2-67
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 2 Setting Up The NAM Traffic Analyzer
Classification
The NAM enables the selection of the "better" application identifier, wherein "better" is defined as the
deeper inspection to be used for application classification. You can also manually select the preferred
inspection method.
For example, the NBAR Application ID inspection may report a "better" classification than the NAM’s
Protocol Directory, and so you may want to use the NBAR Application ID instead.
The NAM also allows for the configuration of custom applications via the North Bound Interface (NBI).
This is needed to ensure uniform application classification across a number of NAMs.
The menu selections for setting up Classification are:
• Applications, page 2-67
• Application Groups, page 2-70
• URL-based Applications, page 2-71
• Encapsulations, page 2-73
Applications
The NAM recognizes an application on the basis of port number, port number range, stateful inspection
of traffic (for example, voice signaling traffic or FTP), heuristics (for example, MS-RPC or SUN-RPC),
or standardized application identifiers exported by Cisco platforms with NDE. If the NAM is not able to
recognize an application using any of these mechanisms, the application type of the traffic is reported as
“unknown.” You can configure the application reported as “unknown” to create custom applications.
The Applications window lists applications that have been set up for this NAM. To view the Applications
window, click Setup > Classification > Applications. Use this window to view and add proprietary
applications, and edit the user-defined applications.
Figure 2-8 shows an example of what the screen may look like.
Figure 2-8 Applications