Table Of Contents
Cisco Network Analysis Module
API Programmer Guide, 5.0Sample Java Code to Encode Login Password
Helper Interface for Single Sign-On
Sample Code for Single Sign-on Using NAMAuth Helper Applet
Cisco Network Analysis Module
API Programmer Guide, 5.0
Introduction
The Cisco Network Analysis Module (NAM) API Programmer Guide describes APIs that are available to connect to the NAM system. The NAM API provides a mechanism for provisioning and retrieving data from the NAM servers using an eXtensible Markup Language (XML) interface. The API utilizes Representational State Transfer (REST) methodology to execute requests (web services) over HTTP or HTTPS by sending the XML data to the API server.
The REST XML interface is capable of configuring a subset of the software features through create, read, update, and delete operations mapped to a particular HTTP or HTTPS method. APIs are provided for sites, data sources, application, application groups, action, threshold, packet capture, WAAS monitored server, system info, and NetFlow data export. You can configure external devices for streaming queries with specific aggregation and filtering parameters. These are used to create an outgoing stream of exported NetFlow records transmitted from NAM.
Organization
This guide is organized as follows:
Audience
This guide is intended to be a technical resource for application developers who want to use the NAM APIs to provision network services and leverage data. The developers who use the APIs should also have an understanding of a high-level programming language such as Java, or an equivalent.
Additionally, we recommend that you have knowledge of the following:
•Hyper Text Transfer Protocol (HTTP or HTTPS)
•XML and XML schema
•PHP Hypertext Preprocessor
•NetFlow Data Export
You should be familiar with the NAM GUI and have a basic understanding of the NAM functionality. In most cases, API operations correlate to GUI operations.
Conventions
This guide uses the following conventions:
Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the guide.
Related Documentation
This section provides a list of the NAM software documentation.
You can find links to all NAM software documentation at the following URL:
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/tsd_products_support_series_home.html
Following is a list of Cisco Network Analysis Module documentation available, for this release:
•User Guide for Cisco Network Analysis Module Traffic Analyzer
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
•Catalyst 6500 Series Switch and Cisco 7600 Series Router Network Analysis Module Installation and Configuration Note http://www.cisco.com/en/US/products/sw/cscowork/ps5401/prod_installation_guides_list.html
•Cisco Branch Router Series (NME-NAM) Installation and Configuration Note http://www.cisco.com/en/US/products/sw/cscowork/ps5401/prod_installation_guides_list.html
•Cisco NAM Command Reference Guide
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/prod_command_reference_list.html
•Cisco WAAS VB NAM Installation and Configuration Note
http://www.cisco.com/en/US/products/ps10506/prod_installation_guides_list.html
•Cisco NAM Appliances Installation and Configuration Note (2204)
http://www.cisco.com/en/US/products/ps10113/prod_installation_guides_list.html
•Cisco NAM Appliances Installation and Configuration Note (2220)
http://www.cisco.com/en/US/products/ps10113/prod_installation_guides_list.html
REST Web Services
The REST web services provides an external API interface for configuring and retrieving performance data, utilizing a set of guidelines for performing these services over HTTP or HTTPS protocols. It takes advantage of the HTTP or HTTPS methods (GET, POST, UPDATE, and DELETE) as part of the request.
A standard REST plug-in from Zend is commonly used for NAM. These implement Representational State Transfer (REST) web services (see Figure 1), which offer classes of objects for create, read, update, and delete operations. The REST web service requests are sent over HTTP or HTTPS for the creation and manipulation of objects within the NAM server. These classes of objects are used on server data elements. The server receives the requests, decodes it, validates it, performs the operation, and returns the success of the operation or data depending on the request. The responses are generally in XML format and are encoded.
The following figure explains the REST web services:
Figure 1 REST Web Services
For NetFlow data, the REST web services XML interface specifies a SQL-like query that is interpreted by the server. The V9 export capability is available for sending the stream of flow data.
Note For Application Response Time (ART) data only, retrieval is in the Comma Separated Value (CSV) format, which is achieved by clicking the CSV export button from the NAM GUI. For operations such as the export of high-volume data or for reporting, the data is sent in CSV format. This data is imported into the external system for further processing and reporting, or to other applications such as Microsoft Excel. For more information on CSV data retrieval see Appendix - CSV Interface.
Authentication
This section describes the process you use to log in programmatically using single sign-on to multiple NAMs. You can access multiple NAMs without having to log in repeatedly (see Helper Interface for Single Sign-On for details).
To use the APIs, the client program needs to obtain a session ID from the NAM before any HTTP requests can be processed successfully. The login request generates a session ID that is valid for a period of time. During this time, you can make indefinite requests to the server using the session ID for authentication. A HTTP request without a valid session ID is rejected. The session ID is valid only for the IP address of the original login request to prevent session hijacking. The session is terminated when you log out or after 30 minutes of inactivity. (This inactivity interval is not configurable by you).
The following steps outline the procedure to log in to the NAM server:
Step 1 Log in using the following HTTP request:
http://nam/auth/login.php?api=true
Where, nam is the IP address of the NAM server.
NAM returns:
a. Three name-value pairs:
"domain", "nonce", "pkey"Where
•
domain
is the domain of the NAM web server•
nonce
is a randomly used number•
pkey
is the server public keyb. A cookie named:
"sessid
"Where "
sessid
" is the Session IDStep 2 Encode the password using one of the following methods:
a. If nonce is not null (that is, NAM uses local users only), you have to generate a MD5 hash of the password:
encoded_pw = MD5(domain . nonce . <username> . <userpassword>)See Sample Java Code to Encode Login Password for details.
b. If nonce is null (that is, NAM has TACACS+ enabled), you have to encode the password using the following algorithm (based on the Diffie-Hellman key exchange):
privKey = random(m)pubKey = powm(g, privKey, m)shared = MD5(powm(pkey, privKey, m))encoded_pw = one_pass(<userpasswd>, shared);where:g = 0x527d44089958ca1em = 0x5c13ada6c91d2ba3powm() is the power with modulo operatorone_pass() is string XOR function (see section 12 for sample code)See Sample Java Code to Encode Login Password for details.
Step 3 Send the encoded password to NAM using the following URL: http://nam/auth/authenicate.php?sessid=sessid&username=username&pwdigest=encoded_pw&pkey=pubkeyencode_pq = MD5(domain, nonce, username, password)
Where:
•nam is the IP address of the NAM server.
•sessid is the session ID.
•username is the NAM log in user name
•encoded_pw is the encoded password
•pubkey is the value calculated from step2 (b)
If login is successful, NAM returns the Overview page.
Step 4 Log out using the URL:
http://nam/auth/logout.php
The session is closed.
Sample Java Code to Encode Login Password
NAM uses two methods for password protection. For local user database, the HTTP digest authentication method (based on RFC-2617) is used. The password is protected using the MD5 secure one-way hash. If TACACS+ is enabled, the Diffie-Hellman key exchange method (ANSI X9.42, RFC-2613) is used to encode the password.
// Copyright (c) 2010 by Cisco Systems, Inc. All rights reserved.import java.security.*;import java.math.*;/** NAMEncode: Helper class for NAM web user authentication */public class NAMEncode {/** Encode the login password* @return the encoded password*/public static String encodePassword(String username, String password,String domain,String nonce,String pkey){ if(nonce != null && nonce.length() > 0)return encodeMD5(domain + nonce + username + password);elsereturn encodeD_H(password, pkey);}/** Encode using MD5 secure hash */public static String encodeMD5(String input){try{ MessageDigest _md5 = MessageDigest.getInstance("MD5");byte[] output = _md5.digest(input.getBytes());// Convert output to Hex StringString encoded = "";for(int i=0; i<output.length; i++){ int unum = output[i];if(unum < 0)unum += 0x100;encoded += Integer.toHexString(unum/16) +Integer.toHexString(unum%16);}return encoded;}catch (Exception ex){ ex.printStackTrace();return null;}}/** Encode using Diffie-Hellman key exchange */public static String encodeD_H(String password, String pkey){BigInteger gen = new BigInteger("527d44089958ca1e", 16); // generatorBigInteger mod = new BigInteger("5c13ada6c91d2ba3", 16); // modulusBigInteger spub = new BigInteger(pkey, 16); // server's public keyBigInteger sec = new BigInteger(62, new java.util.Random());BigInteger pub = gen.modPow(sec, mod); // client public keyBigInteger shr = spub.modPow(sec, mod); // shared secret keyString cpkey = pub.toString(16);while (cpkey.length() < 16)cpkey = "0"+cpkey;String shared = shr.toString(16);while (shared.length() < 16)shared = "0"+shared;shared = encodeMD5(shared);String encoded = one_pass(password, shared);return encoded + "," + cpkey;}/** One-Time-Pass encoding */public static String one_pass(String str, String key){ String res = "";for(int i=0; i<str.length(); i++){ int code = (str.charAt(i) ^Integer.parseInt(key.substring((i*2)%32, (i*2)%32+2), 16) );res += Integer.toHexString(code/16) +Integer.toHexString(code%16);}return res;}}Helper Interface for Single Sign-On
NAM provides a Java applet to facilitate single sign-on to multiple NAMs from a centralized web application. The NAMAuth helper applet implements the login algorithm as described in Authentication and allows web-based applications running on a browser to log in to the NAM automatically without user intervention. The web-based application loads the helper applet and allows it to handle the login requests to the NAM.
The helper applet can be loaded using the URL: http://nam/java/NAMAuth.class
Sample Code for Single Sign-on Using NAMAuth Helper Applet
<html><body><b>Sample JavaScript code to login to NAM from Centralized App</b><! Loads NAM Helper Applet. Replace "namlab-kom1" with NAM hostname !><applet CODEBASE='http://namlab-kom1/java/' CODE='NAMAuth.class' name='namlab_kom1' width=0 height=0 MAYSCRIPT></applet><SCRIPT LANGUAGE="JavaScript">function dologin(){ // session initres = document.namlab_kom1.sessionInit();if(res.length == 0)return false;arr = res.split(',');var domain = arr[0];var nonce = arr[1];var pkey = arr[2];var cookie = arr[3]; //cookie is set automatically by browser//encode the password. Should be done by the servervar user = document.login.name.value;var passwd = document.login.passwd.value;var encoded_pw = document.namlab_kom1.encodePassword(user, passwd, domain, nonce, pkey);// session loginres = document.namlab_kom1.sessionLogin("admin", encoded_pw);if(res==true)window.location = "http://namlab-kom1";elsealert("Login failed!");}function dologout(){ document.kom1Auth.sessionLogout();}</SCRIPT><form name=login><table><tr><td>NAM:</td><td>namlab-kom1</td></tr><tr><td>User ID:</td><td><input type="text" name="name" size="20"></td></tr><tr><td>Password:</td><td><input type="password" name="passwd" size="20"></td></tr><tr><td> </td><td><input type=button value="Login"onClick="Javascript:dologin();"></td></tr></form></body></html>NAM Supported APIs
APIs indicate the nature of data you receive. You must specify the list of attributes to be set or predefined, for a specific XML request.
For example, for a
•Create operation, an object ID is generated by default. Thus it is optional.
•Modify operation, an object ID and the attributes for modification have to be specified.
•View operation, an object ID or filter for the return of multiple records of information have to be specified.
•Delete operation, an object ID and the attributes to delete have to be specified.
The API requests are executed using a combination of HTTP/HTTPS by sending the XML data to the API server. After the request is complete, a confirmation is sent by the server in the form of a response, to indicate that the operation is successful, or to return data. An object ID, which is an identity of the specific resource is returned in most cases for subsequent processing. This data returned is normally in the XML format.
Sample response
Following is a sample of the response or the operation result:
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-site/id/9</uri></operation-result></nam-response>
Where:
•status indicates if the operation is successful or not
•description is the description of the operation performed
•uri indicates where the resource resides
•ID indicates the identification of the newly created resource
The following section describes the supported NAM configurations and APIs:
Sites
NAM introduces the capability to define a site, with which you can aggregate and organize performance statistics. A site is a collection of hosts (network endpoints) partitioned into views that help you monitor traffic and troubleshoot problems. A site is defined as a set of subnets specified by an address or prefix, as well as other criteria such as a remote device data source (for example, remote WAE device and segment information).
Data Sourcing APIs are used to get data source information, in order to create sites. You can include multiple types of data sources in the site definition, and you can then get an aggregated view of all network traffic.
A site can be defined using one or more of the following rules:
•Subnet (prefix)
•Subnet from a particular data source
•Subnet from a particular VLAN and data source
•WAN/LAN interface from a particular NDE device (data source)
•WAAS data sources
Every flow will be associated with one data source and two sites, one for each network endpoint (host). You can define a site using a combination of multiple rules described above. For example, if a site has both optimized and non-optimized traffic, it can be defined using a combination of WAAS data sources and a subnet from a NDE data source.
When defining a site using multiple data sources, be careful to make sure that those data sources do not have duplicated traffic to avoid double counting the site traffic statistics. For more information on sites, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Site API Syntax and Example
The following section contains the syntax and example for the site API:
Create Site
This operation will create a new site.
Note You can create only one site at a time.
Request
Following is a sample of the XML request.
<sites><site><name>fremont</name><description>fremont-site</description><status>0</status><siteRules><rule><prefix><ip>172.90.0.0</ip><netmask>18</netmask></prefix><dataSource><id>1</id></dataSource></rule></siteRules></site></sites>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-site/id/9</uri></operation-result></nam-response>Resource Properties
Property Descriptionid
Uniquely identifies the resource.
Note This value must be saved for future references to the specific site. For example, in the above XML response, 9 is the unique site ID.
name
Identifies the name of the resource
description
Identifies the description of the resource
dataSource
Identifies the data source this rule references.
Note Data sources can be retrieved from the Data Sources APIs available at Data Sources
prefix
Identifies the prefix
vlan
Identifies VLAN
interface
Identifies NDE and WAN interface
interfaceType
Identifies the Interface type (NDE or WAN)
List Site Details
This operation will show configuration details for a specific site.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><site id="9"><name>fremont2</name><description>fremont-site</description><status>active</status><siteRules><rule><prefix><ip>172.20.0.0</ip><netmask>18</netmask></prefix><dataSource><id>1</id><name>DATA PORT 1</name></dataSource></rule></siteRules></site></nam-response>List Sites
This operation lists all the available sites.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><sites><site id="1"><name>Default</name><description>Unclassified hosts</description><status>active</status></site><site id="9"><name>fremont2</name><description>fremont-site</description><status>active</status></site></sites></nam-response>Update Site
This operation will update site definition.
Request
Following is a sample of the XML request.
<sites><site><name>fremont</name><description>fremont-site</description><status>0</status><siteRules><rule><prefix><ip>172.90.0.0</ip><netmask>18</netmask></prefix><dataSource><id>2</id></dataSource></rule></siteRules></site></sites>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete Site
This operation will delete a site.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Data Sources
Data sources are the source of traffic for NAM. These data sources are primarily used to define sites. Some examples are: physical data ports of the NAM where you get SPAN data, a specific router or switch that sends NetFlow to the NAM, or a WAAS device segment that sends data to NAM or ERSPAN and which goes to NAM's management port. For more information on data sources, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Data Source API Syntax and Examples
The following section describes the syntax and example for the data source API:
List Data Sources
This operation lists all the available data sources.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><DataSources><data-source id="2"><description>DATA PORT 1</description></data-source><data-source id="3"><description>DATA PORT 2</description></data-source></DataSources></nam-response>List Data Source Details
This operation lists the detailed configuration of the data source.
.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><DataSources><data-source id="2"><description>DATA PORT 1</description></data-source></DataSources></nam-response>Update Data Source
This operation is currently not supported in this release.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>501</status><description>Not Implemented</description></operation-result></nam-response>Application
NAM supports a set of predefined applications based on standardized application tags. Application is also referred to as Application Protocol, or simply Protocol. The application ID or tag uniquely identifies the application that consists of an engine ID and a selector. The engine ID distinguishes between the separate repositories of application definitions . For example: IANA layer 3 protocols and IANA layer 4 port numbers. A selector uniquely identifies an application within an engine ID. For example: Port 80 is mapped to selector 80 in IANA- l4.
The definition files of these built-in applications will be parsed at startup and will form the basis for the in-memory representation of the applications. Each application is associated with a list of port or protocol ranges.
For more information on applications, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Custom Application Configuration
NAM also supports another set of protocols for which you must define the custom engine ID and selectors. Here the applications and modifications in mappings will be kept in a separate configuration file and read in at startup after the built-in protocols have been read. URL based applications belong to the custom application configuration category.
From the two sets of application definitions, NAM can build in-memory look-up and hash tables that is used by the classifications. The set of built-in applications can be derived from the NAM protocol list.
Application API Syntax and Example
The following section contains the syntax and example for the Application API:
•Create Custom Application Protocol
•Create Custom Application Protocol
•List Details for Application Protocol with ID = x
•Update Custom Application Protocol
•Delete Custom Application Protocol
Create Custom Application Protocol
Creates a custom application protocol.
Request
Following is a sample of the XML request.
<applicationId><name>NDE-9999</name><matches><match><layer>UDP</layer><ports>9999</ports></match></matches></applicationId>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-apps/apptag/268435458</uri></operation-result></nam-response>List Application Protocols
This operation lists all applications.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><applicationId><name>icmp</name><appTag>16777217</appTag><engineId>iana-l3</engineId><selector>1</selector><matches><match><layer> IP</layer><ports>1</ports></match></matches></applicationId></nam-response>List Details for Application Protocol with ID = x
This operation lists the configuration details for the application protocol with ID=x.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><applicationId><name>icmp</name><appTag>16777217</appTag><engineId>iana-l3</engineId><selector>1</selector><matches><match><layer> IP</layer><ports>1</ports></match></matches></applicationId></nam-response>Update Custom Application Protocol
This operation updates a custom application.
Request
Following is a sample of the XML request.
<applicationId><name>NDE-TCP-9999</name><matches><match><layer>TCP</layer><ports>9999</ports></match></matches></applicationId>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-apps/apptag/268435458</uri></operation-result></nam-response>Delete Custom Application Protocol
This operation deletes a custom application protocol.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Application Groups
An application group is a set of application protocols that can be monitored as a whole. For more information on application groups, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Application Groups API Syntax and Examples
The following section contains the syntax and example for the application groups API:
•List Details of the Application Group
Create an Application Group
Create an application group.
Request
Following is a sample of the XML request.
<appGroups><appGroup><name>Directory-Services</name><apps><app><name>ldap</name><tag>50332037</tag></app><app><name>ldaps</name><tag>50332284</tag></app><app><name>msft-gc</name><tag>50334916</tag></app><app><name>msft-gc-ssl</name><tag>50334917</tag></app></apps></appGroup></appGroups>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-appgrp/id/28</uri></operation-result></nam-response>List all Application Groups
This operation lists all application groups.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><appGroups><appGroup><id>1</id><name>Authentication</name></appGroup><appGroup><id>2</id><name>Backup</name></appGroup><appGroup><id>3</id><name>Call-Management</name></appGroup></appGroups></nam-response>List Details of the Application Group
This operation lists the configuration details of the application group.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><appGroups><appGroup><id>8</id><name>Directory-Services</name><apps><app><name>ldap</name><tag>50332037</tag></app><app><name>ldaps</name><tag>50332284</tag></app><app><name>msft-gc</name><tag>50334916</tag></app><app><name>msft-gc-ssl</name><tag>50334917</tag></app></apps></appGroup></appGroups></nam-response>Update an Application Group
This operation updates the application group.
Request
Following is a sample of the XML request.
<appGroups><appGroup><id>47</id><name>cisco-net-mgmt</name><apps><app><name>cisco-net-mgmt</name><tag>50333389</tag></app><app><name>my-netflow</name><tag>268435457</tag></app></apps></appGroup></appGroups>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete an Application Group
This operation deletes an application group.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Action
Actions are special APIs, used only for thresholds. These are predefined conditions based on a rising data threshold, a falling data threshold, or both. They should be configured before thresholds. You can set thresholds and alarms on various network parameters such as increased utilization, severe application response delays, and voice quality degradation and be alerted to potential problems. You can use an external SNMP manager to set up thresholds for NAM MIB variables by configuring the alarm and event tables in the NAM. These events are also used for the capture trigger events. The actions produce commands like e-mail, trap, capture trigger, or syslog. For more information on actions, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Action API Syntax and Examples
The following section contains the syntax and example for the Action API:
•List Details for Alarm Actions with ID = x
Create Alarm Action
This operation creates an alarm action.
.
Request
Following is a sample of the XML request.
<alarmAction><name>All actions Test</name><email>enabled</email><trap><community>public</community></trap><triggerCapture><session>4</session><action>start</action></triggerCapture><syslog>enabled</syslog></alarmAction>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-action/id/5</uri></operation-result></nam-response>List Alarm Actions
This operation lists all alarm actions.
.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><alarmAction><id>6</id><name>All actions </name><email>enabled</email><trap><community>public</community></trap><triggerCapture><session>4</session><action>start</action></triggerCapture><syslog>enabled</syslog></alarmAction><alarmAction><id>2</id><name>email and trap actions</name><email>enabled</email><trap><community>public</community></trap></alarmAction></nam-response>List Details for Alarm Actions with ID = x
This operation lists the configuration details of a single alarm action.
.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><alarmAction><id>3</id><name>All Actions Enabled</name><email>enabled</email><trap><community>public</community></trap><triggerCapture><session>3</session><action>start</action></triggerCapture><syslog>enabled</syslog></alarmAction></nam-response>Update Alarm Action
This operation updates an alarm action.
.
Request
Following is a sample of the XML request.
<alarmAction><name>All actions Test</name><email>enabled</email><triggerCapture><session>4</session><action>stop</action></triggerCapture><syslog>enabled</syslog></alarmAction>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete Alarm Action
This operation deletes an alarm action.
.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Thresholds
Thresholds are programmatic ways of setting triggers or sending alerts, as a result of which an action is performed. This is done with the help of Action APIs. The action includes sending e-mails, syslogs or setting up a capture session. These thresholds provide a programmatic interface that enables you to interface with third party applications. For more information on thresholds, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
NAM API is used to set up alarm thresholds for variables with values that trigger alarms.You can set up alarm thresholds by defining threshold conditions for the following monitored variables on the NAM:
•Host
•Conversation
•Application
•Response Time
•DSCP (replaces diffServ)
•Voice Signalling
•RTP Streams
•NDE Interface
Threshold API Syntax and Examples
The following section contains the syntax and example for the Threshold API:
•List Details for Threshold with ID = x
Create Threshold
This operation creates a threshold.
Request
Following is a sample of the XML request.
<iapThreshold><description>Response Time threshold</description><severity>High</severity><risingAction>2</risingAction><fallingAction>2</fallingAction><application>any</application><server><site>Any</site><host>Any</host></server><iapMetrics><risingAverageResponseTime>300</risingAverageResponseTime><fallingAverageResponseTime>250</fallingAverageResponseTime><risingMaxNetworkTime>100</risingMaxNetworkTime><fallingMaxNetworkTime>80</fallingMaxNetworkTime></iapMetrics></iapThreshold>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-threshold/type/host/id/11</uri></operation-result></nam-response>List Thresholds
This operation lists all thresholds.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><hostThreshold><id>6</id><description>Host threshold 3</description><severity>Low</severity><risingAction>1</risingAction><fallingAction>1</fallingAction><site>any</site><host>any</host><dscp>1</dscp><hostMetrics><risingInPackets>10000</risingInPackets><fallingInPackets>5000</fallingInPackets></hostMetrics></hostThreshold><iapThreshold><id>2002</id><description>Response Time threshold</description><severity>High</severity><risingAction>2</risingAction><fallingAction>2</fallingAction><application>any</application><server><site>any</site><host>any</host></server><iapMetrics><risingAverageResponseTime>300</risingAverageResponseTime><fallingAverageResponseTime>300</fallingAverageResponseTime><risingMaxNetworkTime>100</risingMaxNetworkTime><fallingMaxNetworkTime>100</fallingMaxNetworkTime></iapMetrics></iapThreshold></nam-response>List Details for Threshold with ID = x
This operation lists the configuration details of a single threshold.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><iapThreshold><id>2002</id><description>Response Time threshold</description><severity>High</severity><risingAction>2</risingAction><fallingAction>2</fallingAction><application>any</application><server><site>any</site><host>any</host></server><iapMetrics><risingAverageResponseTime>300</risingAverageResponseTime><fallingAverageResponseTime>250</fallingAverageResponseTime><risingMaxNetworkTime>100</risingMaxNetworkTime><fallingMaxNetworkTime>80</fallingMaxNetworkTime></iapMetrics></iapThreshold></nam-response>Update Threshold
This operation updates a threshold.
Request
Following is a sample of the XML request.
<hostThreshold><id>0</id><description>Host threshold 2</description><severity>Warning</severity><risingAction>none</risingAction><fallingAction>none</fallingAction><host>10.0.0.2</host><site>2</site><appId>16777220</appId><hostMetrics><risingInPackets>1000</risingInPackets><fallingInPackets>600</fallingInPackets></hostMetrics></hostThreshold>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete Threshold
This operation deletes a threshold.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Packet Capture
For this release, the packet capture configurations and trigger operations are performed using the web-based XML interface, that supports HTTP file transfer. Captures can be performed using a web browser from any desktop, and decodes can be viewed through the Traffic Analyzer GUI, while the data is still being captured. The capture and decode capability of the Cisco NAM provides depth and insight into data analysis using trigger-based captures, filters, decodes, and a capture analysis tool such as Error Scan, to quickly pinpoint and resolve problems.
The software filters under the hardware-assisted capture functionality of the appliances are used to provide capture. The software capture sessions allow multiple software filters. Packet Capture utilizes the application ID as a filter parameter in the capture process, and supports site configuration. The settings in one filter are made such that all set values are matched.
In addition, multiple capture sessions are also supported. One multiple capture session supports the hardware filters on the appliances. Multiple filters within a capture session are set such that if any one of the filters match, the packet is captured.
Each filter can match on:
•The application (and encapsulation)
•Source and destination IP addresses (v4 and v6 with mask)
•Port numbers with ranges
•VLAN with range
•Data match with offset, size, and mask
For more information on packet capture, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Packet Capture API Syntax and Examples
The following section contains the syntax and example for the packet capture API:
•Lists Details for Capture Session with ID = x
•Update Capture Session, page 42
Create Capture Session
This operation creates a capture session.
Request
Following is a sample request for the create buffer session:
<capture><session><name>buffer-session</name><trafficSource>1</trafficSource><dataPorts><dataPort>DATA PORT 1</dataPort><dataPort>DATA PORT 2</dataPort></dataPorts><sliceSize>100</sliceSize><buffer><bufferSize>500</bufferSize><wrapMode>0</wrapMode></buffer><filters><filterId>2</filterId></filters></session></capture>Request
Following is a sample request for the create file session:
<capture><session><name>CaptureNBI2</name><trafficSource>1</trafficSource><dataPorts><dataPort>DATA PORT 1</dataPort><dataPort>DATA PORT 2</dataPort></dataPorts><sliceSize>200</sliceSize><file><rotateFiles>1</rotateFiles><numFiles>5</numFiles><fileSize>10</fileSize><fileLocation></fileLocation></file><filters><filterId>2</filterId></filters></session></capture>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-capture/session/id/2</uri></operation-result></nam-response>List Capture Sessions
Lists all capture sessions.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><capture><session><id>8</id><name>buffer-session</name><trafficSource>1</trafficSource><dataPorts><dataPort>DATA PORT 1</dataPort><dataPort>DATA PORT 2</dataPort></dataPorts><sliceSize>100</sliceSize><buffer><bufferSize>185</bufferSize><wrapMode>0</wrapMode></buffer><filters/><status><startTime>1284583755</startTime><state>2</state><packetsCaptured>5817</packetsCaptured></status></session></capture></nam-response>For information on the integers in the sample response, see Resource Properties for Capture.
Lists Details for Capture Session with ID = x
This operation lists the configuration details of a single capture session.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><capture><session><id>1</id><name>mem_sess1</name><bufferSize>500</bufferSize><trafficSource>1</trafficSource><startTime>0</startTime><state>2</state><packetsCaptured>0</packetsCaptured><sliceSize>500</sliceSize><mode>1</mode><filters/></session></capture></nam-response>For more information on the integers in the sample response, see Resource Properties for Capture.
Resource Properties for Capture
Property Descriptionstate
running(1),stopped(2),stoppedOnError(3),paused(4),full(5)
mode
noMode(0),stopWhenFull(1),wrapOnFull(2),fileRotate(3)
Update Capture Session
This operation updates the capture session.
Request
Following is a sample of the XML request.
<captures><session><name>file_sess1</name><trafficSource>1</trafficSource><sliceSize>500</sliceSize><state>1</state><files><fileSize>10</fileSize><rotateFiles>1</rotateFiles><numFiles>1</numFiles><fileLocation></fileLocation></files><filters><filterId>1</filterId><filterId>3</filterId></filters></session></captures>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete Capture Session
This operation deletes the capture session.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Capture Session Action
This operation creates the capture session action.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>List Hardware Filters
This operation lists all hardware capture filters.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><capture><hwFilter><name>hwf_ip_tcpudp</name><filterId>3</filterId><filterType>4</filterType><ipVersion>4</ipVersion><srcAddrMask>10.0.0.1/32</srcAddrMask><dstAddrMask>10.0.0.5/32</dstAddrMask><srcPort>80</srcPort><protocol>6</protocol></hwFilter><hwFilter><name>hwf_vlan</name><filterId>5</filterId><filterType>0</filterType><vlans>8</vlans></hwFilter></capture></nam-response>For more information on the integers in the samples, see Resource Properties for Hardware Capture Filters.
Resource Properties for Hardware Capture Filters
Create Hardware Filter
This operation creates hardware capture filter.
Request
Following is a sample of the XML request.
<capture><hwFilter><name>hwf_ip_tcpudp</name><filterType>4</filterType><ipVersion>4</ipVersion><srcAddrMask>10.0.0.1/32</srcAddrMask><dstAddrMask>10.0.0.5/32</dstAddrMask><srcPort>80</srcPort><protocol>6</protocol></hwFilter></capture>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-capture/hwfilter/id/1</uri></operation-result></nam-response>For more information on the integers in the samples, see Resource Properties for Hardware Capture Filters.
Update Hardware Filter
This operation updates the hardware capture filter.
Request
Following is a sample of the XML request.
<capture><hwFilter><name>hwf_ip_tcpudp</name><filterType>4</filterType><ipVersion>4</ipVersion><srcAddrMask>10.0.0.1/32</srcAddrMask><dstAddrMask>10.0.0.5/32</dstAddrMask><srcPort>8080</srcPort><protocol>6</protocol></hwFilter></capture>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>For more information on the integers in the samples, see Resource Properties for Hardware Capture Filters.
Delete Hardware Filter
This operation deletes the hardware capture filter.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>List Software Filter
This operation lists capture software filters.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><capture><swFilter><id>1</id><sessionId>0</sessionId><name>swf_ip</name><sourceIpAddress>10.0.0.0/255.255.0.0</sourceIpAddress><destinationIpAddress>10.0.0.0/255.255.0.0</destinationIpAddress><application>16777222</application><encap>1</encap></swFilter></capture></nam-response>Create Software Filter
This operation creates software capture filter.
Request
Following is a sample of the XML request.
<capture><swFilter><name>nam_swf3</name><sessionId>1</sessionId><srcAddrMask>10.0.0.4/16</srcAddrMask><dstAddrMask>10.0.0.8/16</dstAddrMask><netEncap>1</netEncap><vlans>11</vlans><application>16777220</application><direction>1</direction></swFilter></capture>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-capture/swfilter/id/2</uri></operation-result></nam-response>Update Software Filter
This operation updates software capture filter.
Request
Following is a sample of the XML request.
<capture><swFilter><sessionId>0</sessionId><name>swf_ip</name><protocol>ip</protocol><sourcePort>45</sourcePort><pattern>11:10:4a:10</pattern></swFilter></capture>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete Software Filter
This operation deletes software capture filter.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>List Capture Files
This operation lists all capture files.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><captureFiles><fileUrl>http://10.0.0.1/capture/packets.php?filename=capture_http.pcap</fileUrl><fileUrl>http://10.0.0.1/capture/packets.php?filename=capture_ftp.pcap</fileUrl><captureFiles></nam-response>Delete Capture File
This operation deletes a capture file.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>WAAS Monitored Servers
WAAS monitored servers specify the servers from which WAAS devices export traffic flow data to the NAM monitors. To enable WAAS monitoring, you must list the servers to be monitored by the NAM using the WAAS device's flow monitoring. For more information on WAAS Monitored Servers, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
Note NAM is unable to monitor WAAS traffic until you set up WAAS monitored servers. NAM displays status of WAAS devices as pending until you set up WAAS monitored servers.
WAAS Monitored Servers API Syntax and Examples
The following section contains the syntax and example for the WAAS monitored servers API:
•Create WAAS Monitored Servers
•List all WAAS Monitored Servers
•Delete a WAAS Monitored Server with ID = x
•Delete all WAAS Monitored Servers
List all WAAS Monitored Servers
This operation lists all WAAS monitored servers.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><waasServerFilter><ipAddr>10.0.0.3</ipAddr><ipAddr>10.0.0.5</ipAddr><ipAddr>10.0.0.7</ipAddr><ipAddr>10.0.0.1</ipAddr><ipAddr>10.0.0.25</ipAddr></waasServerFilter></nam-response>Create WAAS Monitored Servers
This operation creates a WAAS monitored server.
Request
<waasServerFilter><ipAddr>10.0.0.3</ipAddr><ipAddr>10.0.0.5</ipAddr><ipAddr>10.0.0.7</ipAddr><ipAddr>10.0.0.1</ipAddr><ipAddr>10.0.0.25</ipAddr></waasServerFilter>Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-waas/id/1</uri></operation-result></nam-response>Delete a WAAS Monitored Server with ID = x
This operation deletes a WAAS monitored server.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>Delete all WAAS Monitored Servers
This operation deletes all WAAS monitored servers.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result></nam-response>System Info
System Info API helps to provide details on NAM specifications like, NAM hardware type and the software version that is used.
System Info Syntax and Examples
Table 9 System Info APIs
Resource URL Method Description System Info /nbi/nbi-system GETLists the system information.
Note Create, update, and delete operations are not supported for this release.
The following section contains the syntax and example for the System Info API:
Get System Info
Lists the NAM system information.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result><systemInfo><hardware><name>Cisco Network Analysis Module</name><model>WS-SVC-NAM-2</model><serial>SAD122300X8</serial></hardware><software><namAppImage>5.0(1)</namAppImage></software></systemInfo></nam-response>NetFlow Data Export
The NAM uses NetFlow as a channel for the ongoing streaming of aggregated data, based on the configured set of NDE Descriptors or queries of the data attributes in NAM. NAM is capable of producing large amounts of measurement data that includes flow data, response time data, and RTP stream data. As a means of exporting this high-volume data to external devices (either Cisco or partner devices), NAM uses the NetFlow Data Export (NDE) V9 methodology.
The distinguishing feature of the NetFlow format, which is the basis for an IETF standard, is that it is template-based. Templates provide an extensible design to the record format, a feature that must allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. For more information on NetFlow, see http://www.cisco.com/go/netflow.
Note NetFlow data export is sent in an unencrypted binary format. Therefore, sensitive data should be retrieved from NAM using encrypted channels, instead of NetFlow based data export.
For more information on NetFlow Data Export, see User Guide for the Cisco Network Analysis Module Traffic Analyzer, 5.0 at http://www.cisco.com/en/US/products/sw/cscowork/ps5401/products_user_guide_list.html
NDE API Syntax and Examples
The following section contains the syntax and example for the NDE API
Create NDE Exporter
Creates a NDE exporter.
Request
<netflowExport><name>nde exporter 1</name><query>select * from Application destination ipaddr=10.0.0.1;port=9996 format encoding=9 protocol transportProtocol=udp interval 5 options 0 where appId=50331728</query></netflowExport>The following are the table types available for SQL query:
•Host
•Application
•Client Server Response Time
•Application Conversation
•Network Conversation
•RTP Metrics
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description><uri>/nbi/nbi-query/id/3</uri></operation-result></nam-response>List NDE Exporters
This operation lists all NDE exporters.
Request
This operation does not require a request body.
Response
Following is a sample of the XMLresponse.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><ndeDescriptor><id>3</id><name>nde exporter 1</name><record_type>Application</record_type><period>1</period><addr>10.0.0.1</addr><port>9996</port><protocol>0</protocol><version>9</version><options>0</options><filters/></ndeDescriptor></nam-response>List Details for NDE Exporter with ID = x
This operation lists a single NDE exporter configuration with ID = x.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<nam-response><operation-result><status>0</status><description>Successful</description></operation-result><ndeDescriptor><id>3</id><name>nde exporter 1</name><record_type>Application</record_type><period>1</period><addr>10.0.0.1</addr><port>9996</port><protocol>0</protocol><version>9</version><options>0</options><filters/></ndeDescriptor></nam-response>Update NDE Exporter
This operation updates NDE exporter. It is not supported in this release.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>501</status><description>Not implemented</description></operation-result></nam-response>Delete NDE Exporter
This operation deletes NDE exporter.
Request
This operation does not require a request body.
Response
Following is a sample of the XML response.
<?xml version="1.0" encoding="UTF-8"?><nam-response><operation-result><status>0</status><description>Successful</description></operation-result>F</nam-response>NDE Descriptors
The NetFlow v9 Data Export (NDE) Descriptor is a permanent definition of NAM aggregated data query that defines the scope, contents and destination of the subset of aggregated NAM data that must be exported to designated destinations across the network, using the industry-wide standard of NetFlow v9 instead of the standard UDP transport. NAM employs NetFlow as a channel for ongoing streaming of aggregated data, based on the configured set of descriptors or queries of the data attributes in NAM. SQL language is used for querying.
After the query is created, it defines the subset of NAM aggregated data that must be exported through NDE, to a specified destination on an ongoing basis (while the query still exists). These queries can be created, updated, retrieved, and deleted based on the requirements. This is primarily performed by the REST XML based interface with the help of NAM APIs, as shown in section NDE API Syntax and Examples. However, the output data is exported in a fixed selection of aggregated data records that are shipped with the product.
Selection
This part of NDE descriptor defines what is to be exported:
•Record Type
•Period (in minutes)
•NetFlow options selector
Record Types
Following are the record types supported by NAM for NetFlow:
•Application
•Host
•Client Server Response Time
•Application Conversation
•Network Conversation
•RTP Metrics
Record Options
NetFlow v9 options are part of the standard used to export data records defining mapping of encoded data values into one or more mapped values. See Record Options for details.
In NAM, the following mappings are exportable using the NDE options:
•Site ID to site name and description
•Application ID to application name
Destination (Data Collectors)
This part of NDE descriptor defines where the exported data is sent:
•IP address of the collector
•Port number of the collector
NAM exports the aggregated data in the NDE format to the NDE capable data collectors. At startup APIs create the NDE query using the XML based interface, that specify the criteria for the aggregated data. Periodic updates or continuous bulk data output is received by the data collectors based on the configured aggregation period. Data collectors contain the set of instantiated aggregations.
However, it is possible to introduce optimizations inside the Data Collector by cascading the aggregations so that the aggregation with reduced keyset and/or of lower frequency is driven off as compared to the output of more detailed aggregation. These recognize the set of NetFlow field ID's that NAM uses for data export. In the current release, NAM defines new fields to facilitate export of NAM aggregated data using keys (For example: site) and values (For example: IAP metrics).
Following table shows the exported fields along with their types and ID values:
Table 11 NetFlow V9 field IDs Exported by NAM (Newly Introduced in NAM 5.0)
Field Type ID Value Length (in bytes) Description NAM_DATA_SRC42001
4 (u32)
Assigned NAM data source (port, NDE device, VLAN ID and so on.), associated with NAM input
ifIndex.
SITE42002
4 (u32)
Assigned site for NAM (aggregation of source hosts). See Sites for more information on site.
SRC_SITE42002
4 (u32)
Assigned NAM source site(aggregation of source hosts). See Sites for more information on site.
DST_SITE42003
4 (u32)
Assigned NAM destination site (aggregation of destination hosts). See Sites for more information on site.
SERVER_SITE42004
4 (u32)
Assigned NAM server site for IAP metrics. This can be both traffic source and destination. See Sites for more information on site.
CLIENT_SITE42005
4 (u32)
Assigned NAM client site for IAP metrics. This can be both traffic source and destination. See Sites for more information on site.
IPV4_SERVER42007
4 (IPv4)
Server address (IPv4) in IAP metrics. This can be both traffic source and destination. See for information on IPv4/v6 union field type.
IPV4_CLIENT42008
4 (IPv4)
Client address (IPv6) in IAP metrics This can be both traffic source and destination. See Important Note, page 66 for information on IPv4/v6 union field type.
NET_ENCAP42010
4 (u32)
Network protocol encapsulation enum.
IPV6_SERVER42011
16 (IPv6)
Server address (IPv6) in IAP metrics. This can be both traffic source and destination.
See Important Note, page 66 for information on IPv4/v6 union field type.
IPV6_CLIENT42012
16 (IPv6)
Client address (IPv6) in IAP metrics. This can be both traffic source and destination. See Important Note, page 66 for information on IPv4/v6 union field type.
SRC_DEVICE_ID42013
4 (u32)
Internal index of the (traffic) source device.
SRC_DEVICE_IPV4_ADDR42014
4 (IPv4)
Address of the source device (IPv4). See Important Note, page 66 for information on IPv4/v6 union field type.
SRC_DEVICE_IPV6_ADDR42015
16 (IPv6)
Address of the source device (IPv6). See Important Note, page 66 for information on IPv4/v6 union field type.
SITE_NAME42016
N
Site name. See Sites for more information on site.
SITE_DESC42017
N
Site description.
OPTIMIZATION_SEGMENT42020
1(u8)
WAAS optimization segment (Client LAN, Client WAN, Server WAN, Server LAN, or Passthrough).
In the following groups, metrics applies to the last reported interval, since the last report was generated.
Traffic payload stats CLT_PKTS42033
8(u64)
Number of packets sent by client(s) during the reporting period.
SVR_PKTS42034
8(u64)
Number of packets sent by server(s) during the reporting period.
RETRS_BYTES42035
4(u32)
Number of retransmitted bytes detected during the reporting period.
RETRS_PKTS42036
4(u32)
Number of retransmitted packets detected during the reporting period.
Transaction metrics NUM_TRANS42040
4(u32)
Transactions: Number of transactions observed during the reporting period.
SUM_TRANS_TIME42041
4(u32)
Transaction Time: Time between the client request and the last server response for that request. This has to be divided by
NUM_TRANS
to get the average. MAX_TRANS_TIME42042
4(u32)
Transaction Time: Maximum transaction time between the client request and the last server response for that request.
MIN_TRANS_TIME42043
4(u32)
Transaction Time: Minimum transaction time between the client request and the last server response for that request.
SUM_DATA_TRS_TIME42044
4(u32)
Data Transfer Time: Time to transfer the server response.
SUM_RETRS_TIME42045
4(u32)
Retransmission Time: Time to retransmit data due to packet loss. Average per transaction.
TCP connections (sessions) metrics NEW_CONNECTIONS42050
4(u32)
Number of new TCP connections made (TCP 3-way handshake) during the reporting period.
COMPLETED_CONNECTIONS42051
4(u32)
Number of TCP connections closed during the reporting period.
REFUSED_CONNECTIONS42052
4(u32)
Number of refused TCP connections during the reporting period.
UNRESP_CONNECTIONS42053
4(u32)
Number of unresponsive TCP connections during the reporting period.
SUM_SESS_DURATION42054
4 (u32)
Average duration of TCP connections during the reporting period.
Response Time metrics NUM_RESPS42060
4 (u32)
Responses: Number of request-response pairs observed during the reporting period.
NUM_RESPS142061
4 (u32)
Number of responses with response time less than RspTime1 threshold.
NUM_RESPS242062
4 (u32)
Number of responses with response time less than RspTime2 and larger than RspTime1.
NUM_RESPS342063
4 (u32)
Number of responses with response time less than RspTime3 and larger than RspTime2.
NUM_RESPS442064
4 (u32)
Number of responses with response time less than RspTime4 and larger than RspTime3.
NUM_RESPS542065
4 (u32)
Number of responses with response time less than RspTime5 and larger than RspTime4.
NUM_RESPS642066
4 (u32)
Number of responses with response time less than RspTime6 and larger than RspTime5.
NUM_RESPS742067
4 (u32)
Number of responses with response time less than LateRsp7 and larger than RspTime6.
NUM_LATE_RESPS42068
4 (u32)
Late responses: Number of late responses observed during the reporting period.
SUM_RESP_TIME42071
4 (u32)
Response Time: Time between the client request and the first server response as observed at the NAM probing point in milliseconds.
MAX_RESP_TIME42072
4 (u32)
Response Time: Maximum time between the client request and the first server response as observed at the NAM probing point in milliseconds.
MIN_RESP_TIME42073
4 (u32)
Response Time: Minimum time between the client request and the first server response as observed at the NAM probing point in milliseconds.
SUM_SVR_RESP_TIME42074
4 (u32)
Server Response Time: Time between the server receiving the client request and sending the first response.
MAX_SVR_RESP_TIME42075
4 (u32)
Server Response Time: Maximum time between the server receiving the client request and sending the first response.
MIN_SVR_RESP_TIME42076
4 (u32)
Server Response Time: Minimum time between the server receiving the client request and sending the first response.
SUM_TOTAL_RESP_TIME42077
4 (u32)
Total Response Time: Time between the client sending a request and receiving the first server response.
MAX_TOTAL_RESP_TIME42078
4 (u32)
Total Response Time: Maximum time between the client sending a request and receiving the first server response.
MIN_TOTAL_RESP_TIME42079
4 (u32)
Total Response Time: Minimum time between the client sending a request and receiving the first server response.
Network times group SUM_NWK_TIME42081
4(u32)
Network Time: Network round trip time between the client and the server. This is calculated from the TCP connection setup (3-way handshake).
MAX_NWK_TIME42082
4 (u32)
Network Time: Maximum Network round trip time between the client and the server. This is calculated from the TCP connection setup (3-way handshake).
MIN_NWK_TIMR42083
4 (u32)
Network Time: Minimum Network round trip time between the client and the server. This is calculated from the TCP connection setup (3-way handshake).
SUM_CLT_NWK_TIME42084
4 (u32)
Client Network Time: Network round trip time between the client and the NAM probing point.
MAX_CLT_NWK_TIME42085
4 (u32)
Client Network Time: Maximum Network round trip time between the client and the NAM probing point.
MIN_CLT_NWK_TIME42086
4 (u32)
Client Network Time: Minimum Network round trip time between the client and the NAM probing point.
SUM_SVR_NWK_TIME42087
4 (u32)
Server Network Time: Network round trip time between the server and the NAM probing point.
MAX_SVR_NWK_TIME42088
4 (u32)
Server Network Time: Maximum Network round trip time between the server and the NAM probing point.
MIN_SVR_NWK_TIME42089
4 (u32)
Server Network Time: Minimum Network round trip time between the server and the NAM probing point.
NUM_ROUNDTRIPS42090
4 (u32)
Number of client acknowledged roundtrips observed during the reporting period.
SUM_ROUNDTRIP_TIME42091
4 (u32)
Client ACK RTT: Time for data packet from server to be client acknowledged (ACK) as observed at NAM probing point. It can be used as an estimate for the Client Network Time.
RTP metrics group RTP_SSRC42101
4 (u32)
RTP stream unique ID given by sensor.
RTP_PAYLOADTYPE42102
4 (u32)
RTP stream payload type. See http://www.iana.org/assignments/rtp-parameters
RTP_CODEC42103
4 (u32)
RTP stream's codec enum.
RTP_1STPKTTME42111
4 (u32)
The first packet time in seconds.
RTP_DURATION42112
4 (u32)
Duration of the RTP stream.
RTP_AVGMOS10042113
4 (u32)
Average MOS value x100, where x =
RTP_AVGMOS
. For example: A value of 338 becomes 3.38 (338/100). RTP_MOSDRN10042114
4 (u32)
MOS duration value x100, where x = RTP_MOSDRN. For example: A value of 440 becomes 4.40 (440/100).
RTP_WRSMOS10042115
4 (u32)
Worst MOS value x100, where x = RTP_WRSMOS. For example: A value of 229 becomes 2.29 (229/100).
RTP_ACTPKTLSS42116
4 (u32)
Actual packet loss.
RTP_ADJPKTLSS42117
4 (u32)
Adjusted packet loss.
RTP_JITTER10042118
4 (u32)
Stream Jitter value x100. For example: A value of 101 becomes 1.01 (101/100).
RTP_SOC42119
4 (u32)
Seconds of concealment.
RTP_SSC42120
4 (u32)
Seconds of severe concealment.
RTP_MAXPKTLSS42121
4 (u32)
Maximum packet loss.
RTP_PK2JTR10042122
4 (u32)
Packet-to-packet jitter measure x100. For example: A value of 115 becomes 1.15 (115/100).
RTP_MOSQUALTY42123
4 (u32)
MOS quality.
RTP_CONNCOUNT42124
4 (u32)
Total connection count for the RTP stream.
Important Note
In addition, NAM internally uses IPv4 and IPv6 addresses in fields for IP addresses. For example: host, client, server, and so on. While exporting the internal NAM cache entries, the used field ID for the IP address can be either IPv4 or IPv6 depending on field value.
The following examples show how the NetFlow v9 uses the fields with IPv4/IPv6 types:
•IPV4_DST_ADDR (id=12) or IPV6_DST_ADDR (id = 28) for destination address
•IPV4_SERVER (id=42007 above) or IPV6_SERVER (id=42011) for server address
Definitions of NetFlow Fields
In data fields that bear semantics of IP address, NAM uses field ID corresponding to IPv4 or IPv6 typed field, dynamically. This means that at any given point of time the same record type can be exported using either of the two aggregated data records, one with the field (For Example: source host address) defined with IPv4 typed field or the second with the same field defined with IPv6 typed field.
The following tables list the definitions of data records:
•Host
NAM REST XML Schema
NAM uses an XML schema and metadata to validate that the XML requests passed from the client are correct. The validation verifies that the className is valid and that the attributes listed in the XML request are recognized.
The API XML schema is defined by the World Wide Web Consortium (W3C) organization as a structured way to express data structures. The schema provides constructs for defining data types and the mapping of those data types to data structures.
Note The schema file is available in the image at : http://nam-host/admin/nbischema.php.
The following section describes the NAM REST XML schema:
<?xml version="1.0" encoding="UTF-8"?><xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified"><xs:annotation><xs:documentation>NAM REST API Schema - Version v1.0Copyright (c) 2009-2010 by Cisco Systems, Inc.All rights reserved.Schema file: nam-nbi-v1.0.xsd</xs:documentation></xs:annotation><xs:element name="hostThreshold"><xs:annotation><xs:documentation>Host Threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="site" minOccurs="1" maxOccurs="1"/><xs:element ref="host" minOccurs="1" maxOccurs="1"/><xs:element ref="application" minOccurs="0" maxOccurs="1"/><xs:element ref="dscp" minOccurs="0" maxOccurs="1"/><xs:element ref="hostMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="applicationThreshold"><xs:annotation><xs:documentation>Application threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="site" minOccurs="1" maxOccurs="1"/><xs:element ref="application" minOccurs="1" maxOccurs="1"/><xs:element ref="dscp" minOccurs="0" maxOccurs="1"/><xs:element ref="applicationMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="ndeInterfaceThreshold"><xs:annotation><xs:documentation>NDE Interface threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="dataSource" minOccurs="1" maxOccurs="1"/><xs:element ref="ifIndex" minOccurs="1" maxOccurs="1" /><xs:element ref="direction" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="ndeInterfaceMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="dscpThreshold"><xs:annotation><xs:documentation>DiffServ threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="site" minOccurs="1" maxOccurs="1"/><xs:element ref="dscpGroupId" minOccurs="0" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="dscpMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="rtpThreshold"><xs:annotation><xs:documentation>RTP threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element name="caller" minOccurs="1" maxOccurs="1" type="SiteHostPair"/><xs:element name="called" minOccurs="1" maxOccurs="1" type="SiteHostPair"/><xs:element name="codec" minOccurs="1" maxOccurs="1" type="CodecTypes"/><xs:element ref="rtpMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="iapThreshold"><xs:annotation><xs:documentation>IAP threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="application" minOccurs="1" maxOccurs="1"/><xs:element name="client" minOccurs="0" maxOccurs="1" type="SiteHostPair"/><xs:element name="server" minOccurs="1" maxOccurs="1" type="SiteHostPair"/><xs:element ref="iapMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="conversationThreshold"><xs:annotation><xs:documentation>Conversation threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element name="source" minOccurs="1" maxOccurs="1" type="SiteHostPair"/><xs:element name="desintation" minOccurs="1" maxOccurs="1" type="SiteHostPair" /><xs:element ref="application" minOccurs="0" maxOccurs="1"/><xs:element ref="conversationMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="voiceThreshold"><xs:annotation><xs:documentation>Voice threshold elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="id" minOccurs="0" maxOccurs="1"/><xs:element ref="description" minOccurs="1" maxOccurs="1"/><xs:element ref="severity" minOccurs="1" maxOccurs="1"/><xs:element ref="risingAction" minOccurs="1" maxOccurs="1"/><xs:element ref="fallingAction" minOccurs="0" maxOccurs="1"/><xs:element ref="voiceMetrics" minOccurs="1" maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:element name="id" type="xs:integer"/><xs:element name="description" type="xs:string"/><xs:element name="application" type="xs:string"/><xs:element name="interface" type="xs:string"/><xs:element name="site" type="xs:string"/><xs:element name="host" type="xs:string"/><xs:element name="dscp" type="xs:string"/><xs:element name="device" type="xs:integer"/><xs:element name="direction" type="InterfaceDirectionTypes"/><xs:element name="ifIndex" type="xs:string"/><xs:element name="dataSource" type="xs:integer"/><xs:element name="dscpGroupId" type="xs:integer"/><xs:element name="severity" type="SeverityLevels"/><xs:element name="risingAction" type="xs:integer"/><xs:element name="fallingAction" type="xs:integer"/><xs:element name="hostMetrics"><xs:annotation><xs:documentation>Host Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingInBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingOutBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingInPackets" minOccurs="0" type="xs:integer"/><xs:element name="risingOutPackets" minOccurs="0" type="xs:integer"/><xs:element name="risingTotalBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingTotalPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingInBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingOutBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingInPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingOutPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingTotalBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingTotalPackets" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="applicationMetrics"><xs:annotation><xs:documentation>Application Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingPackets" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="ndeInterfaceMetrics"><xs:annotation><xs:documentation>NDE Interface Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="inBytes" minOccurs="0" type="xs:integer"/><xs:element name="outBytes" minOccurs="0" type="xs:integer"/><xs:element name="inPackets" minOccurs="0" type="xs:integer"/><xs:element name="outPackets" minOccurs="0" type="xs:integer"/><xs:element name="totalBytes" minOccurs="0" type="xs:integer"/><xs:element name="totalPackets" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="dscpMetrics"><xs:annotation><xs:documentation>DiffServ Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="inBytes" minOccurs="0" type="xs:integer"/><xs:element name="outBytes" minOccurs="0" type="xs:integer"/><xs:element name="inPackets" minOccurs="0" type="xs:integer"/><xs:element name="outPackets" minOccurs="0" type="xs:integer"/><xs:element name="totalBytes" minOccurs="0" type="xs:integer"/><xs:element name="totalPackets" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="rtpMetrics"><xs:annotation><xs:documentation>RTP Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingMos" minOccurs="0" type="xs:float"/><xs:element name="risingAdjustedPktLossPercent" minOccurs="0" type="xs:integer"/><xs:element name="risingActualPktLossPercent" minOccurs="0" type="xs:integer"/><xs:element name="risingActualPktLoss" minOccurs="0" type="xs:integer"/><xs:element name="risingJitter" minOccurs="0" type="xs:integer"/><xs:element name="risingSSC" minOccurs="0" type="xs:integer"/><xs:element name="risingSOC" minOccurs="0" type="xs:integer"/><xs:element name="fallingMos" minOccurs="0" type="xs:float"/><xs:element name="fallingAdjustedPktLossPercent" minOccurs="0" type="xs:integer"/><xs:element name="fallingActualPktLossPercent" minOccurs="0" type="xs:integer"/><xs:element name="fallingActualPktLoss" minOccurs="0" type="xs:integer"/><xs:element name="fallingJitter" minOccurs="0" type="xs:integer"/><xs:element name="fallingSSC" minOccurs="0" type="xs:integer"/><xs:element name="fallingSOC" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="iapMetrics"><xs:annotation><xs:documentation>IAP Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingAverageResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageServerResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxServerResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageTotalResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxTotalResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageTransactionTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxTransactionTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageDataTransmissionTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageRetransmissionTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageRoundTripTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageClientNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxiumumClientNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageServerNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxServerNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingAverageNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingMaxNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="risingClientBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingClientPackets" minOccurs="0" type="xs:integer"/><xs:element name="risingServerBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingServerPackets" minOccurs="0" type="xs:integer"/><xs:element name="risingRetransmissionBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingRetransmissionPackets" minOccurs="0" type="xs:integer"/><xs:element name="risingTimeouts" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageServerResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxServerResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageTotalResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxTotalResponseTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageTransactionTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxTransactionTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageDataTransmissionTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageRetransmissionTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageRoundTripTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageClientNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxiumumClientNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageServerNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxServerNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingAverageNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingMaxNetworkTime" minOccurs="0" type="xs:integer"/><xs:element name="fallingClientBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingClientPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingServerBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingServerPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingRetransmissionBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingRetransmissionPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingTimeouts" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="conversationMetrics"><xs:annotation><xs:documentation>Conversation Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingBytesSrcToDst" minOccurs="0" type="xs:integer"/><xs:element name="risingBytesDstToSrc" minOccurs="0" type="xs:integer"/><xs:element name="risingPacketsSrcToDst" minOccurs="0" type="xs:integer"/><xs:element name="risingPacketsDstToSrc" minOccurs="0" type="xs:integer"/><xs:element name="risingTotalBytes" minOccurs="0" type="xs:integer"/><xs:element name="risingTotalPackets" minOccurs="0" type="xs:integer"/><xs:element name="fallingBytesSrcToDst" minOccurs="0" type="xs:integer"/><xs:element name="fallingBytesDstToSrc" minOccurs="0" type="xs:integer"/><xs:element name="fallingPacketsSrcToDst" minOccurs="0" type="xs:integer"/><xs:element name="fallingPacketsDstToSrc" minOccurs="0" type="xs:integer"/><xs:element name="fallingTotalBytes" minOccurs="0" type="xs:integer"/><xs:element name="fallingTotalPackets" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:element name="voiceMetrics"><xs:annotation><xs:documentation>Voice Signaling Metrics</xs:documentation></xs:annotation><xs:complexType><xs:all minOccurs="0"><xs:element name="risingJitter" minOccurs="0" type="xs:integer"/><xs:element name="risingPktLossPercent" minOccurs="0" type="xs:integer"/><xs:element name="fallingJitter" minOccurs="0" type="xs:integer"/><xs:element name="fallingPktLossPercent" minOccurs="0" type="xs:integer"/></xs:all></xs:complexType></xs:element><xs:simpleType name="SeverityLevels"><xs:annotation><xs:documentation>Severity Levels for Alarms</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="High"/><xs:enumeration value="Low"/></xs:restriction></xs:simpleType><xs:simpleType name="InterfaceDirectionTypes"><xs:annotation><xs:documentation>Interface Direction Type</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="ingress"/><xs:enumeration value="egress"/></xs:restriction></xs:simpleType><xs:simpleType name="CodecTypes"><xs:annotation><xs:documentation>Audio Codec Types</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="G711 Alaw 56k"/><xs:enumeration value="G711 Alaw 64k"/><xs:enumeration value="G711 Ulaw 56k"/><xs:enumeration value="G711 Ulaw 64k"/><xs:enumeration value="G722 48k"/><xs:enumeration value="G722 56k"/><xs:enumeration value="G722 64k"/><xs:enumeration value="G726 16k"/><xs:enumeration value="G726 24k"/><xs:enumeration value="G726 32k"/><xs:enumeration value="GSM"/><xs:enumeration value="GSM Half Rate"/><xs:enumeration value="GSM Full Rate"/><xs:enumeration value="GSM Enhanced Full Rate"/><xs:enumeration value="G728"/><xs:enumeration value="G729"/><xs:enumeration value="G731"/></xs:restriction></xs:simpleType><xs:complexType name="SiteHostPair"><xs:annotation><xs:documentation>Site/Host Pair</xs:documentation></xs:annotation><xs:sequence><xs:element ref="site"/><xs:element ref="host"/></xs:sequence></xs:complexType><xs:element name="alarmAction"><xs:annotation><xs:documentation>Defines a collection of alarm action elements.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element name="id" minOccurs="0" maxOccurs="1" type="xs:integer"/><xs:element name="name" minOccurs="1" maxOccurs="1" type="xs:string"/><xs:element name="email" minOccurs="0" maxOccurs="1" type="EnableDisableType"/><xs:element ref="trap" minOccurs="0" maxOccurs="1"/><xs:element ref="triggerCapture" minOccurs="0" maxOccurs="1"/><xs:element name="syslog" minOccurs="0" maxOccurs="1" type="EnableDisableType"/></xs:sequence></xs:complexType></xs:element><xs:simpleType name="EnableDisableType"><xs:annotation><xs:documentation>Enable/Disable type that specifies enabled or disabled mode</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="enabled"/><xs:enumeration value="disabled"/></xs:restriction></xs:simpleType><xs:element name="community" type="CommunityName"><xs:annotation><xs:documentation>SNMP Notification Community string.</xs:documentation></xs:annotation></xs:element><xs:element name="trap"><xs:annotation><xs:documentation>SNMP Community</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element ref="community" minOccurs="1" maxOccurs="1"></xs:element></xs:sequence></xs:complexType></xs:element><xs:simpleType name="CommunityName"><xs:annotation><xs:documentation>The communityName type represents a community string.</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="([a-zA-Z0-9@#$%^+=]+)" /><xs:minLength value="1"/><xs:maxLength value="50"/></xs:restriction></xs:simpleType><xs:element name="triggerCapture"><xs:annotation><xs:documentation>Capture Trigger Action</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element name="session" type="xs:integer"/><xs:element name="action" type="captureTriggerType"/></xs:sequence></xs:complexType></xs:element><xs:simpleType name="captureTriggerType"><xs:restriction base="xs:string"><xs:enumeration value="start"></xs:enumeration><xs:enumeration value="stop"></xs:enumeration></xs:restriction></xs:simpleType><xs:complexType name="Site"><xs:annotation><xs:documentation>Site definition consists of data-sources, vlan, WAN/NDE interfaces, prefixes</xs:documentation></xs:annotation><xs:sequence><xs:element name="name" type="siteNameType"/><xs:element name="description" type="siteDescriptionType"/><xs:element name="status" type="xs:integer"/><xs:element name="siteRules" type="SiteRulesType"/></xs:sequence><xs:attribute name="id" type="xs:integer" use="optional"/></xs:complexType><xs:complexType name="SiteRulesType"><xs:annotation><xs:documentation>Site rules</xs:documentation></xs:annotation><xs:sequence><xs:element name="rule" type="SiteRuleType" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:complexType name="SiteRuleType"><xs:annotation><xs:documentation>Site rule element</xs:documentation></xs:annotation><xs:sequence><xs:element name="prefix" type="PrefixType" minOccurs="0"/><xs:element name="dataSource" type="DataSourceType" minOccurs="0"/><xs:element name="vlanId" type="xs:integer" minOccurs="0"/><xs:element name="interfaceId" type="xs:integer" minOccurs="0"/><xs:element name="interfaceType" type="interfaceType" minOccurs="0"/></xs:sequence></xs:complexType><xs:simpleType name="siteNameType"><xs:annotation><xs:documentation>The siteName type represents a site name.</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="([_:a-zA-Z0-9\s\.\-]+)" /><xs:minLength value="1"/><xs:maxLength value="64"/></xs:restriction></xs:simpleType><xs:simpleType name="siteDescriptionType"><xs:annotation><xs:documentation>The siteDescription type represents a site description.</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="([_:a-zA-Z0-9\s\-]+)" /><xs:minLength value="1"/><xs:maxLength value="64"/></xs:restriction></xs:simpleType><xs:simpleType name="interfaceType"><xs:restriction base="xs:integer"><xs:enumeration value="0" id="WAN" ></xs:enumeration><xs:enumeration value="1" id="NDE"></xs:enumeration></xs:restriction></xs:simpleType><xs:complexType name="DataSourceIdType"><xs:attribute name="id" type="xs:integer" use="required"/></xs:complexType><xs:complexType name="DataSourceIdsType"><xs:sequence><xs:element name="dataSource" type="DataSourceIdType" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:complexType name="DataSourceType"><xs:sequence><xs:element name="id" type="xs:integer"/><xs:element name="name" type="xs:string" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="DataSourcesType"><xs:sequence><xs:element name="dataSource" type="DataSourceType" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:complexType name="VlansType"><xs:sequence><xs:element name="vlanId" type="xs:integer" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:complexType name="InterfacesType"><xs:sequence><xs:element name="interfaceId" type="xs:integer" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:complexType name="InterfaceTypes"><xs:annotation><xs:documentation xml:lang="en">WAN = 0, NDE = 1</xs:documentation></xs:annotation><xs:sequence><xs:element name="type" type="xs:integer" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:simpleType name="NetmaskType"><xs:annotation><xs:documentation xml:lang="en">The representation of a network netmask</xs:documentation></xs:annotation><xs:union><xs:simpleType><xs:restriction base="xs:integer"/></xs:simpleType><!-- only integer format supported<xs:simpleType><xs:restriction base="ipv4Address"/></xs:simpleType>--></xs:union></xs:simpleType><xs:complexType name="PrefixType"><xs:annotation><xs:documentation xml:lang="en">The representation of a network prefix (ipaddress and netmask)</xs:documentation></xs:annotation><xs:sequence><xs:element name="ip" type="ipAddress"/><xs:element name="netmask" type="NetmaskType"/></xs:sequence></xs:complexType><xs:complexType name="PrefixesType"><xs:annotation><xs:documentation xml:lang="en">The representation of network prefixes</xs:documentation></xs:annotation><xs:sequence><xs:element name="prefix" type="PrefixType" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:element name="sites"><xs:complexType><xs:sequence><xs:element name="site" type="Site"/></xs:sequence></xs:complexType></xs:element><xs:simpleType name="ipv4Address"><xs:annotation><xs:documentation>The representation of an IPv4 address</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="((0|(1[0-9]{0,2})|(2(([0-4][0-9]?)|(5[0-5]?)|([6-9]?)))|([3-9][0-9]?))\.){3}(0|(1[0 -9]{0,2})|(2(([0-4][0-9]?)|(5[0-5]?)|([6-9]?)))|([3-9][0-9]?))" /></xs:restriction></xs:simpleType><xs:simpleType name="ipv6Address"><xs:annotation><xs:documentation>The representation of an IPv6 address</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="((([0-9a-fA-F]{1,4}:){7})([0-9a-fA-F]{1,4}))|((([0-9a-fA-F]{1,4}:){6})(([0-9]{1,3}\ .[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})))|((([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*(::)(([0- 9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*)|((([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*(::)(([0-9 a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*(([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})))" /></xs:restriction></xs:simpleType><xs:simpleType name="ipv6Prefix"><xs:annotation><xs:documentation>The representation of an IPv6 prefix</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:pattern value="((([0-9a-fA-F]{1,4}:){7})([0-9a-fA-F]{1,4})/\d+)|((([0-9a-fA-F]{1,4}:){6})(([0-9]{1 ,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}))/\d+)|((([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*( ::)(([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*/\d+)|((([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}) )*(::)(([0-9a-fA-F]{1,4}:)*([0-9a-fA-F]{1,4}))*(([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9] {1,3}))/\d+)" /></xs:restriction></xs:simpleType><xs:simpleType name="ipv6PrefixOrAddress"><xs:annotation><xs:documentation>The representation of an IPv6 prefix or address</xs:documentation></xs:annotation><xs:union memberTypes="ipv6Prefix ipv6Address" /></xs:simpleType><xs:simpleType name="ipAddress" ><xs:annotation><xs:documentation>The representation of an IP address. This can be IPv4 or IPv6.</xs:documentation></xs:annotation><xs:union memberTypes="ipv4Address ipv6Address" /></xs:simpleType><xs:complexType name="CaptureSessionType"><xs:annotation><xs:documentation>The representation of a Packet Capture Session.Refer to NAM GUI Capture Screen for more information.</xs:documentation></xs:annotation><xs:sequence><xs:element name="name" type="xs:string"/><xs:element name="trafficSource" type="xs:integer"/><xs:element name="dataPorts" type="DataPortType" minOccurs="0"/><xs:element name="sliceSize" type="xs:integer"/><xs:element name="buffer" type="CaptureSessionBufferType" minOccurs="0"/><xs:element name="file" type="CaptureSessionFileType" minOccurs="0" /><xs:element name="filters" type="CaptureFilterIdType" minOccurs="0"/><xs:element name="status" type="CaptureSessionStatusType" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="DataPortType"><xs:sequence><xs:element name="dataPort" type="DataPortNames" maxOccurs="4"/></xs:sequence></xs:complexType><xs:simpleType name="DataPortNames"><xs:annotation><xs:documentation>Data Port Names</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="DATA PORT 1"/><xs:enumeration value="DATA PORT 2"/><xs:enumeration value="DATA PORT 3"/><xs:enumeration value="DATA PORT 4"/></xs:restriction></xs:simpleType><xs:complexType name="CaptureSessionFileType"><xs:sequence><xs:element name="rotateFiles" type="xs:integer"/><xs:element name="numFiles" type="xs:integer"/><xs:element name="fileSize" type="xs:integer"/><xs:element name="fileLocation" type="xs:string"/></xs:sequence></xs:complexType><xs:complexType name="CaptureSessionBufferType"><xs:sequence><xs:element name="bufferSize" type="xs:integer"/><xs:element name="wrapMode" type="xs:integer"/></xs:sequence></xs:complexType><xs:complexType name="CaptureFilterIdType"><xs:sequence><xs:element name="filterId" minOccurs="0" type="xs:integer"/></xs:sequence></xs:complexType><xs:complexType name="CaptureSessionStatusType"><xs:sequence><xs:element name="status" type="xs:integer"/><xs:element name="startTime" type="xs:string"/><xs:element name="packetsCaptured" type="xs:integer"/></xs:sequence></xs:complexType><xs:complexType name="CaptureTriggerEventType"><xs:sequence><xs:element name="startTrigger" type="xs:integer"/><xs:element name="stopTrigger" type="xs:string" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="CaptureHardwareFilterType"><xs:annotation><xs:documentation xml:lang="en">The representation of a hardware capture filter.Filter types: VLANs(0),VLANs+IP(1),IP(3),IP+TCP+UDP(4),IP+Payload(5),Payload(6)Protocol types: Any(0),ICMP(1),IGMP(2),TCP(6),UDP(17),GRE(47),IPinIP(94),L2TP(115)VLAN format: 1,2,3,4 or range 8..11Refer to NAM User Guide - GUI Capture Screen for more information.</xs:documentation></xs:annotation><xs:sequence><xs:element name="name" type="xs:string"/><xs:element name="filterId" type="xs:integer" minOccurs="0"/><xs:element name="sessionId" type="xs:integer" minOccurs="0"/><xs:element name="filterType" type="xs:integer"/><xs:element name="ipVersion" type="xs:integer" minOccurs="0"/><xs:element name="srcAddrMask" type="xs:string" minOccurs="0"/><xs:element name="dstAddrMask" type="xs:string" minOccurs="0"/><xs:element name="srcPort" type="xs:integer" minOccurs="0"/><xs:element name="dstPort" type="xs:integer" minOccurs="0"/><xs:element name="vlans" type="xs:string" minOccurs="0"/><xs:element name="protocol" type="xs:string" minOccurs="0"/><xs:element name="pattern" type="CaptureHardwareFilterPatternType" minOccurs="0" /><xs:element name="pattern2" type="CaptureHardwareFilterPatternType" minOccurs="0"/><xs:element name="pattern3" type="CaptureHardwareFilterPatternType" minOccurs="0"/><xs:element name="pattern4" type="CaptureHardwareFilterPatternType" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="CaptureSoftwareFilterType"><xs:annotation><xs:documentation xml:lang="en">The representation of a capture software filter.Prefer to NAM GUI Capture Screen for more information.</xs:documentation></xs:annotation><xs:sequence><xs:element name="name" type="xs:string"/><xs:element name="filterId" type="xs:integer" minOccurs="0"/><xs:element name="sessionId" type="xs:integer" minOccurs="0"/><xs:element name="srcAddrMask" type="xs:string" minOccurs="0" /><xs:element name="dstAddrMask" type="xs:string" minOccurs="0"/><xs:element name="srcPort" type="xs:string" minOccurs="0" /><xs:element name="dstPort" type="xs:string" minOccurs="0"/><xs:element name="netEncap" type="xs:integer" minOccurs="0"/><xs:element name="vlans" type="xs:string" minOccurs="0"/><xs:element name="protocol" type="xs:string" minOccurs="0"/><xs:element name="application" type="xs:integer" minOccurs="0"/><xs:element name="direction" type="xs:integer" minOccurs="0"/><xs:element name="patternOffset" type="xs:integer" minOccurs="0"/><xs:element name="patternOffsetBase" type="xs:integer" minOccurs="0"/><xs:element name="pattern" type="xs:string" minOccurs="0"/><xs:element name="patternMask" type="xs:string" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="CaptureHardwareFilterPatternType"><xs:sequence><xs:element name="dataOffset" type="xs:integer"/><xs:element name="dataValue" type="xs:string"/><xs:element name="dataMask" type="xs:string"/></xs:sequence></xs:complexType><xs:complexType name="CaptureSessionStateType"><xs:sequence><xs:element name="name" type="xs:string"/><xs:element name="sessionId" type="xs:integer"/><xs:element name="startTime" type="xs:dateTime"/><xs:element name="packets" type="xs:integer"/><xs:element name="state" type="xs:string"/></xs:sequence></xs:complexType><xs:complexType name="QueryType"><xs:annotation><xs:documentation xml:lang="en">Query stream to configure a NDE Export Resource.Example:query element = select * from Application destination ipaddr=10.0.0.1;port=9997format encoding=9 protocol transportProtocol=udp interval 1options 2 where site1=any;appId=anyQuery tables:HostApplicationNetworkConversationApplicationConversationIAPServerApplicationIAPClientServerApplicationRTPMetricsOptions type:application description(1)site definitions (2)data-source definitions (3)</xs:documentation></xs:annotation><xs:sequence><xs:element name="name" type="xs:string"/><xs:element name="query" type="xs:string" /></xs:sequence></xs:complexType><xs:complexType name="ApplicationMatchType"><xs:sequence><xs:element name="layer" type="xs:string" /><xs:element name="ports" type="xs:string" /></xs:sequence></xs:complexType><xs:complexType name="ApplicationMatchesType"><xs:sequence><xs:element name="match" type="ApplicationMatchType" minOccurs="1" maxOccurs="unbounded" /></xs:sequence></xs:complexType><xs:complexType name="ApplicationIdType"><xs:sequence><xs:element name="name" type="xs:string" /><xs:element name="appTag" type="xs:long" minOccurs="0"/><xs:element name="engineId" type="xs:long" minOccurs="0" /><xs:element name="selector" type="appSelectorType" minOccurs="0"/><xs:element name="matches" type="ApplicationMatchesType" /></xs:sequence></xs:complexType><xs:simpleType name="appSelectorType"><xs:annotation><xs:documentation>The appSelector type represents an application selector</xs:documentation></xs:annotation><xs:restriction base="xs:integer" ><xs:minInclusive value="0"/><xs:maxInclusive value="65535"/></xs:restriction></xs:simpleType><xs:complexType name="OperationResult"><xs:sequence><xs:element name="status" type="xs:integer"/><xs:element name="description" type="xs:string"/><xs:element name="uri" type="xs:string" minOccurs="0"/></xs:sequence></xs:complexType><xs:element name="nam-response"><xs:complexType><xs:sequence><xs:element name="operation-result" type="OperationResult"/><xs:choice minOccurs="0"><xs:element name="site" type="Site" maxOccurs="unbounded"/><xs:element ref="capture" maxOccurs="unbounded"/><xs:element ref="application" maxOccurs="unbounded"/><xs:element ref="alarmAction" maxOccurs="unbounded"/><xs:element ref="ndeDescriptor" maxOccurs="unbounded"/><xs:element ref="hostThreshold" maxOccurs="unbounded"/><xs:element ref="applicationThreshold" maxOccurs="unbounded"/><xs:element ref="ndeInterfaceThreshold" maxOccurs="unbounded"/><xs:element ref="dscpThreshold" maxOccurs="unbounded"/><xs:element ref="rtpThreshold" maxOccurs="unbounded"/><xs:element ref="iapThreshold" maxOccurs="unbounded"/><xs:element ref="conversationThreshold" maxOccurs="unbounded"/></xs:choice></xs:sequence></xs:complexType></xs:element><xs:element name="nam-request"><xs:complexType><xs:choice><xs:element name="site" type="Site"/><xs:element ref="capture"/><xs:element ref="application"/><xs:element ref="alarmAction"/><xs:element ref="netflowExport"/><xs:element ref="hostThreshold"/><xs:element ref="applicationThreshold"/><xs:element ref="ndeInterfaceThreshold"/><xs:element ref="dscpThreshold"/><xs:element ref="rtpThreshold"/><xs:element ref="iapThreshold"/><xs:element ref="conversationThreshold"/><xs:element ref="voiceThreshold"/></xs:choice></xs:complexType></xs:element><xs:element name="capture"><xs:complexType><xs:sequence><xs:choice><xs:element name="swFilter" type="CaptureSoftwareFilterType"/><xs:element name="hwFilter" type="CaptureHardwareFilterType"/><xs:element name="session" type="CaptureSessionType"/></xs:choice></xs:sequence></xs:complexType></xs:element><xs:element name="captureFileDownload" ><xs:complexType><xs:sequence><xs:element name="filename" type="xs:string"/><xs:element name="path" type="xs:string"/></xs:sequence></xs:complexType></xs:element><xs:element name="captureFiles"><xs:complexType><xs:sequence><xs:element name="fileUrl" type="xs:string" /></xs:sequence></xs:complexType></xs:element><xs:element name="ndeDescriptor"><xs:complexType><xs:sequence><xs:element name="id" type="xs:integer" minOccurs="0" /><xs:element name="name" type="xs:string" /><xs:element name="recordType" type="xs:string" /><xs:element name="period" type="xs:integer" /><xs:element name="addr" type="xs:string" /><xs:element name="port" type="xs:integer" /><xs:element name="protocol" type="xs:string" /><xs:element name="version" type="xs:string" /><xs:element name="options" type="xs:string" minOccurs="0"/><xs:element name="filters" type="NdeFiltersType" minOccurs="0" /></xs:sequence></xs:complexType></xs:element><xs:complexType name="NdeFilterType"><xs:sequence><xs:element name="field" type="xs:string" /><!-- <xs:element name="operation" type="xs:string" /> --><xs:element name="value" type="xs:string" /></xs:sequence></xs:complexType><xs:complexType name="NdeFiltersType"><xs:sequence><xs:element name="filter" type="NdeFilterType" maxOccurs="unbounded" /></xs:sequence></xs:complexType><xs:element name="netflowExport" type="QueryType"/><xs:element name="applicationId" type="ApplicationIdType"/><xs:complexType name="WaasServerFilterType"><xs:annotation><xs:documentation>WAAS Server Filter definition - a collection of IPv4 addresses.</xs:documentation></xs:annotation><xs:sequence><xs:element name="ipAddr" type="ipv4Address" maxOccurs="unbounded"/></xs:sequence></xs:complexType><xs:element name="waasServerFilter" type="WaasServerFilterType"/><!-- Application Group --><xs:element name="appGroups" type="AppGroupsType"/><xs:complexType name="AppGroupsType"><xs:sequence><xs:element name="appGroup" type="AppGroupType" /></xs:sequence></xs:complexType><xs:complexType name="AppGroupType"><xs:sequence><xs:element name="id" type="xs:integer" minOccurs="0"/><xs:element name="name" type="xs:string" /><xs:element name="apps" type="AppsType" minOccurs="0"/></xs:sequence></xs:complexType><xs:complexType name="AppsType"><xs:sequence><xs:element name="app" type="AppType" maxOccurs="35" /></xs:sequence></xs:complexType><xs:complexType name="AppType"><xs:sequence><xs:element name="name" type="xs:string" /><xs:element name="tag" type="xs:integer" /></xs:sequence></xs:complexType></xs:schema>Appendix - CSV Interface
This appendix provides information on the NAM 4.x release CSV export APIs that are supported in this release for backward compatibility purposes. In this release, these APIs help to export the last interval of data depending on the interval that is set in the administration monitor settings. You can set default interval settings from 1 to 5 minutes depending on the data that is exported. The data exported from these URL CSV based exports, will be based on the last interval. These help to configure NAM for traffic and response time. For more information on how to configure these aggregation intervals, refer to the Cisco Network Analysis Module Traffic Analyzer User Guide.
CSV API
Comma Separated Value data files are exported from the NAM using the HTTP protocol following IETF standards. NAM CSV data export follows the pull model where you send the request to NAM to get exported data.
Following is the table that explains the 4.X APIs that are available for the NAM 5.0 release.
Where:
•nam-host is the NAM IP address or hostname
•datasrc is the Name of the data source from which data is retrieved
•colName is the name of the column to be sorted/filtered (optional)
•value is the value to be filtered (optional)
•numRows is the number of data rows requested
•startRow is the Start row, set to 0 to get from the beginning of the table
•sessID is the log in session ID
•deltaMode is the delta mode. Set to 1 by default.
•filterTCP used to filter TCP packets when set to 1. Default value is 0.
Note To request data files, you must send
HTTP GET
requests to the web server using the URLs as listed in the above table.
All parameters must be URL encoded. For example, "ALL SPAN" must be encoded as ALL+SPAN or ALL%20SPAN. Use the NAM GUI, the CLI, or the SNMP interface to obtain the list of NAM datasources.
For example, to get ART data from the ALL SPAN data source, use the following URL:
http://<nam-host>/monitor/art/artRptExport.php?source=ALL+SPAN&PHPSESSID=4f9eac23fa78a162d18a9eb3ee32645a
After successful authentication, the NAM responds with the CSV data file in a HTTP response.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)