublesho oting WAAS Troubleshooting[...]

  • Page 221

    B-1 User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 OL-22617-01 APPENDIX B Supported MIB Objects Supported MIBs Ta b l e B - 1 lists the MIB objects supported by the superv isor engine and the N AM. T able B-1 Sup ervisor Engine Modul e and NAM RMON Support Module Object Identifier (OID) and Description Source Supervisor Engi[...]

  • Page 222

    B-2 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 5.0 OL-22617-01 Appendix B Sup ported MIB Objects Supported MIBs Supervisor Engine ...mib-2(1).rmon(16).tok enRing(10 ).ringStation ControlT able(1) ...mib-2(1).rmon(16).tok enRing(10 ).ringStation Ta b l e ( 2 ) ...mib-2(1).rmon(16).tok enRing(10 ).ringStation OrderT able(3) [...]

  • Page 223

    B-3 User Guide for the Cisco Network An alysis Module Traffic Analyzer, 5.0 OL-22617-01 Appendix B Supported MIB Objects Supported M IBs Supervisor Engine ...cisco(9).workgroup(5).cis coStackMIB(1).ciscoStatck MIBConformance(31).cisc oStati cMIBGroups(20. chassisGroup(3) CISCO-ST A CK-MIB Collection of object s providing i nformation about the chas[...]

  • Page 224

    B-4 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 5.0 OL-22617-01 Appendix B Sup ported MIB Objects Supported MIBs[...]

  • Page 225

    IN-1 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 INDEX A administration (see system administr ation) 5-1 alarm thresholds, setting NAM thresholds 2-39 deletin g 2-48 editing 2-48 switch thresh olds 2-49 syslog, setting up 5-12 ART 3-24, 3-27 Audit trail 5-14 C capture error scan 4-17 Capture bu ffer max[...]

  • Page 226

    Index IN-2 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 protocol 2-68 SPAN sessions 2-6 Custom captu res 4-8 custom display filt ers, managing creating 4-23 deletin g 4-27 editing 4-26 setting up 4-23 D dashboards Alarm Summary 3-6 overview 1-2 Performance Overview 3-5 Response Time Summary 3-5 Traffic A[...]

  • Page 227

    Index IN-3 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 sending data directly t o NAM 2-17 External reporting console 2-55 F Filtering audit trail 5-15 IP 4-14 IP and Payload Data 4-14 IP and TCP/UDP 4-14 Payload data 4-15 VLAN and IP 4-13 Filter Response Time for all D ata Sources by Monitored Servers 2[...]

  • Page 228

    Index IN-4 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 NetFlow configuring on devices 2-20 Cisco IOS 2-21 multi-layer switching cache 2-21 NAMs in a device slot 2-22 NDE export 2-22 NDE v8 aggregations 2-21 devices, mana ging testing 2-28 exporting da ta 1-15 interfaces, understanding 2-19 records, unde[...]

  • Page 229

    Index IN-5 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 methods (table) 2-4 NetFlow, configu ring on devices 2-20 Cisco IOS 2-21 multi-layer switching cache 2-21 NAMs in a device slot 2-22 NDE export 2-22 NDE v8 aggregations 2-21 NetFlow devices, managing testing 2-28 SPAN session creating 2-6 deletin g [...]

  • Page 230

    Index IN-6 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 V VACL 1-14, 2-17 VLAN access control list 1-14, 2-17 VACL, configuring on LAN VLANs 2-18 on WAN interfaces 2-17 viewing community switch strings 5-5 DiffServ data 3-12 NAM SNMP system groups 5-3 network parameters 5-2 response time data server 3-25[...]