2-16
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 2 Setting Up The NAM Traffic Analyzer
Traffic
Step 4 Use the no device command to delete the device:
root@172-20-104-107.cisco.com# no device 1
Sucessfully deleted device 1
root@172-20-104-107.cisco.com#
Note that if the auto-creation mode is on, and the device continues to send ERSPAN packets to the NAM,
the data source (and device entry) will be recreated again automatically as soon as the next ERSPAN
packet arrives. Therefore, if you wish to delete an existing ERSPAN data source, it is usually advisable
to first turn the ERSPAN auto-create feature off, as described earlier.
Configuring ERSPAN on Devices
There are two ways to configure ERSPAN so that the NAM receives the data:
• Sending ERSPAN Data to Layer 3 Interface, page 2-16
• Sending ERSPAN Data Directly to the NAM Management Interface, page 2-17
Sending ERSPAN Data to Layer 3 Interface
To send the data to a layer 3 interface on the Switch housing the NAM, configure the ERSPAN source
session. The ERSPAN destination session then sends the traffic to a NAM data-port. After performing
this configuration, you can select the DATA PORT X data source to analyze the ERSPAN traffic.
Note This method causes the ERSPAN traffic to arrive on one of the NAM data ports, which is the most
efficient method and will not have any adverse effect on the NAM’s IP connectivity. Therefore, we
recommend this method.
Sample Configuration of ERSPAN Source
monitor session 1 type erspan-source
no shut
source interface Fa 3/47
destination
erspan-id N
ip address aa.bb.cc.dd
origin ip address ee.ff.gg.hh
Where:
• erspan-id N is the ERSPAN ID
• aa.bb.cc.dd is the IP address of the destination switch (loopback address or any routable IP address)
• ee.ff.gg.hh is the source IP address of the ERSPAN traffic
Sample Configuration of ERSPAN Destination
monitor session 1 type erspan-destination
no shut
destination analysis-module 2 data-port 2
source
erspan-id N
ip address aa.bb.cc.dd
Where:
• erspan-id N matches the ERSPAN ID at the source switch