Cisco Systems 5 manual Software Filters, Maximum Session, NAM Platform Size, 300 MB, 132 MB

Chapter 4 Capturing and Decoding Packet Data

Sessions

Table 4-4	Maximum Capture Session Sizes for NAM Platforms (continued)
		Maximum Session
NAM Platform		Size
WS-SVC-NAM-2		300 MB
WS-SVC-NAM-2 with memory upgrade (MEM-C6KNAM-2GB)		500 MB
WS-SVC-NAM-2-250S		500 MB
NAM2204-RJ45		2 GB
NAM2204-SFP		2 GB
NAM2220		10 GB
NME-NAM-80S		132 MB
NME-NAM-120S		300 MB

When capturing to multiple files, a suffix is added to the file name. For example, the first file for a capture named CaptureA would be labeled as CaptureA_1 the second CaptureA_2, and so on.

Note When configuring capture to disk sessions, it is important to keep track of your free disk space and manage your capture files. The NAM Traffic Analyzer allows you to create more capture files than you have the free disk space to store. For example, you might have 400 MB of free disk space when you set up two capture sessions that each store 160 MB of capture files. A little later, before the previous capture sessions have each written 160 MB of data, you might notice you still have 160 MB of free disk space and set up another capture session to store an addition 120 MB of capture files. You will then eventually run out of disk space, causing all active capture sessions to end with errors.

Step 4 Click the Submit button to finish configuration for this session, or configure Software Filters for this session (see the next section, Software Filters, page 4-7).

Software Filters

You can create and save specialized filters that will disregard everything except the information you are interested in when you capture data (see Figure 4-2). Starting in NAM Traffic Analyzer Release 5.0, you can configure multiple software filters for each session (up to six). This allows you to narrow in on the traffic that you are interested in, and it also saves resources (either memory or disk space).

If you create a session and then start it, you cannot edit the session without stopping it. If you edit a session containing already captured data, you will get a warning saying that the session will be cleared and the data removed. If you ignore the warning and add a filter to the session, and submit it, the new filter settings will be used.

The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or TCP), you will need to use the “IP Protocol” selector. Selecting, for example, TCP in the “IP Protocol” selector will filter on all packets using TCP.

See these topics for help setting up and managing software filters:

•Creating a Software Filter, page 4-8

•Editing a Software Capture Filter, page 4-11

User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0

OL-22617-01 4-7