4-7
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 4 Capturing and Decoding Packet Data
Sessions
When capturing to multiple files, a suffix is added to the file name. For example, the first file for a
capture named CaptureA would be labeled as CaptureA_1 the second CaptureA_2, and so on.
Note When configuring capture to disk sessions, it is important to keep track of your free disk space and
manage your capture files. The NAM Traffic Analyzer allows you to create more capture files than you
have the free disk space to store. For example, you might have 400 MB of free disk space when you set
up two capture sessions that each store 160 MB of capture files. A little later, before the previous capture
sessions have each written 160 MB of data, you might notice you still have 160 MB of free disk space
and set up another capture session to store an addition 120 MB of capture files. You will then eventually
run out of disk space, causing all active capture sessions to end with errors.
Step 4 Click the Submit button to finish configuration for this session, or configure Software Filters for this
session (see the next section, Software Filters, page 4-7).
Software Filters
You can create and save specialized filters that will disregard everything except the information you are
interested in when you capture data (see Figure 4-2). Starting in NAM Traffic Analyzer Release 5.0, you
can configure multiple software filters for each session (up to six). This allows you to narrow in on the
traffic that you are interested in, and it also saves resources (either memory or disk space).
If you create a session and then start it, you cannot edit the session without stopping it. If you edit a
session containing already captured data, you will get a warning saying that the session will be cleared
and the data removed. If you ignore the warning and add a filter to the session, and submit it, the new
filter settings will be used.
The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a
layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or
TCP), you will need to use the “IP Protocol” selector. Selecting, for example, TCP in the “IP Protocol”
selector will filter on all packets using TCP.
See these topics for help setting up and managing software filters:
• Creating a Software Filter, page 4-8
• Editing a Software Capture Filter, page 4-11
WS-SVC-NAM-2 300 MB
WS-SVC-NAM-2 with memory upgrade (MEM-C6KNAM-2GB) 500 MB
WS-SVC-NAM-2-250S 500 MB
NAM2204-RJ45 2 GB
NAM2204-SFP 2 GB
NAM2220 10 GB
NME-NAM-80S 132 MB
NME-NAM-120S 300 MB
Table 4-4 Maximum Capture Session Sizes for NAM Platforms (continued)
NAM Platform
Maximum Session
Size