2-10
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 2 Setting Up The NAM Traffic Analyzer
Traffic
The fields are explained in Table 2-7, NAM Data Sources.
SPAN
A switched port analyzer (SPAN) session is an association of a destination port with a set of source ports,
configured with parameters that specify the monitored network traffic. You can configure up to two
SPAN sessions in a Catalyst 6500 or 7600 Routers chassis.
For information about SPAN sessions, see SPAN, page 2-3.
ERSPAN
This section describes how to configure Encapsulated Remote Switched Port Analyzer (ERSPAN) of the
Catalyst 6500 switch or Cisco 7600 series router as a NAM data source. You configure ERSPAN as a
NAM data source from the Catalyst 6500 switch or Cisco 7600 series router command line interface, not
the NAM GUI.
As an ERSPAN consumer, the NAM can receive ERSPAN packets on its management port from devices
such as Cisco routers and switches. Those packets are analyzed as if that traffic had appeared on one of
the NAM data ports. The NAM supports ERSPAN versions 1 and 3. Incoming ERSPAN data is parsed
by the NAM, stored in its internal database, and presented in the GUI in the same way as traffic from
other data sources.
For the NAM to receive ERSPAN from an external switch or router, that device must be configured to
send ERSPAN packets to the NAM’s IP address.
See the following sections about using ERSPAN as a data source:
• Enabling Auto-Creation of ERSPAN Data Sources Using the Web GUI, page 2-11
• Enabling Auto-Creation of ERSPAN Data Sources Using the CLI, page 2-11
• Disabling Auto-Creation of ERSPAN Data Sources Using the Web GUI, page 2-12
• Disabling Auto-Creation of ERSPAN Data Sources Using the CLI, page 2-12
• Creating ERSPAN Data Sources Using the Web GUI, page 2-12
• Creating ERSPAN Data Sources Using the CLI, page 2-12
Tab l e 2-7 NAM Data Sources
Field Description
Device DATA PORT if it is a local physical port, or the IP address of the
learned device.
Type The source of traffic for the NAM.
DATA PORT if it is a local physical port.
WAAS, ERSPAN, or NETFLOW if a data stream exported from the
router or switch or WAE device.
Activity Shows the most recent activity.
Status ACTIVE or INACTIVE.
Data Source The Name given to the data source.
Data Source Details “Physical Port”, or information about the data source being Enabled
or Disabled.