Cisco Systems NAM, 5 Configuration/guide/span.html, Configuration/guide/nde.html, Ports VLANs

Chapter 1 Overview

Understanding How the NAM Works

•Advanced Troubleshooting. The NAM provides robust capture and decode capabilities for packet traces that can be triggered or terminated based on user-defined thresholds.

•Open instrumentation. The NAM is a mediation and instrumentation product offering, and hence provides a robust API that can be used by partner products as well as customers that have home grown applications. See the Cisco NAM 5.0 API Programmer’s Guide.

The NAM delivers the above functionality by analyzing a wide variety of data sources that include:

•Port mirroring technology like SPAN and RSPAN/ERSPAN. The NAM can analyze Ethernet VLAN traffic from the following sources: Ethernet, Fast Ethernet, Gigabit Ethernet, trunk port, or Fast EtherChannel SPAN, RSPAN, or ERSPAN source port

•VACL

•NetFlow Data Export (NDE). The NAM can analyze NetFlow Data Export (NDE) from Managed Devices (Routers/Switches)

•WAAS

•SNMP

•Network Tap Device. Applies to Cisco NAM 2200 Series appliances only.

The NAM Traffic Analyzer 5.0 retains the ability to use SNMP as a southbound interface for configuration and data retrieval from switches and routers. NAM 5.0 moves away from RMON and toward web services and Netflow Data Export as the northbound interface for data objects. NAM 5.0 will continue to support baseline manageability features of SNMP such as MIB-2 and IF-TABLE, and the health status and interface statistics that can be used by external products like Fault and Configuration Management offerings (for example, CiscoWorks LMS).

For more information about SPAN, RSPAN, and ERSPAN, see the "Configuring Local SPAN, RSPAN, and ERSPAN" chapter in the Catalyst 6500 Series Switch Software Configuration Guide.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/

configuration/guide/span.html

For more general information about NDE, see this section in the Cisco 7600 Series Cisco IOS Software Configuration Guide, 12.2SX.

http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SXF/

configuration/guide/nde.html

Table 1-1summarizes the traffic sources that are used for NAM monitoring.

Table 1-1	Summary of Traffic Sources for NAM Monitoring
Traffic Source			LAN			WAN
		Ports		VLANs	Ports		VLANs
VACL capture		Yes		Yes	Yes		N/A
NetFlow Data Export NDE (local)		Yes		Yes	Yes		Yes
NetFlow Data Export NDE (remote)		Yes		Yes	Yes		Yes
SPAN		Yes		Yes	No		No
ERSPAN		Yes		Yes	No		No

The next sections describe how the NAM uses the supported data sources:

•Understanding How the NAM Uses SPAN, page 1-14

•Understanding How the NAM Uses VACLs, page 1-14

	User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01		1-13