Understanding How the NAM Works | Cisco Systems 5 instruction

Chapter 1 Overview

Understanding How the NAM Works

Above the Statistics legend is a dropdown selector, which allows you to choose which of the metrics shown in the “over-time” chart you would like reflected in the Statistics legend. For example, if the line chart has Bytes or Packets in the check boxes above the line chart, the selector over the Statistics legend will show the same choices, Bytes or Packets.

Context-Sensitive Online Help

The “Help” link on the top-right corner of the NAM Traffic Analyzer interface will bring you to the Help page for that particular screen of the GUI..

In addition to the Help link on the top-right corner of each page, some pages also have a blue “i”, which provides help for that specific subject.

Understanding How the NAM Works

The Network Analysis Module (NAM) product family addresses the following major functional areas:

•Network layer Traffic Analysis. The NAM provides comprehensive traffic analysis to identify what applications are running over the network, how much network resources are consumed, and who is using these applications. The NAM offers a rich set of reports with which to view traffic by Hosts, Application or Conversations. See the discussions about Dashboards, starting with Traffic Summary, page 3-4.

•Application Response Time. The NAM can provide passive measurement of TCP-based applications for any given server or client, supplying a wide variety of statistics like response time, network flight time, and transaction time.

•WAN Optimization insight. The NAM can provide insight into WAN Optimization offerings that compress and optimize WAN Traffic for pre- and post-deployment scenarios. This is applicable for Optimized and Passthru traffic.

•Voice Quality Analysis. The NAM provides application performance for real time applications like Voice and Video. The NAM can compute MOS, as well as provide RTP analysis for the media stream. See Media, page 3-37.

	User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
1-12	OL-22617-01

Image 26

Cisco Systems 5 manual Understanding How the NAM Works, Context-Sensitive Online Help

Contents

Americas Headquarters Text Part Number OL-22617-01Page N T E N T S Span Network Sites URL Nbar System Administration Resources Audit Trail Understanding Traffic Patterns at the Network Layer About This Guide Chapter Overview Convention AudienceConventions Boldface font Obtaining Documentation and Submitting a Service Request Xiv Introducing NAM Traffic Analyzer A P T E R Dashboards Logical Site New Application Classification Architecture Standards-Based NBI NetFlow v9 Data Export Historical Analysis WS-SVC-NAM-1-250S Snmp v3 Support -- NAM to Router/Switch SupportOverview of the NAM Platforms WS-SVC-NAM-2-250S Cisco Branch Routers Common Navigation and Control Elements LoggingNavigating the User Interface Menu Bar Detailed Views Context Menus Quick Capture Chart View / Grid View Interactive Report Zoom/Pan Charts Mouse-Over for Details Statistics Sort GridBytes / Packets Understanding How the NAM Works Context-Sensitive Online Help Ports VLANs Configuration/guide/span.htmlConfiguration/guide/nde.html Module Cisco IOS Software Understanding How the NAM Uses SpanUnderstanding How the NAM Uses VACLs Guide/span.html Understanding How the NAM Uses NDE Guide/vacl.html Understanding How the NAM Uses Waas Configuration Overview Action Description GUI Location User Guide Location Setup Network Sites Administration SystemSetup Data Export Setup Alarms Actions Capture Packet Configuring and Viewing DataAdministration Users Capture/Decode Cisco Waas NAM Virtual Service Blade Default Functions Traffic Analysis Analyze Media Voice Call Statistics Voice Signaling/RTP Stream MonitoringApplication Response Time Metrics About Span Sessions TrafficTraffic Usage Statistics SPAN, Data Sources, Hardware Deduplication, NAM Traffic Analyzer the NAM GUI Switch CLIMethod Usage Notes Supervisor portCopyTable Snmp Column Description Creating a Span Session State Description Field Description Dialog Box Choose Setup Traffic Span SessionsEditing a Span Session SPAN, ERSPAN, VACL, NetFlow, WAAS, Data SourcesDeleting a Span Session Fields are explained in -7, NAM Data Sources Router or switch or WAE deviceOr Disabled Data Port if it is a local physical port, or the IP address Enabling Auto-Creation of Erspan Data Sources Using the CLI Click Setup Traffic NAM Data Sources Disabling Auto-Creation of Erspan Data Sources Using the CLI Creating Erspan Data Sources Using the Web GUI Creating Erspan Data Sources Using the CLI Enter the name you would like for the data source required Deleting Erspan Data Sources Using the Web GUIEnter the device ID from Step Click the Delete button along the bottom of the window Deleting Erspan Data Sources Using the CLIUse the no data-sourcecommand to delete the data source Sample Configuration of Erspan Source Configuring Erspan on DevicesUse the no device command to delete the device Sample Configuration of Erspan Destination Configuring Vacl on a WAN Interface Sample Configuration Configuring Vacl on a LAN Vlan NetFlow Understanding NetFlow Interfaces Understanding NetFlow Flow Records Output Interface Are Flows Reported? Configuring NetFlow on DevicesManaging NetFlow Data Sources For Devices Running Cisco IOS For NAMs Located in a Device Slot Enabling Auto-Creation of NetFlow Data Sources Using the CLI Creating NetFlow Data Sources Using the Web GUI Snmp Credentials Creating NetFlow Data Sources Using the CLI Security Level Deleting NetFlow Data Sources Using the Web GUI Deleting NetFlow Data Sources Using the CLI Testing NetFlow Devices Snmp read test result. For the local device only Understanding WaasContact information for the device Point, configure a Client WAN data source Setting DescriptionConfigure a Client data source Configure a Server WAN data source Monitoring Server Data Sources Monitoring Client Data SourcesMonitoring WAN Data Sources Server data source Deployment Scenario Managing Waas DevicesDeployment Scenarios Choose Setup Traffic NAM Data Sources Adding Data Sources for New Waas Device Editing Waas Data Sources Deleting a Waas Data Source Auto Create of New Waas Devices Choose Setup Traffic Hardware DeduplicationHardware Deduplication Alarm Actions, Thresholds, User Scenario, AlarmsAlarm Actions Alarm Action Configuration Choose Setup Alarms Actions Editing Alarm ActionsDeleting Alarm Actions Application associated with this threshold ThresholdsName of the threshold Site associated with this threshold Choose Setup Alarms Thresholds Setting Host ThresholdsAlarm Summary dashboard Monitor Overview Alarm Summary Field Setting Conversation Thresholds Setting Application Thresholds Dashboard Monitor Overview Alarm Summary , where you Setting Response Time Thresholds Dashboard Monitor Overview Alarm Summary, where you Setting Dscp ThresholdsGive the Dscp Alarm Threshold a name Chose a Dscp value from the list High, Low, or High and Low alarms Setting RTP Stream ThresholdsGive the RTP Streams Alarm Threshold a name Alarm actions Setting Voice Signaling Thresholds Give the NDE Interface Alarm Threshold a name Setting NDE Interface ThresholdsDashboard Monitor Overview Alarm Summary , where you can Choose a data source from the list Editing an Alarm Threshold Deleting a NAM Threshold NetFlow Data ExportUser Scenario NetFlow, Scheduled Exports, Custom Export, NetFlow Exports screen appears shown in Figure Viewing Configured NetFlow ExportsChoose Setup Data Export NetFlow Port number of the device to be exported to Configuring NetFlow Data ExportDescription of the NetFlow Export Valid characters 1-9. Length Min 1, Max Host Record types supported by NAM for NetFlow areApplication ART Client Server Application Click Scheduled ExportsEditing NetFlow Data Export Deleting a Scheduled Export Choose Setup Data Export Scheduled ExportsEditing a Scheduled Export Device Information Managed DeviceCustom Export Name of the network administrator for the router Choose Setup Managed Device Device InformationTotal time the switch has been running Name of the Snmp read-write community string configured on Nbar Protocol Discovery Field / Operation Description NetworkSites Sites, NDE Interface Capacity, Dscp Groups, Definition Rules Specifying a Site Using SubnetsSpecifying a Site Using WAE devices Waas Data Sources Resolving Ambiguity Overlapping Site Definitions Specifying a Site Using Multiple RulesViewing Defined Sites Name of the site Shows if the site is Enabled or DisabledDefining a Site Description of what the site includes Optional text string for describing site See -7for an exampleUnique text string for naming a site Subnet Detection Enter an IPv4 or IPv6 address Editing a SiteSubnet Detection Creating an NDE Interface NDE Interface CapacityDscp Groups Field Description Usage Notes Choose Setup Network Dscp GroupsCreating a Dscp Group Through Dscp AF/EF/CS Format Bit Field Format Deleting a Dscp Group ClassificationEditing a Dscp Group Applications 8shows an example of what the screen may look like Choose Setup Classification Applications Creating a New Application Repeat through as many times as desired Editing an ApplicationThat list, highlight it and click the left arrow Deleting a Protocol Choose Setup Classification Application GroupsApplication Groups Creating an Application Group Deleting an Application Group URL-based ApplicationsEditing an Application Group To edit an application group Choose Setup Classification URL-based Applications Example Editing a URL-Based Application Deleting a URL-based Application Encapsulations Choose Setup Classification EncapsulationsMonitoring Aggregation Intervals, Response Time, Voice, RTP Filter, URL, Waas Monitored Servers, Choose Setup Monitoring Aggregation IntervalsAggregation Intervals Short-Term Long-Term Choose Setup Monitoring Response TimeResponse Time Normal Minimum Voice Choose Setup Monitoring VoiceMonitor Setup Window Field Appliance 10,000 500 1,750 000 1,000 250 Choose Setup Monitoring RTP FilterRTP Filter Enabling a URL Collection Changing a URL Collection Disabling a URL Collection Choose Setup Monitoring URLEnabling a URL Collection To change a URL collection Changing a URL CollectionElement Description Usage Notes URL page -10displays Disabling a URL Collection Choose Setup Monitoring URL CollectionWaas Monitored Servers Adding a Waas Monitored Server To delete a Waas monitored server data source Choose Setup Monitoring Waas ServersDeleting a Waas Monitored Server Analyze Navigation,Monitor Navigation Interactive Report Saving Filter Parameters Saving Filter Information Traffic Summary Response Time Summary Alarm Summary Site Summary Top N Applications by Alarm Count Top N Sites by Alarm CountTop N Hosts by Site and Alarm Count Top N Applications by Site and Alarm Count Analyzing Traffic Application Hosts Detail Host Applications Detail Monitored as a whole NDE Interface Traffic AnalysisApplication group set of applications that can be Traffic rate number of bytes per second Dscp value Viewing Interface DetailsDscp Detail Application Groups Detail Applicable site or Unassigned if no site Filtering a URL Collection List URL HitsViewing Collected URLs Viewing Collected URLs Filtering a URL Collection List Top Application Traffic Host ConversationsNetwork Conversation Top Application Traffic Top Talkers Detail WAN OptimizationApplication Traffic By Host Application Performance Analysis Conversation Multi-Segments Response Time NAM Application Response Time Measurements 7lists and describes the ART metrics measured by NAM Metric Description Metric Description Network Application Response TimeNetwork Response Time Client-Server Response Time Server Response TimeClient Response Time Server Application Responses Server Application Transactions Detailed Views Server Application Transactions Server Network Responses Client-Server Application Responses Client-Server Application Transactions Packet as observed at NAM probing point Client-Server Network ResponsesServer-response packet, excluding retransmission time Interface, Health, NBAR, InterfaceInterfaces Stats Table Interface Statistics Over Time Switch HealthHealth CPU usage Chassis HealthChassis Information Backplane Utilization Crossbar Switching Fabric Ternary Content Addressable Memory Information Router Health Router Health Router Information Media Information on how to contact this personCurrent state of the power supply being instrumented Time in hundredths of a second since the network management RTP Stream Information RTP StreamsPurpose RTP Stream Stats Summary RTP Stream Stats Details Voice Call StatisticsMonitoring RTP Streams Calls Table Calling number as it appears in the signaling protocolCalled number as it appears in the signaling protocol Time when the call was detected to start From inspecting the call signaling protocolInspecting call signaling protocol Time when the call was detected to end RTP Conversation Field Purpose NAM calculated score that takes into account Synchronization source number as it appear in the RTPHeader Duration of the stream OL-22617-01 Capturing and Decoding Packet Data Quick Capture Sessions Many times as necessary Viewing Capture SessionsName of the capture session Size of the session Choose Capture Packet/Capture Decode Sessions Configuring Capture SessionsOperation Description Configure Capture Session Window Name of the capture Enter a capture name Maximum Session NAM Platform Size Administration System Capture Data StorageMaximum Capture Session Sizes for NAM Platforms NAM Platform Size Software FiltersMaximum Session 300 MB Software Filter Dialog -4 displays Creating a Software FilterChoose Capture Packet Capture/Decode Sessions For MAC address, enter hh hh hh hh hh hh, where hh is a IPv4 address in dotted-quad format n.n.n.n, where n is 0 toDefault if blank is Hexadecimal number from 0 to 9 or a to f. The default is Choose GTP.IPv6 for IPV6 address for tunneled packet over Editing a Software Capture Filter To edit software capture filters Hardware Assisted Filters Configuring a Hardware FilterTo cancel the changes, click Cancel Vlan and IP IP and TCP/UDP IP and Payload Data Vlan and IP List is also shown in Figure IP and TCP/UDP IP and Payload Data Files Payload Data Display the packets in a file Delete files Displays a graphic image of network traffic KB/second Error ScanAnalyzing Capture Files Displays packets and bytes transferred for each protocol Downloading Capture Files Choose Capture Packet Capture/Decode Files Deleting a Capture File Deleting Multiple Files Load and decode the previous block of packets from the NAM Viewing Packet Decode InformationStop packet loading Load and decode the next block of packets from the NAM Filtering Packets Displayed in the Packet Decoder Choose a Filter ModeBrowsing Packets in the Packet Decoder Choose an Address Filter Viewing Detailed Protocol Decode Information Define a Protocol Filter Creating Custom Display Filters Using Alarm-Triggered CapturesCustom Display Filters To create custom display filters Custom Decode Filter Dialog Box Operator Meaning Tips for Creating Custom Decode Filter ExpressionsSee Tips for Creating Custom Decode Filter Expressions Format Examples of Custom Decode Filter Expressions Editing Custom Display FiltersField Filter By Format Choose Capture Packet Capture/Decode Display Filters Deleting Custom Display Filters To delete custom display filters OL-22617-01 User and System Administration System Administration Network Parameters Choose Administration System Network ParametersResources Snmp Agent Creating NAM Community Strings Choose Administration System Snmp AgentWorking with NAM Community Strings Snmp Agent Dialog Box displays Deleting NAM Community Strings Testing the Router Community StringsSystem Time To delete the NAM community strings Synchronizing the NAM System Time Locally Synchronizing the NAM System Time with the Switch or RouterChoose Administration System System Time Clock set hhmmss mm/dd/yyyy Choose Administration System E-Mail Setting Mail SettingConfiguring the NAM System Time with an NTP Server Web Data Publication To enable Web Data PublishingChoose Administration System Web Data Publication Capture Data Storage Creating NFS Storage Locations Configuring the NFS ServerConfiguring the NFS Storage Location on the NAM Editing NFS Storage Locations Editing iSCSI Storage Locations ISCSI target name configured on the remote iSCSI serverCreating iSCSI Storage Locations Name of the remote storage entry Choose Administration System Syslog Setting Syslog SettingSnmp Trap Setting Choose Administration System Snmp Trap Setting Deleting a NAM Trap Destination PreferencesEditing a NAM Trap Destination Audit Trail DiagnosticsSystem Alerts System Alerts, Audit Trail, Tech Support, Tech Support Choose Administration Diagnostics Audit TrailChoose Administration Diagnostics Tech Support Downloading Core Files Privilege Access Level User AdministrationRecovering Passwords Local Database To create a new user Choose Administration Users Local DatabaseCreating a New User Deleting a User Choose the Administration Users Local DatabaseEditing a User Establishing TACACS+ Authentication and Authorization Field Usage Notes For Windows NT and 2000 Systems Configuring a Cisco ACS TACACS+ ServerClick Network Configuration Click Add Entry Click Submit/Restart Configuring a Generic TACACS+ Server Adding a NAM User or User Group Current User Sessions Parameter Enter NAM Traffic Analyzer 5.0 Usage Scenarios Deploying NAMs for Voice/Video applications DeploymentDeploying NAMs in the Branch Deploying NAMs for WAN Optimization Integrating NAM with Third Party Reporting Tools Autodiscovery Capabilities of NAMCreating Custom Applications See Dscp Groups, Integrating NAM with LMSUnderstanding Traffic Patterns at the Network Layer See Application Response Time, See Thresholds, Troubleshooting Using NAM for Problem Isolation Using NAM for SmartGrid Visibility Troubleshooting General NAM Issues Packet Drops Error MessagesDoes the session from the switch/router work? NAM Not Responding Waas Troubleshooting NAM Behavior OL-19530-02 Supported MIBs Module Object Identifier OID and Description Source Mib-21.rmon16.tokenRing10.ringStation RFC Mib-21.rmon16.tokenRing10.ringStationConfig RFCObjects10 Power, Temperature and Fan Status Mib-21.rmon16.tokenRing10.ringStation RFC OrderTable3 Cat6kXbarMIBObjects1 Cisco9.workgroup5.ciscoStackMIB1.ciscoStatckCiscoMgmt9.ciscoCat6kCrossbarMIB217.cisco Crossbar statistics OL-22617-01 Custom display filters Capture settings, configuringDownloading to a file Creating Configuring as datasource IN-2 Alarm thresholds Ipesp IPIP4 Creating Deleting Editing Spanning, directing traffic for IN-4 Authentication and authorization, establishing Server, configuring to support NAM Voice data Collecting Viewing Voice signaling thresholds See Virtual Switch Software Waas data sources