Cisco Systems NAM manual

Americas Headquarters Cisco Systems, In c. 170 West Tasman Drive San Jose, CA 951 34-1706 USA http://www.ci sco.com Tel: 408 526-4000 800 553-NETS (638 7) Fax: 408 527-0883 Cisco Netw ork Anal ysis Module (NAM) T raf fic Analyz er User Guide, 5.0 January 20 1 1 Text Part Number: OL -22617-01[...]

THE SPECIFICATION S AND INFORMATION REGARDING TH E PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITH OUT NOTICE. ALL STATEMENTS , INFORMATION, AND RECOMMENDATI ONS IN THI S MANUAL ARE BE LIEVED TO BE A CCURATE BUT ARE PRESENTED WI THOUT WARRANTY OF ANY KIND, EX PRESS OR IMPLIED. USERS MUST TAKE FULL RESPO NSIBILITY FOR THEIR APPLICATION OF ANY PRO[...]

iii User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 CONTENTS About This Guide xi CHAPTER 1 Overview 1-1 Introducing NAM Traffic Analyzer 5. 0 1-1 Dashboards 1-2 Logical Site 1-2 New Application Classification Architecture 1-3 Standards-Based NBI 1-3 NetFlow v9 Data Export 1-4 Historical Ana lysis 1-4 SNMP v[...]

Contents iv User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Cisco WAAS NAM Virtual Service Blade 1-20 CHAPTER 2 Setting Up The NAM Traffic Analyzer 2-1 Default Functions 2-1 Traffic Analysis 2-1 Application Response Time Metrics 2-2 Voice Signaling /RTP Stream Monitoring 2-2 Traffic Usage Statistics 2-3 Tra[...]

Contents v User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Setting RTP Strea m Thresholds 2-45 Setting Voice Signaling Thresholds 2-46 Setting NDE Interface Thresholds 2-47 Editing an Alarm Threshold 2-48 Deleting a NAM Threshold 2-48 User Scenario 2-49 Data Export 2-49 NetFlow 2-49 Viewing Configured NetFlo[...]

Contents vi User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 URL-based Applicatio ns 2-71 Example 2-72 Editing a URL-Based Application 2-73 Deleting a UR L-based Ap plication 2-73 Encapsulatio ns 2-73 Monitoring 2-74 Aggregation Intervals 2-74 Response Time 2-76 Voice 2-76 RTP Filter 2-78 URL 2-78 Enabling a[...]

Contents vii User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Filtering a URL Collection List 3-14 Host Conversations 3-15 Network Conversation 3-15 Top Applicatio n Traffic 3-15 Application Traffic By Host 3-17 WAN Optimization 3-17 Top Talkers Detail 3-17 Application Performance Analysis 3-18 Transaction Ti[...]

Contents viii User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 RTP Conversatio n 3-42 CHAPTER 4 Capturing and Decoding Packet D ata 4-1 Sessions 4-2 Viewing Capture Sessions 4-3 Configuring Capture Sessions 4-4 Software Filters 4-7 Creating a Software F ilter 4-8 Editing a Software Capture Filter 4-11 Hardwa[...]

Contents ix User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 Capture Data Storage 5-8 Creating NFS Storage Locations 5-9 Editing NFS Storage Locations 5-10 Creating iSCSI Storage Locations 5-11 Editing iSCSI Storage Locations 5-11 Syslog Setting 5-12 SNMP Trap Setting 5-12 Creating a NAM Trap Destination 5-12[...]

Contents x User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Understanding Traffic Patterns at the Network Layer 6-4 Understanding Traffic pattern s for DiffServ-Enabled Networks 6-4 Using NAM to Evaluate Application-Lev el Performance Monitoring for TCP-Interactiv e Applications 6-4 Using NAM to Evaluate App[...]

xi User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide This guide describes ho w to use Cisco Netw ork An alysis Module T raf f ic Analyzer 5.0 (N AM 5.0) software. This pref ace has the following sectio ns: • Chapter Over vie w , page xi • Audience, p age xii • Con ventions, page xii •[...]

xii User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide Audience This guide is designed for net work administrato rs who are responsible for setting up and configu ring Network Analy sis Modules (N AMs) to monitor traf fic and diag nose emergin g problems on netw ork segments. As a netw ork adm[...]

xiii User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide Obtaining Documentation and Submitting a Service Request For info rmation on obtaining documentation, sub mitting a service request, and gatheri ng additional information, see the mont hly What’ s New in Cisco Pr oduct Documentation , w[...]

xiv User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 About This Guide[...]

CH A P T E R 1-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 1 Overview This chapter pro vides information about the Cisco Netw ork Analysis Module T raff ic Analyzer , Release 5.0 and describes the ne w features and ho w to navigate the int erface. This chapter contains t he follo wing sections: • I[...]

1-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Introducing NAM Tr affic Analyzer 5.0 Cisco N AM includes an embedded, we b-based T raffic Analyzer GUI that provides quick access to the configuration menus and presents eas y-to-read performance monitoring and analysis on web, v oice,[...]

1-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Introducing NAM Traffic Analyzer 5.0 a set of subnets specified by an address prefix and ma sk, or using other criter ia such as a remote de vice data source (for e xample, remote W AE device and se gment information). If you want to li[...]

1-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Introducing NAM Tr affic Analyzer 5.0 W ith NAM 5.0, t he NBI is expanded to inclu de a Re presentational State T ransfer (REST) web service for conf iguration, and retrie val of data pertainin g to sites. Also introduced is the capabil[...]

1-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Overview of the NAM Platforms SNMP v3 Support -- NAM to Router/Switch Support Simple Network Management Prot ocol V ersion 3 (SNMPv3) is an interoperable stand ards-based protocol for network m anagement. The sec urity features provided[...]

1-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Logging In Logging In Log into the N AM by using the username and password that the N AM installer provided you, and cl ick the Login b utton. If you are ha ving problems logging in: • Make sure you are us ing a browser that is curren[...]

1-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Monitor : See “summary” vie ws that allow you to vie w network traf fic, appli cation performance, site performance, and alarms at a glance. Analyze : See various “o ver -time” vie ws for traff ic,[...]

1-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Navigating the User Interface Context Menus On most charts that appear on the dashboards , you can left-click on a colored bar of data to get a context menu, with which you can get mor e detailed information about that it em. The exampl[...]

1-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Interactive Report On most Monitoring and Analyze scr eens, you can use the Interacti ve Re port on the left side of the screen to view and change the parameters of the in formation displayed in the charts[...]

1-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Navigating the User Interface Mouse-Over for Details When in Chart vie w , you can mouseo ver the ch art to get more detailed i nformation about what occurred at a specific time. Many of t he line charts in N AM are “dual-axis, ” m[...]

1-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Navigating the User In terface Sort Grid When looking at informati on in Grid vie w , you can sort the information b y clicking the heading of any column. Click it ag ain to sort in re verse order . Bytes / Packets On most Analyze char[...]

1-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks Abov e the Statistics leg end is a dropdo wn selector , which allo ws you to choose which of the metrics sho wn in the “ov e r -time” chart you would lik e reflected in the Statistics legend. F or e[...]

1-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Understanding How the NAM Works • Adv anced T roubleshooting. The N AM provides rob u st capture a nd decode capabilities for packet traces that can be triggered or termin ated based on user-d efined thresh olds. • Open instrumenta[...]

1-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks • Understanding Ho w the NAM Uses NDE, page 1-15 • Understanding Ho w the N AM Uses W AAS, page 1-16 Understanding How the NAM Uses SPAN A switched po rt analyzer (SP AN) se ssion is an associ ation[...]

1-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Understanding How the NAM Works A V A CL can provide access control for all packets that are bridged wi thin a VL AN or that are routed into or out of a VLAN or , with Release 12.1(13)E or later releases , a W AN interface. Unlik e reg[...]

1-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Understanding How the NAM Wo rks T o use an NDE data source for the N AM, you must conf igure the remote de vice to export the NDE packets. The defa ult UDP port is 3000, b ut you can configure it from th e N AM CLI as follo ws: root@n[...]

1-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Configuration Overview Configuration Overview Ta b l e 1-3 . “Confi guration Ov erview” le ads you through the basic confi guration steps you can follo w for the N AM T raff ic Analyz er 5.0. These are not necessarily in the order [...]

1-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Configuration Overview V e rify that V o ice/RTP Stream T raffi c is being gathered After the N AM T raff ic An alyzer is started, V oic e/R TP stream traffic will automatically start being monitored. The N AM enables you to monito r a[...]

1-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overview Configuration Overview Configuring and Viewing Data Some of the N AM 5.0 features require conf iguration of sites. A si te is a collection of hosts, or network endpoints, partition ed into vie ws that help you monitor traf fic an d tro[...]

1-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 1 Overvi ew Configuration Overview Cisco WAAS NAM Virtual Service Blade T o set up the N AM T raff ic Analyzer , Release 5.0 on a Cisco W AAS N AM V irtual Service Blade, you need to foll o w these ste ps: Step 1 Confir m that you hav e completed [...]

CH A P T E R 2-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 2 Setting Up The NAM Traffic Analyzer This chapter pro vides information about functions th at will begin automati cally , and other setup tasks you will need to perform for N AM T raff ic Analyz er Release 5.0. It contains th e follo wing se[...]

2-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Default Functions Application Response Time Metrics The N AM T raff ic A nalyzer software provides response time measurements and v arious user-e xperience-related metrics, which a re computed by moni toring a[...]

2-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Traffic Usage Statistics The N AM T raff ic Analyzer provides traf fic statistic s brok en out by ap plication, host, con versation, VLAN, and DSCP code point. Summary dashboards sho w T op N charts br[...]

2-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Before you can monitor data, y ou must direct specif ic traff ic flo wing through a switch to t he N AM for monitoring purposes. Use the methods d escribed in Ta b l e 2-1 , Methods of Directing T raff[...]

2-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Ta b l e 2-3 , Acti ve SP AN Sessions Dialog , describes the fields on the SP AN Sessions screen. Note IOS supports only two SP AN sessions, but each SP AN session can ha ve more than one destination. [...]

2-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Note Deleting or editing a SP AN session that has multiple SP AN destinations will af fect all SP AN destination s. Ta b l e 2-4 lists the possible SP AN sta tes. The SP AN s tate di splays in parenthe[...]

2-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 2 Click the Cre ate bu tt o n. The Create SP AN Session Dialog displays (the f ields are described in Ta b l e 2-5 , Create SP AN Session Dialog ). Switch P ort is the default f or the SP AN T ype[...]

2-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Editing a SPAN Session Y ou can only edit SP AN sessions that have been directed to the N AM. Note This section applies to WS- SVC-N AM-1 and WS-SVC-N AM-2 devices, and the N AM 2220 and 2204 appliance[...]

2-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Deleting a SPAN Session Note This section does not apply t o NME-N AM de vices. Note Deletin g a SP AN session th at has multipl e SP AN destinations will af fect all destinations. T o delete a SP AN s[...]

2-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic The fields are e xplained in Ta b l e 2-7 , N AM Data Sources . SPAN A switched po rt analyzer (SP AN) se ssion is an associ ation of a dest ination port wi th a set of sourc e ports, confi gured with[...]

2-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic • Deleting ERSP AN Data Sources Using the W eb GUI, page 2-14 • Deleting ERSP AN Data Sources Using the CLI, page 2-15 • Config uring ERSP AN on Devices, pag e 2-16 Enabling Auto-Creation of ERS[...]

2-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic The N AM will now automatically create a ERSP AN da ta source for each device that sends ERSP AN packets to it. The da ta source will ha ve the specif ic Session ID that is populat ed by the de vice i[...]

2-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Creating ERSPAN Data Sources Using the CLI T o manually conf igure a ERSP AN data source on the N AM using the CLI (for e xample if the auto-creation feature is tur ned of f), use the follo wing steps[...]

2-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 7 Enter ? to see all the command optio ns av ailable, as in the example below: root@172-20-104-107.cisco.com(sub-data-source-erspan)# ? ? - display help cancel - discard changes and exit from sub[...]

2-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 3 Click the Delete b utton along the bottom of the windo w . Deleting ERSPAN Data Sources Using the CLI T o delete a ERSP AN data source usin g the CLI, use the follo wing steps. Note that when u[...]

2-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 4 Use the no device command to delete the de vice: root@172-20-104-107.cisco.com# no device 1 Sucessfully deleted device 1 root@172-20-104-107.cisco.com# Note that if the auto-creation mode i s o[...]

2-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic • aa.bb .cc.dd is the IP address defi ned at the destination Y ou can no w connect to the N AM to monitor and cap ture traf fic of the Data Port 2 data source. Sending ERSPAN Data Directly to the NA[...]

2-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Cat6509(config)# vlan access-map wan 100 Cat6509(config-access-map)# match ip address 100 Cat6509(config-access-map)# action forward capture Cat6509(config-access-map)# exit Cat6509(config)# vlan filt[...]

2-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic As a consumer , the N AM can receiv e NetFlow packets on its management port from devices such as Cisco routers and switches. Those records are stored in its collection database as if that traf fic ha[...]

2-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Figur e 2-2 Sample NetFlow Netw or k Ta b l e 2-8 , Reporting Flo w Records lists the reported flo ws if NetFlo w is enabled on interface a. Managing NetFlow Data Sources A data source entry must e xi[...]

2-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic For Devices Running Cisco IOS Step 1 Select the interface on which you wish to turn on routed flow cache. Prompt# configure terminal Prompt(config)# interface <type slot/port> Prompt(config-if)#[...]

2-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic • protocol-port • prefix Step 2 Enable the aggregation cache. Prompt(config-flow-cache)# enable Step 3 Export the flo w entries in the aggr egation cache to N AM UDP port 3000. Prompt(config-flow-[...]

2-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 4 Click the Submit b utton. Enabling Auto-Creation of NetFlow Da ta Sources Using the CLI Configuration of the auto-create feature is also possible using the N AM CLI. Remember that the auto-crea[...]

2-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Step 6 (Optional) If you kno w the specific v alue of the Engine ID on the de vice you would like to mo nitor , check the “Engine” check box, and enter the value of the Engine ID. If the “Eng in[...]

2-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Creating NetFlow Data Sources Using the CLI T o manually config ure a NetFlow data sour ce on the N AM using the CLI, for example if the auto-creation feature is turned of f, use the follo wing steps.[...]

2-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic V3 SECURITY LEVEL : No authentication, no privacy V3 AUTHENTICATION : MD5 V3 AUTH PASSPHRASE : V3 PRIVACY : DES V3 PRIV PASSPHRASE : root@172-20-104-107.cisco.com(sub-device-netflow)# Step 6 Ty p e ex[...]

2-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Step 13 Ty p e exit to come out of the subcommand mode and create the data sour ce: root@172-20-104-107.cisco.com(sub-data-source-netflow)# exit Data source created successfully, ID = 3 The data sourc[...]

2-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic root@172-20-104-107.cisco.com# Step 2 Use the no data-source command to de lete the dat a source: root@172-20-104-107.cisco.com# no data-source 3 Successfully deleted data source 3 root@172-20-104-107[...]

2-29 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic If the de vice is sending Net Flow V ersion 9 (V9) and the N AM has received t he NDE templates, then a V9 T emplates button appears belo w the De vice System Information windo w . Note NetFlo w v9 te[...]

2-30 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic For more inf ormation about W AAS and configuring the W AAS components, see the document: Cisco W ide Ar ea Application Services Conf iguration Guide , OL-16376-01 http://www .cisco.com/en/US/docs/app[...]

2-31 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Y ou can also conf igure a data source to use Expo rt Passthrough data. F or more information about configuring W AAS data source s, see Editing W AAS Data Source s, page 2-34 . Monitoring Client Data[...]

2-32 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Deployment Scenarios Ta b l e 2-12 , W AAS Data Source Conf igurations lists six dif fe rent deployment scenarios you might consider to monitor the optimized traf fic on your W AAS network. Scenario #[...]

2-33 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Y ou must then co nfigu re the W AAS segments you wa nt to monitor as W AAS data sources: Cli ent, Client W AN, Server W AN, and/or Server . See Ed iting W AAS Data Sources, pa ge 2-34 , for more deta[...]

2-34 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Traffic Editing WAAS Data Sources The N AM uses W AAS data sources to monitor traf fic coll ected from dif ferent W AAS segments: Client, Client W AN, Server W AN, and Server . Each W AAS segment is represent[...]

2-35 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Traffic Auto Create of New WAAS Devices If you ha ve num erous W A E de vices, you can set up the N AM to confi gure ne wly discovered W AE devices using a predefined configuratio n template usi ng the NAM Au[...]

2-36 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms The default inspects the entire p acket. The second option inspects a ll segments e xcept the ISL portion of the packet. The third op tion inspects all se gments except the ISL, MA C, and VLAN portions[...]

2-37 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note Y ou could see two alarms for the same occurrence if both the source and the destination are in the same site. When you choose Setup > Alarms > Actions , you will see e vents that have been [...]

2-38 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms T o conf igure e-mail alarm actions: Step 1 Choose Setup > Alarms > Actions . The Alarm Action page displays an y configured actions. If none of th e four actions (e-mail, trap, capture, or syslo[...]

2-39 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Step 1 Choose Setup > Alarms > Actions . The Alarm Action table displays an y configured Alarms. Step 2 Choose the alarm e vent you want to remove, and click the Delete b utton. Thresholds The N [...]

2-40 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Y ou can set up alarm thresholds b y defin ing threshold condition s for monitored v ariables on the NAM T raff ic Analyzer . Figure 2-5 shows the threshold ty pes you can configure: Figur e 2-5 Creat [...]

2-41 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-42 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-43 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-44 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-45 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-46 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 4 Cli[...]

2-47 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Alarms Step 2 Click the Cre ate but ton and choose V oice Signaling tab. Step 3 The V oice Signaling Alarm Threshold Conf iguration windo w displays. Fill in the f ields as appropriat e. Ta b l e 2-21 , V oic[...]

2-48 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Alarms Note If you lea ve a selection blank , it means that that parameter will no t be considered. If you select “ Any”, it will use an y of the selections for that parameter , if encountered. Step 3 Cli[...]

2-49 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export User Scenario If you want t he N AM to notify you of an y violations of Response T ime metrics for a particular server , and then initiate a packet capture, complete the follo wing steps: Step 1 S[...]

2-50 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export NetFlo w collects traff ic statistics by monitoring packets that flow t hrough the de vice and storing the statistics in the NetFlo w table. NDE con verts the NetFlo w table statistics into record[...]

2-51 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export Figur e 2-6 NetFlow Expor ts Screen Already defined NetFlow Exports will be li sted on the screen. If yo u hover o ver the “quick view” arro w icon ne xt to the Record T ype, as shown in Figur[...]

2-52 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export Export Record Ty p e The record types supported b y NAM for NetFlo w are: • Applic ation • Host • AR T Client Server Application • Application Con versations • Network Con versations •[...]

2-53 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Data Export Step 4 Click the Submit b utton t o sav e the co nfiguration, or cl ick the Reset button to clear the f ields, or click the Cancel button to e x it the screen without conf iguration. Editing NetFl[...]

2-54 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Data Export Note W ith N AM Traf fic Analyzer 5.0, you ca n only configure one e-mail address. Step 6 Choose the deli very option (HTML or CSV). Step 7 Enter the report descript ion, which will appear at the [...]

2-55 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Managed Device Custom Export Y ou can enable Custom Expor t to send response time data to an ex ternal reporting console su ch as NetQoS SuperAgent. After you enable Custom Export, you may also want to enable[...]

2-56 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Managed Device Note For the WS-SVC-N AM-1 and WS-SVC-N AM-2 pl atforms, SNMPv3 is not requi red. SNMP requests and responses are communicated over an internal interface with in the chassis, and SNMPv3 is not [...]

2-57 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Managed Device Step 2 Click the T est Connectivity b utton to perform an SNMP t est. Click Close when f inished. Step 3 Click Submit to submit the informati on and close the windo w . NBAR Protocol Discovery [...]

2-58 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network If NB AR Protocol Discov ery is en abled, the NB AR Interfaces window lists kno w n interfaces b y name and type. Ta b l e 2-26 , NB AR Interface Details describes the f ields on the screen. T o narro[...]

2-59 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network The site definition is very flexible and c an accommoda te various scenarios. The site definition is u sed not only for vie wing of data, bu t for data export and data retention as well. Normally , a [...]

2-60 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network Specifying a Site Using Multiple Rules Y ou can def ine a site using a combination o f multiple rules described abo ve. F or example, if a site has both optimized and non-optimized traf fic, it can be[...]

2-61 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network The f ields on this sc reen are descri bed in Ta b l e 2-27 , Sites Screen . Defining a Site The “Def inition Rules” section on page 2-59 gi ves sp ecific i nformation ab out v arious sc enarios. [...]

2-62 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network See Figure 2-7 for an e xample. Figur e 2-7 Site Configuration Screen The fields are def ined below in Ta b l e 2-28 , Site Configu ration Screen Fields . Ta b l e 2-28 Sit e Configurat ion Scr een Fi[...]

2-63 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network Step 4 Click the Submit b utton. Note The “Unassigned” site (with a de sc ription of “Unclassified hosts” ) includes any that do not match any of your si te conf igurations. Sites are classifi[...]

2-64 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Network NDE Interface Capacity After you ha ve set up NetFlo w data sources (see NetFlo w , page 2-18 ), you can go to th e NDE Interface Capaci ty screen at Setup > Network > NDE Interface Cap acity to[...]

2-65 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Network These topics help you set up and manage the DSCP groups: • Creating a DSCP Group, page 2-64 • Editing a DSCP Group, page 2- 66 • Deleting a DSCP Group, page 2-66 Creating a DSCP Group T o create[...]

2-66 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Step 4 Click Submit to sa ve your changes, or cl ick Reset to cancel. Editing a DSCP Group T o edit a DSCP gr oup: Step 1 Choose Setup > N etwork > DSCP Gr oups . The DSCP groups windo w [...]

2-67 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification The N AM enables the selection of the "better" application identifier , wh erein "better" is def ined as the deeper inspection to be used for ap plication classification. Y [...]

2-68 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Ta b l e 2-33 , Applications describes the f ields on the Applications setup page. This section provides the follo w ing procedures: • Creating a Ne w Application, page 2-68 • Editing an Ap[...]

2-69 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification This allo ws you to configure appl ications consis tently across mult iple N A Ms, so that the same user-created application is exported with the same v alue. Step 5 Choose a protocol f amily f[...]

2-70 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification T o edit an ap plication: Step 1 Choose Setup > Classification > A pplications . Step 2 Select the applicatio n to edit, and click Edit . The Application Co nfigurati on windo w displays.[...]

2-71 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification Editing an Application Group T o edit an ap plication group: Step 1 Choose Setup > Classif ication > Applicat ion Groups . Step 2 Select the Application Group b y clicking the radio butto[...]

2-72 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Classification Step 1 Choose Setup > Classif ication > URL-based Appl ications . Step 2 Click Cr eate . The Create URL-based Application w indow disp lays. Enter v alues in the f ields according to Ta b[...]

2-73 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Classification See Figure 2-9 for an example of creating a URL-based application. Figur e 2-9 Example of Cr eating a URL -Based Application Editing a URL-Based Application T o edit URL- based applic ations: S[...]

2-74 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring Encapsulations Using Encapsulati on gi ves you incr eased flexib ility when trying to mo nitor (such as counting or grouping) dif ferent types of application traf fic. The encapsu lation settings a[...]

2-75 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring • URL, page 2-78 • W AAS Monitored Servers, page 2-80 Aggregation Intervals The N AM Traf fic Analyzer has short-t erm and long-t erm aggre gation intervals (referred to as long-term reporting [...]

2-76 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring The aggreg ation interv als determine ho w much da ta can be stored in the N A M database. See Ta b l e 2-3 5 , Data Reten tion for information about data retention. Response Time T o conf igure th[...]

2-77 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring Step 5 Accept the default set tings or change the sett ings to the v alues you want to monitor . Click Submit to sav e your changes, or click Reset to cancel. Voice After you set up the N AM to mon[...]

2-78 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring Note T o report jitter and packet lo ss for the SCCP protocol, you must enable CDR on Cisco Unif ied CallManager . For more i nformation on Cisco Unifie d CallManager , see the Cisco Unified CallMa[...]

2-79 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring • Disabling a URL Coll ection Enabling a URL Collection T o enable a URL collection: Step 1 Choose Setup > Monitoring > URL. The URL screen displays. Figur e 2-1 0 URL Collection Configur a[...]

2-80 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring : Step 4 Check the Recycle Entries check box to recycle entries. Step 5 Check the check box for one of the follo wing: • Collect complete URL (Host, P ath and Arguments) • Collect Host only (i [...]

2-81 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Analyzer Monitoring Disabling a URL Collection T o disable a URL collec tion: Step 1 Choose Setup > Monitoring > URL Collection . Step 2 Uncheck the En able check box . Step 3 Click Submit . WAAS Monitored Serve[...]

2-82 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 2 Setting Up The NAM Traffic Ana lyzer Monitoring The Add W AAS Server(s) dialog box displays . Step 4 Enter the server IP address in the Serv er Address fiel d. Y ou can paste multip le IP addresses here as well. Step 5 Click Submit . Deleting a [...]

CH A P T E R 3-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 3 Monitoring and Analysis The Cisco N AM T raff ic Analyzer R elease 5.0 introduces a redesigned interface and user experience, with more intuiti ve workflo ws and interactiv e reporting capabilities. There are two types of dashboards in N AM[...]

3-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Navigation Navigation Context Menus On most of the dashboards, you can left-cl ick on the colored bar of data to get a context men u, with which you can get more detai led information about one parti cular application. Th[...]

3-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Navigation • Maximum interv al for up to 1 hour is supported for the follo wing dashboards: R TP Streams, V oice Call Statistics, Calls T ables, R TP Con versations, Host Con versations, Con versations, and Response T [...]

3-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Traffic Summary Traffic Summary The T raff ic Summary Dashboard all ows you to vie w the T op N Applications, T op N Application Groups, T op N Hosts (In and Out) , IP Distrib ution by Byt es, T op N DSCP , and T op N VLA[...]

3-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Summary T o see a chart in table format, use the “V iew as Char t / V iew as Grid” toggle b utton on the bottom right corner of the chart. Y ou can also click the “V iew as Image” b utton to vie w t[...]

3-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Site Summary Note T o change from bytes to bits, choose Administration > System > Prefer ences and change the “Data d isplayed in ” selection. Site Summary The Site Summary Dashboard (accessed by choosi ng Monit[...]

3-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Alarm Summary Note Y ou could see a count of two alarms for the same occurre nce if: - both the source and th e destination are in the same site i n the T op N Site - Host Pair chart. - both the source and the destin ati[...]

3-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Analyzing Traffic The charts av ailable under the “ Analyze” me nu show statistics that occur o ver time. Ta b l e 3-1 Field Description Site This contain site or source and destinat ion sites (sourc[...]

3-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Y ou can use the Zoom/P an feature, in which you can drag the be ginning or end to change the time interv al, as sho wn belo w . The time interval change on the zoom/p an chart wil l af fect the data p[...]

3-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Host The Host T raff ic Analysis Screen will sho w you at a qui ck glance the i nput and outpu t of a particula r host ov er time. It is av ailable under the menu option Analyze > T raffic > Host [...]

3-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic NDE Interface Traffic Analysis The NDE Interface Ana lysis page enables you to view da ta collected for indi vidual interfaces on a switch or router that is e xporting Netflo w packets to the N AM. Th[...]

3-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic • T op N Applications - Egress • To p N H o s t s - I n g r e s s • T op N Hosts - Egress • T op N DSCP Aggr - Ingress • T op N DSCP Aggr - Egress The interface speed can be entered manually t[...]

3-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Figur e 3-5 DSCP Gr oup T raffic Over Time On this screen, you will see: • T raff ic volume o ver time for the selected DSCP group • T op N applications and application groups usin g that DSCP gro[...]

3-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic URL Hits Y ou can analyze the URLs collect ed by the NAM (for setup, see URL, page 2-78 ) . This sect ion contai ns the follo wing procedures: • V iewing Collected U RLs • Filtering a URL Collecti o[...]

3-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Analyzi ng Traffic Host Conversations If you choose Analyze > T r affi c > Detailed V iews > Hos t Con versations , and click on “Host” in the host cov ersation tables, you can se e detailed lists of all th[...]

3-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Analyzing Traffic Applications Ov er T ime, as shown in Figure 3- 7 , will show you all of the applications that ha ve been running for the time p eriod interv al. The color -coded legend sho ws you what the applications[...]

3-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis WAN Optimization Application Traffic By Host When you choose Analyze > T raffic > Detailed V iews > Application T raffic By Hosts , you will see the traff ic for a giv en application broken out by individual ho[...]

3-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis WAN Optimization Application Performance Analysis T o analyze the W AAS traff ic, c hoose Analyze > W AN Optimization > A pplication Perf ormance Analysis . The charts av ailable on this page are: • T ransaction [...]

3-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Response Time The N AM T raf fic Analyzer monitors TCP packet flo w between clie nt an d server , and measure s response time data to pro vide more visibility into appli cation response times (AR T) and ne[...]

3-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Figur e 3-1 1 T ransaction Time versus Response Time Measurements Ta b l e 3-7 lists and describes the AR T metrics measured b y N AM 5.0. Client request Ser ver response Application response time T otal t[...]

3-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Number of unresponsi ve connections Number o f TCP connection requ ests (SYN) that are not respond ed during the monitoring interv al Number of refused connections Number of TCP connection requ ests (SYN) [...]

3-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Application Response T ime Metrics are a vailabl e on the response Response T i me Summary Dashboard ( Monitor > Response Time Summary ), which allo ws you to see a “summary” vie w of the data. T o [...]

3-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Note If you do not specify any ap plication, the chart wil l sho w the network time instead of tr ansaction time. The Other Metrics chart allows you to see informat ion about th e network link b etween sit[...]

3-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Ta b l e 3-8 , Server Appl ication Responses Metrics , pro vides definitions of each f ield of the Server Application Responses windo w . Server Application Transactions The Server Appli cation T ransactio[...]

3-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

3-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

3-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Response Time Client-Server Application Transactions The Client-Server Application T ransactions window provides a summary o f the server applicat ion transaction response ti mes (AR T ) per serv er application displayi[...]

3-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Response Ti me Note N AM uses the TCP three-way handshake to calcu late network delay . If there are no new TCP connections during the pollin g interv al, the N AM GUI displays a dash (-) for the delay v alue indicating [...]

3-29 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device T o view the Client-Server Netw ork Responses windo w , choose Analyze > Response Ti me > Detailed V iew s > Client-Server Network Responses . N AM uses the TCP three-way handshake to calcu late [...]

3-30 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device • Health, page 3-3 1 • NB AR, page 3-37 Interface Interfaces Stats Table T o view packet distrib ution details on the interfaces, choose An alyze > Managed Device > Interfa ce . The Interfaces St[...]

3-31 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Interface Statistics Over Time When you select an interface in the Interface Stats T abl e, the statistics for that interf ace will be graphed in the area below , as shown in Figure 3-13 . Figur e 3-13 In[...]

3-32 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Chassis Health The Chassis Health windo w displays two real-time grap hs: CP U usage and Backplane U tilization. CPU usage CPU type • Usage for last 1 minute (%) • Usage for last 5 minutes (%) Backplan[...]

3-33 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Crossbar Switching Fabric This option sho ws the Crossbar Switching F abric information. UpT ime The time (in hundredths of a second) since the network management portion of the system wa s last re-initia[...]

3-34 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Ternary Content Addressable Memory Informatio n Sho ws the T ernary Content Addressable Memory ( TCAM) usage informatio n. Ta b l e 3-18 lists and describes the TC AM information. Ta b l e 3-17 Crossbar Sw[...]

3-35 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Managed Device Router Health If your de vice is a router , the Router Health windo w displays with a drop -do wn box that provi des the follo wing options: • Router Health, page 3-35 • Router Information, page 3-36 [...]

3-36 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Managed Device Router Information The Router Informat ion windo w displays rout er information. Ta b l e 3-20 lists and describes the f ields of the Router Informat ion windo w . T emper ature Status The current state of[...]

3-37 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media NBAR Y ou can use the N AM Tr af fic An alyzer to vie w Network Based Application Recognit ion (NB AR) data. T o view the NB AR data collected for a switch or router , select Analyze > Managed D evice > NB A[...]

3-38 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media RTP Streams Purpose The R TP Streams w indo w shows y ou three pieces of information: RTP Stream Information • Source IP Address and Port: IP ad dress and UDP port of the originator o f the R TP stream. • Desti[...]

3-39 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media RTP Stream Stats Details This table shows the per-interval stats calculated by N AM at each interval. The columns of the tables are: • Report T ime: time when the stats were calcul ated. This is the end time of [...]

3-40 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media • V oice Call Statistics : Number of calls per signali ng protocol (SCC P , SIP , MGCP , and H.323) at each interv al during the selected in terval . • T op N End Points by Jitter (ms) : Endp oints that ha ve t[...]

3-41 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media If you click on a call ro w in the table, in the R TP Streams for the Select ed Call display at the bottom of the page you will see all streams that are associated with the call. It will display the R TP streams t[...]

3-42 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media Y ou can see more detailed in formation about each R TP stream by selectin g the R TP stream and clicking on the RT P S t r e a m D e t a i l s bu tton. A pop up wi ndo w will sho w more detailed information of th [...]

3-43 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monitoring and An alysis Media SSRC Synchronization sour ce number as it appear in the R TP header Duration Weighted MOS N AM calc ulated score that takes into account of the duration of the stream T able 3-23 RTP Con versations T able (continu[...]

3-44 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 3 Monito ring and Analysis Media[...]

CH A P T E R 4-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 4 Capturing and Decoding Packet Data The Capture feature of the NAM T raff ic Analyzer allo ws you to set up multiple sessions for capturing, filt ering, and decoding pack et data, manage the data in a fil e control system, and display the co[...]

4-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Figur e 4-1 Quic k Captur e Sessions The purpose of Ca pture Sessions is t o capture, filter , a nd decode packet da ta, manage the d ata in a file control system, and display the cont ents of the pack[...]

4-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Figur e 4-2 NAM Captur e Sessions This section contains the following subjects: • V iewing Capture Sessions, page 4-3 • Config uring Capture Sessions, page 4-4 • Software Filters, page 4-7 View[...]

4-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Ta b l e 4-2 , Buttons in th e Capture Session Operations Windo w describes the operations that you can perform from the Capture Sessi ons window . Configuring Capture Sessions Y ou can conf igure up t[...]

4-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Figur e 4-3 Configure Captur e Sessi on Window Step 3 Enter information in t he Capture Settings Fields ( Ta b l e 4-3 ) as ap propriate. Ta b l e 4-3 Captur e Settings Fields Field Description Usage[...]

4-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Ta b l e 4-4 lists the hardware platforms N AM 5.0supports and their maximum session si ze. This is the maximum capture memory b uffer size for all capture session s together , not individ ually . Stor[...]

4-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s When capturing to multip le files, a suff ix is added to the f ile name. For e xample, the f irst file for a capture named Captur eA would be labeled as Capt ureA_1 the second Captur eA_2 , and so on[...]

4-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Creating a Software Filter Y ou can def ine a software f ilter to filter based on any o f the follo wing: • Source host address • Destination host address • Network enc apsulation • VLAN or VLA[...]

4-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Ta b l e 4-5 Softwar e Filter Dialog Bo x Field Description Usage Notes Name Enter a name of the ne w filter . Source Address / Mask Source address of the packets. • For IP , IPIP4, GRE.IP , or GTP[...]

4-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Destination Address / Mask Destination address of the packets. • F or IP , IPIP4, GRE.IP , or GTP .IPv4 addresses, enter a valid IPv4 address in dotted-quad form at n.n.n.n, where n is 0 to 255. The[...]

4-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s Note The parameters described in the table abov e are independently ev aluated by the N AM. Therefore, the N AM will allo w you to enter parame ters that are contradictory , but you will not be able[...]

4-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions • T o cancel the changes, click Cancel . Hardware Assisted Filters Hardware Assisted Capture enables you to improv e capture performance by providing hardwa re-specific filt ers to help you elimin a[...]

4-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Session s The list is also shown in Figure 4-5 . Figur e 4-5 Hardw are Filt er T ype Step 5 Data fields will then appear that correspond with th e type of hardw are filt er you selected. Fill in the desired f[...]

4-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Sessions Step 7 Click Submit . IP T o configure an IP hardw are filter: Step 1 Enter a Filter N ame. Step 2 From the T ype drop-down menu , choose IP . Step 3 Enter a Source Address / Mask (optional). Step 4 E[...]

4-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files • Enter a Mask of up to four b ytes (eight hex charact ers). Step 7 Repeat Step 6 for up to four payload dat a segments. Note Only one payload seg ment (one ro w) is required. Be careful not to create[...]

4-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Files • Name: • Size: • Date: • State: • Location: If you are using a Cisco 2200 Ser ies appliance, the N AM will create a xxx.pcap f ile. If you click on the do wnload b utton, a xxx.pcap f ile wi l[...]

4-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files Note Capture files on the NAM 2200 Series appliances ar e stored in nati ve N AM format. Y ou can con vert the capture file format to .pcap using the Conv ert/Rename/Merge button on the Capture > P a[...]

4-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Files The Error Scan screen is sho w n in Figure 4-6 . Figur e 4-6 Er ror Scan Scr een The fields are described in Ta b l e 4-8 . Downloading Capture Files The follo wing procedure describes ho w to do wnload [...]

4-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Files Step 2 Choose a capture file from the list of captures. Step 3 Click Download . A File Download dialog box displays and asks “ Do you want to sa ve this f ile? ” Figur e 4-7 Download Capture File Di[...]

4-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Step 3 Click the Delete b utton. A dialog box displays and asks “ Delete all captur e file(s)? ” Step 4 Click OK to delete all the f iles or Cancel to allo w them to rema[...]

4-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Ta b l e 4-10 describes the columns displayed in the pack et browser pane. Browsing Packets in the Packet Decoder Y ou can use t he packet brows er to bro wse the list o f ca[...]

4-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information – Destinatio n allows y ou to specify the destinati on address, or lea ve it bl ank if not applicab le. – Both Directions allo ws you to match of packets tra velling in b[...]

4-23 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information • T o adjust the s ize of an y of the panes , click and drag the pane frame up or do wn. Using Alarm-Triggered Captures Y ou can con figure multip le alarm-tr iggered cap t[...]

4-24 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Ta b l e 4-1 1 Custom Decode Filter Dialog Bo x Field Description Usage Notes Filter Name The name of the capture filter . Enter the name of the filt er to be created. Descri[...]

4-25 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Step 4 Do one of the foll ow ing: • T o create the fi lter , click Submit . • T o cancel filter creation, click Cancel . Tips for Creating Custom Decode Filt er Expressio[...]

4-26 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information Examples of Custom Decode Filter Expressions • T o match SNMP packets from 111.122.133.1 44, enter: snmp and (ip.src == 111.122.133.144) • T o match IP packets from the 1[...]

4-27 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and D ecoding Packet Data Viewing Packet Decode Information Step 4 Do one of the foll ow ing: • T o apply the ch anges, clic k Submit . • T o clear the page of your changes, click Reset . • T o exit the page without ap plying th[...]

4-28 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 4 Capturing and Decoding Packe t Data Viewing Packet D ecode Information[...]

CH A P T E R 5-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 5 User and System Administration This chapter pr ovides infor mation about performing u s er and system administration tasks and generating diagnostic informat ion for obt aining technical assistance. This chapter contains t he follo wing sec[...]

5-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Resources Choose Administration > System > Resources to vie w the System Overvie w windo w . Ta b l e 5-1 describes the f ields of the System Overvie w windo w for a N AM Traf fic Analy[...]

5-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Note N AM 5.0 does not supp ort using IPv6 for the n etwork parameter IP add ress. Step 3 Do one of the foll ow ing: • T o sav e the changes, click Submit . • T o cancel the changes, cli[...]

5-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration T o view and set the N AM SNMP Agent: Step 1 Choose Administration > System > SNMP Agent . Step 2 Enter or change the infor mation on the N AM SNMP screen. The fields are detailed in Ta[...]

5-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Deleting NAM Community Strings T o delete the N AM community strings: Step 1 Choose Administration > System > SNMP Agent . At the botto m of the window , th e N AM Community Strings Di[...]

5-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration • Cisco 2200 Series appliances ca n get their time from a local CLI clock set command. Caution Both the client computer and the N AM server must ha ve the ti me set accurately for their res[...]

5-7 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Step 6 Do one of the foll ow ing: • T o sav e the changes click Submit . • T o leav e the configuration unchanged, choose Reset . Configuring the NAM System Time with an NTP Server T o c[...]

5-8 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 7 Click Submit to sa ve your mo difications, or click Reset to clear the dialog of any characters you entered or restore the pre vious settings. Web Data Publication W eb Data Publicatio[...]

5-9 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion • Creating iSCSI Storage Locations, page 5-11 • Editing iSCSI Storag e Locations, page 5-11 Creating NFS Storage Locations The NFS server must be conf igured properly to al lo w NAM to w[...]

5-10 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 4 Click Submit to create the NFS storage location. Othe rwise click Reset to remo ve your entr ies or Cancel to cancel the chan ge. Editing NFS Storage Locations The follo wing procedur[...]

5-11 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Creating iSCSI Storage Locations The follo wing procedure describes ho w to create an iSCSI storage l ocation for storing N AM capture data. Step 1 Choose Administration > System > Ca[...]

5-12 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration System Admi nistration Step 4 Click Submit to change the iSCSI storage lo cation parameters. Otherwise click Re set to remov e your entries or Cancel to cancel the change. Note Before the changes to the iSCSI stor[...]

5-13 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration System Ad ministra tion Step 2 Click the Cre ate bu tt o n. Step 3 In the “Community” f i eld, enter the community stri ng set in the N AM Thresholds. Step 4 In the “IP Address” field, enter the IP address[...]

5-14 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration Diagnostics Diagnostics The Diagnostics option of the Administration menu pro vides tools to aid in tro ubleshooting. Y ou can use these tools when you have a problem that might require assistance from the Cisco T[...]

5-15 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration Diagnostics • User ID • T ime stamp • IP address (in case of remote web access) • Acti vity description T o access the audit trail window: Step 1 Choose Administration > Diagnostics > A udit T rail .[...]

5-16 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration User Administration The User Administration optio n of the Administration menu provides the fol lowin g options: • Local Databa se, page 5-16 • Establishing T A CA CS+ Authentication and Au[...]

5-17 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration For info rmation on resetting t he N AM passwords on 6500 Series N A Ms, see Catalyst 6500 Se ries Switch and Cisco 7600 Series Internet Router Network Analysis Mod ule Installation and Con fig[...]

5-18 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Usernames and passwords cannot exceed 32 characters and can be alphanumeri c. The follo wing special characters are not allowed: '!' '@' '#' '$' '%&[...]

5-19 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration Step 2 Select the username. Step 3 Click Delete . Note If you delete user acco unts while users are logged in , they remain logged in and retain their pri vileges. The session remains in ef fec[...]

5-20 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Step 3 Do one of the foll ow ing: • T o sav e the changes, click Submit . • T o cancel, clic k Reset . Ti p If you cannot log into the N AM T raff ic Analyzer with T A CACS+ con figur ed, v[...]

5-21 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 5 User and System Administration User Administration Adding a NAM User or User Group T o add a N AM user or user group: Step 1 Click User Setup . Step 2 Enter the user login name. Step 3 Click Add/Edit . Step 4 Enter the user data . Step 5 Select[...]

5-22 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 5 User a nd System Administration User Administration Current User Sessions The Current User Sessions table is a record of the users who are logged into the application. The user session times out after 30 minut es of inacti vity . After a user se[...]

CH A P T E R 6-1 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 6 NAM Traffic Analyzer 5.0 Usage Scenarios This chapte r describes usag e scenarios for t he Ci sco Network Analysis Module T raff ic Analyzer, Release 5.0. This chapter contains the following sections: Deployment • Deploying NAMs in the Br[...]

6-2 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Deployment Deployment Deploying NAMs in the Branch A N AM T raff ic Analyz er deployed in the b ranch will provide a de tailed view of the traff ic traversing to and from the branch. The N A M can monitor [...]

6-3 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Deployment See related content Data Export , NetFlow , page 2-49 . Autodiscovery Capabilities of NAM If you ar e an e xisting N AM 4.x user , you will not need t o conf igure the SP AN sessions, and the y[...]

6-4 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Monitoring Integrating NAM with LMS The N AM Traf fic Analyz er GUI can be placed on the LMS (LAN Management Suite) 4.0 dashboard and accessed thru the LMS GUI. See technic al documentation for LMS on http[...]

6-5 User Guide for the Cisco Netwo rk Analysis Module (NAM) Tra ffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Troubleshooting Using NAM to Evaluate Application-Level Performance Monitoring for UDP Realtime Applications The N AM Traf fic Analyzer monitors R TP streams: Wh en a phone call ends, th e endpoints calcu[...]

6-6 User Guide for the Cisco Network Analysis Mod ule (NAM) Traffic Analyzer, 5.0 OL-22617-01 Chapter 6 NAM Traffic Analyzer 5.0 Usage Scenarios Troublesho oting If the alarm is for an Application Response T ime issue, you can access Monitor > Response Time Summary or Analyze > Response Time > A pplication to drill-do wn on what hosts are [...]

A-1 User Guide for the Cisco Network Analysis Module Traffic Analyzer, 4.1 OL-19530-02 APPENDIX A Troubleshooting This appendix addresses some co mmon issues you might encounter wh ile using N AM Traf fic Analyzer 5.0. It contains th e follo wing sections: • General NAM Issues, page A-1 • Error Messages, page A-2 • Packet Drops, page A-2 • [...]

A-2 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troublesho oting Error Messages Error Messages Q. I’m waiting fo r the graphical data to populat e on a dashboard. What does this red er ror “Request Error -- Please T ry Again” mean? A. This means an inter nal error has occurred, or the login [...]

A-3 User Guide for the Cisco Network An alysis Module Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troubleshooting NAM Behavior • Does a ping to N AM mgmt IP address work? • What is the module status on Sup/router? show modules CLI NAM Behavior Q. Why is the bro w ser beha ving strangely? It is displaying data for no apparent reason. A. Clear t[...]

A-4 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 4.1 OL-19530-02 Appendix A Troublesho oting WAAS Troubleshooting[...]

B-1 User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 OL-22617-01 APPENDIX B Supported MIB Objects Supported MIBs Ta b l e B - 1 lists the MIB objects supported by the superv isor engine and the N AM. T able B-1 Sup ervisor Engine Modul e and NAM RMON Support Module Object Identifier (OID) and Description Source Supervisor Engi[...]

B-2 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 5.0 OL-22617-01 Appendix B Sup ported MIB Objects Supported MIBs Supervisor Engine ...mib-2(1).rmon(16).tok enRing(10 ).ringStation ControlT able(1) ...mib-2(1).rmon(16).tok enRing(10 ).ringStation Ta b l e ( 2 ) ...mib-2(1).rmon(16).tok enRing(10 ).ringStation OrderT able(3) [...]

B-3 User Guide for the Cisco Network An alysis Module Traffic Analyzer, 5.0 OL-22617-01 Appendix B Supported MIB Objects Supported M IBs Supervisor Engine ...cisco(9).workgroup(5).cis coStackMIB(1).ciscoStatck MIBConformance(31).cisc oStati cMIBGroups(20. chassisGroup(3) CISCO-ST A CK-MIB Collection of object s providing i nformation about the chas[...]

B-4 User Guide for the Cisco Network A nalysis Mod ule Traffic Analyzer, 5.0 OL-22617-01 Appendix B Sup ported MIB Objects Supported MIBs[...]

IN-1 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 INDEX A administration (see system administr ation) 5-1 alarm thresholds, setting NAM thresholds 2-39 deletin g 2-48 editing 2-48 switch thresh olds 2-49 syslog, setting up 5-12 ART 3-24, 3-27 Audit trail 5-14 C capture error scan 4-17 Capture bu ffer max[...]

Index IN-2 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 protocol 2-68 SPAN sessions 2-6 Custom captu res 4-8 custom display filt ers, managing creating 4-23 deletin g 4-27 editing 4-26 setting up 4-23 D dashboards Alarm Summary 3-6 overview 1-2 Performance Overview 3-5 Response Time Summary 3-5 Traffic A[...]

Index IN-3 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 sending data directly t o NAM 2-17 External reporting console 2-55 F Filtering audit trail 5-15 IP 4-14 IP and Payload Data 4-14 IP and TCP/UDP 4-14 Payload data 4-15 VLAN and IP 4-13 Filter Response Time for all D ata Sources by Monitored Servers 2[...]

Index IN-4 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 NetFlow configuring on devices 2-20 Cisco IOS 2-21 multi-layer switching cache 2-21 NAMs in a device slot 2-22 NDE export 2-22 NDE v8 aggregations 2-21 devices, mana ging testing 2-28 exporting da ta 1-15 interfaces, understanding 2-19 records, unde[...]

Index IN-5 User Guide for the Cisco Network Analysi s Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 methods (table) 2-4 NetFlow, configu ring on devices 2-20 Cisco IOS 2-21 multi-layer switching cache 2-21 NAMs in a device slot 2-22 NDE export 2-22 NDE v8 aggregations 2-21 NetFlow devices, managing testing 2-28 SPAN session creating 2-6 deletin g [...]

Index IN-6 User Guide for the Cisco Network Analys is Module (NAM) Traffic Analyzer, 5.0 OL-22617-01 V VACL 1-14, 2-17 VLAN access control list 1-14, 2-17 VACL, configuring on LAN VLANs 2-18 on WAN interfaces 2-17 viewing community switch strings 5-5 DiffServ data 3-12 NAM SNMP system groups 5-3 network parameters 5-2 response time data server 3-25[...]