Cisco Systems 5, NAM Traffic

2-3

User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0

OL-22617-01

Chapter 2 Setting Up The NAM Traffic Analyzer

Traffic

The NAM Traffic Analyzer provides traffic statistics broken out by application, host, conversation,

VLAN, and DSCP code point. Summary dashboards show Top N charts broken out by these attributes,

as well as detailed views in tabular form. Analysis dashboards show usage over time by one particular

application, host, and so forth, as well as other interesting measurements for the particular element being

analyzed over a user-specified period of time.

Traffic

The NAM 5.0 Traffic Analyzer menu selections for setting up Traffic are:

• SPAN, page 2-3

• Data Sources, page 2-9

• Hardware Deduplication, page 2-35

A switched port analyzer (SPAN) session is an association of a destination port with a set of source ports,

configured with parameters that specify the monitored network traffic. See Data Sources, page 2-9 for

more information about data sources.

The following sections describe SPAN sessions on devices running the NAM:

• About SPAN Sessions, page 2-3

• Creating a SPAN Session, page 2-6

• Editing a SPAN Session, page 2-8

• Deleting a SPAN Session, page 2-9

Note This section applies to WS-SVC-NAM-1 and WS-SVC-NAM-2 devices, the NAM 2220 and 2204

appliances, and the NME-NAM branch routers.

Depending on the IOS running on the Supervisor, port names are displayed differently. Newer versions

of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1. In the VSS,

a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

The NME-NAM device has two Gigabit Ethernet ports—an internal interface and an external interface.

One of the two interfaces must be selected as the NAM management port for IP traffic (such as HTTP

and SNMP). The NAM can monitor traffic for analysis on the internal interface, the external interface,

or both simultaneously. A typical configuration is to monitor LAN and WAN traffic on the internal

interface. However, the external interface can be used to monitor LAN traffic.

WS-SVC-NAM-1 devices can have only one active SPAN session. You can select a switch port or

EtherChannel as the SPAN source; however, you may select only one SPAN type. WS-SVC-NAM-2

devices and switch software support two SPAN destination ports.