Americas Headquarters
Text Part Number OL-22617-01
Page
N T E N T S
Span
Network Sites
URL
Nbar
System Administration Resources
Audit Trail
Understanding Traffic Patterns at the Network Layer
About This Guide
Chapter Overview
Convention
Audience
Conventions
Boldface font
Obtaining Documentation and Submitting a Service Request
Xiv
Introducing NAM Traffic Analyzer
A P T E R
Dashboards
Logical Site
New Application Classification Architecture
Standards-Based NBI
NetFlow v9 Data Export
Historical Analysis
WS-SVC-NAM-1-250S
Snmp v3 Support -- NAM to Router/Switch Support
Overview of the NAM Platforms
WS-SVC-NAM-2-250S Cisco Branch Routers
Common Navigation and Control Elements
Logging
Navigating the User Interface
Menu Bar
Detailed Views
Context Menus
Quick Capture
Chart View / Grid View
Interactive Report
Zoom/Pan Charts
Mouse-Over for Details
Bytes / Packets
Sort Grid
Statistics
Understanding How the NAM Works
Context-Sensitive Online Help
Configuration/guide/nde.html
Configuration/guide/span.html
Ports VLANs
Module Cisco IOS Software
Understanding How the NAM Uses Span
Understanding How the NAM Uses VACLs
Guide/span.html
Understanding How the NAM Uses NDE
Guide/vacl.html
Understanding How the NAM Uses Waas
Configuration Overview
Action Description GUI Location User Guide Location
Setup Network Sites
Administration System
Setup Data Export
Setup Alarms Actions
Capture Packet
Configuring and Viewing Data
Administration Users
Capture/Decode
Cisco Waas NAM Virtual Service Blade
Default Functions
Traffic Analysis
Application Response Time Metrics
Voice Signaling/RTP Stream Monitoring
Analyze Media Voice Call Statistics
About Span Sessions
Traffic
Traffic Usage Statistics
SPAN, Data Sources, Hardware Deduplication,
NAM Traffic Analyzer the NAM GUI
Switch CLI
Method Usage Notes
Supervisor portCopyTable Snmp
Column Description
Creating a Span Session
State Description
Field Description
Editing a Span Session
Choose Setup Traffic Span Sessions
Dialog Box
Deleting a Span Session
Data Sources
SPAN, ERSPAN, VACL, NetFlow, WAAS,
Fields are explained in -7, NAM Data Sources
Router or switch or WAE device
Or Disabled
Data Port if it is a local physical port, or the IP address
Enabling Auto-Creation of Erspan Data Sources Using the CLI
Click Setup Traffic NAM Data Sources
Disabling Auto-Creation of Erspan Data Sources Using the CLI
Creating Erspan Data Sources Using the Web GUI
Creating Erspan Data Sources Using the CLI
Enter the device ID from Step
Deleting Erspan Data Sources Using the Web GUI
Enter the name you would like for the data source required
Use the no data-sourcecommand to delete the data source
Deleting Erspan Data Sources Using the CLI
Click the Delete button along the bottom of the window
Sample Configuration of Erspan Source
Configuring Erspan on Devices
Use the no device command to delete the device
Sample Configuration of Erspan Destination
Configuring Vacl on a WAN Interface
Sample Configuration
Configuring Vacl on a LAN Vlan
NetFlow
Understanding NetFlow Interfaces
Understanding NetFlow Flow Records
Managing NetFlow Data Sources
Configuring NetFlow on Devices
Output Interface Are Flows Reported?
For Devices Running Cisco IOS
For NAMs Located in a Device Slot
Enabling Auto-Creation of NetFlow Data Sources Using the CLI
Creating NetFlow Data Sources Using the Web GUI
Snmp Credentials
Creating NetFlow Data Sources Using the CLI
Security Level
Deleting NetFlow Data Sources Using the Web GUI
Deleting NetFlow Data Sources Using the CLI
Testing NetFlow Devices
Contact information for the device
Understanding Waas
Snmp read test result. For the local device only
Point, configure a Client WAN data source
Setting Description
Configure a Client data source
Configure a Server WAN data source
Monitoring Server Data Sources
Monitoring Client Data Sources
Monitoring WAN Data Sources
Server data source
Deployment Scenarios
Managing Waas Devices
Deployment Scenario
Choose Setup Traffic NAM Data Sources
Adding Data Sources for New Waas Device
Editing Waas Data Sources
Deleting a Waas Data Source
Hardware Deduplication
Choose Setup Traffic Hardware Deduplication
Auto Create of New Waas Devices
Alarm Actions
Alarms
Alarm Actions, Thresholds, User Scenario,
Alarm Action Configuration
Deleting Alarm Actions
Editing Alarm Actions
Choose Setup Alarms Actions
Application associated with this threshold
Thresholds
Name of the threshold
Site associated with this threshold
Choose Setup Alarms Thresholds
Setting Host Thresholds
Alarm Summary dashboard Monitor Overview Alarm Summary
Field
Setting Conversation Thresholds
Setting Application Thresholds
Dashboard Monitor Overview Alarm Summary , where you
Setting Response Time Thresholds
Dashboard Monitor Overview Alarm Summary, where you
Setting Dscp Thresholds
Give the Dscp Alarm Threshold a name
Chose a Dscp value from the list
High, Low, or High and Low alarms
Setting RTP Stream Thresholds
Give the RTP Streams Alarm Threshold a name
Alarm actions
Setting Voice Signaling Thresholds
Give the NDE Interface Alarm Threshold a name
Setting NDE Interface Thresholds
Dashboard Monitor Overview Alarm Summary , where you can
Choose a data source from the list
Editing an Alarm Threshold
Deleting a NAM Threshold
NetFlow
Data Export
User Scenario
NetFlow, Scheduled Exports, Custom Export,
Choose Setup Data Export NetFlow
Viewing Configured NetFlow Exports
NetFlow Exports screen appears shown in Figure
Port number of the device to be exported to
Configuring NetFlow Data Export
Description of the NetFlow Export
Valid characters 1-9. Length Min 1, Max
Host
Record types supported by NAM for NetFlow are
Application
ART Client Server Application
Editing NetFlow Data Export
Scheduled Exports
Click
Editing a Scheduled Export
Choose Setup Data Export Scheduled Exports
Deleting a Scheduled Export
Custom Export
Managed Device
Device Information
Name of the network administrator for the router
Choose Setup Managed Device Device Information
Total time the switch has been running
Name of the Snmp read-write community string configured on
Nbar Protocol Discovery
Field / Operation Description
Network
Sites
Sites, NDE Interface Capacity, Dscp Groups,
Specifying a Site Using WAE devices Waas Data Sources
Specifying a Site Using Subnets
Definition Rules
Viewing Defined Sites
Specifying a Site Using Multiple Rules
Resolving Ambiguity Overlapping Site Definitions
Name of the site
Shows if the site is Enabled or Disabled
Defining a Site
Description of what the site includes
Optional text string for describing site
See -7for an example
Unique text string for naming a site
Subnet Detection
Subnet Detection
Editing a Site
Enter an IPv4 or IPv6 address
Dscp Groups
NDE Interface Capacity
Creating an NDE Interface
Field Description Usage Notes
Choose Setup Network Dscp Groups
Creating a Dscp Group
Through Dscp AF/EF/CS Format Bit Field Format
Editing a Dscp Group
Classification
Deleting a Dscp Group
Applications
8shows an example of what the screen may look like
Choose Setup Classification Applications
Creating a New Application
That list, highlight it and click the left arrow
Editing an Application
Repeat through as many times as desired
Deleting a Protocol
Choose Setup Classification Application Groups
Application Groups
Creating an Application Group
Deleting an Application Group
URL-based Applications
Editing an Application Group
To edit an application group
Choose Setup Classification URL-based Applications
Example
Editing a URL-Based Application
Deleting a URL-based Application
Encapsulations
Choose Setup Classification Encapsulations
Monitoring
Aggregation Intervals, Response Time, Voice, RTP Filter,
Aggregation Intervals
Choose Setup Monitoring Aggregation Intervals
URL, Waas Monitored Servers,
Short-Term Long-Term
Choose Setup Monitoring Response Time
Response Time
Normal Minimum
Voice
Choose Setup Monitoring Voice
Monitor Setup Window
Field Appliance
10,000 500 1,750 000 1,000 250
Choose Setup Monitoring RTP Filter
RTP Filter
Enabling a URL Collection Changing a URL Collection
Enabling a URL Collection
Choose Setup Monitoring URL
Disabling a URL Collection
To change a URL collection
Changing a URL Collection
Element Description Usage Notes
URL page -10displays
Disabling a URL Collection
Choose Setup Monitoring URL Collection
Waas Monitored Servers
Adding a Waas Monitored Server
Deleting a Waas Monitored Server
Choose Setup Monitoring Waas Servers
To delete a Waas monitored server data source
Monitor
Navigation,
Analyze
Navigation
Interactive Report
Saving Filter Parameters
Saving Filter Information
Traffic Summary
Response Time Summary
Alarm Summary
Site Summary
Top N Applications by Alarm Count
Top N Sites by Alarm Count
Top N Hosts by Site and Alarm Count
Top N Applications by Site and Alarm Count
Analyzing Traffic
Application
Hosts Detail
Host
Applications Detail
Monitored as a whole
NDE Interface Traffic Analysis
Application group set of applications that can be
Traffic rate number of bytes per second
Dscp Detail
Viewing Interface Details
Dscp value
Application Groups Detail
Applicable site or Unassigned if no site
Filtering a URL Collection List
URL Hits
Viewing Collected URLs
Viewing Collected URLs Filtering a URL Collection List
Network Conversation
Host Conversations
Top Application Traffic
Top Application Traffic
Application Traffic By Host
WAN Optimization
Top Talkers Detail
Application Performance Analysis
Conversation Multi-Segments
Response Time
NAM Application Response Time Measurements
7lists and describes the ART metrics measured by NAM
Metric Description
Metric Description
Network Response Time
Application Response Time
Network
Client-Server Response Time
Server Response Time
Client Response Time
Server Application Responses
Server Application Transactions
Detailed Views Server Application Transactions
Server Network Responses
Client-Server Application Responses
Client-Server Application Transactions
Server-response packet, excluding retransmission time
Client-Server Network Responses
Packet as observed at NAM probing point
Interface,
Interfaces Stats Table
Interface
Health, NBAR,
Health
Switch Health
Interface Statistics Over Time
CPU usage
Chassis Health
Chassis Information
Backplane Utilization
Crossbar Switching Fabric
Ternary Content Addressable Memory Information
Router Health
Router Health
Router Information
Media
Information on how to contact this person
Current state of the power supply being instrumented
Time in hundredths of a second since the network management
RTP Stream Information
RTP Streams
Purpose
RTP Stream Stats Summary
Monitoring RTP Streams
Voice Call Statistics
RTP Stream Stats Details
Called number as it appears in the signaling protocol
Calling number as it appears in the signaling protocol
Calls Table
Time when the call was detected to start
From inspecting the call signaling protocol
Inspecting call signaling protocol
Time when the call was detected to end
RTP Conversation
Field Purpose
NAM calculated score that takes into account
Synchronization source number as it appear in the RTP
Header
Duration of the stream
OL-22617-01
Capturing and Decoding Packet Data
Quick Capture
Sessions
Many times as necessary
Viewing Capture Sessions
Name of the capture session
Size of the session
Operation Description
Configuring Capture Sessions
Choose Capture Packet/Capture Decode Sessions
Configure Capture Session Window
Name of the capture Enter a capture name
Maximum Capture Session Sizes for NAM Platforms
Administration System Capture Data Storage
Maximum Session NAM Platform Size
NAM Platform Size
Software Filters
Maximum Session
300 MB
Choose Capture Packet Capture/Decode Sessions
Creating a Software Filter
Software Filter Dialog -4 displays
For MAC address, enter hh hh hh hh hh hh, where hh is a
IPv4 address in dotted-quad format n.n.n.n, where n is 0 to
Default if blank is
Hexadecimal number from 0 to 9 or a to f. The default is
Choose GTP.IPv6 for IPV6 address for tunneled packet over
Editing a Software Capture Filter
To edit software capture filters
Hardware Assisted Filters
Configuring a Hardware Filter
To cancel the changes, click Cancel
Vlan and IP IP and TCP/UDP IP and Payload Data
Vlan and IP
List is also shown in Figure
IP and TCP/UDP
IP and Payload Data
Files
Payload Data
Display the packets in a file
Delete files
Displays a graphic image of network traffic KB/second
Error Scan
Analyzing Capture Files
Displays packets and bytes transferred for each protocol
Downloading Capture Files
Choose Capture Packet Capture/Decode Files
Deleting a Capture File
Deleting Multiple Files
Load and decode the previous block of packets from the NAM
Viewing Packet Decode Information
Stop packet loading
Load and decode the next block of packets from the NAM
Filtering Packets Displayed in the Packet Decoder
Choose a Filter Mode
Browsing Packets in the Packet Decoder
Choose an Address Filter
Viewing Detailed Protocol Decode Information
Define a Protocol Filter
Creating Custom Display Filters
Using Alarm-Triggered Captures
Custom Display Filters
To create custom display filters
Custom Decode Filter Dialog Box
Operator Meaning
Tips for Creating Custom Decode Filter Expressions
See Tips for Creating Custom Decode Filter Expressions
Format
Examples of Custom Decode Filter Expressions
Editing Custom Display Filters
Field Filter By Format
Choose Capture Packet Capture/Decode Display Filters
Deleting Custom Display Filters
To delete custom display filters
OL-22617-01
User and System Administration
System Administration
Resources
Choose Administration System Network Parameters
Network Parameters
Snmp Agent
Creating NAM Community Strings
Choose Administration System Snmp Agent
Working with NAM Community Strings
Snmp Agent Dialog Box displays
Deleting NAM Community Strings
Testing the Router Community Strings
System Time
To delete the NAM community strings
Synchronizing the NAM System Time Locally
Synchronizing the NAM System Time with the Switch or Router
Choose Administration System System Time
Clock set hhmmss mm/dd/yyyy
Configuring the NAM System Time with an NTP Server
Mail Setting
Choose Administration System E-Mail Setting
Web Data Publication
To enable Web Data Publishing
Choose Administration System Web Data Publication
Capture Data Storage
Configuring the NFS Storage Location on the NAM
Configuring the NFS Server
Creating NFS Storage Locations
Editing NFS Storage Locations
Editing iSCSI Storage Locations
ISCSI target name configured on the remote iSCSI server
Creating iSCSI Storage Locations
Name of the remote storage entry
Choose Administration System Syslog Setting
Syslog Setting
Snmp Trap Setting
Choose Administration System Snmp Trap Setting
Editing a NAM Trap Destination
Preferences
Deleting a NAM Trap Destination
Audit Trail
Diagnostics
System Alerts
System Alerts, Audit Trail, Tech Support,
Tech Support
Choose Administration Diagnostics Audit Trail
Choose Administration Diagnostics Tech Support
Downloading Core Files
Privilege Access Level
User Administration
Recovering Passwords
Local Database
Creating a New User
Choose Administration Users Local Database
To create a new user
Editing a User
Choose the Administration Users Local Database
Deleting a User
Establishing TACACS+ Authentication and Authorization
Field Usage Notes
For Windows NT and 2000 Systems
Configuring a Cisco ACS TACACS+ Server
Click Network Configuration Click Add Entry
Click Submit/Restart
Configuring a Generic TACACS+ Server
Adding a NAM User or User Group
Current User Sessions
Parameter Enter
NAM Traffic Analyzer 5.0 Usage Scenarios
Deploying NAMs for Voice/Video applications
Deployment
Deploying NAMs in the Branch
Deploying NAMs for WAN Optimization
Creating Custom Applications
Autodiscovery Capabilities of NAM
Integrating NAM with Third Party Reporting Tools
See Dscp Groups,
Integrating NAM with LMS
Understanding Traffic Patterns at the Network Layer
See Application Response Time, See Thresholds,
Troubleshooting
Using NAM for Problem Isolation
Using NAM for SmartGrid Visibility
Troubleshooting
General NAM Issues
Packet Drops
Error Messages
Does the session from the switch/router work?
NAM Not Responding
Waas Troubleshooting
NAM Behavior
OL-19530-02
Supported MIBs
Module Object Identifier OID and Description Source
Mib-21.rmon16.tokenRing10.ringStation RFC
Mib-21.rmon16.tokenRing10.ringStationConfig RFC
Objects10 Power, Temperature and Fan Status
Mib-21.rmon16.tokenRing10.ringStation RFC OrderTable3
Cat6kXbarMIBObjects1
Cisco9.workgroup5.ciscoStackMIB1.ciscoStatck
CiscoMgmt9.ciscoCat6kCrossbarMIB217.cisco
Crossbar statistics
OL-22617-01
Custom display filters
Capture settings, configuring
Downloading to a file
Creating
Configuring as datasource
IN-2
Alarm thresholds
Ipesp IPIP4
Creating Deleting Editing Spanning, directing traffic for
IN-4
Authentication and authorization, establishing
Server, configuring to support NAM
Voice data Collecting Viewing Voice signaling thresholds
See Virtual Switch Software Waas data sources