Cisco Systems 5, NAM manual NetFlow v9 Data Export, Historical Analysis

Chapter 1 Overview

Introducing NAM Traffic Analyzer 5.0

With NAM 5.0, the NBI is expanded to include a Representational State Transfer (REST) web service for configuration, and retrieval of data pertaining to sites. Also introduced is the capability to export high-volume performance data in the form of Netflow v9 (see the next section, “NetFlow v9 Data Export”).

Note REST does not support retrieval of performance data for sites.

REST is a set of guidelines for doing web services over HTTP. It takes advantage of the HTTP method (GET, POST, UPDATE, DELETE) as part of the request.

The REST request/response messages using the REST web service will contain XML data in the body content of the HTTP request. An XML schema will describe the message content format. All REST request/response messages are handled in XML format. Then the REST web service consumer can use any HTTP client to communitate with the REST server. To use the REST web service via HTTPS, the NAM crypto patch needs to be installed on the NAM.

The NBI web service will provide an external API interface for provisioning and retrieving performance data. For application developers who want to use the NAM APIs to provision network services and leverage data, see the Cisco Network Analysis Module 5.0 API Programmer’s Guide. The developers who use the APIs should have an understanding of a high-level programming language such as Java or an equivalent.

NetFlow v9 Data Export

The NAM uses NetFlow as a format for the ongoing streaming of aggregated data, based on the configured set of descriptors or queries of the data attributes in NAM. The NAM as a producer of NDE (NetFlow Data Export) packets is a new feature for NAM Traffic Analyzer 5.0. The NAM's new functionality of NDE is part of its new NBI.

NetFlow collects traffic statistics by monitoring packets that flow through the device and storing the statistics in the NetFlow table. NDE converts the NetFlow table statistics into records, and exports the records to an external device, which is called a NetFlow collector.

The NDE Descriptor is a permanent definition of the NAM aggregated data query of aggregated NAM data, which must be exported to designated destinations across the network using the industry-wide standard of NetFlow v9 instead of the standard UDP transport.

The NDE Descriptor defines the data query that remains in effect as long as the NDE descriptor exists in NAM’s permanent storage. Having it instantiated means that the NAM will be exporting the matching aggregated data records continuously (in a specified frequency) until the NDE descriptor is deleted or updated.

For information about set up, see Data Export, NetFlow, page 2-49.

Historical Analysis

Unlike previous versions of the NAM, in which you have to configure targeted historical reports in advance, the NAM Traffic Analyzer 5.0 stores short-term and long-term data that you can view using the new dashboards.

The NAM proactively collects and stores up to 72 hours of data at a granularity of 1, 5, or 10 minute intervals, and longer-term data with a granularity of 1 to 2 hours, This allows you to specify different time periods to view trends over time and identify potential problems.

User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0

1-4 OL-22617-01