User Guide for Cisco Network Analysis Module Traffic Analyzer, 5.0
Monitoring and Analysis
Downloads: This chapterpdf (PDF - 1.32MB) The complete bookPDF (PDF - 6.99MB) | Feedback

Monitoring and Analysis

Table Of Contents

Monitoring and Analysis

Navigation

Context Menus

Interactive Report

Saving Filter Parameters

Traffic Summary

Response Time Summary

Site Summary

Alarm Summary

Analyzing Traffic

Application

Hosts Detail

Host

Applications Detail

NDE Interface Traffic Analysis

Viewing Interface Details

DSCP Detail

DSCP

Application Groups Detail

URL Hits

Viewing Collected URLs

Filtering a URL Collection List

Host Conversations

Network Conversation

Top Application Traffic

Application Traffic By Host

WAN Optimization

Top Talkers Detail

Application Performance Analysis

Transaction Time (Client Experience)

Traffic Volume and Compression Ratio

Average Concurrent Connections (Optimized vs. Passthru)

Multi-Segment Network Time (Client LAN - WAN - Server LAN)

Conversation Multi-Segments

Response Time

Application Response Time

Network Response Time

Server Response Time

Client Response Time

Client-Server Response Time

Server Application Responses

Server Application Transactions

Server Network Responses

Client-Server Application Responses

Client-Server Application Transactions

Client-Server Network Responses

Managed Device

Interface

Interfaces Stats Table

Interface Statistics Over Time

Health

Switch Health

Router Health

NBAR

Media

RTP Streams

Purpose

Monitoring RTP Streams

Voice Call Statistics

Calls Table

RTP Conversation


Monitoring and Analysis


The Cisco NAM Traffic Analyzer Release 5.0 introduces a redesigned interface and user experience, with more intuitive workflows and interactive reporting capabilities.

There are two types of dashboards in NAM 5.0: One type is the "summary" views found under the Monitor menu, and the other type is the "over time" views found under the Analyze menu. The Monitor dashboards allow you to view network traffic, application performance, site performance, and alarms at a glance. From there, you can isolate one area, for example an application with response time issues, and then drill-down to the Analyze dashboard for further investigation.

This chapter provides information about monitoring your network traffic and analyzing the information presented.

This chapter contains the following sections:

Navigation

Monitor

Traffic Summary

Response Time Summary

Site Summary

Alarm Summary

Analyze

Analyzing Traffic

WAN Optimization

Response Time

Managed Device

Media

Navigation

Context Menus

On most of the dashboards, you can left-click on the colored bar of data to get a context menu, with which you can get more detailed information about one particular application.

The description to the right of "Selected Application" in the menu shows what item you had clicked on (in the case above, "ftp").

The menu items above the separator line are specific to the selected element of the Top N chart. The items below the separator line are not specific to the selected element, but apply to the Top N chart.

Interactive Report

On most Monitoring or Analyze screens, you can use the Interactive Report on the left to redefine the parameters of the information displayed in the dashboards. Click the Filter button to change the parameters of the information displayed in the charts.

You can choose from various parameters, such as the time interval for the data being displayed. An asterisk represents required fields.

The reporting time interval selection changes depending upon the dashboard you are viewing, and the NAM platform you are using:

The NAM appliance supports the following short term intervals: Last 5 minutes, last 15 minutes, last 1 hour, last 4 hours, and last 8 hours.

The Branch Routers (NME-NAM) support the following short term intervals: Last 5 minutes, last 15 minutes, and last 1 hour.

The other platforms support the following short term intervals: Last 5 minutes, last 15 minutes, last 1 hour, and last 4 hours.

The Long Term interval selections (Last 1 day, 1 week, and 1 month) are disabled from the following dashboards: RTP Streams, Voice Call Statistics, Calls Tables, RTP Conversations, Host Conversations, Conversations, and Response Time Details Views.

Maximum interval for up to 1 hour is supported for the following dashboards: RTP Streams, Voice Call Statistics, Calls Tables, RTP Conversations, Host Conversations, Conversations, and Response Time Details Views.

The "From" and "To" fields are only enabled when the Time Range is set to "Custom."

Saving Filter Parameters

After clicking the Filter button in the Interactive Report and selecting the desired parameters, you can then save these selections with the purpose of viewing that same data at a future time. Enter a name in the "Filter Name" field, as shown in Figure 3-1. A filter will only be saved if a Filter Name is entered. Also, only saved filters are persisted across muliple login sessions. Click the Submit button.

Figure 3-1 Saving Filter Information

This filter is now saved and displayed underneath the Interactive Report, as shown in Figure 3-2. You can save up to five filters.

Figure 3-2 Filter Parameters Accessible

Traffic Summary

The Traffic Summary Dashboard allows you to view the Top N Applications, Top N Application Groups, Top N Hosts (In and Out), IP Distribution by Bytes, Top N DSCP, and Top N VLAN being monitored on your network. It provides auto-monitoring of traffic from all potential data sources (for example, SPAN, NDE, and WAAS). You can get to the Traffic Summary Dashboard by going to Monitor > Overview > Traffic Summary.

You can use the Interactive Report on the left to filter the information for a particular Site, Data Source, VLAN, or reporting time interval. You can specify just one type of criteria and leave the others blank, or specify all of them. You can also choose to view the Rate or cumulative data from the Interactive Report.

When you log into the NAM for the first time, the default view will be the Traffic Summary dashboard, and the top data source is selected by default.

For each chart described below, you can left-click on any colored bar to get to a context menu, with which you can get more detailed information about that item.

The charts shown on this dashboard are:

Top N Applications

The Top N Applications Chart enables you to view the traffic rate (bytes per second or bits per second) or traffic volume (bytes or bits), depending on the Interactive Report filter selection (data rate or cumulative, respectively). When you place your cursor over the colored bar, you will see the number of bytes per second collected or the total bytes over the last time interval.

If you left-click on a colored bar and choose "Capture" from the context menu, you can start a capture on this data (see Chapter 4, "Capturing and Decoding Packet Data" for more information about Capture).

Top N Application Groups

This chart shows a detailed analysis of the Top N application groups and the traffic rate or volume for this interval. In the Interactive Report, you can select either rate or cumulative, where rate is the bytes per second, and cumulative is the total number of bytes.

Top N Hosts (In and Out)

This chart displays the traffic rate (bytes per second or bits per second) or traffic volume (bytes or bits). To get more specific details about the host activity, left-click on the colored bar and make a selection. You can also choose "Capture" from the context menu to start a capture on this data (see Chapter 4, "Capturing and Decoding Packet Data" for more information about Capture).

IP Distribution by Bytes

This chart shows the percentages of bytes being distributed to IP protocols (for example, IPv4 TCP).

Top N DSCP

This chart shows statistics for the top DSCP Aggregation Groups.

Top N VLAN

This chart shows the Top N VLAN statistics. In this chart, you may see VLAN 0, which is for traffic that does not have any VLAN tags. You can also use this value in Capture to do filtering.

If you left-click on a colored bar and choose "Capture" from the context menu, you can start a capture on this data (see Chapter 4, "Capturing and Decoding Packet Data" for more information about Capture).

To see a chart in table format, use the "View as Chart / View as Grid" toggle button on the bottom right corner of the chart. You can also click the "View as Image" button to view the image and save it as a PNG file.

When viewing the data as a Grid, the numbers will be formatted according to what you have configured in Administration > System > Preferences. On that page, you can also configure the number of Top N entries you would like to display.

Response Time Summary

The NAM Traffic Analyzer software provides response time measurements and various user-experience-related metrics, which are computed by monitoring and time-stamping packets sent from the user to the server providing services. These Application Response Time Metrics are available to view under the Response Time Summary Dashboard (Monitor > Overview > Response Time Summary). In NAM 4.x, this was referred to as Intelligent Application Performance (IAP) analytics.

After the NAM Traffic Analyzer is started, these metrics will begin to populate automatically. When you first navigate to Response Time Summary dashboard, the top data source is selected by default. This dashboard shows you performance statistics for Site, Data Source, VLAN, and a specific amount of time.

Use the Interactive Report window on the left side of the screen to change the parameters for the information displayed. To see a chart in table format, use the "View as Chart / View as Grid" toggle button on the bottom right corner of the chart. You can also click the "View as Image" button to view the image and save it as a PNG file.

The dashboard charts will show you the following information:

Top N Applications by Server Response Time

This chart displays the server response times for the applications in the site, data source, VLAN, or site clients or servers you selected in the Interactive Report window. For example, a selection "http" would show you the average response time of http servers seen in the traffic category you have selected in the Interactive Report window. The data is shown in microseconds.

Top N Site-to-Site Network Time

This chart displays the top network time between the client site and the server site in the category you selected. The data is shown in microseconds.

Top N Servers By Server Response Time

This chart allows you to see how well servers are performing, by showing you the server that has the longest response time (the item appearing at the top). The data is shown in microseconds.

Top N Servers By Bytes

This chart displays the total bytes or rate of traffic for the top servers.


Note To change from bytes to bits, choose Administration > System > Preferences and change the "Data displayed in" selection.


Top N Clients By Transaction Time

This chart displays the transaction time per client. The client with the highest response time appears on top. The data is shown in milliseconds.

Top N Clients By Bytes

This chart displays the total bytes or rate of traffic for the top clients.


Note To change from bytes to bits, choose Administration > System > Preferences and change the "Data displayed in" selection.


Site Summary

The Site Summary Dashboard (accessed by choosing Monitor > Overview > Site Summary) will show you information about the sites in your network. You can use the Interactive Report on the left side of the screen to change the information displayed. For more information about sites, see Sites, page 2-58.

The charts displayed on the Alarm Summary dashboard are:

Top N Site Pairs by Traffic

This chart shows top site to site traffic.

Top N Sites by Average Transaction Time

This chart shows the average transaction time by site.

Top N Sites by Traffic

This chart shows the sites that have the most traffic (which are the most active). It is a total of all the traffic sent or received for hosts that belong to the particular site, which means that this traffic includes intra-site traffic as well.

Top N Sites by Average MOS

This chart shows sites that have the highest average Mean Opinion Score (MOS).

MOS will normally range from 1-5, denoting the perceived quality of the transmission, where 1 is the lowest perceived quality, and 5 is the highest perceived quality measurement. The MOS is weighted depending on the duration.

To see any of the charts in table format, use the "View as Chart / View as Grid" toggle button on the bottom right corner of the chart. You can also click the "View as Image" button to view the image and save it as a PNG file. The numbers will be formatted according to what you have configured in Administration > Settings > Preferences.

Alarm Summary

The Alarm Summary Dashboard (accessed by choosing Monitor > Overview > Alarm Summary) will show you the top alarms occurring in the network.

To display network traffic information for a particular amount of time, use the Interactive Report on the left side of the screen. The Severity Selector in the Interactive Report allows you to choose to view high severity alarms only, low severity alarms only, or both high and low severity alarms (these settings are configured under Setup > Alarms > Thresholds). You can also choose the desired amount of time from the Time Range drop-down menu, or you can customize the time range.

On any chart on the Alarm Summary Dashboard, you can click on a colored bar to see the Context menu, with which you can get more information.

If you do not set any alarms or thresholds, the Alarm Summary Dashboard will have no data. For information on setting up alarms and thresholds, see Alarms, page 2-36.


Note You could see a count of two alarms for the same occurrence if:
- both the source and the destination are in the same site in the Top N Site - Host Pair chart.
- both the source and the destination are in the same site in the Top N Site chart.
- both the source and the destination are in the same site using the same application in the Top N Site - Application Pair chart.



Note You will not have any data in Top N Site - Application and Top N Application if there is no threshold configured that involves an application (for example: Response Time threshold or Application threshold).


NDE Interface alarms are not related to any site; therefore, they will not appear on the four colored site alarm charts on the Alarm Summary dashboard. Instead, the New Alarms Raised and Last 50 Alarms tables at the bottom of this screen will contain NDE Interface alarms raised.

The five charts displayed on the Alarm Summary dashboard are:

Top N Sites by Alarm Count

This chart will list the Top N sites (maximum of 10) that have the most alarm triggers during the selected time range. If no thresholds are configured, this chart will have no data.The number on the bottom of the chart is the alarm count.

You can configure thresholds under Setup > Alarms > Thresholds. You can configure the Top N entries under Administration > System > Preferences.

Top N Hosts by Site and Alarm Count

This chart shows the number of alarm messages during the selected time range that are triggered for Hosts across all sites, by the Site - Host Pair.

Top N Applications by Alarm Count

This chart shows the number of alarms during the selected time range for Applications across all sites.

Top N Applications by Site and Alarm Count

This chart shows the most alarm triggers during the selected time range by the application and site pair.

New Alarms Raised

The New Alarms Raised table shows you all alarms that occurred during the interval selected in the Interactive Report window. Some alarms may have been triggered outside of the time period, but may still be occurring.

You can use the Filter drop-down menu to filter the alarms.

Last 50 Alarms

The Last 50 Alarms table shows you the alarms that occurred during the interval selected in the Interactive Report window. Some alarms may have been triggered outside of the time period, but may still be occurring.

You can click the "All Alarms" button at the bottom to bring up a separate window, which will show you all 50 alarms without the need for scrolling.

You can also use the "Filter" button, both on this screen and the "All Alarms" screen, to display only alarms that meet the criteria you enter.

Table 3-1

Field
Description
Site

This contain site or source and destination sites (source - destination) of the network traffic that generated the alarm message.

Alarm Triggered By

Details information of the network traffic that generated the alarm message. The format of the alarm triggered by string are:

Triggered by application threshold: application

Triggered by application with DSCP threshold: DSCP:codepoint - application

Triggered by host threshold: host

Triggered by host with application threshold: host - application

Triggered by host with application and DSCP: DSCP: code point - host - application

Triggered by host with DSCP: DSCP: code point - host

Triggered by conversation: source - destination

Triggered by conversation with application: source - application - destination

Triggered by response time: IAP: client - application - server.

Triggered by DSCP: DSCP: code point

Triggered by RTP stream: source - source port - codec(codec string) - SSRC(number) - destination - destination port

Triggered by voice signaling: Calling (address - number) Called (address - number) ID/References(id() - ref(calling:called))

Triggered by NDE interfaces: NDE: Device (address) - If-Index(number) - Ingress/Egress

Threshold Variable

Parameter of the threshold that is used to evaluate alarm condition.

Threshold Value

User defined rising value of the threshold variable.

Triggered Time

Time when the alarm condition was found occurred.

Triggered Value

Parameter value when the alarm condition was raised. Note: The triggered value could be - when the viewing window does not included the alarm when it was occurring.

Clear Time

Time when the alarm condition was resolved. The alarm variable has fallen below the falling threshold value.


Analyzing Traffic

The charts available under the "Analyze" menu show statistics that occur over time.

You can use the Zoom/Pan feature, in which you can drag the beginning or end to change the time interval, as shown below.

The time interval change on the zoom/pan chart will affect the data presented in the charts in the bottom of the window. The zoom/pan time interval also affects the drill-down navigations; if the zoom/pan interval is modified, the context menu drill-downs from that dashboard will use the zoom/pan time interval.


Note In a bar chart which you can zoom/pan, each block represents data collected during the previous interval (the time stamp displayed at the bottom of each block is the end of the time range). Therefore, you may have to drag the zoom/pan one block further than expected to get the desired data to populate in the charts in the bottom of the window.


The NAM 5.0 Traffic Analyzer menu selections for Analyze > Traffic are:

Application

Host

NDE Interface Traffic Analysis

DSCP

URL Hits

Application

The Application Analysis screen will show you at a glance the traffic level for a giver application over a selected period of time. It is available under the menu option Analyze > Traffic > Application. It will show you:

A graph of application traffic over time

Top hosts transmitting and receiving traffc on that application for the selected time period

Application Configuration -- Shows the criteria by which the NAM classifies packets as that application. This is typically a list of TCP and/or UDP ports that identify the application. Note that some applications are identified by heuristic or other state-based algorithms.

Hosts Detail

On the "Top N Hosts - Traffic In" or "Top N Hosts - Traffic Out" chart, you can left-click a colored bar to get the context menu, and choose "Hosts Detail" to see the All Hosts screen and the detailed information about all hosts. Table 3-3 describes the fields on the All Hosts screen.

Table 3-2 Host Detail

Field
Description
Host

Host address

Application

Application type

In Bytes/sec

Number of bytes per second incoming

In Packets/sec

Number of packets per second incoming

Out Bytes/sec

Number of bytes per second outgoing

Out Packets/sec

Number of packets per second outgoing


Host

The Host Traffic Analysis Screen will show you at a quick glance the input and output of a particular host over time. It is available under the menu option Analyze > Traffic > Host. It will show you:

Input and output traffic for the host over time

Top N application activity of the host over the selected interval

Total application usage distribution for the host

Figure 3-3 Host Traffic Analysis

Applications Detail

On the "Top N Applications" chart, you can left-click a colored bar to get the context menu, and choose "Applications Detail" to see the All Applications screen and the detailed information about all applications. Table 3-3 describes the fields on the All Applications screen.

Table 3-3 Applications Detail

Field
Description
Application

Application type

Application Group

The application group (set of applications that can be monitored as a whole).

Bytes/sec

Traffic rate; number of bytes per second

Packets/sec

Traffic rate; number of packets per second


NDE Interface Traffic Analysis

The NDE Interface Analysis page enables you to view data collected for individual interfaces on a switch or router that is exporting Netflow packets to the NAM. The displayed information represents the total data collected since the collection was created, or since the NAM was restarted. To view the NDE Interface Analysis page, choose Analyze > Traffic > NDE Interface.

You need to configure the NDE interface capacity to see both the utilization in the charts and the interface name on the NDE interface list. See NDE Interface Capacity, page 2-63.

You can also give the SNMP RO (or RW) community string to an NDE data source, and then the NAM will fill up the NDE interface Capacity. Choose Setup > NAM Data Sources to enter the community string. For more information, see Creating NetFlow Data Sources Using the Web GUI, page 2-23 or Creating NetFlow Data Sources Using the CLI, page 2-25.

Select an interface from the Interface Selector on the left side of the screen to see traffic in the charts (see Figure 3-4). Click the arrow icon to the left of the NDE data source name to display all interfaces, and then select an interface. If the charts show no data, and you see a message "Interface needs to be selected," you have not yet chosen an interface.

Figure 3-4 Interface Selector

Once you have chosen the interface, you will see the following charts populated:

Interface Traffic (Ingress % Utilization and Egress % Utilization)

Top N Applications - Ingress

Top N Applications - Egress

Top N Hosts - Ingress

Top N Hosts - Egress

Top N DSCP Aggr - Ingress

Top N DSCP Aggr - Egress

The interface speed can be entered manually through the Interface capacity table, or it can be auto configured if the SNMP settings for the NDE device are entered in data source table.

Viewing Interface Details

To view packet distribution details on a specific interface, click the interface name (or interface index) in the Interface Selector on the left side of the screen. The detail window displays with a chart that shows the total packet distribution on the specified interface.

DSCP Detail

On the "Top N DSCP Aggr - Ingress" and "Top N DSCP Aggr - Egress" chart, you can left-click a colored bar to get the context menu, and choose "DSCP Detail" to see the "All DSCP" screen. You can also get to this screen by choosing Analyze > Traffic > DSCP Traffic from the menu and clicking the "All DSCP" button on the right.

Table 3-4 describes the fields on the All Applications screen.

Table 3-4 DSCP Detail

Field
Description
DSCP

DSCP value

Application

Application type

Bits/sec or Bytes/sec

Traffic rate; number of bits or bytes per second


Note In Administration > System > Preferences, you can choose to display NAM data in Bits or Bytes.


Packets/sec

Traffic rate; number of packets per second


DSCP

Differentiated services monitoring (DiffServ) is designed to monitor the network traffic usage of differentiated services code point (DSCP) values.

To monitor DSCP groups, you must configure at least one aggregation profile and one or more aggregation groups associated with each profile. For more information on configuring an aggregation profile, see DSCP Groups, page 2-64.

You can monitor the DSCP information by going to Analyze > Traffic > DSCP Traffic Analysis. You will see the DSCP group information as shown in Figure 3-5.

Figure 3-5 DSCP Group Traffic Over Time

On this screen, you will see:

Traffic volume over time for the selected DSCP group

Top N applications and application groups using that DSCP group

Top N hosts transmitting and receiving traffic on that DSCP group

Application Groups Detail

On the "Top N Application Groups" chart, you can left-click a colored bar to get the context menu, and choose "Applications Groups Detail" to see the All Application Groups screen and the detailed information about all application groups. Table 3-5 describes the fields on the All Applications screen.

Table 3-5 Application Groups Detail

Field
Description
Application Group

The application group (set of applications that can be monitored as a whole).

Site

Applicable site (or Unassigned if no site)

Bytes/sec

Traffic rate; number of bytes per second

Packets/sec

Traffic rate; number of packets per second


URL Hits

You can analyze the URLs collected by the NAM (for setup, see URL, page 2-78). This section contains the following procedures:

Viewing Collected URLs

Filtering a URL Collection List

Viewing Collected URLs

To view collected URLs:


Step 1 Choose Analyze > Traffic > URL.

The URLs Window displays with the collected URLs. The columns are described in Table 3-6.

Table 3-6 URLs Table 

Field
Description
Index

URL index

URL

URL text

Hits

Number of hits



Note Only one URL collection can be active at one time. The data source is for information only.



Filtering a URL Collection List

To filter a URL collection list:


Step 1 From the drop-down list in the URLs Window (Analyze > Traffic > URL), select which part of the URL to filter:

URL—You can filter on any part of the URL

Host—This filter applies only to the host part of collected URLs.

Path—This filter applies only to the path part of the collected URLs

Arguments—This filter applies only to the argument part of the collected URLs.

Step 2 Enter filter string.

Step 3 Click Filter to apply the filter.


Note To remove any display filter and show all URLs collected, click Clear.



Host Conversations

If you choose Analyze > Traffic > Detailed Views > Host Conversations, and click on "Host" in the host coversation tables, you can see detailed lists of all the conversations for a particular host:

Table of hosts which are sending packets to the selected host, along with application, vlan, and traffic rate information.

Table of hosts which are receiving packets from the selected host, along with application, vlan, and traffic rate information.

Breakout of application usage for the selected host.

Use the Filter button in the Interactive Report (left side of the screen) to change the parameters of the information displayed.

The NAM Traffic Analyzer only supports a maximum Time Range of one hour filter for the Host Conversations, Network Conversation, RTP Streams, Voice Calls Statistics, Calls Table, and RTP Conversations.

Network Conversation

If you choose Analyze > Traffic > Detailed Views > Conversations, you can see a detailed analysis of all Network Conversations (including packets and bits information).

Use the Filter button in the Interactive Report (left side of the screen) to change the information displayed.

Figure 3-6 Network Conversations

The NAM Traffic Analyzer only supports a maximum Time Range of one hour filter for the Host Conversations, Network Conversation, RTP Streams, Voice Calls Statistics, Calls Table, and RTP Conversations.

Top Application Traffic

When you choose Analyze > Traffic > Detailed Views > Top Application Traffic, you can view the top applications by traffic rate over a selected time and for the specified site and/or data source.

Applications Over Time, as shown in Figure 3-7, will show you all of the applications that have been running for the time period interval. The color-coded legend shows you what the applications are running.

Figure 3-7 Top Application Traffic

If you place your cursor over any of the data points, you will get more details about the exact values for each of the applications that are running, as shown in Figure 3-8.

Figure 3-8 Mouse-Over Details

Application Traffic By Host

When you choose Analyze > Traffic > Detailed Views > Application Traffic By Hosts, you will see the traffic for a given application broken out by individual hosts using the application (see Figure 3-9). You may specify the time period to view, as well as the application, site (optional), data source (optional), and VLAN (optional).

Figure 3-9 Application Traffic By Host

The NAM Traffic Analyzer only supports a maximum Time Range of one hour filter for the Host Conversations, Network Conversation, RTP Streams, Voice Calls Statistics, Calls Table, and RTP Conversations.

WAN Optimization

The NAM can provide insight into WAN Optimization offerings that compress and optimize WAN Traffic for pre- and post-deployment scenarios. This is applicable for Optimized and Passthru traffic.

The NAM 5.0 Traffic Analyzer menu selections for WAN Optimization are:

Top Talkers Detail

Application Performance Analysis

Conversation Multi-Segments

Top Talkers Detail

While you are in the process of deploying WAAS devices, you can get data to assist in the WAAS planning and configuration. For information about setting up WAN traffic, see Adding Data Sources for New WAAS Device, page 2-33.

When you choose Monitor > WAN Optimization > Top Talkers Detail, you will see the window that assists you in the pre-deployment process. Use the Interactive Report window to select the traffic you want to analyze for optimization. It will show you the Top Applications, Top Network Links, Top Clients, and Top Servers. It will not be available for the NetFlow (NDE) data sources.

Based on the results, you can then configure the WAAS products to optimize your network.

Application Performance Analysis

To analyze the WAAS traffic, choose Analyze > WAN Optimization > Application Performance Analysis.

The charts available on this page are:

Transaction Time (Client Experience)

Traffic Volume and Compression Ratio

Average Concurrent Connections (Optimized vs. Passthru)

Multi-Segment Network Time (Client LAN - WAN - Server LAN)

Transaction Time (Client Experience)

This chart displays the average client transaction time. One line represents pass-through traffic (in which optimization is turned off), and the second represents optimized traffic. After setting up optimization for a certain period, you can compare the two lines and see where the vertical drop in the chart occurs. The data is shown in milliseconds.

Traffic Volume and Compression Ratio

This chart shows the bandwidth reduction ratio between the number of bytes before compression and the number of bytes after compression.

Average Concurrent Connections (Optimized vs. Passthru)

This chart shows the number of concurrent connections during a specified time and can be used for capacity planning.

Multi-Segment Network Time (Client LAN - WAN - Server LAN)

This chart shows the network time between the multiple segments. The data is shown in milliseconds.

Conversation Multi-Segments

Use the Conversation Multiple Segments window to monitor WAAS traffic. This window provides a correlation of data from different data sources, and allows you to view and compare response time metrics from multiple WAAS segments (data sources). You can access this window from Analyze > WAN Optimization > Conversation Multi-segments.

The Response Time Across Multiple Segments window shows response time metrics of the selected server or client-server pair from applicable data sources.

Response Time

The NAM Traffic Analyzer monitors TCP packet flow between client and server, and measures response time data to provide more visibility into application response times (ART) and network latency. NAM 5.0 response time monitoring provides end-to-end response times to help you locate possible network and application delays.


Note NAM 5.0 does not support IPv6 for response time monitoring.


You can set up the NAM to measure network time, client response time, server response time, and total transaction time to improve application performance. Figure 3-10 shows the various points in network packet flow where the NAM gathers data and the trip times you can monitor. This is one example that represents only a subset of measurements.

Figure 3-10 NAM Application Response Time Measurements

Figure 3-11 shows a representation of total transaction time as opposed to application response time.

Figure 3-11 Transaction Time versus Response Time Measurements

Table 3-7 lists and describes the ART metrics measured by NAM 5.0.

Table 3-7 Application Response Time Metrics 

Metric
Description

Average Response Time

Response Time is the time between the client request and the first response packet from the server, as observed at the NAM probing point. Increases in the response time usually indicate problems with server resources, such as the CPU, Memory, Disk, or I/O due to a lack of necessary resources or a poorly written application.

This and other Response Time metrics are in millisecond (msec) units.

Min Response Time

Max Response Time

Number of Responses

Total number of request-response pairs observed during the monitoring interval

Number of Late Responses

Total number of responses that exceed the Max Response Time

Number of Responses 1

Number of responses with a response time less than RspTime1 threshold

Number of Responses 2

Number of responses with response time less than RspTime2 and larger than RspTime1

Number of Responses 3

Number of responses with response time less than RspTime3 and larger than RspTime2

Number of Responses 4

Number of responses with response time less than RspTime4 and larger than RspTime3

Number of Responses 5

Number of responses with response time less than RspTime5 and larger than RspTime4

Number of Responses 6

Number of responses with response time less than RspTime6 and larger than RspTime5

Number of Responses 7

Number of responses with response time less than LateRsp and larger than RspTime6

Client Bytes

Number of TCP payload bytes sent from the client(s) during the monitoring interval

Server Bytes

Number of TCP payload bytes sent from the server(s) during the monitoring interval

Client Packets

Number of TCP packets sent from the client(s) during the monitoring interval

Server Packets

Number of TCP packets sent from the server(s) during the monitoring interval

Average number of concurrent connections

Average number of concurrent TCP connections during the reporting interval

Number of new connections

Number of new TCP connections made (TCP 3-way handshake) during the monitoring interval

Number of closed connections

Number of TCP connections closed during the monitoring interval

Number of unresponsive connections

Number of TCP connection requests (SYN) that are not responded during the monitoring interval

Number of refused connections

Number of TCP connection requests (SYN) that are refused during the monitoring interval

Average Connection duration

Average duration of TCP connections during the monitoring interval

Average Server Response Time

Server Response Time is the time it takes an application server (for example, a web server) to respond to a request. This is the server "think time," which is the time between the client request arriving at the server and the first response packet being returned by the server.

Increases in the server response time usually indicate problems with application and/or server resources, such as the CPU, Memory, Disk, or I/O.

Min Server Response Time

Max Server Response Time

Average Network Time

Network time between a client and a server. Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Min Network Time

Max Network Time

Average Client Network Time

Client Network Time is the network time between a client and the NAM switch or router.

In WAAS monitoring, Client Network Time from a WAE client data source represents the network RTT between the client and its edge WAE, while Client Network Time from the WAE server data source represents the WAN RTT (between the edge and core WAEs).

Min Client Network Time

Max Client Network Time

Average Server Network Time

Server Network Time is the network time between a server and NAM probing point.

In WAAS monitoring, Server Network Time from a server data source represents the network time between the server and its core WAE.

Min Server Network Time

Max Server Network Time

Average Total Response Time

Total Response Time is the total amount of time between the client request and when the client receives the first response packet from the server.

Use Total Response Time with care because it is not measured directly and mixes the server response time metric with the network time metric.

Min Total Response Time

Max Total Response Time

Average Transaction Time

Transaction Time is the total amount of time between the client request and the final response packet from the server.

Transaction times may vary depending upon client usages and application types. Transaction Time is a key indicator for monitoring client experiences and detecting application performance anomalies.

Min Transaction Time

Max Transaction Time

Number of Transactions

The number of transactions completed during the monitoring interval.

Average Data Transmission Time

Elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time.

Average Data Time

Data Time: Average data time portion of transaction time.

Packets Retransmitted

Number of retransmitted packets detected during the monitoring interval

Bytes Retransmitted

Number of retransmitted bytes detected during the monitoring interval

Average Retransmission Time

Average time to retransmit lost packets per transaction

Client ACK Round Trip Time

Average network time for the client to acknowledge (ACK) a server data packet as observed at NAM probing point

Number of Client ACK Round Trips

Number of client ACK RTs observered during the monitoring interval


Application Response Time Metrics are available on the response Response Time Summary Dashboard (Monitor > Response Time Summary), which allows you to see a "summary" view of the data.

To analyze Response Time data over time, use the selections found under Analyze > Response Time:

Application Response Time

Network Response Time

Server Response Time

Client Response Time

Client-Server Response Time

When you select Analyze > Response Time > Detailed Views, you will be able to select one of the following screens, each of which contains detailed lists of the response events.

Server Application Responses

Server Application Transactions

Server Network Responses

Client-Server Application Responses

Client-Server Application Transactions

Client-Server Network Responses

Application Response Time

The Application Analysis screen allows you to view the performance of a particular application over time. It is accessed from Analyze > Response Time > Application.

The Transaction Time chart shows you the average transaction time for the application you have selected. It is broken down into three components: Network Time, Server Response Time, and Data Time.

The Other Metrics chart allows you to see information over time after you have selected the desired metrics from the "Metric1" and "Metric2" drop-down.

Next are the Top Clients and Top Servers charts. These will show you the clients and servers with the most bytes of traffic for the chosen application.

Network Response Time

After you have selected a client site and a server site, the chart will show you the transaction time of the network link between the client site and server site. It is accessed from Analyze > Response Time > Network.


Note If you do not specify any application, the chart will show the network time instead of transaction time.


The Other Metrics chart allows you to see information about the network link between sites, after you have selected the desired metrics from the "Metric1" and "Metric2" drop-down.

The Top Clients and Top Servers charts will show you the top clients and servers that are communicating through the network link (in bytes).

Server Response Time

Choose the Client Site and Server Site from the Interactive Report on the left, and enter the IP address for the server that you want to analyze. The Server Transaction Time Composition chart will display the network time, server response time, data time, and transaction time.

The Other Metrics chart allows you to see information about the server performance after you have selected the desired metrics from the "Metric1" and "Metric2" drop-down.

Top Client shows you top client talking to the server you have selected; Server Top Clients Sites shows the top client sites. (traffic bytes)

Client Response Time

After entering the client IP address and application in the Interactive Report Filter, you can analyze the transaction time of that client in the Client Transaction Time Composition chart.

The Other Metrics chart allows you to see client performance over time after you have selected the desired metrics from the "Metric1" and "Metric2" drop-down.

The Clients Top Applications chart show you the applications being used the most by the client selected, and the Top Servers chart show you the servers being used most by the client.

Client-Server Response Time

After you enter the client IP address and server IP address in the Interactive Report, you can analyze the transaction times between the client and server you have selected in the Client-Server Transaction Composition Over Time chart.

The Other Metrics chart allows you to see Client-Server transaction information after you have selected the desired metrics from the "Metric1" and "Metric2" drop-down.

Server Application Responses

The Server Application Responses Table displays when you choose Analyze > Response Time > Detailed Views > Server Application Responses.

If you click on a row of data, you can then choose "Response Time Details" to see more information.

Table 3-8, Server Application Responses Metrics, provides definitions of each field of the Server Application Responses window.

Table 3-8 Server Application Responses Metrics 

Field
Description
Client Site

Name of the client site.

Server Site

Name of the server site.

Data Source

Name of the data source

VLAN

VLAN

Server

Name or IP address of the server

Application

Application currently running

Number of Clients

Total number of clients

Number of Responses

Total number of responses

Average Client Network Time (ms)

Client Network Time is the network time between a client and the NAM switch or router.

In WAAS monitoring, Client Network Time from a WAE client data source represents the network RTT between the client and its edge WAE, while Client Network Time from the WAE server data source represents the WAN RTT (between the edge and core WAEs).

Maximum Client Network Time (ms)
Average Server Response Time (ms)

Server Response Time is the time it takes an application server (for example, a web server) to respond to a request. This is the server "think time," which is the time between the client request arriving at the server and the first response packet being returned by the server.

Increases in the server response time usually indicate problems with application and/or server resources, such as the CPU, Memory, Disk, or I/O.

Maximum Server Response Time (ms)
Average Total Response Time (ms)

Total Response Time is the total amount of time between the client request and when the client receives the first response packet from the server.

Maximum Total Response Time (ms)

Server Application Transactions

The Server Application Transaction window displays when you click Analyze > Response Time > Detailed Views > Server Application Transactions.

The Server Application Transactions window provides a summary of the server application transaction response times (ART) per server application displaying the server IP address, application used, and minimum, average, and maximum response times for the following:

Application Response Time

Data Transfer Time

Retransmit Time

Round Trip Time


Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.


Table 3-9, Server Application Transactions Metrics, provides definitions of each field of the Server Application Transactions window.

Table 3-9 Server Application Transactions Metrics 

Field
Description
Client Site

Name of the client site.

Server Site

Name of the server site.

Data Source

Name of the data source

VLAN

VLAN

Server

Name or IP address of the server

Application

Application currently running

Number of Clients

Total number of clients

Number of Transactions

Total number of transactions

Average Transaction Time (ms)

Average time (ms) elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Average Server Response Time (ms)

Amount of time it takes a server to send the initial response to a client request as seen by the NAM.

Average Data Transfer Time (ms)

Average elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time. Data transfer time is always measured in the server-to-client direction and can be used to detect problems for a particular type of transaction of an application.

Average Retransmission Time (ms)

Average time to retransmit lost packets, per transaction.

Client ACK Round Trip Time (ms)

Average round trip time for the client to acknowledge (ACK) a server TCP packet.


Server Network Responses

The Server Network Responses window shows the network connectivity and responsiveness between the server and the switch. It is located at Analyze > Response Time > Detailed Views > Server Network Responses.


Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.


Table 3-10, Server Network Responses Window, provides definitions of each field of the Server Network Response Times window.

Table 3-10 Server Network Responses Window  

Field
Description
Client Site

Name of the client site

Server Site

Name of the server site

Data Source

Name of the data source.

VLAN

VLAN

Server

Name or IP address of the server

Application

Application being used by server

Number of Clients

Total number of clients during the monitoring interval

Number of Connections

Total number of connections during the monitoring interval

Average Server Network Time (ms)

Average of the Server Network Time (network time between a server and NAM probing point).

Maximum Server Network Time (ms)

Maximum of the Server Network Time (network time between a server and NAM probing point).

Average Network Time

Average of the network time between client and server. Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Maximum Network Time

Maximum of the network time between client and server.

Server Bytes

Number of TCP payload bytes sent from the server(s) during the monitoring interval.

Client Bytes

Number of TCP payload bytes sent from the client(s) during the monitoring interval.


Client-Server Application Responses

To view the Client-Server Application Responses window, click Analyze > Response Time > Detailed Views > Client-Server Appplication Responses.

The Client-Server Application Responses window displays.


Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.


Table 3-11 Client-Server Application Responses Window  

Field
Description
Client Site

Name of the client site

Server Site

Name of the server site

Data Source

Name of the data source.

VLAN

VLAN

Server

Name or IP address of the server

Client

Host address of the client.

Application

Application being used by server

Number of Responses

Total number of responses observed during the monitoring interval

Minimum Client Network Time (ms)

Minimum network time between a client and the NAM switch or router.

Average Client Network Time (ms)

Average network time between a client and the NAM switch or router.

Maximum Client Network Time (ms)

Maximum network time between a client and the NAM switch or router.

Minimum Server Network Time (ms)

Minimum network time between a server and NAM probing point.

Average Server Network Time (ms)

Average network time between a server and NAM probing point.

Maximum Server Network Time (ms)

Maximum network time between a server and NAM probing point.

Minimum Transaction Time (ms)

The total amount of time between the client request and the final response packet from the server.

Average Transaction Time (ms)

Average time (ms) elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Maximum Transaction Time (ms)

The total amount of time between the client request and the final response packet from the server.


Client-Server Application Transactions

The Client-Server Application Transactions window provides a summary of the server application transaction response times (ART) per server application displaying the server IP address, application used, and minimum, average, and maximum response times for the following:

Application Response Time

Data Transfer Time

Retransmit Time

Round Trip Time


Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.


The Client-Server Application Transaction window displays when you click Analyze > Response Time > Detailed Views > Client-Server Application Transactions. You can also view the TopN Chart to view the most active network.

Table 3-12 Client-Server Application Transactions Window  

Field
Description
Client Site

Name of the client site.

Server Site

Name of the server site.

Data Source

Name of the data source.

VLAN

VLAN

Server

Name or IP address of the server

Client

Host address of the client.

Application

Application being used by server

Number of Transactions

Total number of transactions observed during the monitoring interval

Average Transaction Time (ms)

Average time (ms) elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Average Server Response Time (ms)

Amount of time it takes a server to send the initial response to a client request as seen by the NAM.

Average Data Transmission Time (ms)

Elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time.

Average Retransmission Time (ms)

Average time to retransmit lost packets per transaction

Client ACK Round Trip Time (ms)

Average network time for the client to acknowledge (ACK) a server data packet as observed at NAM probing point


Client-Server Network Responses

The Client-Server Network Responses window shows information about network connectivity (also known as network flight time) between servers and clients.

To view the Client-Server Network Responses window, choose Analyze > Response Time > Detailed Views > Client-Server Network Responses.

NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Table 3-13 describes the fields of the Server-Client Network Response Time window.

Table 3-13 Client-Server Network Responses Window  

Field
Description
Client Site

Name of the client site.

Server Site

Name of the server site.

Data Source

Name of the data source.

VLAN

VLAN

Server

Name or IP address of the server.

Client

Host address of the client.

Application

Application being used by server.

Number of Connections

Number of connections.

Minimum Client Network Time (ms)

Minimum network time between a client and the NAM switch or router.

Average Client Network Time (ms)

Average network time between a client and the NAM switch or router.

Maximum Client Network Time (ms)

Maximum network time between a client and the NAM switch or router.

Minimum Server Network Time (ms)

Minimum network time between a server and NAM probing point.

Average Server Network Time (ms)

Average network time between a server and NAM probing point.

Maximum Server Network Time (ms)

Maximum network time between a server and NAM probing point.

Minimum Network Time (ms)

Minimum of the network time between client and server.

Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Average Network Time (ms)

Average of the network time between client and server.

Maximum Network Time (ms)

Maximum of the network time between client and server.


Managed Device

The NAM 5.0 Traffic Analyzer menu selections for analyzing Managed Devices are:

Interface

Health

NBAR

Interface

Interfaces Stats Table

To view packet distribution details on the interfaces, choose Analyze > Managed Device > Interface. The Interfaces Stats table displays and shows the total packet distribution on all interfaces. Use the Interactive Report and the Filter button on the left to change the time range displayed. The Discards and Errors are measured in packets per second.

Figure 3-12 Interfaces Stats Table

The fields in the table are described in Table 3-14.

Table 3-14 Interfaces Stats Table 

Field
Description
Interface

Interface number.

In % Utilization

Utilization percentage of the port.

Out % Utilization

Utilization percentage of the port.

In Packets/s

Number of incoming packets collected per second.

Out Packets/s

Number of outgoing packets sent out per second.

In Bytes/s

Number of bytes collected per second.

Out Bytes/s

Number of bytes sent out per second.

In Non-Unicast/s

Number of non-unicasts collected per second.

Out Non-Unicast/s

Number of non-unicasts sent out per second.

In Discards/s

Number of discards collected per second.

Out Discards/s

Number of discards sent out per second.

In Errors/s

Number of errors collected per second.

Out Errors/s

Number of errors sent out per second.


Interface Statistics Over Time

When you select an interface in the Interface Stats Table, the statistics for that interface will be graphed in the area below, as shown in Figure 3-13.

Figure 3-13 Interface Statistics Over Time

There are four check boxes above the graph: Bytes, Packets, Discards, and Errors. You can check the check boxes for the information you would like displayed in the graph:

Bytes: In Bytes, Out Bytes

Packets: In Packets (inUcastPkts + inNUcastPkts ), Out Packets (outUcastPkts + outNUcastPkts)

Discards: In Discards, Out Discards

Errors: In Errors, Out Errors

Health

You can use the NAM Traffic Analyzer to view system health data. To view system health data collected for the switch or router, choose Monitor > Managed Device > Health from the menu.

Switch Health

For a switch, the Health window is displayed with a drop-down menu that provides the following options:

Chassis Health

Chassis Information

Crossbar Switching Fabric

Ternary Content Addressable Memory Information

Chassis Health

The Chassis Health window displays two real-time graphs: CPU usage and Backplane Utilization.

CPU usage

CPU type

Usage for last 1 minute (%)

Usage for last 5 minutes (%)

Backplane Utilization

Peak %

Peak Time (For example: Mon October 1 2007, 15:26:55)

The Health window also displays a matrix with the following information:

Minor Alarm (on, off)

Major Alarm (on, off)

Temperature Alarm (on, off)

Fan Status (other, ok, minorFault, majorFault, unknown)

Table 3-15 Chassis Memory Information 

Column
Description
Memory Type

Type of memory including DRAM, FLASH, NVRAM, MBUF, CLUSTER, MALLOC.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.


Chassis Information

The Chassis Information window displays.

Table 3-16 Chassis Information 

Field
Description
Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Backplane

The chassis backplane type.

Supervisor Software Version

The full name and version identification of the system's software operating-system and networking software.

UpTime

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud rate

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown

ac

dc

externalPowerSupply

internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

1: normal
2: warning
3: critical
4: shutdown
5: notPresent
6: notFunctioning

Power Redundancy Mode

Power Redundancy Mode:

The power-supply redundancy mode.
1: not supported
2: redundant
3: combined

Power Total

Total current available for FRU usage.

When Redundancy Mode is redundant, the total current available will be the capability of a power supply with the lesser power capability of the two power supplies.

When Redundancy Mode is combined, the total current available will be the sum of the capacities of all operating power supplies.

Power Drawn

Total Current Drawn by powered-on FRUs.


Crossbar Switching Fabric

This option shows the Crossbar Switching Fabric information.

Table 3-17 Crossbar Switching Fabric Information 

Field
Description
Crossbar Switching Fabric

Physical and configuration information about the module:

Active slot—Indicates the slot number of the active switching fabric module. A value of zero indicates that the active switching fabric module is either powered down or not present in the chassis.

Backup slot—Indicates the slot number of the backup switching fabric module. A value of zero indicates that the backup switching fabric module is either powered down or not present in the chassis.

Bus Only Mode Allowed—Determines the value of each module. If set to True, each and every module is allowed to run in bus-only mode. If set to False, none of the modules are allowed to run in bus-only mode. (All the non-fabric capable modules will be powered off.) Absence of fabric module results in all the fabric capable modules being powered off.

Truncated Mode Allowed—Indicates whether truncated mode is administratively enabled on the device or not.

Module Switching Mode

Indicates switching mode of the module:

busmode—Module does not use fabric. Backplane is used for both lookup and data forwarding.

crossbarmode—Module uses the backplane for forwarding decision and fabric for data forwarding.

dcefmode—Module uses fabric for data forwarding and local forwarding is enabled.

Module-Channel

Module slot number

Module-Status

Status of the fabric channel at the module

Fabric Status

Status of the fabric channel at the slot

Speed (MB)

Speed (MB/second) of the module

Module-Channel

Channel for the module

In Errors

The total number of error packets received since this entry was last initialized.

Our Errors

The total number of error packets transmitted since this entry was last initialized.

Dropped

The total number of dropped packets transmitted since this entry was last initialized.

In Utilization (%)

Input utilization of the channel for the module.

Out Utilization (%)

Output utilization of the channel for the module.


Ternary Content Addressable Memory Information

Shows the Ternary Content Addressable Memory (TCAM) usage information. Table 3-18 lists and describes the TCAM information.

Table 3-18 Ternary Content Addressable Memory Information 

Field
Description
Security Acl Mask

Indicates that TCAM space is allocated to store ACL masks.

Security Acl Value

Indicates that TCAM space is allocated to store ACL value.

Dynamic Security Acl Mask

Indicates that TCAM space is allocated to dynamically store ACL masks.

Dynamic Security Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Qos Acl Mask

Indicates that TCAM space is allocated to store QoS masks.

Qos Acl Value

Indicates that TCAM space is allocated to store QoS value.

Dynamic Qos Acl Mask

Indicates that TCAM space is allocated to dynamically store QoS masks.

Dynamic Qos Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Layer 4 Port Operator

Indicates that TCAM space is allocated for layer 4 port operators purpose.

Interface Mapping Module

Indicates that TCAM space is allocated for interface mapping purpose.


Router Health

If your device is a router, the Router Health window displays with a drop-down box that provides the following options:

Router Health

Router Information

Router Health

The Router Health window displays a real-time graph and information about the health of a router. Table 3-19 describes the contents of the Router Health window.

Table 3-19 Router Health Information 

Field
Description
CPU Usage (graph)

Overall CPU busy percentage in the last 5 minute period

CPU Type

Describes type of CPU being monitored

Last 1 minute

Overall CPU busy percentage in the last 1 minute period.

Last 5 minutes

Overall CPU busy percentage in the last 5 minute period.

Temperature Description

Description of the test point being measured

Temperature Status

The current state of the test point being instrumented; one of the following are the states:

Normal

Warning

Critical

Shutdown

Not Present

Not Functioning

Unknown

Failures

The failing component of the power supply being measured:

None—No failure

inputVoltage—Input power lost in one of the power supplies

dcOutputVoltage—DC output voltage lost in one of the power supplies

Thermal—Power supply thermal failure.

Multiple—Multiple failures.

Fan—Fan failure

Overvoltage—Over voltage.

Memory Type

Type of memory including processor and I/O.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.


Router Information

The Router Information window displays router information. Table 3-20 lists and describes the fields of the Router Information window.

Table 3-20 Router Information 

Field
Description
Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Supervisor Software Version

The full name and version identification of the system's software operating-system and networking software.

Up Time

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown

ac

dc

externalPowerSupply

internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

1: normal
2: warning
3: critical
4: shutdown
5: notPresent
6: notFunctioning


NBAR

You can use the NAM Traffic Analyzer to view Network Based Application Recognition (NBAR) data. To view the NBAR data collected for a switch or router, select Analyze > Managed Device > NBAR.

If NBAR is not enabled on your switch or router, you will see a message stating that you cannot see NBAR information without an IOS version that supports NBAR. After you acquire the correct IOS version, you can enable the feature under Setup > Managed Devices > NBAR Protocol Discovery.

Media

The NAM 5.0 Traffic Analyzer menu selections for Analyzing Media are:

RTP Streams

Voice Call Statistics

Calls Table

RTP Conversation

RTP Streams

Purpose

The RTP Streams window shows you three pieces of information:

RTP Stream Information

Source IP Address and Port: IP address and UDP port of the originator of the RTP stream.

Destination IP Address and Port: Ip address and UDP port of the receiver of the RTP stream.

SSRC: Synchronization source number as it appeared in the RTP header of the RTP stream.

codec: encoding decoding format of the RTP stream.

RTP Stream Stats Summary

This shows you the summary of the RTP stream for the entire duration of RTP stream.

Duration: duration of the RTP stream. This may not be the entire duration of the stream. It depends on the viewing time interval of the window which launched this RTP stream detail window.

Worst / Duration Weighted / Max MOS: the lowest score among per-interval reports, the score of all per-munite interval reports that takes duration into account, and the highest score among per-interval reports of the stream.


Note Duration-weighted is calculated with the following formula:
SUM (per-minute-mos * duration) / SUM (duration)


Worst / Duration Weighted / Min Jitter: the largest jitter among per-interval reports, the jitter that takes into account of the duration of all per-interval reports, and the smallest jitter values among per-interval reports of the stream.


Note Duration-weighted are used with the following formula:
SUM(per-interval-jitter * duration) / SUM(duration)


Worst / Overall / Min Actual Packet Loss: Loss percent of RTP packets that are not seen by NAM and RTP packets that arrived beyond the buffer capability of the receiving end point. This includes the highest percentile among per-interval reports, the sum of packets loss against total packets of all per-interval reports, and the lowest percentile loss among per-interval reports.

Worst / Overall / Min Actual Packet Loss: Similar to above, but the percent loss only includes RTP packets that were not seen by the NAM.

Worst / Total / Min Concealment Seconds: Number of seconds in which NAM detected packet loss during the duration of the stream. This includes lowest concealment seconds among per-interval reports, total concealment seconds of the entire duration of the stream, and highest concealment seconds among per-minute stream reports.

Severe Concealment Seconds: Similar to above; severe condition is met when the seconds have more than 5 percent loss.

RTP Stream Stats Details

This table shows the per-interval stats calculated by NAM at each interval. The columns of the tables are:

Report Time: time when the stats were calculated. This is the end time of the interval.

Report Duration: the stream duration during the report interval.

Worst MOS: the lowest score of the stream among 3-second MOS score. NAM internally evaluates the MOS value of the stream every 3 seconds. This is the lowest score among them.

Average MOS: average score of the 3-second score values during the duration of the stream in the interval. This value is used in deriving the Duration Weighted MOS value in NAM.

Jitter: variation of packet arrival time compare to the expected time.

Actual Packet Loss percentile: percentile of packets that are not seen by NAM.

Adjusted Packet Loss percentile: percentile of packets that include the actual packets lost an packets that had arrived too late to get into buffer prior to paying back at the endpoint.

Concealment Seconds: number of seconds in which the NAM sees packet loss.

Severe Concealment Seconds: number of seconds in which the NAM detected more 5 percent of packet loss.

Packets: total packets NAM have seen for the interval.

Monitoring RTP Streams

To monitor the RTP streams, choose Analyze > Media > RTP Streams. You can also arrive at this page by:

From the RTP Conversation table, clicking on a specific stream

From the Call Detail window, clicking on the stream that is associated with the call

On this screen, at least one of the following is required: Site, data source, or VLAN.

The five charts available on this screen are:

RTP Streams: Number of streams that fall in the quality bands of excellent, good, fair, and poor during the selected interval.

Top N Source End Points: Endpoints that generated the lowest duration weighted MOS during the selected interval.

Top N Destination Endpoints: Endpoints that experienced the lowest duration weighted MOS during the selected interval.

Top N RTP streams: RTP streams that have the lowest duration weighted MOS during the selected interval.

Top N RTP streams by Adjusted Packet Loss: RTP streams that have the highest overall adjusted packet loss percent during the selected interval.

Voice Call Statistics

To monitor voice quality, choose Analyze > Media > Voice Call Statistics. The charts will provide an overview of voice quality.

The charts available are:

Voice Call Statistics: Number of calls per signaling protocol (SCCP, SIP, MGCP, and H.323) at each interval during the selected interval.

Top N End Points by Jitter (ms): Endpoints that have the largest average of endpoint reported jitter during the selected interval.

Top N End Points by Packet Loss (%): Endpoints that have the largest average of endpoint reported packet loss during the selected interval.

Top N Calls by Jitter (ms): Calls that have the longest endpoint-reported jitter during the selected interval.

Top N Calls by Packet Loss (%): Calls that have the most endpoint reported packet loss percent during the selected interval.

Calls Table

The Calls Table shows you calls that the NAM detected by inspecting voice signaling protocols' payload. For this table to have data, the NAM must see:

SCCP protocol: Call Information message of the call.

SIP protocol: SIP INVITE message of the the call. Note that SIP protocol will be detected as per call leg.

H.323 protocol: Call SETUP of the call.

MGCP protocol: Create connection message of the call. Note that MGCP will be detected per call leg.


Note SIP and MGCP will be detected per call leg. Each call could be 2 or more parties. Each party has its own call leg from the call party to control entity, e.g. Cisco Call Manager or MGCP gateway. Any information that is not detected by NAM will be displayed as "-" or blank on the GUI screen.


To view the active calls, choose Analyze > Media > Detailed Views > Call Table. The Calls Table and RTP Streams for the Selected Call Table display. These tables show a list of all currently active calls.


Note Some values in the Calls table are not available until the end of the call, and Cisco Unified Communications Manager must be configured to have the IP phones send out the call status and quality information.



Note All calculated metrics in Table 3-21, Calls Table, are based on a one minute interval.


Table 3-21 provides descriptions of the fields of the Calls Table.

Table 3-21 Calls Table 

Field
Description
Calling Number

Calling number as it appears in the signaling protocol.

Called Number

Called number as it appears in the signaling protocol.

Calling Host Address

RTP receiving address of the calling party detected by the NAM from inspecting the call signaling protocol.

Calling Port

RTP receiving port of the calling party detected by NAM from inspecting call signaling protocol.

Calling Alias

Calling party name detected by NAM from inspecting call signaling protocol.

Called Host Address

IP address of the phone receiving the call.

Called Port

Port of the phone receiving the call.

Called Alias

Alias name, MGCP endpoint ID, or SIP URI of the called party phone.

Calling Reported Jitter (ms)

Jitter value reported by calling party at the end of the call.

Calling Reported Packet Loss (%)

Percentage of packet loss reported by calling party at the end of the call.

Start Time

Time when the call was detected to start.

End Time

Time when the call was detected to end.

Duration

Duration of the call.


Note When the call signaling's call tear down sequence is not detected by the NAM, the NAM will assume:
- the call ended after 3 hours in low call volume per interval
- the call ended after 1 hour in high call volume per interval (high call volume is defined as call table filled up during the interval.)


Called Reported Jitter (ms)

Jitter value reported by called party at the end of the call.

Called Reported Pkt Loss (%)

Percentage of packet loss reported by called party at the end of the call.


If you click on a call row in the table, in the RTP Streams for the Selected Call display at the bottom of the page you will see all streams that are associated with the call. It will display the RTP streams that:

have source address and port matched the call's calling host address and calling port or called host address and called port

have destination address and port that matched the call's calling host address and calling port or called address and called port


Note There is a delay of two minutes of RTP streams statistics. As the result, there may not be any RTP stream information of the call.


The RTP Streams of the Selected Call table shows the overall RTP streams statistics that are calculated by the NAM. You can use this information to compare the views of the call endpoints and the NAM regarding the call's qualities. The columns of the RTP Stream are described in Table 3-22.

Table 3-22 RTP Streams for the Selected Call table

Field
Purpose
Source Address

IP Address of the originator of the RTP stream

Source Port

UDP port of the originator of the RTP stream

Destination Address

IP address of the receiver of the RTP stream

Destination Port

UDP port of the receiver of the RTP stream

Codec

Encoding decoding format/algorithm of the RTP stream

SSRC

Synchronization source number as it appear in the RTP header

Duration Weighted MOS

NAM calculated score that takes into account of the duration of the stream

Duration Weighted Jitter

Jitter that takes into account of the duration of the RTP stream among all per-interval reports

Overall Adjusted Packet Loss

Percentile of adjust packets lost against total packets of all per-interval RTP reports.


You can see more detailed information about each RTP stream by selecting the RTP stream and clicking on the RTP Stream Details button. A pop up window will show more detailed information of the stream displayed.


RTP Conversation

To get detailed information about RTP conversations, choose Analyze > Media > Detailed Views > RTP Conversations. This table shows you the overview of RTP streams analyzed by NAM during the selected interval. You can drill-down to each stream to get stream statistics, which are analyzed by the NAM at each interval. To get more detailed information, you can:

Click on the RTP stream for which you want to see more information.

Click on the "RTP Stream Details" context menu. A pop up window will show you the detailed information of the stream.

The columns of the RTP Conversation tables are described in Table 3-23, RTP Conversations Table.

Table 3-23 RTP Conversations Table 

Field
Purpose
Start Time

Time when the RTP stream was discovered by the NAM

Source Address

IP Address of the originator of the RTP stream

Source Port

UDP port of the originator of the RTP stream

Destination Address

IP address of the receiver of the RTP stream

Destination Port

UDP port of the receiver of the RTP stream

Codec

Encoding decoding format/algorithm of the RTP stream

SSRC

Synchronization source number as it appear in the RTP header

Duration Weighted MOS

NAM calculated score that takes into account of the duration of the stream