Cisco Systems 5, NAM manual Sessions

Chapter 4 Capturing and Decoding Packet Data

Sessions

Figure 4-1 Quick Capture

Sessions

The purpose of Capture Sessions is to capture, filter, and decode packet data, manage the data in a file control system, and display the contents of the packets. The captured packets can then be decoded and analyzed on the NAM for more efficient problem isolation.

As shown in Figure 4-2, network packets coming into NAM must pass at least one hardware filter in order to go on to the next step. If no hardware filters are configured, all packets pass through. See Hardware Assisted Filters, page 4-12for more information about hardware filters.

Note Hardware filters apply only to the Cisco 2200 Series Appliances.

Note Custom Capture Filters are not available in the NAM Traffic Analyzer 5.0 release.

Packets must then pass at least one software filter in that particular session to be saved by that session. If no software filters are configured for a session, then all packets are captured.

For each hardware and software filter, every field you configure must match if the packet is to pass through that filter. The more fields you configure inside a filter, the more specific that filter is, and therefore fewer packets will pass through it.

User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0

4-2 OL-22617-01