Cisco Services Modules

Cisco Branch Routers Series Network Analysis Module 4.0

  • Viewing Options

  • PDF (661.2 KB)
  • Feedback

In today's business reality, distributed enterprises heavily rely on applications for communication, collaboration, and effective day-to-day operations. At the same time, IT is challenged with managing application delivery in an environment that is rapidly changing. The number of business applications is growing, application architectures are increasingly complex, application traffic is proliferating, and traffic patterns are difficult to predict. In addition, driven by security, regulatory, and economic considerations, enterprises are embracing data center consolidation, desktop virtualization, and network and application convergence to maximize the value of their IT investments. This demands comprehensive application and network visibility to successfully deliver disparate applications in a complex IT environment.

Cisco ® Network Analysis Module (NAM) is a powerful network-aware performance assurance solution that delivers unparalleled visibility into application and network performance to help ensure the consistent and efficient delivery of applications and services to end users.

Product Overview

Cisco Branch Routers Series Network Analysis Module (Figure 1) is an all-inclusive solution that combines performance monitoring, traffic analysis, and advanced troubleshooting to meet the performance assurance needs of today's dynamic, evolving enterprises. It is designed to provide deeper insight into the branch both at the network and application levels. It offers real-time visibility into the applications running on the network, how the network resources are being utilized, and how the end users experience the services being delivered in the empowered branch. The visibility helps enable IT to effectively use control and optimization mechanisms such as quality of service (QoS) and Wide Area Application Services (WAAS) to improve performance of these services.

Figure 1. Cisco Branch Routers Series NAM, NME-NAM

The unique design of Cisco Branch Routers Series NAM combines a rich set of embedded data collection capabilities and performance analytics with a remotely accessible, web-based management console, all of which reside on a single network module that is installed into Cisco 3900 Series, Cisco 2900 Series, Cisco 2800 Series or Cisco ® 3800 Series Integrated Services Routers, or Cisco 3700 Series Multiservice Access Routers.
Cisco Branch Routers Series NAM directly monitors and analyzes the WAN and LAN data streams using Cisco Express Forwarding to copy the actual packets traversing the router interfaces to the internal NAM interface. The direct access to the data path from inside the routers gives Cisco NAM the advantage in providing granular packet-level analytics to accurately characterize application performance and quality of experience. Cisco NAM also uses Cisco IOS ® Software features, such as Cisco NetFlow, from both local and remote routers and switches to provide insight into network traffic in the empowered branch.
Cisco NAM includes an embedded, web-based Traffic Analyzer GUI, which provides quick access to the configuration menus and application performance views for voice, video, and TCP-based applications. It also provides traffic analysis views with the detailed information on VLANs, Differentiated Services (DiffServ), hosts, conversation pairs, and application usage that is essential for managing effective and reliable delivery of applications. Figure 2 highlights the deployment of Cisco Branch Routers Series NAM, Cisco Catalyst ® 6500 Series NAM, and Cisco NAM Appliance, offering the deployment flexibility and comprehensive visibility required to deliver consistent performance levels across the network. As illustrated in the figure, Cisco NAM deployed in the branch provides end-to-end visibility for both branch-to-branch applications, such as voice, and TCP-based applications hosted in the data center.

Figure 2. Deploying Cisco Branch Routers Series NAM to Build Intelligence into the Empowered Branch

Features and Benefits

Intelligent Application Performance Analytics

Cisco NAM 4.0 provides comprehensive intelligent application performance (IAP) measurements to accurately characterize end-user experience. It analyzes the TCP-based client/server messages to provide transaction- and session-based statistics. Intelligence derived from integrated application and network visibility helps to isolate application problems to the network, the application, or the server. It also helps to quickly analyze the root cause and resolve problems, minimizing any impact to the end users.
The Cisco NAM GUI allows network administrators to correlate the end-user experience with network performance metrics, such as network delay, round-trip time, retransmission time, and so on, to identify the cause of degradation. For example, the source of network latency affecting the end-user experience can be identified by analyzing network delay metrics, namely client network delay, server network delay, and network delay. Similarly, server resource issues can be identified by network metrics such as application delay and server response time.
Figure 3 provides an example of the application response time report for an HTTP application. The report shows reduction in the application delay after the administrator restarted a hung process on the application server.

Figure 3. Troubleshooting Response Time in the Empowered Branch

The application performance data can also be analyzed over time to identify trends, track service-level objectives, and establish meaningful thresholds to receive proactive actionable alerts. Thus, degradations in application performance can be preempted, and the underlying cause can be promptly investigated and resolved before it affects the end user. The changes in network and application usage can also be correlated with fluctuations in response times. The capability allows administrators to assess and predict the impact of new application rollouts, WAN optimization, or changes in user populations on application performance.

Visibility into WAN-Optimized Networks

Cisco Wide Area Application Services is a powerful application acceleration and WAN optimization solution that optimizes the performance of TCP-based applications operating in a WAN environment. This optimization allows IT organizations to consolidate costly branch-office servers and storage in centrally managed data centers and to deploy new applications directly from the data center while offering LAN-like application performance for any employee, regardless of location.
In a typical WAN-optimized deployment, the interception of application traffic obscures the response time, data transfer time, and other performance metrics; hence the traditional monitoring techniques fail to accurately characterize the impact of optimization.

Figure 4. Assessing the Impact of WAAS Optimization

Cisco NAM 4.0 uses the built-in instrumentation on the Wide-Area Application Engine devices as additional data sources to gather flow data for optimized traffic and provide end-to-end application performance visibility in a WAAS environment. It measures and reports on application response time, transaction time, bandwidth usage, and LAN/WAN data throughput among other performance metrics. As a result, it can accurately quantify the impact of WAAS optimization as illustrated in Figure 4.
Cisco NAM can also help to assess which applications would benefit the most from deploying WAN optimization and application acceleration services. Analyzing the response time data over a period of time, the administrator can identify the applications where the response time improvement can be significant with an increase in available bandwidth. In addition, understanding the traffic mix provides a sense of how much compression could be achieved with WAAS based on the type of applications in the mix.
Finally, Cisco NAM can be used to provide real-time visibility for ongoing optimization improvements, to monitor optimized and nonoptimized applications, and to troubleshooting any performance degradation issues.

Superior Voice Quality Monitoring

Cisco NAM offers real-time voice quality monitoring using Mean Opinion Score (MOS) and key performance indicators such as jitter and packet loss. It calculates MOS based on R-Factor (ITU-T G.107 Recommendations). It also integrates with Cisco Unified Communications Management Suite to deliver an enterprisewide voice management solution. Cisco NAM offers scalable and flexible deployment options complementing Cisco Unified Communications Management Suite with networkwide visibility allowing enforcement of end-to-end service-level objectives.
Figure 5 presents the last 60-minute view summarizing the voice quality for the active calls. The interface allows the user to filter the data by quality grade (Poor, Fair, Good, Excellent) and identify any anomalous behavior.

Figure 5. Monitoring Voice Quality (MOS) for Active Calls

Cisco NAM combines superior voice characterization with real-time troubleshooting capabilities to help improve the quality of voice services delivered to the end user. It can generate proactive alerts to notify of possible voice quality degradations. Acting on the alerts, the administrator can rapidly pinpoint the degraded voice stream and correlate it with network performance indicators such as jitter and packet loss to analyze the underlying cause. Voice performance issues can be further investigated using the traffic analysis capabilities of Cisco NAM. The administrator can use Cisco NAM's DiffServ monitoring capabilities (Figure 6) to monitor traffic by differentiated services code point (DSCP) allocations defined by QoS policies. This allows administrators to detect whether voice is misclassified or whether nonbusiness critical traffic is contending with voice for network resources, hence affecting voice quality.

Figure 6. Analyzing QoS Using DSMON

WAN Usage Monitoring at the Application Level

One of the foundations of Cisco NAM is its ability to look inside the live packet to gather information on applications, hosts, and conversations. Application monitoring identifies every application that has consumed bandwidth, reports how much bandwidth has been consumed, and detects which hosts are using which applications. Host and conversation-pair monitoring provides bandwidth consumption per host and shows which hosts are talking to each other along with the amount of traffic each host is generating. Monitoring applications, hosts, and conversations can help to proactively spot bottlenecks before the network suffers blows to performance and availability. It can also help improve WAN traffic performance, since these metrics reveal usage patterns for users as well as for router and switch, interface, server, and application resources.
Besides delivering a real-time snapshot of bandwidth usage and consumption, Cisco NAM also delivers a continuous historical view of how the bandwidth was used so the network administrator can quickly decide when and where to make changes in network resources. As an example, Figure 7 presents the report highlighting the applications utilizing the most bandwidth. Data can also be collected over a select period of time and then analyzed after the event to discover when an anomaly has occurred so it can be quickly resolved.

Figure 7. Identifying the Top Applications

Advanced Troubleshooting

On detecting degradation in performance, Cisco NAM can automatically trigger packet capture to help investigate and analyze the root cause. Captures can be performed using a web browser from any desktop, and packet decodes can be viewed through the Traffic Analyzer GUI. Cisco NAM's capture and decode capability provides depth and insight into data analysis using trigger-based captures, filters, decodes, and a capture analysis toolset to quickly pinpoint and resolve problem areas (Figure 8).

Figure 8. Capturing and Decoding Packets with Cisco Branch Routers Series NAM

Analyzing Quality of Service

Cisco NAM supports both the planning and management of quality of service deployments for voice, video, and other critical IP-based services. It supports the Differentiated Services Monitoring (DSMON) MIB, which monitors traffic by DSCP allocations defined by QoS policies. Using the Cisco NAM DiffServ monitoring capabilities, applications, hosts, and conversations participating in each grouping of DiffServ classes can be identified. This information can be used to validate and tune planning assumptions and QoS allocations. It can also be used to detect incorrectly marked or unauthorized traffic.

Supported Router Platforms

The Cisco Branch Routers Series NAM, models NME-NAM-80S and NME-NAM-120S, can be deployed in any network module slot in the Cisco router platforms indicated in Table 1. An NM Adapter Card is required to successfully integrate the NME-NAM into supported ISR G2 platforms. The NME-NAM supports the router platforms with NAM software version 3.6.1b or later. Only one Cisco NAM can be installed in each Cisco branch router.

Table 1. NME-NAM Supported Router Platforms

Router Platform

Minimum Cisco IOS Software Version Required

NM Adapter Card Required

Cisco 3945 ISR

Cisco IOS Software 15.0(1)M


Cisco 3925 ISR

Cisco IOS Software 15.0(1)M


Cisco 2951 ISR

Cisco IOS Software 15.0(1)M


Cisco 2921 ISR

Cisco IOS Software 15.0(1)M


Cisco 2911 ISR

Cisco IOS Software 15.0(1)M


Cisco 3845 ISR

Cisco IOS Software 12.4(9)T


Cisco 3825 ISR

Cisco IOS Software 12.4(9)T


Cisco 2851 ISR

Cisco IOS Software 12.4(9)T


Cisco 2821 ISR

Cisco IOS Software 12.4(9)T


Cisco 2811 ISR

Cisco IOS Software 12.4(9)T


Cisco 3745 MSR

Cisco IOS Software 12.4(9)T


Cisco 3725 MSR

Cisco IOS Software 12.4(9)T


Cisco Branch Routers Series NAM Software License Options

Cisco NAM offers two license options for monitoring voice traffic. One license allows the monitoring of 50 voice (RTP) streams; the other, the monitoring of 100 voice streams. Both license options are supported on Cisco Branch Routers Series NAM, NME-NAM-120S.

Product Specifications

Table 2 provides the specifications for Cisco Branch Routers Series NAM, NME-NAM-120S.

Table 2. Product Specifications



Hardware architecture

1.0 GHz Intel Celeron M CPU with 1 GB RAM and a 120 GB hard disk drive

Monitoring interfaces

Two monitoring interfaces: One internal backplane interface for receiving a copy of LAN or WAN traffic through a special packet-monitoring feature in the router's Cisco IOS Software and one external Gigabit Ethernet interface for receiving traffic directly from local or remote LAN ports. Either can be used for management traffic and for receiving NetFlow data.


Using the internal monitoring interface, traffic monitoring throughput of up to 100 Mbps has been characterized for the NME-NAM-120S installed in Cisco 3900 Series and Cisco 3800 Series Integrated Services Routers, and up to 45 Mbps in Cisco 2900 Series and Cisco 2800 Series Integrated Services Routers. The external monitoring interface has been characterized to support up to 200 Mbps throughput monitoring. Your monitoring performance may differ based on factors such as packet size, traffic business, collections enabled on the NAM, and features enabled on the router. Contact your Cisco sales representative to obtain further information about NME-NAM-120S performance characteristics.

Topologies and data sources: WAN

Packets on WAN interfaces are copied by a special packet-monitoring feature in Cisco IOS Software using Cisco Express Forwarding and sent to Cisco NAM through the internal backplane interface for analysis at the IP layer and up. NetFlow (versions 1, 5, 6, 7, 8, and 9) data from local and remote devices is sent through the internal or external interface.

Topologies and data sources: LAN

An external Gigabit Ethernet interface receives packets directly from local and remote LAN ports. NetFlow (versions 1, 5, 6, 7, 8, and 9) data from local and remote devices is sent through the internal or external interface.

Interfaces and external applications

HTTP and HTTPS with the embedded web-based NAM Traffic Analyzer

Simple Network Management Protocol (SNMP) versions 1 and 2c with other standards-based applications

NAM Traffic Analyzer

• Embedded in Cisco NAM Software 4.0
• Web-based: Requires Microsoft Internet Explorer 6.0 (with Service Pack 2), Internet Explorer 7.0, or Firefox 2.0; supports both English and Japanese versions of browsers
• Supports Secure Sockets Layer (SSL) security with up to 168-bit encryption
• Role-based user authorization and authentication locally or using TACACS+
• Real-time and historical statistics (up to 100 days) on LAN and WAN traffic and network-based services

Cisco NAM Software 4.0

Supports Cisco Branch Routers Series NAM, NM-NAM, NME-NAM-80S and NME-NAM-120S


Cisco NAM is standards-compliant and supports RMON and RMON2 MIBs as well as several extensions; major MIB groups supported in the Cisco NAM are:

• MIB-II (RFC 1213)
• RMON (RFC 2819)
• RMON2 (RFC 2021)
• DSMON (RFC 3287)
• HC-RMON (RFC 3273)
• NBAR-Protocol Directory
• Application Response Time


Cisco NAM provides RMON2 statistics on several hundred unique protocols, including those defined in RFC 2896, and several Cisco proprietary protocols.

Automatically detects unknown protocols.

Users have the flexibility to customize the protocol directory by defining protocols on a single port or on a range of ports.

Supports protocols discovered using Cisco NBAR-PD MIB in Cisco IOS Software (requires Cisco IOS Software Release 12.3(7)T or later).

Protocols supported include (this list is not all-inclusive):

• TCP and User Datagram Protocol (UDP) over IP including IPv6
• Voice over IP (VoIP) including Skinny Client Control Protocol (SCCP), Real Time Protocol/Real Time Control Protocol (RTP/RTCP), Media Gateway Control Protocol (MGCP), and Session Initiation Protocol (SIP)
• Mobile IP protocols
• Storage area network (SAN) protocols including Fibre Channel over TCP/IP
• AppleTalk, DECnet, Novell, Microsoft
• Database protocols, including Oracle and Sybase
• Peer-to-peer protocols such as Gnutella, FastTrack, and WinMX
• Bridge and router protocols
• Cisco proprietary protocols such as Cisco Discovery Protocol
• Unknown protocols by TCP/UDP ports, Remote Procedure Call (RPC) program numbers, and so on

Physical dimensions

Dimensions (H x W x D): 1.55 x 7.10 x 7.2 inches (3.9 x 18.0 x 18.3 centimeters)

Weight: 1.5 pounds (0.7 kilograms) maximum

Operating environment

Operating temperature: 41 to 104°F (5 to 40°C)

Nonoperating and storage temperature: -40 to 158°F (-40 to 70°C)

Operating humidity: 5 percent to 85 percent (noncondensing)

Operating altitude: -197 ft to 6,000 ft (-60 to 1,800 m)


• UL 60950-1, Second Edition Safety of Information Technology Equipment - Safety - Part 1: General Requirements (USA). Plastic materials that are exposed to the end user shall meet the requirements of fire enclosure (UL94V-1) as defined in UL 60950.
• CSA 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements (Canada)
• IEC 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements, including all national deviations as specified in the current CB Bulletin
• EN 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements (European Union) incorporating all deviations, as applicable
• GB 4943-95, Safety of Information Technology Equipment (Including Electrical Business Equipment) (standard for China, equivalent to IEC 60950)
• AS/NZ 60950.1 Information Technology Equipment, Safety Part 1: General Requirements (Australia)


• Emission:
• 47 CFR Part 15 Class A
• CISPR22 Class A
• EN300386 Class A
• EN55022 Class A
• EN61000-3-2
• EN61000-3-3
• VCCI Class I
• AS/NZS CISPR 22 Class A
• Immunity:
• EN300386
• EN50082-1
• EN55024
• EN61000-6-1

Ordering Information

Table 3 provides ordering information for Cisco NAM Software 4.0 for the Cisco Branch Routers Series NAMs. Table 4 provides ordering information for the Cisco Branch Router Series NAM. To place an order, visit the Cisco Ordering Homepage. To download software, visit the Cisco Software Center.

Table 3. Ordering Information for NAM Software 4.0 for Cisco Branch Routers Series NAMs



Part Number


Current NAM customers:

• NME-NAM-120S

Download from Cisco Software Center


Cisco NAM for Branch Routers

New customers:

• NME-NAM-120S

Preloaded in the NAM hardware


Cisco NAM Software 4.0 for Branch Routers NAM

Table 4. Ordering Information for Cisco Branch Routers Series NAM

Part Number

Cisco Branch Router Series NAM Description


Cisco Branch Routers Series Network Analysis Module (Spare)


Voice Monitoring Software License for NME-NAM-120S, 50 RTP Streams (Spare)


Voice Monitoring Software License for NME-NAM-120S, 100 RTP Streams (Spare)


Cisco NAM Software 4.0


NM Adapter Card for integration of NME-NAM into supported ISR G2 platforms (Spare)

Service and Support

Cisco offers a range of services programs to accelerate customer success. These innovative services programs are delivered through a unique combination of people, processes, tools, and partners, resulting in high levels of customer satisfaction. Cisco Services help to protect your network investment, optimize network operations, and prepare the network for new applications to extend network intelligence and the power of your business. For more information about Cisco Services, see Cisco Technical Support Services. Service and support for Cisco Branch Routers Series NAM are covered under the service contract for the router platform.

For More Information

For more information about Cisco Branch Router Series NAM, visit or contact either your local account representative or the Cisco NAM product marketing group at