Text Part Number OL-22617-01
Americas Headquarters
Page
N T E N T S
Span
Network Sites
URL
Nbar
System Administration Resources
Audit Trail
Understanding Traffic Patterns at the Network Layer
Chapter Overview
About This Guide
Boldface font
Audience
Conventions
Convention
Obtaining Documentation and Submitting a Service Request
Xiv
A P T E R
Introducing NAM Traffic Analyzer
Logical Site
Dashboards
Standards-Based NBI
New Application Classification Architecture
Historical Analysis
NetFlow v9 Data Export
WS-SVC-NAM-2-250S Cisco Branch Routers
Snmp v3 Support -- NAM to Router/Switch Support
Overview of the NAM Platforms
WS-SVC-NAM-1-250S
Menu Bar
Logging
Navigating the User Interface
Common Navigation and Control Elements
Detailed Views
Quick Capture
Context Menus
Interactive Report
Chart View / Grid View
Mouse-Over for Details
Zoom/Pan Charts
Bytes / Packets
Sort Grid
Statistics
Context-Sensitive Online Help
Understanding How the NAM Works
Configuration/guide/nde.html
Configuration/guide/span.html
Ports VLANs
Guide/span.html
Understanding How the NAM Uses Span
Understanding How the NAM Uses VACLs
Module Cisco IOS Software
Guide/vacl.html
Understanding How the NAM Uses NDE
Understanding How the NAM Uses Waas
Action Description GUI Location User Guide Location
Configuration Overview
Setup Alarms Actions
Administration System
Setup Data Export
Setup Network Sites
Capture/Decode
Configuring and Viewing Data
Administration Users
Capture Packet
Cisco Waas NAM Virtual Service Blade
Traffic Analysis
Default Functions
Application Response Time Metrics
Voice Signaling/RTP Stream Monitoring
Analyze Media Voice Call Statistics
SPAN, Data Sources, Hardware Deduplication,
Traffic
Traffic Usage Statistics
About Span Sessions
Supervisor portCopyTable Snmp
Switch CLI
Method Usage Notes
NAM Traffic Analyzer the NAM GUI
Column Description
State Description
Creating a Span Session
Field Description
Editing a Span Session
Choose Setup Traffic Span Sessions
Dialog Box
Deleting a Span Session
Data Sources
SPAN, ERSPAN, VACL, NetFlow, WAAS,
Data Port if it is a local physical port, or the IP address
Router or switch or WAE device
Or Disabled
Fields are explained in -7, NAM Data Sources
Click Setup Traffic NAM Data Sources
Enabling Auto-Creation of Erspan Data Sources Using the CLI
Creating Erspan Data Sources Using the Web GUI
Disabling Auto-Creation of Erspan Data Sources Using the CLI
Creating Erspan Data Sources Using the CLI
Enter the device ID from Step
Deleting Erspan Data Sources Using the Web GUI
Enter the name you would like for the data source required
Use the no data-sourcecommand to delete the data source
Deleting Erspan Data Sources Using the CLI
Click the Delete button along the bottom of the window
Sample Configuration of Erspan Destination
Configuring Erspan on Devices
Use the no device command to delete the device
Sample Configuration of Erspan Source
Sample Configuration
Configuring Vacl on a WAN Interface
NetFlow
Configuring Vacl on a LAN Vlan
Understanding NetFlow Flow Records
Understanding NetFlow Interfaces
Managing NetFlow Data Sources
Configuring NetFlow on Devices
Output Interface Are Flows Reported?
For Devices Running Cisco IOS
For NAMs Located in a Device Slot
Creating NetFlow Data Sources Using the Web GUI
Enabling Auto-Creation of NetFlow Data Sources Using the CLI
Snmp Credentials
Creating NetFlow Data Sources Using the CLI
Security Level
Deleting NetFlow Data Sources Using the CLI
Deleting NetFlow Data Sources Using the Web GUI
Testing NetFlow Devices
Contact information for the device
Understanding Waas
Snmp read test result. For the local device only
Configure a Server WAN data source
Setting Description
Configure a Client data source
Point, configure a Client WAN data source
Server data source
Monitoring Client Data Sources
Monitoring WAN Data Sources
Monitoring Server Data Sources
Deployment Scenarios
Managing Waas Devices
Deployment Scenario
Adding Data Sources for New Waas Device
Choose Setup Traffic NAM Data Sources
Deleting a Waas Data Source
Editing Waas Data Sources
Hardware Deduplication
Choose Setup Traffic Hardware Deduplication
Auto Create of New Waas Devices
Alarm Actions
Alarms
Alarm Actions, Thresholds, User Scenario,
Alarm Action Configuration
Deleting Alarm Actions
Editing Alarm Actions
Choose Setup Alarms Actions
Site associated with this threshold
Thresholds
Name of the threshold
Application associated with this threshold
Field
Setting Host Thresholds
Alarm Summary dashboard Monitor Overview Alarm Summary
Choose Setup Alarms Thresholds
Setting Conversation Thresholds
Dashboard Monitor Overview Alarm Summary , where you
Setting Application Thresholds
Setting Response Time Thresholds
Chose a Dscp value from the list
Setting Dscp Thresholds
Give the Dscp Alarm Threshold a name
Dashboard Monitor Overview Alarm Summary, where you
Alarm actions
Setting RTP Stream Thresholds
Give the RTP Streams Alarm Threshold a name
High, Low, or High and Low alarms
Setting Voice Signaling Thresholds
Choose a data source from the list
Setting NDE Interface Thresholds
Dashboard Monitor Overview Alarm Summary , where you can
Give the NDE Interface Alarm Threshold a name
Deleting a NAM Threshold
Editing an Alarm Threshold
NetFlow, Scheduled Exports, Custom Export,
Data Export
User Scenario
NetFlow
Choose Setup Data Export NetFlow
Viewing Configured NetFlow Exports
NetFlow Exports screen appears shown in Figure
Valid characters 1-9. Length Min 1, Max
Configuring NetFlow Data Export
Description of the NetFlow Export
Port number of the device to be exported to
ART Client Server Application
Record types supported by NAM for NetFlow are
Application
Host
Editing NetFlow Data Export
Scheduled Exports
Click
Editing a Scheduled Export
Choose Setup Data Export Scheduled Exports
Deleting a Scheduled Export
Custom Export
Managed Device
Device Information
Name of the Snmp read-write community string configured on
Choose Setup Managed Device Device Information
Total time the switch has been running
Name of the network administrator for the router
Nbar Protocol Discovery
Sites, NDE Interface Capacity, Dscp Groups,
Network
Sites
Field / Operation Description
Specifying a Site Using WAE devices Waas Data Sources
Specifying a Site Using Subnets
Definition Rules
Viewing Defined Sites
Specifying a Site Using Multiple Rules
Resolving Ambiguity Overlapping Site Definitions
Description of what the site includes
Shows if the site is Enabled or Disabled
Defining a Site
Name of the site
Subnet Detection
See -7for an example
Unique text string for naming a site
Optional text string for describing site
Subnet Detection
Editing a Site
Enter an IPv4 or IPv6 address
Dscp Groups
NDE Interface Capacity
Creating an NDE Interface
Through Dscp AF/EF/CS Format Bit Field Format
Choose Setup Network Dscp Groups
Creating a Dscp Group
Field Description Usage Notes
Editing a Dscp Group
Classification
Deleting a Dscp Group
8shows an example of what the screen may look like
Applications
Creating a New Application
Choose Setup Classification Applications
That list, highlight it and click the left arrow
Editing an Application
Repeat through as many times as desired
Creating an Application Group
Choose Setup Classification Application Groups
Application Groups
Deleting a Protocol
To edit an application group
URL-based Applications
Editing an Application Group
Deleting an Application Group
Example
Choose Setup Classification URL-based Applications
Deleting a URL-based Application
Editing a URL-Based Application
Aggregation Intervals, Response Time, Voice, RTP Filter,
Choose Setup Classification Encapsulations
Monitoring
Encapsulations
Aggregation Intervals
Choose Setup Monitoring Aggregation Intervals
URL, Waas Monitored Servers,
Normal Minimum
Choose Setup Monitoring Response Time
Response Time
Short-Term Long-Term
Field Appliance
Choose Setup Monitoring Voice
Monitor Setup Window
Voice
Enabling a URL Collection Changing a URL Collection
Choose Setup Monitoring RTP Filter
RTP Filter
10,000 500 1,750 000 1,000 250
Enabling a URL Collection
Choose Setup Monitoring URL
Disabling a URL Collection
URL page -10displays
Changing a URL Collection
Element Description Usage Notes
To change a URL collection
Adding a Waas Monitored Server
Choose Setup Monitoring URL Collection
Waas Monitored Servers
Disabling a URL Collection
Deleting a Waas Monitored Server
Choose Setup Monitoring Waas Servers
To delete a Waas monitored server data source
Monitor
Navigation,
Analyze
Interactive Report
Navigation
Saving Filter Information
Saving Filter Parameters
Traffic Summary
Response Time Summary
Site Summary
Alarm Summary
Top N Applications by Site and Alarm Count
Top N Sites by Alarm Count
Top N Hosts by Site and Alarm Count
Top N Applications by Alarm Count
Analyzing Traffic
Hosts Detail
Application
Applications Detail
Host
Traffic rate number of bytes per second
NDE Interface Traffic Analysis
Application group set of applications that can be
Monitored as a whole
Dscp Detail
Viewing Interface Details
Dscp value
Applicable site or Unassigned if no site
Application Groups Detail
Viewing Collected URLs Filtering a URL Collection List
URL Hits
Viewing Collected URLs
Filtering a URL Collection List
Network Conversation
Host Conversations
Top Application Traffic
Top Application Traffic
Application Traffic By Host
WAN Optimization
Top Talkers Detail
Conversation Multi-Segments
Application Performance Analysis
NAM Application Response Time Measurements
Response Time
Metric Description
7lists and describes the ART metrics measured by NAM
Metric Description
Network Response Time
Application Response Time
Network
Server Application Responses
Server Response Time
Client Response Time
Client-Server Response Time
Detailed Views Server Application Transactions
Server Application Transactions
Server Network Responses
Client-Server Application Responses
Client-Server Application Transactions
Server-response packet, excluding retransmission time
Client-Server Network Responses
Packet as observed at NAM probing point
Interface,
Interfaces Stats Table
Interface
Health, NBAR,
Health
Switch Health
Interface Statistics Over Time
Backplane Utilization
Chassis Health
Chassis Information
CPU usage
Crossbar Switching Fabric
Ternary Content Addressable Memory Information
Router Health
Router Health
Router Information
Time in hundredths of a second since the network management
Information on how to contact this person
Current state of the power supply being instrumented
Media
RTP Stream Stats Summary
RTP Streams
Purpose
RTP Stream Information
Monitoring RTP Streams
Voice Call Statistics
RTP Stream Stats Details
Called number as it appears in the signaling protocol
Calling number as it appears in the signaling protocol
Calls Table
Time when the call was detected to end
From inspecting the call signaling protocol
Inspecting call signaling protocol
Time when the call was detected to start
Field Purpose
RTP Conversation
Duration of the stream
Synchronization source number as it appear in the RTP
Header
NAM calculated score that takes into account
OL-22617-01
Quick Capture
Capturing and Decoding Packet Data
Sessions
Size of the session
Viewing Capture Sessions
Name of the capture session
Many times as necessary
Operation Description
Configuring Capture Sessions
Choose Capture Packet/Capture Decode Sessions
Name of the capture Enter a capture name
Configure Capture Session Window
Maximum Capture Session Sizes for NAM Platforms
Administration System Capture Data Storage
Maximum Session NAM Platform Size
300 MB
Software Filters
Maximum Session
NAM Platform Size
Choose Capture Packet Capture/Decode Sessions
Creating a Software Filter
Software Filter Dialog -4 displays
Hexadecimal number from 0 to 9 or a to f. The default is
IPv4 address in dotted-quad format n.n.n.n, where n is 0 to
Default if blank is
For MAC address, enter hh hh hh hh hh hh, where hh is a
Choose GTP.IPv6 for IPV6 address for tunneled packet over
To edit software capture filters
Editing a Software Capture Filter
Vlan and IP IP and TCP/UDP IP and Payload Data
Configuring a Hardware Filter
To cancel the changes, click Cancel
Hardware Assisted Filters
List is also shown in Figure
Vlan and IP
IP and Payload Data
IP and TCP/UDP
Payload Data
Files
Delete files
Display the packets in a file
Displays packets and bytes transferred for each protocol
Error Scan
Analyzing Capture Files
Displays a graphic image of network traffic KB/second
Choose Capture Packet Capture/Decode Files
Downloading Capture Files
Deleting Multiple Files
Deleting a Capture File
Load and decode the next block of packets from the NAM
Viewing Packet Decode Information
Stop packet loading
Load and decode the previous block of packets from the NAM
Choose an Address Filter
Choose a Filter Mode
Browsing Packets in the Packet Decoder
Filtering Packets Displayed in the Packet Decoder
Define a Protocol Filter
Viewing Detailed Protocol Decode Information
To create custom display filters
Using Alarm-Triggered Captures
Custom Display Filters
Creating Custom Display Filters
Custom Decode Filter Dialog Box
Format
Tips for Creating Custom Decode Filter Expressions
See Tips for Creating Custom Decode Filter Expressions
Operator Meaning
Choose Capture Packet Capture/Decode Display Filters
Editing Custom Display Filters
Field Filter By Format
Examples of Custom Decode Filter Expressions
To delete custom display filters
Deleting Custom Display Filters
OL-22617-01
System Administration
User and System Administration
Resources
Choose Administration System Network Parameters
Network Parameters
Snmp Agent
Snmp Agent Dialog Box displays
Choose Administration System Snmp Agent
Working with NAM Community Strings
Creating NAM Community Strings
To delete the NAM community strings
Testing the Router Community Strings
System Time
Deleting NAM Community Strings
Clock set hhmmss mm/dd/yyyy
Synchronizing the NAM System Time with the Switch or Router
Choose Administration System System Time
Synchronizing the NAM System Time Locally
Configuring the NAM System Time with an NTP Server
Mail Setting
Choose Administration System E-Mail Setting
Capture Data Storage
To enable Web Data Publishing
Choose Administration System Web Data Publication
Web Data Publication
Configuring the NFS Storage Location on the NAM
Configuring the NFS Server
Creating NFS Storage Locations
Editing NFS Storage Locations
Name of the remote storage entry
ISCSI target name configured on the remote iSCSI server
Creating iSCSI Storage Locations
Editing iSCSI Storage Locations
Choose Administration System Snmp Trap Setting
Syslog Setting
Snmp Trap Setting
Choose Administration System Syslog Setting
Editing a NAM Trap Destination
Preferences
Deleting a NAM Trap Destination
System Alerts, Audit Trail, Tech Support,
Diagnostics
System Alerts
Audit Trail
Downloading Core Files
Choose Administration Diagnostics Audit Trail
Choose Administration Diagnostics Tech Support
Tech Support
Local Database
User Administration
Recovering Passwords
Privilege Access Level
Creating a New User
Choose Administration Users Local Database
To create a new user
Editing a User
Choose the Administration Users Local Database
Deleting a User
Field Usage Notes
Establishing TACACS+ Authentication and Authorization
Click Submit/Restart
Configuring a Cisco ACS TACACS+ Server
Click Network Configuration Click Add Entry
For Windows NT and 2000 Systems
Adding a NAM User or User Group
Configuring a Generic TACACS+ Server
Parameter Enter
Current User Sessions
NAM Traffic Analyzer 5.0 Usage Scenarios
Deploying NAMs for WAN Optimization
Deployment
Deploying NAMs in the Branch
Deploying NAMs for Voice/Video applications
Creating Custom Applications
Autodiscovery Capabilities of NAM
Integrating NAM with Third Party Reporting Tools
See Application Response Time, See Thresholds,
Integrating NAM with LMS
Understanding Traffic Patterns at the Network Layer
See Dscp Groups,
Using NAM for Problem Isolation
Troubleshooting
Using NAM for SmartGrid Visibility
General NAM Issues
Troubleshooting
NAM Not Responding
Error Messages
Does the session from the switch/router work?
Packet Drops
NAM Behavior
Waas Troubleshooting
OL-19530-02
Module Object Identifier OID and Description Source
Supported MIBs
Mib-21.rmon16.tokenRing10.ringStation RFC OrderTable3
Mib-21.rmon16.tokenRing10.ringStationConfig RFC
Objects10 Power, Temperature and Fan Status
Mib-21.rmon16.tokenRing10.ringStation RFC
Crossbar statistics
Cisco9.workgroup5.ciscoStackMIB1.ciscoStatck
CiscoMgmt9.ciscoCat6kCrossbarMIB217.cisco
Cat6kXbarMIBObjects1
OL-22617-01
Creating
Capture settings, configuring
Downloading to a file
Custom display filters
IN-2
Configuring as datasource
Ipesp IPIP4
Alarm thresholds
IN-4
Creating Deleting Editing Spanning, directing traffic for
Server, configuring to support NAM
Authentication and authorization, establishing
See Virtual Switch Software Waas data sources
Voice data Collecting Viewing Voice signaling thresholds