User Guide for Cisco Network Analysis Module Traffic Analyzer, 3.6 - Monitoring Data [Cisco Prime Network Analysis Module Software]

Table Of Contents

Monitoring Data

Overview of Data Collection and Data Sources

Configuring Multiple Collections

Protocol Auto Discovery

NDE Flow Masks and V8 Aggregation Caches

Viewing the Monitor Overview Charts

Data Source Persistence

Viewing Individual Applications Data

Viewing the Applications Current Rates Table

Displaying Details from the Applications Table

Capturing Application Protocol Data from the Application Table

Viewing Real-Time Data from the Application Table

Viewing Reports from the Applications Table

Viewing the Top N Applications Chart

Viewing the Applications Cumulative Data Table

Displaying Details from the Applications Table

Viewing Application Groups

Viewing the Application Groups Current Rates Table

Displaying Details from the Application Group Table

Viewing Real-Time Data from the Application Group Table

Viewing Reports from the Application Group Table

Viewing the Top N Application Group Chart

Viewing the Application Groups Cumulative Data Table

Viewing Collected URLs

Viewing Collected URLs

Filtering a URL Collection List

Creating a URL-based Application from a Collected URL

Viewing the TCP/UDP Port Table

Viewing the TCP/UDP Port Table Current Rates

Viewing the TCP/UDP Port Table TopN Chart

Viewing the TCP/UDP Port Table Cumulative Data

Viewing Voice Data

Viewing the Voice Protocol Overview

Displaying Protocol Details From the Aggregate Statistics Table

Viewing Known Phones

Displaying Phone Details From the Known Phones Table

Viewing Active Calls

Displaying Call Details From the Active Calls Table

Viewing RTP Stream Traffic

Monitoring Hosts Data

Viewing the Network Hosts Current Rates Table

Viewing Network Host Details

Capturing Network Host Data from the Network Host Table

Viewing Real-Time Traffic Statistics from the Hosts Table

Viewing Reports from the Network Hosts Table

Viewing the Network Hosts Top N Chart

Viewing the Network Hosts Cumulative Data Table

Viewing the MAC Stations Current Rates Table

Viewing the MAC Stations Top N Chart

Viewing the MAC Stations Cumulative Data Table

Viewing Conversations Data

Viewing Network Hosts

Viewing the Network Host Conversations Current Rates Table

Viewing the Network Host Conversations Top N Chart

Viewing the Network Host Conversations Cumulative Data Table

Viewing the Application Hosts

Viewing MAC Stations

Viewing the MAC Station Conversations Current Rates Table

Viewing the MAC Conversations Top N Chart

Viewing the MAC Station Conversations Cumulative Data Table

Viewing VLAN Data

Viewing the VLAN Traffic Statistics Current Rates Table

Viewing Reports from the VLAN Traffic Statistics Table

Viewing the VLAN Traffic Statistics Top N Chart

Viewing VLAN Traffic Statistics Cumulative Data Table

Viewing the VLAN Priority (COS) Statistics Current Rates Table

Viewing the VLAN Priority (COS) Statistics Top N Chart

Viewing the VLAN Priority (COS) Statistics Cumulative Data Table

Viewing DiffServ Data

Viewing the DiffServ Traffic Statistics Current Rates Table

Viewing Real-Time Traffic Statistics from the DiffServ Traffic Statistics Table

Viewing Reports from the DiffServ Traffic Statistics Table

Viewing the DiffServ Traffic Top N Chart

Viewing the DiffServ Traffic Statistics Cumulative Data Table

Viewing the DiffServ Application Statistics Current Rates Table

Displaying Application Conversation Details From Application Statistics Table

Viewing Real-Time Traffic Statistics from the DiffServ Application Statistics Table

Viewing Reports from the DiffServ Application Statistics Table

Viewing the DiffServ Application Statistics Top N Chart

Viewing the DiffServ Application Statistics Cumulative Data Table

Viewing the DiffServ Host Statistics Current Rates Table

Displaying Host Conversation Details From the DiffServ Host Statistics Table

Viewing Real-Time Data from the DiffServ Host Statistics Table

Viewing Reports from the DiffServ Host Statistics Table

Viewing the DiffServ Host Statistics Top N Chart

Viewing the DiffServ Host Statistics Cumulative Data Table

Monitoring Response Time Data

Legacy Application Response Time Monitoring

NAM 3.6 Application Response Time Measurements

Server Application Response Time

Viewing Server Application Response Time

Viewing the Application Response Time TopN Chart

Server Network Response Time

Viewing Server Network Response Time Details

Viewing the Server Network Response Time Top N Chart

Server/Client Application Response Time

Viewing the Server/Client Application Response Time

Viewing the Client/Server Application Response Time Top N Chart

Server/Client Network Response Time

Viewing the Server/Client Network Response Time

Viewing the Client-Server Network Response Time TopN Chart

Viewing Port/Interface Statistics Data

Viewing the Port Stats Current Rates Table

Viewing the Interface Stats Current Rates Table

Viewing Port/Interface Details

Viewing Real-Time Traffic Data from the Port/Interface Stats Table

Viewing Reports from the Port/Interface Stats Table

Viewing the Top N Port Stats Chart

Viewing the Top N Interface Stats Chart

Viewing the Port Stats Cumulative Data Table

Viewing the Interface Stats Cumulative Data Table

Viewing Interface Details

Viewing System Health

Switch Health

Switch Health

Switch Information

Crossbar Switching Fabric

Ternary Content Addressable Memory Information

Router Health

Router Health

Router Information

Viewing NBAR

Viewing the NBAR Current Rates Table

Viewing the Top N NBAR Chart

Viewing the NBAR Cumulative Data Table

Viewing MPLS Traffic Statistics

Viewing All Labels

Traffic Statistics per MPLS Tag

Custom RMON Data Source

Monitoring Application per MPLS Tag

Monitoring Host per MPLS Tag

Monitoring Host Conversation per MPLS Tag

Viewing VRF and VC Statistics

Monitoring Data

The Monitor tab provides options for viewing various types of monitored data. There are options for:

•Overview of Data Collection and Data Sources

•Viewing the Monitor Overview Charts

•Viewing Application Groups

•Viewing Individual Applications Data

•Viewing Collected URLs

•Viewing Voice Data

•Monitoring Hosts Data

•Viewing Conversations Data

•Viewing VLAN Data

•Viewing DiffServ Data

•Monitoring Response Time Data

•Viewing Port/Interface Statistics Data

•Viewing System Health

•Viewing NBAR

•Viewing MPLS Traffic Statistics

Overview of Data Collection and Data Sources

All statistics and monitoring data produced by the NAM are generated by various types of collections. A collection operates on a stream of packets and produces output based on the input stream. In most cases, a collection corresponds directly to MIB tables such as RMON or SMON.

The Collection Definitions table (Table 4-1) defines the different collection types.

Table 4-1 Collection Definitions

Collection

Definition

Corresponds

Host

Examines a stream of packets; produces a table of all network addresses observed in those packets (also known as the collection data). Each entry records the total number of packets and bytes sent and received by that host and the number of non-unicast packets sent by that host.

RMON2 nlHostTable (the actual implementation of the collection).

Protocol

Examines a stream of packets; produces a table of all protocols observed in those packets. Each entry indicates the number of packets and bytes observed for that protocol.

RMON protocolDistStatsTable (the actual implementation of the collection).

Capture

Examines a stream of packets; produces a table of actual packet data (the captureBufferEntries). Each entry contains an exact copy of the data observed in the packet.

RMON1 bufferTable, filterTable, and channelTable variables.

Voice
(proprietary)

Examines a stream of packets; produces tables of data for IP telephony-related protocols:

•All IP phones observed in the packet stream.

•Individual calls observed in the packet stream.

•Statistics (such as jitter and packet loss) for each phone and call entry are recorded.

•The worst-quality calls that were observed (determined by several characteristics).

—

The stream of packets on which a collection operates is called the collection data source. It might be different for each collection. The data produced by a collection is called the collection data.

Note The collection data is usually in the form of SNMP tables (except in voice collections).

The NAM can support simultaneous combinations of different collections, each operating on different collection data sources.

•The number of potential simultaneous collections is limited only by CPU and memory resources.

•The collection data sources are limited by the SPAN sources. For more information on SPAN sources, see the "Setting Up Data Sources" section.

•NAM 3.6 can support a maximum of 1,500 data sources.

Configuring Multiple Collections

You can configure multiple collections (such as host, conversation, protocol, ART, and voice) simultaneously on the NAM. Collections are always configured on separate data sources.

Associated with each collection is a specific collection data source that might or might not correspond directly with the SPAN/VACL traffic stream that was configured. Examples of collection data sources include:

•All packets in the SPAN/VACL traffic stream regardless of the port/VLAN or origin (ALL SPAN).

•All packets in the SPAN/VACL traffic stream on a specific VLAN (VLAN x).

•All packets in the SPAN/VACL traffic stream that were configured to arrive on a specific NAM data port (DATA PORT 1 or DATA PORT 2).

•NetFlow Data Export (NDE) records received by the NAM from either the local Supervisor engine module or other remote NDE sources such as remote routers. (Available only on NAM-1 and NAM-2.)

•Switch engine module (Supervisor) records received by the NAM. You can select any combination of Port statistics, VLAN statistics, and NBAR statistics. (Available only on NAM-1 and -NAM-2.)

•Router engine module records (Router) received by the NAM. You can select any combination of Interface statistics and NBAR statistics. (Available only on the NM-NAM and NME-NAM.)

Note Data sources persist across all Monitor windows. For example, if you select VLAN2 as a data source, then go to another Monitor window, VLAN2 will be displayed there if it is configured for that collection. If the previously selected data source is not configured for collection on the new Monitor window, the NAM displays the default data source for that window.

Individual collection instances process only those packets in the traffic streams that correspond to their configured data sources. For example, a host collection configured with a data source of VLAN 12 will not be populated with any received NDE flow records. Nor will it be populated with packets in the SPAN/VACL traffic stream that are not tagged for VLAN 12.

Similarly, a conversation collection configured with a data source specifying NDE records from a remote router will not be populated with any packets arriving in the SPAN/VACL traffic stream.

Scenario

You have configured the SPAN/VACL traffic stream source to include VLANs 1, 2, and 3. You now want to start an application collection that counts the packets and bytes monitored for each application protocol within these three VLANs.

You must specify a collection data source for this collection. The data source could be VLAN 1, VLAN 2, or VLAN 3.

If you configure the data source as VLAN 2, the collection generates statistics for those packets received on VLAN 2. However, if you were to specify VLAN 10 as the collection data source, even if VLAN 10 were a valid VLAN ID, the collection would never get populated with data because VLAN 10 was not configured as part of the SPAN/VACL traffic stream.

Note The SPAN/VACL traffic stream represents the aggregate sum of all traffic being sent to the NAM for monitoring as a result of SPAN or VACL configuration on the local Supervisor engine module. In addition to the SPAN/VACL traffic stream, one or more NDE traffic streams might be received from the local Supervisor engine module or remote switches and routers. The data source configured for a specific collection instance must correspond to traffic that appears on one of these traffic streams, or else the collection statistics will not get populated.

Each possible collection data source is represented as an ifEntry in the NAM ifTable (MIB-II). The Data Collection Sources table (Table 4-2) describes the valid collection data sources.

Table 4-2 Data Collection Sources

Collection Data Source

Limitations

All SPAN (aggregate SPAN/VACL traffic stream)

If no SPAN or VACL traffic sources are configured, the collection is not populated with data.

Specific VLAN ID

If the VLAN was not configured as part of the SPAN/VACL traffic stream, the collection is not populated with data.

NDE data source

The export parameters must be configured on the device that will export the records to the NAM; otherwise, the collection is not populated with data. Monitoring is limited to a subset of NAM collection types.

The SPAN, VACL, NDE Traffic Streams and Collection Data Sources illustration (Figure 4-1) shows the relationships between SPAN and NDE data sources and collection data sources.

Figure 4-1 SPAN, VACL, NDE Traffic Streams and Collection Data Sources

You can view real-time data from collections that were configured on the NAM. For more information on setting up collections on the NAM, see the "Configuring Capture Settings" section.

Protocol Auto Discovery

Traffic Analyzer can automatically discover up to 100 unknown protocols. The protocols are displayed according to the parent type and an identifier.

The Auto-Discovered Protocol Types table (Table 4-3) lists the type of protocols that can be automatically discovered and how they are displayed.

Table 4-3 Auto-Discovered Protocol Types

Protocol Type

Displays As...

Ether2

ether2-ether-type number

SNAP

snap-ether-type number

IP

ip-protocol type number

TCP

tcp-port number

UDP

udp-port number

SUNRPC

sunrpc-program number

Note The automatically discovered protocols are not saved in NVRAM and are lost when the NAM is rebooted. To save an auto-discovered protocol, you can enter it manually into the Protocol Directory. For more information, see the "Creating a New Protocol" section. You can also clear the auto-discovered protocols without rebooting by entering the command no monitor protocol auto-learned in the NAM CLI.

NDE Flow Masks and V8 Aggregation Caches

Depending on the flow mask or aggregation configured at the device, some data fields might not be available in the NDE data structure. As a result, some windows will not display data for a NetFlow data source or will display specific conditions. The Flow Mask and Aggregation Window Conditions table (Table 4-4) lists the display conditions for the windows under the Monitor tab and the flow-mask or aggregation that causes them.

Table 4-4 Flow Mask and Aggregation Window Conditions

Flow Mask or Aggregation Cache

Window Conditions

Full flow mask

Supported in all windows.

Destination only flow mask

• Monitor > Apps displays "Others" only, and the detail pop-up window does not have data.

•Monitor > Hosts displays 0.0.0.0 and the detail pop-up window does not have data.

•Monitor > Conversations displays 0.0.0.0 for some hosts and the detail pop-up window does not have data.

Destination-Source flow mask

• Monitor > Apps displays "Others" only, and the detail pop-up window does not have data.

•Monitor > Hosts has data, but the detail pop-up window does not.

•Monitor > Conversations has data, but the detail pop-up window does not.

V8-Protocol-Port-Aggregation

•Monitor > Apps has data, and the detail pop-up window displays 0.0.0.0 only.

•Monitor > Host displays 0.0.0.0 only.

•Monitor > Conversations displays 0.0.0.0 to 0.0.0.0 only.

•There is no data for custom NetFlow data sources that are set up for specific interfaces.

•There is no DiffServ except TOS 0 and DSCP 0.

•Setup > Data Sources > NetFlow Listening Mode detail pop-up window does not have interfaces information.

V8-Destination-Prefix-Aggregation

•Monitor > Apps displays "Others" only.

•Monitor > Host displays data with subnets and 0.0.0.0. The detail pop-up window does not have data.

•Monitor > Conversations displays data with 0.0.0.0 to subnets, and 0.0.0.0 to 0.0.0.0. The detail pop-up window does not have data.

•There is no DiffServ except TOS 0 and DSCP 0.

•There is support for NetFlow custom data sources that are set up for specific interfaces.

V8-Prefix-Aggregation

•Monitor > Apps displays "Others" only.

•Monitor > Host displays data with subnets and 0.0.0.0. The detail pop-up window does not have data.

•Monitor > Conversations displays data and 0.0.0.0 to 0.0.0.0. The detail pop-up window does not have data.

•There is no DiffServ except TOS 0 and DSCP 0.

•There is support for NetFlow custom data sources that are set up for specific interfaces.

V8-Source-Prefix-Aggregation

•Monitor > Apps displays "Others" only.

•Monitor > Host displays data with subnets and 0.0.0.0. The detail pop-up window does not have data.

•Monitor > Conversations displays data with subnets to 0.0.0.0, and 0.0.0.0 to 0.0.0.0. The detail pop-up window does not have data.

•There is no DiffServ except TOS 0 and DSCP 0.

•There is support for NetFlow custom data sources that are set up for specific interfaces.

V8-AS-Aggregation

Not supported.

Viewing the Monitor Overview Charts

The Monitor Overview charts allow you to take a quick look, in graphical format, at the TopN protocol suites, active hosts, active applications, and application response times monitored on your network. To view the Monitor Overview charts, click the Monitor tab.

The following charts are displayed:

•Most Active Applications Chart (Figure 4-2)

•Most Active Hosts Chart (Figure 4-3)

•Server Response Times Chart (Figure 4-4)

•Protocol Suites Chart (Figure 4-5)

Figure 4-2 Most Active Applications Chart

1

Top N protocols sorted by color.

2

Number of bytes collected per second for each protocol.

Figure 4-3 Most Active Hosts Chart

1

Top N network addresses sorted by color.

2

Number of bytes collected per second for each address.

Figure 4-4 Server Response Times Chart

1

Top N servers sorted by color

3

Server response time

2

Protocol used by the server

Figure 4-5 Protocol Suites Chart

1

Pie chart showing network protocol usage.

2

Top N network protocols.

Data Source Persistence

When you view a monitor window with drop down data source lists, the NAM saves the selected data source. When you next view a monitor window with a drop down data source list, the NAM displays the previously saved data source. If no data source has been previously viewed and saved, the NAM displays the default data source. If you go to a different monitor window, and no collection has been configured with the saved data source, the default data source displays.

Viewing Individual Applications Data

To view the distribution of packets and bytes based on the application protocol, click Monitor > Apps. The Applications table displays with three radio buttons on top.

You can select a radio button for:

•Viewing the Application Groups Current Rates Table

•Viewing the Top N Application Group Chart

•Viewing the Application Groups Cumulative Data Table

Viewing the Applications Current Rates Table

The Applications Current Rates table enables you to view the number of packets and bytes collected for each application protocol. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

Note Auto learned or user defined protocols are not listed in the table.

To view the Applications Current Rates table:

Step 1 Click the Current Rates table radio button.

The Application Groups Current Rates Table (Table 4-9) displays.

Table 4-5 Applications Current Rates Table

Field

Description

Protocol

Name of the application protocol.

Packets/s

Number of packets collected per second.

Bytes/s

Number of bytes collected per second.

Step 2 Choose the data source to monitor from the Data Source list.

Step 3 To view data for a specific protocol, enter the protocol name in the Protocol text box, then click Filter.

Any matching protocols are displayed.

Tip•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the Protocol Directory table.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Displaying Details from the Applications Table

To view details for a specific application protocol, select the protocol and click Details, or click on the protocol name in the Protocol column. The Application Group Window (Figure 4-10) displays, showing all network hosts using this protocol. The displayed data is specific to the selected data source.

Figure 4-6 Application Protocol Detail Window

The Applications Protocol Detail Window displays the following information.

Table 4-6 Application Protocol Detail Table

Field

Description

Description

Full name and description of the protocol.

Host

The hostname of the computer using the application protocol.

In Pkts

Number of packets the host received for the specified protocol.

Out Pkts

Number of packets the host transmitted for the specified protocol.

In Bytes

Number of bytes the host received for the specified protocol.

Out Bytes

Number of bytes the host transmitted for the specified protocol.

Capturing Application Protocol Data from the Application Table

You can capture data for a specific application protocol directly from the Application table.

Choose the protocol from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

If a capture is already running, a message window displays. Click Yes to stop the current capture or No to disregard your selection.

Viewing Real-Time Data from the Application Table

You can view real-time data in a graphical format for a specific application protocol. Choose the protocol from the table, then click Real-Time. The Real-Time Graph (Figure 4-7) displays.

Figure 4-7 Real-Time Graph

Viewing Reports from the Applications Table

You can view reports directly from the Applications table. Choose the application protocol for which to view a report, then click Report. The Basic Reports graph displays. If a report is not configured, one will be created based on the selected application and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Top N Applications Chart

The TopN Applications Chart enables you to view the number of packets and bytes collected for the Top N application protocols in a graphical format. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the TopN Applications chart:

Step 1 Click the TopN Chart radio button.

The TopN Application Group Chart (Figure 4-8) displays.

Figure 4-8 TopN Applications Chart

1

Data Source list.

3

Top N application protocols.

2

Variable list.

4

Number of bytes or packets collected per second on each Top N protocol.

Step 2 Choose the data source to monitor from the Data Source list.

Step 3 Choose one of the following from the Variable list:

•Packets—Displays the number of packets per second monitored.

•Bytes—Displays the number of bytes per second monitored.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name.

Viewing the Applications Cumulative Data Table

The Applications Cumulative Data Table enables you to view the number of packets and bytes collected for each application protocol. The data displayed is the total number of packets and bytes collected since the collection was created or since the NAM was restarted.

To view the Applications Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The Application Group Cumulative Data Table (Table 4-11) displays.

Table 4-7 Applications Cumulative Data Table

Field

Description

Protocol Name

Name of the monitored protocol.

Packets

Total number of packets collected over the last time interval.

Bytes

Total number of bytes collected over the last time interval.

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 To refresh the table, click Refresh.

Step 4 To view data for a specific protocol, enter the protocol name in the Protocol text box, then click Filter.

Any matching protocols are displayed.

Tip•To view the full encapsulated protocol name, move the cursor over the protocol name in the Protocol column of the Protocol Directory table.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Displaying Details from the Applications Table

To view details for a specific application protocol, click on the protocol name in the Protocol column. The Protocol Detail Window(Figure 4-9) displays.

Figure 4-9 Protocol Detail Window

The Protocol Detail Window displays the following information:

Table 4-8 Protocol Detail Table

Field

Description

Host

The hostname of the computer using the application protocol.

In Pkts

Number of packets the host received for the specified protocol.

Out Pkts

Number of packets the host transmitted for the specified protocol.

In Bytes

Number of bytes the host received for the specified protocol.

Out Bytes

Number of bytes the host transmitted for the specified protocol.

Viewing Application Groups

To view the distribution of packets and bytes based on the application group, click the Monitor tab, then click Apps and select Application Groups from the Contents Menu. The Applications Group table displays with three radio buttons on top.

You can select a radio button for:

•Viewing the Application Groups Current Rates Table

•Viewing the Top N Application Group Chart

•Viewing the Application Groups Cumulative Data Table

Viewing the Application Groups Current Rates Table

The Application Groups Current Rates table enables you to view the number of packets and bytes collected for each application group. The data displayed is the number of packets and bytes or bits collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Application Groups Current Rates table:

Step 1 Click the Current Rates table radio button.

The Application Groups Current Rates Table (Table 4-9) displays.

Table 4-9 Application Groups Current Rates Table

Field

Description

Application Groups

Name of the application group.

Packets/s

Number of packets collected per second.

Bytes/s

Number of bytes collected per second.

Bits/s

Number of bits collected per second.

Step 2 Choose the data source to monitor from the Data Source list.

Step 3 To view data for a specific protocol group, enter the group name in the text box, then click Filter.

Any matching groups are displayed.

Tip•To view the application list for a particular protocol group, click the + sign in front of the group name.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Displaying Details from the Application Group Table

To view details for a specific application group, select the application group and click Details. The Application Group Window (Figure 4-10) displays, showing all applications in this group and the network hosts using those particular applications. The displayed data is specific to the selected data source.

Figure 4-10 Application Group Window

The Applications Group Detail Window displays the information listed in Table 4-10.

Table 4-10 Application Group Detail Window Fields

Field

Description

Description

Full name and description of each application in that group.

Host

The hostname of the computer using the application group.

In Pkts

Number of packets the host received for the specified group.

Out Pkts

Number of packets the host transmitted for the specified group.

In Bytes

Number of bytes the host received for the specified group.

Out Bytes

Number of bytes the host transmitted for the specified group.

Viewing Real-Time Data from the Application Group Table

You can view real-time data in a graphical format for a specific application protocol.

Choose the protocol from the table, then click Real-Time. The Real-Time Graph(Figure 4-11) displays.

Figure 4-11 Real-Time Graph

Viewing Reports from the Application Group Table

You can view reports directly from the Applications table. Choose the application protocol for which to view a report, then click Report. The Basic Reports graph displays. If a report is not configured, one will be created based on the selected application and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Top N Application Group Chart

The TopN Applications Chart enables you to view the number of packets and bytes collected for the Top N application protocols in a graphical format. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the TopN Applications chart:

Step 1 Click the TopN Chart radio button.

The TopN Application Group Chart (Figure 4-12) displays.

Figure 4-12 TopN Application Group Chart

Step 2 Choose the data source to monitor from the Data Source list.

Step 3 Choose one of the following from the Variable list:

•Packets—Displays the number of packets per second monitored.

•Bytes—Displays the number of bytes per second monitored.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name.

Viewing the Application Groups Cumulative Data Table

The Applications Groups Cumulative Data table enables you to view the number of packets and bytes collected for each application group. The data displayed is the total number of packets and bytes collected since the collection was created or since the NAM was restarted.

To view the Applications Groups Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The Application Group Cumulative Data Table (Table 4-11) displays.

Table 4-11 Application Group Cumulative Data Table

Field

Description

Group Name

Name of the monitored group.

Packets

Total number of packets collected over the last time interval.

Bytes

Total number of bytes collected over the last time interval.

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 To refresh the table, click Refresh.

Step 4 To view data for a specific group, enter the group name in the Group text box, then click Filter.

Any matching groups are displayed.

Tip To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Collected URLs

This section contains the following sections:

•Viewing Collected URLs

•Filtering a URL Collection List

•Creating a URL-based Application from a Collected URL

Viewing Collected URLs

To view collected URLs:

Step 1 Click Monitor > Apps.

Step 2 Click URLs in the TOC.

The URLs Window (Figure 4-13) displays with the collected URLs.

Figure 4-13 URLs Window

Table 4-12 URLs Table

Field

Description

Index

URL index

URL

Name of URL

Hits

Number of hits

Note Only one URL collection can be active at one time. The data source is for information only.

Filtering a URL Collection List

To filter a URL collection list:

Step 1 From the drop-down list in the URLs Window (Figure 4-13), select which part of the URL to filter:

•URL—You can filter on any part of the URL

•Host—This filter applies only to the host part of collected URLs.

•Path—This filter applies only to the path part of the collected URLs

•Arguments—This filter applies only to the argument part of the collected URLs.

Step 2 Enter filter string.

Step 3 Click Filter to apply the filter.

Note To remove any display filter and show all URLs collected, click Clear.

Creating a URL-based Application from a Collected URL

To create a URL-based application from a collected URL:

Step 1 From the list of URLs shown in the Create URL-based Application window, click a radio button to select a row in the URL list.

Step 2 Click Create URL-based Application.

The Create URL-based Application window (Figure 4-14) displays.

Figure 4-14 Create URL-based Application

Step 3 Enter a value in the fields for Index and Protocol Description.

For information about appropriate values for the Index and Protocol Description fields, see Creating a URL-based Application.

Step 4 Click Apply.

Viewing the TCP/UDP Port Table

The TCP/UDP Port Table displays with three radio buttons; one for current rates (the default view), one for TopN Chart, and one for Cumulative Data.

You can select a radio button for:

•Viewing the TCP/UDP Port Table Current Rates

•Viewing the TCP/UDP Port Table TopN Chart

•Viewing the TCP/UDP Port Table Cumulative Data

Viewing the TCP/UDP Port Table Current Rates

To view the TCP/UDP Port Table current rates, click Monitor > Apps > TCP/UDP Port Table.

The TCP/UDP Port Table Current Rates table enables you to view the current rates of data transfer for the various TCP and UDP server ports. Table 4-13 lists the statistics shown in the TCP/UDP Port Table Current Rates table.

Table 4-13 TCP/UDP Port Table Current Rates

Field

Description

Server Port

All server ports currently in use.

Application

Application in use on each port.

Note In some cases, the Application field might be blank. This usually happens with TCP/UDP ports that are used dynamically rather than static or well-known ports. When the NAM determines that the same port was used for more than one application, from that point on the NAM displays the Application field as blank.

Packets In/s

Packets in per second

Packets Out/s

Packets out per second

Bytes In/s

Bytes in per second

Bytes Out/s

Bytes out per second

Viewing the TCP/UDP Port Table TopN Chart

To view the TCP/UDP Port Table TopN Chart, click Monitor > Applications > TCP/UDP Port Table, then click the TopN button. The TCP/UDP Port Table TopN Chart shows a graphical chart of the most active TCP and UDP ports currently being used.

You can select to show the chart based on different Data Sources or to select a different variable such as packets or bytes in or out per second.

Figure 4-15 shows an example of the TCP/UDP Port Table TopN Chart.

Figure 4-15 TCP/UDP Port Table TopN Chart

Viewing the TCP/UDP Port Table Cumulative Data

The TCP/UDP Port Table Cumulative Data table enables you to view the number of packets and bytes collected for each server port. The data displayed is the total number of packets and bytes collected since the collection was created or since the NAM was restarted.

To view the TCP/UDP Port Table Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The TCP/UDP Table Cumulative Data Table (Table 4-14) displays.

Table 4-14 TCP/UDP Table Cumulative Data Table

Field

Description

Server Port

All server ports currently in use

Application

Application in use on each port

Packets In

Total number of packets received

Packets Out

Total number of packets sent

Bytes In

Total number of bytes received

Bytes Out

Total number of bytes sent

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 To refresh the table, click Refresh.

Step 4 To view data for a specific group, enter the group name in the Group text box, then click Filter.

The GUI displays any matching groups.

Tip To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Voice Data

You can use the NAM Traffic Analyzer to view troubleshooting data collected from any enabled voice protocols on the NAM. This enables you to identify potential problems with your voice network.

There are menu items for:

•Viewing the Voice Protocol Overview

•Viewing Known Phones

•Viewing Active Calls

•Viewing RTP Stream Traffic

Viewing the Voice Protocol Overview

To view the voice protocol overview and the Aggregate Statistics table, choose Monitor > Voice/RTP Stream. The Aggregate Statistics table (Figure 4-16) displays.

Figure 4-16 Aggregate Statistics Table

The Aggregate Statistics Table, Table 4-15, contains basic troubleshooting information for the voice protocols implemented in your network.

Table 4-15 Aggregate Statistics Table

Field

Description

Protocol

Name of the voice protocol; protocols include SCCP, H.323, MGCP, and SIP

Calls Monitored

Number of calls monitored.

Avg Pkt Loss (%)

Average packet loss for all calls.

Avg Jitter (ms)

Average jitter for all calls.

Worst Pkt Loss (%)

Worst packet loss percentage monitored.

Worst Jitter (ms)

Worst jitter monitored.

Displaying Protocol Details From the Aggregate Statistics Table

To view the voice protocol details window, check the protocol name and click Details, or click the protocol name. The Worst Quality Calls Tables (Figure 4-17) are displayed.

Figure 4-17 Worst Quality Calls Tables

The Worst Quality Calls Tables shows two sections:

•Packet Loss - Worst Quality Calls Table—Displays the TopN worst calls based on packet loss.

•Jitter - Worst Quality Calls Table—Displays the TopN worst calls based on jitter

To clear the information in the tables, click Clear.

Table 4-16 Worst Quality Calls Tables

Field

Description

Caller Number

Number of the caller phone.

Called Number

Number of the called phone.

Caller

Alias name, MGCP endpoint ID, or SIP URI of the calling party phone.

Called

Alias name, MGCP endpoint ID, or SIP URI of the called party phone.

Time of Call

Time the call was placed.

Caller IP Address

IP address of the caller.

Called IP Address

IP address of the called phone.

% Packet Loss

Percentage of packets lost on the call.

Jitter

Amount of jitter on the call.

Viewing Known Phones

You can view basic and detailed information on all known monitored phones in your network.

If you are using MGCP gateways in your network, the MGCP endpoint and endpoint IDs represent the ports of the MGCP gateway that are used to establish connections with the specified call.

To view known phones:

Step 1 Choose Monitor > Voice/RTP Stream.

The Aggregate Statistics table displays.

Step 2 In the contents, click Known Phones.

The Phones Table (Table 4-17) displays.

Table 4-17 Phones Table

Field

Description

Phone

Phone number or MGCP endpoint.

IP Address

IP address of the phone.

Name

Alias name or MGCP endpoint ID of the phone.

Calls Monitored

Number of calls monitored and percentage of total calls.

Avg Pkt Loss %

Average packets loss on the phone.

Avg Jitter

Average jitter on the phone (in milliseconds).

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Displaying Phone Details From the Known Phones Table

b

Table 4-18 Phone Details

Field

Description

Phone

Phone number

Name

The alias name or MGCP endpoint ID of the phone

IP Address

IP address of the phone

Switch Port

Physical interface switch port that the phone is attached to

Protocol

The protocol that the phone is learned from

Table 4-19 Aggregate Statistics

Field

Description

Calls Monitored

Number of calls monitored since Call Monitoring was last enabled.

Average Packet Loss (%)

Average percent packet loss over all monitored calls.

Average Jitter (msec)

Average jitter over all monitored calls.

Worst Packet Loss (%)

Worst percent packet loss from all monitored calls.

Worst Jitter (msec)

Worse amount of jitter from all monitored calls.

Table 4-20 Last N Calls

Field

Description

Caller Number

Phone number of the caller.

Called Number

Phone number of the called phone.

Caller

Alias name, MGCP endpoint ID, or SIP URI of the calling party phone.

Called

Alias name, MGCP endpoint ID, or SIP URI of the called party phone.

Time of Call

Time the call was established.

Caller IP Address

IP address of the connected caller.

Called IP Address

IP address of the called party.

% Pkt Loss

Percentage of packets lost on the call.

Jitter (msec)

Jitter on the call.

For SCCP, MGCP, and SIP, the jitter value is reported by the phone. For H.323, it is the average inter-arrival jitter calculated as the sum of all detected RTCP receiver reports inter-arrival jitter, divided by the number of detected RTCP receiver reports.

Displaying Call Details From the Last N Calls Table

To view the details of a specific call from the Last N Calls Table, select the radio button, then click Details.

For phones using SCCP, the SCCP Call Detail Table (Table 4-21) displays.

For phones using H.323, the H.323 Call Detail Table (Table 4-22) displays.

For phones using MGCP, the MGCP Call Detail Table (Table 4-23) displays.

For phones using SIP, the SIP Call Detail Table (Table 4-24) displays.

Table 4-21 SCCP Call Detail Table

Field

Description

Phone Number

Phone numbers of the calling and called parties.

Owner

Alias names of the calling and called party phones.

IP Address

IP addresses of the calling and called parties.

Call Reference

The call reference field in the call setup messages.

Call State

Current state of the call; can be Setup, Hold, Connected, or Ended.

Line Instance

Line of the call, such as line 1, line 2, ...

Receiving Audio Address

Calling and called phone IP addresses used to receive audio packets.

Receiving Audio Port

Port upon which audio is received for calling and called parties.

Receiving Audio Codec

Audio encoding scheme used by calling and called phone in this call.

Receiving Audio Pass Through ID

CCM internal significant ID for this call.

Receiving Video Address

Calling and called phone IP addresses used to receive video packets.

Receiving Video Port

Port upon which video is received for calling and called parties.

Receiving Video Codec

Encoding scheme used by calling and called phone in this call.

Receiving Video Pass Through ID

CCM internal significant ID for this call.

Receiving Data Address

Calling and called phone IP addresses used to receive data packets.

Receiving Data Port

Port upon which data is received for calling and called parties.

Receiving Data Codec

Encoding scheme used by calling and called phone in this call.

Receiving Data Pass Through ID

CCM internal significant ID for this call.

Start Time

Day, date, and time the call was started.

End Time

Day, date, and time the call was ended.

Maximum Packet Loss

Maximum loss percentage of this call.

Maximum Jitter

Maximum jitter of this call.

Packets Sent

Reported number of RTP packets sent by calling and called phone.

Packets Received

Reported number of RTP packets received by calling and called phone.

Octets Sent

Reported number of RTP octets sent by calling and called phone.

Octets Received

Reported number of RTP octets received by calling and called phone.

Packet Loss (%)

Percentage of packets lost during the call; based on reported packets sent and received.

Jitter (msec)

Reported jitter of the call by calling and called phones.

Switch Port

Physical interface of the router or switch port to which the phone is attached.

Table 4-22 H.323 Call Detail Table

Field

Description

Number

Phone numbers of the calling and called parties.

Q.931 IP Address

For the calling party, the source IP address of the Q.931 setup message. For the called party, the source IP address of the Q.931 connect message.

Q.931 Port

Port that the phone is using to send Q.931 messages.

Alias

Alias name of the calling and called phones.

Call State

State of the call—setup, connect, or ended.

Call Status

Good—Jitter and/or packet loss do not pass threshold values.

Acceptable—Jitter and/or packet loss pass threshold values but are within 10% of exceeding the values.

Bad—Jitter and/or packet loss exceed the threshold values by more than 10%.

Call Reference

The call reference field in the call setup messages.

Call Id

The call ID field in the call setup messages.

Conference Id

The conference ID field in the call setup messages.

Conference Goal

The conference action of the caller—Create, Invite, or Join.

Fast Start

True or false. Indicates if the call used faststart sequence to set-up the call.

Tunneling

True or false. Indicates if the call used tunneling to set-up the medium (RTP) channel.

Call Type

The type of call—Point-to-Point, N-to-One, or One-to-N.

Product Id

The product string in the call setup message for the calling and called parties.

Version Id

The version of the product for the calling and called parties.

Session Id

The session number of the media (RTP) channel for the calling and called parties.

Logical Channel Number

The logical channel number value of the media (RTP) channel for the calling and called parties.

H.245 IP Address

The IP address where the calling party and called party send H.245 messages in negotiating the call.

H.245 Port

The port where the calling and called parties send H.245 messages when negotiating the call.

RTP IP Address

IP address where the calling and called parties send the RTP packets when negotiating the call.

RTP Port

Port where the calling and called partied send the RTP packets when negotiating the call.

Codec

The encoding or decoding method used to convert analog signals to digital.

RTCP IP Address

IP address where the RTCP report is sent to.

RTCP Port

Port where the RTCP report is sent to.

Start Time

Day, date, and time the call started.

End Time

Day, date, and time the call ended.

Synch Source

Synchronization source value that represents the calling and called party in RTP packets.

Packets Sent

The cumulative number of packets sent on the call, as reported in the last RTCP sender report.

Octets Sent

The cumulative number of octets sent on the call, as reported in the last RTCP sender report.

Packets Lost

The cumulative number of packets lost on the call, as reported in the last RTCP sender report.

Average Packet Loss (%)

The average fraction loss calculated as the sum of fraction loss reported in detected RTCP receiver reports, divided by the number of detected RTCP receiver reports.

Average Jitter (msec)

The average inter-arrival jitter calculated as the sum of all detected RTCP receiver reports inter-arrival jitter, divided by the number of detected RTCP receiver reports.

Note Because of the nature of the MGCP protocol, calls that were monitored by the NAM might have the caller and called party information reversed.

Table 4-23 MGCP Call Detail Table

Field

Description

Name

Alias name or MGCP endpoint ID.

Note This information might appear in a separate Q.931 table above the MGCP Call Detail table.

Phone Number

Phone number of the calling and called parties.

Note This information might appear in a separate Q.931 table above the MGCP Call Detail table.

Phone Number Confidence

Because of the nature of the protocol, the phone number is sometimes detected
with errors.

•High—The detection of the phone number is not likely to have a mistake.

•Low—The detection of the phone number is subject to error due to the nature of the MGCP protocol.

Note This information might appear in a separate Q.931 table above the MGCP Call Detail table.

RTP Address

Receiving RTP address of the calling and called parties.

Endpoint ID

MGCP endpoint ID of the calling and called parties.

Agent Address

IP address of the MGCP call agent.

Gateway Address

Network address of the MGCP gateway.

Call State

Setup—The call is setting up.

Connected—The call is fully established.

Ended—The call has ended.

Call ID

MGCP identification number of the call.

RTP Port

Receiving RTP port of the calling and called parties.

Connection ID

MGCP connection identification number of the call.

RTP Sampling Period

Period at which the RTP packet is sampled for transmission.

Silence Sup

On—Silence suppression option for the call is turned on.

Off—Silence suppression option for the call is turned off.

Codec

Codec of the RTP streams.

Start Time

Time the call is fully established.

End Time

Time the call ended.

Packet Sent

Number of RTP packets sent by the calling and called parties as reported in MGCP connection parameters.

Packets Received

Number of RTP packets received by the calling and called parties as reported in connection parameters.

Octets Sent

Number of RTP octets sent between the calling and called parties as reported in MGCP connection parameters.

Octets Received

Number of RTP octets received between the calling and called parties as reported in MGCP connection parameters.

Packet Loss (%)

Calculated percent loss based on the number of packet loss as reported in MGCP connection parameters.

Jitter

Jitter of the call as reported in MGCP connection parameters.

Table 4-24 SIP Call Detail Table

Field

Description

Name

The SIP phone's alias name

Phone Number

SIP phone's phone number

IP Address

Receiving audio address of the calling and called party

SIP URI

SIP phone SIP URI string

Tag

Tag string of the calling and called party seen in call signaling procedure

Call ID

Call ID string seen in call signalling procedure

Start Time

Time the call was established

End Time

Time the call was terminated

Session Owner

Global SDP owner string of the call

Session ID

Global SDP ID string of the call

Session Name

Global SDP name string of the call

Receiving Audio Address

Address where calling and called party receive audio packets of the call

Receiving Audio Port

Port where calling and called party receive audio packets of the call

Audio Transport

Audio packet format of the call

Audio Payload

Audio codec seen in SDP session of the call negotiation procedure

Audio Packets Sent

Number of packets sent reported by the phone

Audio Packets Received

Number of packets received reported by the phone

Audio Octets Sent

Number of octets sent reported by the phone

Audio Octets Received

Number of octets received reported by the phone

Audio Packet Loss

Number of packets lost reported by the phone

Audio Jitter

Jitter value reported by the phone.

Video Information

Not applicable (N/A) in the case of audio calls

Application Information

Not applicable (N/A) in the case of audio calls

Note If a call is placed on a video/application channel, the SIP Call Detail Table will contain additional rows, similar to the ten Audio rows, but labeled Video and/or Application.

Note Audio Packets/Octets sent/received, loss, and jitter are obtained in SIP BYE and the corresponding BYE OK message. This information is added in Cisco SIP phone firmware 6.3 and above and the phone must be configured with Call Statistics set to Enabled.

Viewing Active Calls

The Active Calls table displays information for all calls currently being monitored.

To view the Active Calls table:

Step 1 Choose Monitor > Voice/RTP Stream.

The Aggregate Statistics table displays.

Step 2 In the contents, click Active Calls.

The Active Calls Table (Table 4-25) displays.

Table 4-25 Active Calls Table

Field

Description

Caller Number

Number of the phone placing the call.

Called Number

Number of the phone receiving the call.

Caller

Alias name, MGCP endpoint ID, or SIP URI of the calling party phone.

Called

Alias name, MGCP endpoint ID, or SIP URI of the called party phone.

Time of Call

Time the call was placed.

Caller IP Address

IP address of the phone making the call.

Called IP Address

IP address of the phone receiving the call.

Step 3 To clear the Active Calls table, click Clear.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Displaying Call Details From the Active Calls Table

To display details of a specific call from the Active Calls table, click the phone number in the Caller Number column. The Active Call Detail window displays.

For phones using SCCP, the SCCP Call Detail Table (Table 4-21) displays.

For phones using H.323, the H.323 Call Detail Table (Table 4-22) displays.

For phones using MGCP, the MGCP Call Detail Table (Table 4-23) displays.

For phones using SIP, the SIP Call Detail Table (Table 4-24) displays.

Viewing RTP Stream Traffic

To view RTP Stream Traffic, choose Monitor > Voice/Video, then choose RTP Stream Traffic in the content menu. The RTP Stream Traffic Window (Figure 4-18) displays.

Figure 4-18 RTP Stream Traffic Window

Table 4-26 describes the fields of the RTP Stream Traffic window.

Table 4-26 RTP Stream Traffic Window Fields

Field

Description

Source Address

Source address of the RTP stream traffic

Source Port

Source port of the RTP stream traffic

Destination Address

Destination address of the RTP stream traffic

Destination Port

Destination port of the RTP stream traffic

RTP Payload Type

Payload type as seen in the RTP stream

SSRC Value

Synchronization Source of the RTP packet

Packet Loss Rate 10 -6

Actual packet loss rate (divided by 1,000,000 for ease of viewing)

Monitoring Hosts Data

You can view results from any active hosts collections in the RMON1 and RMON2 host tables on the NAM.

To view hosts data:

Step 1 Click Monitor > Hosts.

The Network Hosts table displays with three radio buttons above it. You can select a radio button for:

•Viewing the Network Hosts Current Rates Table

•Viewing the Network Hosts Top N Chart

•Viewing the Network Hosts Cumulative Data Table

Step 2 To view the data based on the host MAC addresses, click MAC Stations in the contents.

Note MAC statistics are not available on NM-NAM and NME-NAM devices.

The Mac Stations table displays with three radio buttons above it. You can select a radio button for:

•Viewing the MAC Stations Current Rates Table

•Viewing the MAC Stations Top N Chart

•Viewing the MAC Stations Cumulative Data Table

Viewing the Network Hosts Current Rates Table

The Network Current Rates table enables you to view the various data collected for each host. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Network Current Rates table:

Step 1 In the contents, click Network Hosts.

Step 2 Click the Current Rates radio button.

The Network Hosts Current Rates Table (Table 4-27) displays.

Table 4-27 Network Hosts Current Rates Table

Field

Description

Address

Network address of the host.

Via

Protocol being monitored.

In Packets/s

Number of input packets collected per second.

Out Packets/s

Number of output packets collected per second.

In Bytes/s

Number of input bytes collected per second.

Out Bytes/s

Number of output bytes collected per second.

Non Unicast/s

Number of non unicast broadcast packets collected per second.

Step 3 Choose a data source to monitor from the Data Source list.

Step 4 Enter an address to filter in the Address text box, then click Filter.

The specified address displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Network Host Details

To view details for a specific host, click on the address in the Address column of the Network Hosts table. The Network Hosts Detail Window(Figure 4-19) displays.

Figure 4-19 Network Hosts Detail Window

•Host Details—Displays detailed information for the host.

•Application Protocol Usage Chart—Displays the application protocol usage for the host in graphical format.

•Conversations From Known Protocols—Displays known conversations and statistics from the specified host to other hosts on the network using known protocols.

•Conversations To Known Protocols—Displays known conversations and statistics to the specified host from other hosts on the network using known protocols.

Note To view the full protocol name, move the cursor over the protocol name in the Application Protocol Usage chart.

Tips

To view the full protocol name, move the cursor over the protocol name in the Application Protocol Usage chart.

Capturing Network Host Data from the Network Host Table

You can capture data for a specific host directly from the Network Host table.

Choose the host from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

If a capture is already running, a message window displays. Click Yes to stop the current capture or No to disregard your selection.

The Capture button is available only for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Real-Time Traffic Statistics from the Hosts Table

You can view real-time traffic statistics in a graphical format for a specific host. Choose the host from the table, then click Real-Time. The Real-Time Graph (Figure 4-20) displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-20 Real-Time Graph

Viewing Reports from the Network Hosts Table

You can view reports directly from the Network Hosts table. Choose the host for which to view a report, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected host and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Network Hosts Top N Chart

The Network Hosts Top N Chart enables you to various data for the TopN hosts in a graphical format. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Network Hosts Top N Chart:

Step 1 In the contents, click Network Hosts.

Step 2 Click the TopN Chart radio button.

The Top N Network Hosts Chart (Figure 4-21) displays.

Figure 4-21 Top N Network Hosts Chart

1

Data Source list.

3

Top N network host addresses.

2

Variable list.

4

Number of packets/bytes input/output per second for each Top N host.

Step 3 Choose the data source to monitor from the Data Source list.

Step 4 Choose one of the following from the Sort Option list:

•In Pkts—Displays the number of input packets.

•Out Pkts—Displays the number of output packets.

•In Bytes—Displays the number of input bytes.

•Out Bytes—Displays the number of output bytes.

•Non Unicast Pkts—Displays the number of non-unicast packets.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the Network Hosts Cumulative Data Table

The Network Hosts Cumulative Data Table enables you to view various data collected for each host. The information displayed represents the total data collected since the collection was created or since the NAM was restarted.

To view the Network Hosts Cumulative Data Table:

Step 1 In the contents, click Network Hosts.

Step 2 Click the Cumulative Data radio button.

The Network Hosts Cumulative Data Table (Table 4-28) displays.

Table 4-28 Network Hosts Cumulative Data Table

Field

Description

Address

Network address of the host.

Via

Protocol being monitored.

In Pkts

Total number of input packets over the last interval.

Out Pkts

Total number of output packets over the last interval.

In Bytes

Total number of input bytes over the last interval.

Out Bytes

Total number of output bytes over the last interval.

Non Unicast

Total number of non-unicast broadcast packets over the last interval.

Step 3 Choose a data source to monitor from the Data Source list.

Step 4 To view data for a specific address, enter the address in the Address text box, then click Filter.

Any matching addresses are displayed.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the MAC Stations Current Rates Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The MAC Stations Current Rates table enables you to view the various data collected for each host. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the MAC Stations Current Rates table:

Step 1 In the contents, click MAC Stations.

Step 2 Click the Current Rates Table radio button.

The MAC Stations Table (Table 4-29) displays.

Table 4-29 MAC Stations Table

Field

Description

Address

MAC address of the host.

In Packets/s

Number of packets received by the host per second.

Out Packets/s

Number of packets sent by the host per second.

In Bytes/s

Number of bytes received by the host per second.

Out Bytes/s

Number of bytes sent by the host per second.

Broadcasts/s

Number of broadcasts sent by the host per second.

Multicasts/s

Number of multicasts sent by the host per second.

Step 3 Choose a data source to monitor from the Data Source list.

Step 4 Enter an address to filter in the Address text box, then click Filter.

The specified address displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the MAC Stations Top N Chart

Note This section does not apply to NM-NAM and NME-NAM devices.

The MAC Stations Top N chart enables you to view the various data collected for each host in a graphical format. The information displayed represents the data collected per second over the last time interval.For information on setting the time interval, see the "Setting Global Preferences" section.

To view the MAC Stations Top N chart:

Step 1 In the contents, click MAC Stations.

Step 2 Click the TopN Chart radio button.

The Top N MAC Stations Chart (Figure 4-22)displays.

Figure 4-22 Top N MAC Stations Chart

1

Data Source list.

3

Top N MAC host addresses.

2

Variable list.

4

Number of packets/bytes input/output per second for each Top N host.

Step 3 Choose the data source to monitor from the Data Source list.

Step 4 Choose one of the following from the Sort Option list:

•In Packets—Displays the number of input packets per second.

•Out Packets—Displays the number of output packets per second.

•In Bytes—Displays the number of input bytes per second.

•Out Packets—Displays the number of input bytes per second.

•Broadcast Packets—Sorts the addresses based on the number of broadcast packets per second.

•Multicast Packets—Sorts the addresses based on the number of multicast packets per second.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the MAC Stations Cumulative Data Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The MAC Stations Cumulative Data Table enables you to view the various data collected for each host. The information displayed represents the total data collected since the collection was created or since the NAM was restarted.

To view the MAC Stations Cumulative Data Table:

Step 1 In the contents, click MAC Stations.

Step 2 Click the Cumulative Data radio button.

The MAC Stations Cumulative Data Table (Table 4-29) displays.

Table 4-30 MAC Stations Cumulative Data Table

Field

Description

Address

MAC address of the host.

In Packets

Total number of packets received by the host over the last time interval.

Out Packets

Total number of packets sent by the host over the last time interval.

In Bytes

Total number of bytes received by the host over the last time interval.

Out Bytes

Total number of bytes sent by the host over the last time interval.

Broadcasts

Total number of broadcasts sent by the host over the last time interval.

Multicasts

Total number of multicasts sent by the host.

Step 3 Choose a data source to monitor from the Data Source list.

Step 4 Enter an address to filter in the Address text box, then click Filter.

The specified address displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Conversations Data

You can view conversations data collected on the NAM. Conversations data represents the number of packets and bytes collected between two hosts. Click Monitor > Conversations to view conversations data.

NAM 3.6 provides three menu options for monitoring conversations:

•Viewing Network Hosts

•Viewing the Application Hosts

•Viewing MAC Stations

Viewing Network Hosts

The Network Hosts Conversations table displays statistics between pairs of IP addresses talking to each other. The statistics pertain to all packets between the hosts, regardless of protocol or application. There are three options you can use to display the Network Hosts Conversations table:

•Viewing the Network Host Conversations Current Rates Table

•Viewing the Network Host Conversations Top N Chart

•Viewing the Network Host Conversations Cumulative Data Table

Viewing the Network Host Conversations Current Rates Table

The Network Host Conversations Current Rates table enables you to view the number of packets and bytes collected for each host conversation. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Network Host Conversations Current Rates table:

Step 1 In the contents, click Network Hosts.

Step 2 Click the Current Rates Table radio button.

The Network Host Conversations Current Rates Table (Table 4-31) displays.

Table 4-31 Network Host Conversations Current Rates Table

Field

Description

Source

Source address of the conversation.

Via

Network layer protocol over which the hosts are conversing.

Destination

Destination address of the conversation.

Packets/s

Number of packets collected per second for the conversation over the last interval.

Bytes/s

Number of bytes collected per second for the conversation. over the last interval.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 To view data for a specific source or destination, select Source, Destination, or Source or Destination from the list.

Step 5 Enter the address in the text box, then click Filter.

Any matching source or destination addresses are displayed.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Network Host Conversation Details

To view conversation details for a specific network conversation, click the network address in the Source or Destination column. The following tables are displayed:

•Host Details—Displays detailed information for the source or destination host.

•Application Protocol Usage Chart—Displays the application protocol usage for the source of destination host in graphical format.

•Conversations From Known Protocols—Displays known conversations and statistics from the specified host to other hosts on the network using known protocols.

•Conversations To Known Protocols—Displays known conversations and statistics to the specified host from other hosts on the network using known protocols.

Note To view the full protocol name, move the cursor over the protocol name in the Application Protocol Usage chart.

Capturing Network Host Conversation Data from the Network Host Conversations Table

You can capture data for a specific network host conversation directly from the Network Host Conversations table.

Choose the conversation from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

If a capture is already running, a message window displays. Click Yes to stop the current capture or No to disregard your selection.

The Capture button is available only for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Real-Time Traffic Statistics from the Network Host Conversations Table

You can view real-time traffic statistics in a graphical format for a specific host conversation.

Choose the conversation from the table, then click Real-Time. The Real-Time Graph (Figure 4-20)displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-23 Real-Time Graph

Viewing Reports from the Network Host Conversations Table

You can view reports directly from the Network Hosts Conversations table. Choose the conversation you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected host and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Network Host Conversations Top N Chart

The Top N Network Host Conversations Chart enables you to view the number of packets and bytes collected for the Top N network host conversations in a graphical format. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Top N Network Host Conversations chart:

Step 1 In the contents, click Network Hosts.

Step 2 Click the TopN Chart radio button.

The Top N Network Host Conversations Chart(Figure 4-24)displays.

Figure 4-24 Top N Network Host Conversations Chart

1

Data Source list.

4

Top N destination network addresses.

2

Variable list.

5

Number of packets or bytes collected per second.

3

Top N source network addresses.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose one of the following from the Variable list:

•Packets—Sorts the addresses based on the number of packets.

•Bytes—Sorts the addresses based on the number of bytes.

Viewing the Network Host Conversations Cumulative Data Table

The Network Host Conversations Cumulative Data Table enables you to view the number of packets and bytes collected for each host conversation. The data displayed is the total number of packets and bytes collected since the collection was created or since the NAM was restarted.

To view the Network Host Conversations Cumulative Data table:

Step 1 In the contents, click Network Hosts.

The Network Hosts Conversations Current Rates table displays.

Step 2 Click the Cumulative Data radio button.

The Network Host Conversations Cumulative Data Table (Table 4-32) displays.

Table 4-32 Network Host Conversations Cumulative Data Table

Field

Description

Source

Source address of the conversation.

Via

Network layer protocol over which the hosts are conversing.

Destination

Destination address of the conversation.

Packets

Total number of packets collected over the last time interval for the conversation.

Bytes

Total number of bytes collected over the last time interval for the conversation.

Step 3 Choose a data source to monitor from the Data Source list.

Step 4 Enter an address to filter in the Address text box, then click Filter.

The specified address displays.

Step 5 To refresh the table, click Refresh.

Tip To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Network Host Conversation Details

To view conversation details for a specific network conversation, click the network address in the Source or Destination column. The following tables are displayed:

•Host Details—Displays detailed information for the source or destination host.

•Application Protocol Usage Chart—Displays the application protocol usage for the source of destination host in graphical format.

•Conversations From Known Protocols—Displays known conversations and statistics from the specified host to other hosts on the network using known protocols.

•Conversations To Known Protocols—Displays known conversations and statistics to the specified host from other hosts on the network using known protocols.

Viewing the Application Hosts

The Application Hosts table enables you to view the number of packets and bytes collected for each host conversation. You can use this data to identify application hosts conversations and port numbers that can help you design access control lists on switches and routers to allow or block certain ports between certain hosts. The data displayed is the number of packets and bytes collected per second over the last time interval.

To view the Application Hosts table, click Monitor > Conversations > Application Hosts. Figure 4-25 shows an example of the Application Hosts table.

Figure 4-25 Application Hosts Table

Table 4-33 lists the fields of the Application Hosts Conversations table.

Table 4-33 Application Hosts Conversations

Field

Description

Source

Source address of the conversation

Destination

Destination address of the conversation

Application

Application used in conversation

Port

Port used for the conversation.

Packets

Total number of packets collected over the last time interval for the conversation

Bytes

Total number of bytes collected over the last time interval for the conversation

Viewing MAC Stations

The Media Access Control (MAC) Stations Conversations table displays statistics of conversations between two MAC addresses instead of two IP addresses.

•Viewing the MAC Station Conversations Current Rates Table

•Viewing the MAC Conversations Top N Chart

•Viewing the MAC Station Conversations Cumulative Data Table

Viewing the MAC Station Conversations Current Rates Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The MAC Station Conversations Current Rates table enables you to view the number of packets and bytes collected for each host conversation. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the MAC Station Conversations Current Rates table:

Step 1 In the contents, click Monitor > Conversations > MAC Stations.

The MAC Station Conversations Current Rates Table (Table 4-34) displays.

Table 4-34 MAC Station Conversations Current Rates Table

Field

Description

Source

Source MAC address of the conversation.

Destination

Destination MAC address of the conversation.

Packets/s

Number of packets collected per second for the conversation over the last interval.

Bytes/s

Number of bytes collected per second for the conversation. over the last interval.

Errors/s

Number of errors collected per second for the conversation. over the last interval.

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 To view data for a specific address, enter the full or partial MAC address in the Address text box, then click Filter.

Any matching addresses are displayed.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the MAC Conversations Top N Chart

Note This section does not apply to NM-NAM and NME-NAM devices.

The Top N MAC Station Conversations Chart enables you to view the number of packets and bytes collected for the Top N MAC station conversations in a graphical format. The data displayed is the number of packets and bytes collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Top N MAC Station Conversations chart:

Step 1 In the contents, click MAC Stations.

Step 2 Click the TopN Chart radio button.

The Top N MAC Station Conversations Chart (Figure 4-26) displays.

Figure 4-26 Top N MAC Station Conversations Chart

1

Data Source list.

4

Top N destination MAC addresses.

2

Variable list.

5

Number of packets, bytes, or errors collected per second.

3

Top N source MAC addresses.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose one of the following from the Variable list:

•Packets—Displays the number of packets.

•Bytes—Displays the number of bytes.

•Errors—Displays the number of errors.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the MAC Station Conversations Cumulative Data Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The MAC Station Conversations Cumulative Data Table enables you to view the number of packets and bytes collected for each MAC station conversation. The data displayed is the total number of packets and bytes collected since the collection was created or since the NAM was restarted.

To view the MAC Station Conversations Cumulative Data table:

Step 1 In the contents, click MAC Stations.

Step 2 Click the Cumulative Data radio button.

The MAC Station Conversations Cumulative Data Table (Table 4-35) displays.

Table 4-35 MAC Station Conversations Cumulative Data Table

Field

Description

Source

Source MAC address of the conversation.

Destination

Destination MAC address of the conversation.

Pkts

Total number of packets collected over the last time interval for the conversation.

Bytes

Total number of bytes collected over the last time interval for the conversation.

Errors

Total number of errors collected over the last time interval for the conversation.

Step 3 Choose the data source from the Data Source list.

Step 4 Enter an address to filter in the Address text box, then click Filter.

The specified address displays.

Step 5 To refresh the table, click Refresh.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing VLAN Data

Note This section does not apply to NM-NAM and NME-NAM devices.

You can view VLAN traffic statistics or VLAN priority (COS) statistics collected on the NAM. Supervisor engine module collections are done independent of any collections done on the NAM.

Note Supervisor engine module-based collections require Supervisor II engine module or later on your switch.

To view VLAN data:

Step 1 Click Monitor > VLAN.

The VLAN Traffic Statistics table displays with three radio buttons above it. You can select a radio button for:

•Viewing the VLAN Traffic Statistics Current Rates Table.

•Viewing the VLAN Traffic Statistics Top N Chart.

•Viewing VLAN Traffic Statistics Cumulative Data Table.

Step 2 To view the VLAN data based on VLAN priority (COS) statistics, click VLAN Priority (COS) Statistics in the contents.

The VLAN Priority (COS) Statistics table displays with three radio buttons above it. You can select a radio button for:

•Viewing the VLAN Priority (COS) Statistics Current Rates Table.

•Viewing the VLAN Priority (COS) Statistics Top N Chart.

•Viewing the VLAN Priority (COS) Statistics Cumulative Data Table.

Viewing the VLAN Traffic Statistics Current Rates Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The VLAN Traffic Statistics Current Rates table enables you to view various data collected for each VLAN ID. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the VLAN Traffic Statistics Current Rates table, click the Current Rates radio button.

The VLAN Traffic Statistics Table (Table 4-36) displays.

Table 4-36 VLAN Traffic Statistics Table

Field

Description

VLAN ID

VLAN ID number.

Packets/s

Number of packets collected per second over the last time interval.

Bytes/s

Number of bytes collected per second over the last time interval.

Non-Unicast Packets/s

Number of non-unicast packets collected per second over the last time interval.

Non-Unicast Bytes/s

Number of non-unicast bytes collected per second over the last time interval.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Reports from the VLAN Traffic Statistics Table

You can view reports directly from the VLAN Traffic Statistics table. Choose the VLAN ID you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected VLAN and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the VLAN Traffic Statistics Top N Chart

Note This section does not apply to NM-NAM and NME-NAM devices.

The Top N VLAN Traffic Statistics Chart enables you to view the various data collected for the top N VLAN IDs in a graphical format. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Top N VLAN Traffic Statistics chart:

Step 1 Click the TopN Chart radio button.

The Top N VLAN Traffic Statistics Chart (Figure 4-27)displays.

Figure 4-27 Top N VLAN Traffic Statistics Chart

1

Data source list.

3

Top N VLAN IDs.

2

Variable list.

4

Number of packets/bytes collected per second.

Step 2 Choose the data source from the Data Source list.

Step 3 Choose one of the following from the Variable list:

•Total Packets—Displays the number of total packets.

•Total Bytes—Displays the number of total bytes.

•Non-unicast Packets—Displays the number of non-unicast packets.

•Non-unicast Bytes—Displays the number of non-unicast bytes.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing VLAN Traffic Statistics Cumulative Data Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The VLAN Traffic Statistics Cumulative Data table enables you to view various data collected for each VLAN ID. The information displayed represents the total data collected since the collection was created or since the NAM was restarted.

To view the VLAN Traffic Statistics Cumulative Data table, click the Cumulative Data Table radio button.

The VLAN Traffic Statistics Cumulative Data Table (Table 4-37) displays.

Table 4-37 VLAN Traffic Statistics Cumulative Data Table

Field

Description

VLAN ID

VLAN ID number.

Packets

Total number of packets collected over the last time interval.

Bytes

Total number of bytes collected over the last time interval.

Non-Unicast Packets

Total number of non-unicast packets collected over the last time interval.

Non-Unicast Bytes

Total number of non-unicast bytes collected over the last time interval.

Tip To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the VLAN Priority (COS) Statistics Current Rates Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The VLAN Priority (COS) Statistics Current Rates table enables you to view user priority distributions per data source. The displayed information represents the data collected each second during the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the VLAN Priority (COS) Statistics Current Rates table:

Step 1 In the contents, click Priority (COS) Statistics.

The VLAN Priority (COS) Statistics Current Rates Table (Table 4-38) displays.

Table 4-38 VLAN Priority (COS) Statistics Current Rates Table

Field

Description

Priority

Value of the three bit user priority field encoded in the Tag Control Information field.

Packets/s

Number of packets collected on this priority level. Data is the rate per second over the last time interval.

Bytes/s

Number of bytes collected on this priority level. Data is the rate per second over the last time interval.

Step 2 Choose the data source to monitor from the Data Source list.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the VLAN Priority (COS) Statistics Top N Chart

Note This section does not apply to NM-NAM and NME-NAM devices.

The Top N VLAN Priority (COS) Statistics Chart enables you to view user priority distributions per data source in a graphical format. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Top N VLAN Priority (COS) Statistics chart:

Step 1 In the contents, click Priority (COS) Statistics.

Step 2 Click the TopN Chart radio button.

The Top N VLAN Priorities (COS) Statistics Chart(Figure 4-28) displays.

Figure 4-28 Top N VLAN Priorities (COS) Statistics Chart

1

Data Source list.

4

VLAN counter.

2

Variable list.

5

Number of packets/bytes collected per second.

3

Top N VLAN priorities.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose one of the following from the Variable list:

•Packets—Displays the number of packets.

•Bytes—Displays the number of bytes.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the VLAN Priority (COS) Statistics Cumulative Data Table

Note This section does not apply to NM-NAM and NME-NAM devices.

The VLAN Priority (COS) Statistics Cumulative Data table enables you to view user priority distributions per data source. The information displayed represents the total data collected since the collection was created or since the NAM was restarted. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the VLAN Priority (COS) Statistics Cumulative Data table:

Step 1 In the contents, click Priority (COS) Statistics.

Step 2 Click the Cumulative Data radio button.

The VLAN Priority (COS) Statistics Cumulative Data Table (Table 4-39)displays.

Table 4-39 VLAN Priority (COS) Statistics Cumulative Data Table

Field

Description

Priority

Value of the three bit user priority field encoded in the Tag Control Information field.

Packets

Total number of packets collected on this priority level.

Bytes

Total number of bytes collected on this priority level.

Step 3 Choose the data source to monitor from the Data Source list.

Tip To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing DiffServ Data

You can view the distribution of packets and bytes based on the Differential Services (DiffServ) data collected on the NAM.

Note DiffServ data is not available for local NetFlow devices. This is applicable to WS-SVC-NAM-1, and WS-SVC-NAM-2 devices.

To view DiffServ data:

Step 1 Click Monitor > DiffServ.

The DiffServ Traffic Statistics table displays with three radio buttons above it. You can select a radio button for:

•Viewing the DiffServ Traffic Statistics Current Rates Table.

•Viewing the DiffServ Traffic Top N Chart.

•Viewing the DiffServ Traffic Statistics Cumulative Data Table.

Step 2 To view the DiffServ data based on the application statistics, click Application Stats in the contents.

The DiffServ Applications Statistics table displays with three radio buttons above it. You can select a radio button for:

•Viewing the DiffServ Application Statistics Current Rates Table.

•Viewing the DiffServ Application Statistics Top N Chart.

•Viewing the DiffServ Application Statistics Cumulative Data Table.

Step 3 To view the DiffServ data based on the host statistics, click Host Stats in the contents.

The DiffServ Host Statistics table displays with three radio buttons above it.

You can select a radio button for:

•Viewing the DiffServ Host Statistics Current Rates Table.

•Viewing the DiffServ Host Statistics Top N Chart.

•Viewing the DiffServ Host Statistics Cumulative Data Table.

Viewing the DiffServ Traffic Statistics Current Rates Table

To view the DiffServ Traffic Statistics Current Rates table:

Step 1 In the contents, click Traffic Stats.

Step 2 Click the Current Rates Table radio button.

The DiffServ Traffic Statistics Current Rates Table (Table 4-40) displays.

Table 4-40 DiffServ Traffic Statistics Current Rates Table

Field

Description

Aggregation Group

Name of the aggregation group.

Packets/s

Total packets collected per second over the last interval.

Bytes/s

Total bytes collected per second over the last interval.

Step 3 Choose the data source and profile to monitor from the Data Source-Profile list.

Step 4 Enter the aggregation group to filter in the Aggregation text box, then click Filter.

The specified aggregation group displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing Real-Time Traffic Statistics from the DiffServ Traffic Statistics Table

You can view real-time traffic statistics in a graphical format for a specific aggregation group in the DiffServ Traffic Statistics table.

Choose the aggregation group from the table, then click Real-Time. The Real-Time Graph (Figure 4-20)displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-29 Real-Time Graph

Viewing Reports from the DiffServ Traffic Statistics Table

You can view reports directly from the DiffServ Traffic Statistics table. Choose the aggregation group you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the DiffServ Traffic Top N Chart

To view the DiffServ Traffic Top N chart:

Step 1 In the contents, click Traffic Stats.

Step 2 Click the TopN Chart radio button.

The Top N DiffServ Aggregation Group Chart (Figure 4-30) displays.

Figure 4-30 Top N DiffServ Aggregation Group Chart

1

Data Source-Profile list.

3

Variable list.

2

Top N aggregation groups.

4

Number of packets/bytes collected per second.

Step 3 Choose the data source and profile to monitor from the Data Source-profile list.

Step 4 Choose one of the following from the Variable list:

•Total Packets—Displays the number of total packets.

•Total Bytes—Displays the number of total bytes.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the DiffServ Traffic Statistics Cumulative Data Table

To view the DiffServ Traffic Statistics Cumulative Data table:

Step 1 In the contents, click Traffic Stats.

Step 2 Click the Cumulative Data radio button.

The DiffServ Traffic Statistics Cumulative Data (Table 4-41) displays.

Table 4-41 DiffServ Traffic Statistics Cumulative Data

Field

Description

Aggregation Group

Name of the aggregation group.

Packets

Total packets collected over the last interval.

Bytes

Total bytes collected over the last interval.

Step 3 Choose the data source and profile to monitor from the Data Source-profile list.

Step 4 Enter the aggregation group to filter in the Aggregation text box, then click Filter.

The specified aggregation group displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the DiffServ Application Statistics Current Rates Table

To view the DiffServ Application Statistics Current Rates table:

Step 1 In the contents, click Application Stats.

Step 2 Click the Current Rates Table radio button.

The DiffServ Application Statistics Current Rates (Table 4-42) table displays.

Table 4-42 DiffServ Application Statistics Current Rates

Field

Description

Protocol Name

Name of the monitored protocol.

Packets/s

Total packets collected per second over the last interval.

Bytes/s

Total bytes collected per second over the last interval.

Step 3 Choose the data source and profile to monitor from the Data Source-Profile list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 To view a specific protocol, enter the protocol in the Protocol text box, then
click Filter.

The specified protocol displays.

Tip•To view the full protocol name, move the cursor over the protocol name.

•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Displaying Application Conversation Details From Application Statistics Table

To view the Application Conversations details table, click the protocol name in the Protocol Name column. The Application Conversations Table (Table 4-43)displays.

Table 4-43 Application Conversations Table

Field

Description

Source

Source host address of the conversation.

Destination

Destination host address of the conversation.

Packets

Number of packets during the conversation.

Bytes

Number of bytes during the conversation.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing Real-Time Traffic Statistics from the DiffServ Application Statistics Table

You can view real-time traffic statistics in a graphical format for a specific application protocol in the DiffServ Application Statistics table.

Choose the application protocol from the table, then click Real-Time. The Real-Time Graph (Figure 4-20)displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-31 Real-Time Graph

Viewing Reports from the DiffServ Application Statistics Table

You can view reports directly from the DiffServ Application Statistics table. Choose the application protocol you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected application and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the DiffServ Application Statistics Top N Chart

To view the Top N DiffServ Application Statistics chart:

Step 1 In the contents, click Application Stats.

Step 2 Click the TopN Chart radio button.

The Top N DiffServ Application Statistics Chart (Figure 4-32) displays.

Figure 4-32 Top N DiffServ Application Statistics Chart

1

Data Source-Profile list.

4

Variable list.

2

Aggregation group list.

5

Total packets/bytes collected per second for each protocol.

3

Top N protocols sorted by color.

Step 3 Choose the data source to monitor from the Data Source list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 Choose one of the following from the Variable list:

•Total Packets—Sorts the addresses based on the number of total packets.

•Total Bytes—Sorts the addresses based on the number of total bytes.

Tip To turn off auto refresh, deselect the Auto Refresh check box.
To view the full protocol name, move the cursor over the protocol name

Viewing the DiffServ Application Statistics Cumulative Data Table

To view the DiffServ Application Statistics Cumulative Data table:

Step 1 In the contents, click Application Stats.

Step 2 Click the Cumulative Data radio button.

The DiffServ Application Statistics Cumulative Data Table (Table 4-44) displays.

Table 4-44 DiffServ Application Statistics Cumulative Data Table

Field

Description

Protocol Name

Name of the monitored protocol.

Packets

Total packets collected over the last interval.

Bytes

Total bytes collected over the last interval.

Step 3 Choose the data source and profile to monitor from the Data Source-Profile list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 To view a specific protocol, enter the protocol in the Protocol text box, then
click Filter.

The specified protocol displays.

Tip•To view the full protocol name, move the cursor over the protocol name.

•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Viewing the DiffServ Host Statistics Current Rates Table

To view the DiffServ Host Statistics Current Rates table:

Step 1 In the contents, click Host Stats.

Step 2 Click the Current Rates radio button.

The DiffServ Host Statistics Current Rates Table (Table 4-45) displays.

Table 4-45 DiffServ Host Statistics Current Rates Table

Field

Description

Address

Address of the host.

Type

Type of protocol monitored.

In Packets/s

Total number of input packets collected per second.

Out Packets/s

Total number of output packets collected per second.

In Bytes/s

Total number of input bytes collected per second.

Total Bytes/s

Total number of output bytes collected per second.

Step 3 Choose the data source and profile to monitor from the Data Source-Profile list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 To view a specific address, enter the address in the Address text box, then
click Filter.

The specified address displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Displaying Host Conversation Details From the DiffServ Host Statistics Table

To view the Host Conversations details table, click the address name in the Address column. The Host Conversations Table (Table 4-46)displays.

Table 4-46 Host Conversations Table

Field

Description

Source

Source host address of the conversation.

Application

The application protocol used on the conversation.

Destination

Destination host address of the conversation.

Packets

Number of packets during the conversation.

Octets

Number of octets during the conversation.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing Real-Time Data from the DiffServ Host Statistics Table

You can view real-time data in a graphical format for a specific host in the DiffServ Host Statistics table.

Choose the host from the table, then click Real-Time. The Real-Time Graph (Figure 4-20)displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-33 Real-Time Graph

Viewing Reports from the DiffServ Host Statistics Table

You can view reports directly from the DiffServ Host Statistics table. Choose the host you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected host and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the DiffServ Host Statistics Top N Chart

To view the DiffServ Top N Host Statistics chart:

Step 1 In the contents, click Host Stats.

Step 2 Click the TopN Chart radio button.

The DiffServ Top N Host Statistics Chart (Figure 4-34) displays.

Figure 4-34 DiffServ Top N Host Statistics Chart

1

Data Source-Profile list.

4

Variable list.

2

Aggregation group list.

5

Total packets/bytes collected per second for each address.

3

Top N host addresses sorted by color.

Step 3 Choose the data source and profile from the Data Source-Profile list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 Choose one of the following from the Variable list:

•Total Packets—Sorts the addresses based on the number of total packets.

•Total bytes—Sorts the addresses based on the number of total bytes.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the DiffServ Host Statistics Cumulative Data Table

To view the DiffServ Host Statistics Cumulative Data table:

Step 1 In the contents, click Host Stats.

Step 2 Click the Cumulative Data radio button.

The DiffServ Host Statistics Cumulative Data Table (Table 4-47) displays.

Table 4-47 DiffServ Host Statistics Cumulative Data Table

Field

Description

Address

Address of the host.

Type

Type of protocol monitored.

In Packets

Total number of packets received over the last time interval.

Out Packets

Total number of packets sent over the last time interval.

In Bytes

Total number of bytes received over the last time interval.

Out Bytes

Total number of bytes sent over the last time interval.

Step 3 Choose the data source to monitor from the Data Source list.

Step 4 Choose the aggregation group from the Aggregation list.

Step 5 To view a specific address, enter the address in the Address text box, then
click Filter.

The specified address displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To sort a table variable by percentage of the total, click on the column header. The variable is listed in descending order according to the percentage of the total.

Monitoring Response Time Data

Response time data provides TCP response time information for TCP protocols. NAM 3.6 provides network and application response time (ART) monitoring for the following:

•Server Application Response Time

•Server Network Response Time

•Server/Client Application Response Time

•Server/Client Network Response Time

To view response time data, click Monitor > Response Time.

Legacy Application Response Time Monitoring

In earlier NAM releases, ART measurements were taken between the switch and the server application as shown in Figure 4-35. This did not provide router end-to-end response times. To determine the network and application delay, you would have to deploy two NAMs, with one near the client and another near the server. Then you would have to correlate the data from the two NAMs.

Figure 4-35 NAM Legacy Application Response Time Measurements

NAM 3.6 Application Response Time Measurements

NAM 3.6 provides more visibility into ART and network latency. Table 4-48 defines the ART metrics measure by NAM 3.6 and shown in Figure 4-36.

Table 4-48 NAM 3.6 ART Metrics

ART Metric

Definition

Client Network Delay (CND)

CND is the network round trip time (or flight time) between a client and the NAM switch or router.

Server Network Delay (SND)

SND is the network round trip time (or flight time) between a server and the NAM switch or router.

Application Delay (AD)

AD is the time it takes a server application (for example, a web server application) to respond to a request. AD is the time between the client request arriving at the server application and the first response being returned by the application.

Network Delay (ND)

ND the network round trip (flight time) between a client and a server through the NAM switch or router. ND is equal to the sum of CND and SND.

Total Delay (TD)

TD is the total amount of time from the first packet of a client request until the client receives the first response packet from the application server. Total Delay (TD) is the sum of the Network Delay (ND) and the Application Delay (AD).

Transaction Time (TT)

TT is the total amount of time from the first packet of a client request until the client receives the final response packet from the server.

Figure 4-36 NAM 3.6 Application Response Time Measurements

Figure 4-37 Transaction Time versus Response Time Measurements

Server Application Response Time

The Server Application Response Time window displays by default when you click Monitor > Response Time. The All Data window also displays by default. You can also view the TopN Chart to view the most active network.

Viewing Server Application Response Time

The Server Application Response Time window provides a summary of the application response times (ART) per server application displaying the server IP address, application used, and minimum, average, and maximum response times for the following:

•Application delay

•Network delay

•Total delay

•Transaction time

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Figure 4-38 shows the Server Application Response Time Window.

Figure 4-38 Server Application Response Time Window

Viewing Server ART Details

To view details for a specific server, click the radio button in the Select column, then click Details. The Server ART Detail window displays. You can view detailed information from the server such as server network delay response time, a histogram, octet counts, and maximum and minimum values as well as a chart displaying the response time distribution.

Table 4-49 provides a detailed description of the fields of the Server Application Response Time Window.

Table 4-49 Server Application Response Time Details

Field

Description

Server

Name of server being measured

App

Application being used by server

# of Trans

Number of currently active transactions for this server.

Application Delay

This column displays the minimum, average, and maximum values of AD, the time it takes a server application (for example, a web server application) to respond to a request. AD is the time between the client request arriving at the server application and the first response being returned by the application.

Network Delay

This column displays the minimum, average, and maximum values of ND. ND the network round trip (flight time) between a client and a server through the NAM switch or router. ND is equal to the sum of CND and SND.

Transaction Time

This column displays the minimum, average, and maximum values of TT, the total amount of time from the first packet of a client request until the client receives the final response packet from the server.

Capturing Server ART Data

You can capture data from a specific server directly from the Server ART table.

Click the radio button in the Select column to choose the server from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

If a capture is already running, a message window displays. Click Yes to stop the current capture or No to disregard your selection.

The Capture button is only available for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Reports from the Server Application Response Time Window

You can view reports directly from the Server Application Response Time window. Choose the server you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected server and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Application Response Time TopN Chart

Click TopN Chart to view the most active network. To view the TopN Chart for Server Application Response Time:

Step 1 Click Monitor > Response Time.

The Server Application Response Time window displays.

Step 2 Click the TopN Chart radio button.

The Server Application Response Time Top N Chart (Figure 4-39) displays.

Figure 4-39 Server Application Response Time Top N Chart

1

Data Source list.

4

Protocol used by server.

2

Variable list.

5

Variable value displayed per second.

3

Top N server addresses sorted by color.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose the sorting option from the Variable list.

The specified option displays in the chart.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Server Network Response Time

The Server Network Response Time window shows the network connectivity and responsiveness between the server and the switch.

Figure 4-40 shows the Server Network Response Time Window.

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Figure 4-40 Server Network Response Time Window

Viewing Server Network Response Time Details

Table 4-50 provides a detailed description of the fields of the Server Network Response Time Window.

Table 4-50 Server Network Response Time Window Details

Field

Description

Server

Name of server being measured

App

Application being used by server

# of Clients

Number of clients attached to server

# of Conns

Number of active connections with the server

Server Net Delay (SND)

This column displays the minimum, average, and maximum values of SND. SND is the network round trip time (or flight time) between a server and the NAM switch or router.

Total Net Delay

This column displays the minimum, average, and maximum values of TD. TD is the total amount of time from the first packet of a client request until the client receives the first response packet from the application server. Total Delay (TD) is the sum of the Network Delay (ND) and the Application Delay (AD).

Octets

For server, number of octets (bytes) sent from the server to the client.

For client, number of octets (bytes) sent from the client to the server.

Capturing Data from the Server Network Response Time Window

You can capture data from a specific server directly from the Server Network Response Time window.

Click the radio button in the Select column to choose the server from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

If a capture is already running, a message window displays. Click Yes to stop the current capture or No to disregard your selection.

The Capture button is only available for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Reports from the Server Network Response Time Window

You can view reports directly from the Server Network Response Time window. Choose the server you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected server and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Server Network Response Time Top N Chart

Click TopN Chart to view the most active network. To view the TopN Chart for Server Application Response Time:

Step 1 Click Monitor > Response Time.

The Server Application Response Time window displays.

Step 2 Click Server Network in the menu area.

The Server Network Response Time window displays.

Step 3 Click the TopN Chart radio button.

The Server Network Response Time Top N Chart (Figure 4-41) displays.

Figure 4-41 Server Network Response Time Top N Chart

1

Data Source list.

4

Protocol used by server.

2

Variable list.

5

Variable value displayed per second.

3

Top N server addresses sorted by color.

Step 4 Choose the data source to be monitored from the Data Source list.

Step 5 Choose the sorting option from the Variable list.

The specified option displays in the chart.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Server/Client Application Response Time

The Server/Client ART window provides a summary of the server/client application response time data. You can select an entry in the window to view more detailed information.

Viewing the Server/Client Application Response Time

To view the Server/Client Application Response Time window:

Step 1 In the contents, click Server/Client Application.

Figure 4-42 shows the Server/Client Application Response Time window.

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Figure 4-42 Server/Client Application Response Time Window

The Client-Server Application Response Time Window (Table 4-51) displays.

Table 4-51 Client-Server Application Response Time Window

Field

Description

Server

Host address of the server.

Client

Host address of the client.

App

Application being used by server

# of Trans

Current number of transactions

Application Delay (AD)

This column displays the minimum, average, and maximum values of AD, the time it takes a server application (for example, a web server application) to respond to a request. AD is the time between the client request arriving at the server application and the first response being returned by the application.

Network Delay
(ND)

This column displays the minimum, average, and maximum values of ND, the network round trip (flight time) between a client and a server through the NAM switch or router. ND is equal to the sum of CND and SND.

Total Delay (TD)

TD is the total amount of time from the first packet of a client request until the client receives the first response packet from the application server. Total Delay (TD) is the sum of the Network Delay (ND) and the Application Delay (AD).

Transaction Time

This column displays the minimum, average, and maximum values of TT, the total amount of time from the first packet of a client request until the client receives the final response packet from the server.

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 Choose a variable to filter from the filter list.

Step 4 Enter the name of the variable to filter in the filter box, then click Filter.

The specified variable displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Viewing Server/Client Application Response Time Details

To view details for a specific client/server conversation, click the radio button in the Select column, and click Details. The Server/Client Response Time Detail window displays. You can view detailed information from the client/server conversation as well as a chart displaying the response time distribution.

Capturing Protocol Data from the Client/Server Application Response Time Window

You can capture data for a specific protocol directly from the Client/Server Response Time table.

Choose the server protocol from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

The Capture button is available only for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Reports from the Client/Server Application Response Time Window

You can view reports directly from the Client/Server Response Time table. Choose the protocol you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected client/server and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Client/Server Application Response Time Top N Chart

To view the Client/Server Response Time Top N chart:

Step 1 In the contents menu, click Client/Server Application.

Step 2 Click the TopN Chart radio button.

The Client/Server Application Response Time Top N Chart (Figure 4-43) displays.

Figure 4-43 Client/Server Application Response Time Top N Chart

1

Data Source list.

4

Top N clients sorted by color.

2

Variable list.

5

Protocol used for the conversation.

3

Top N servers sorted by color.

6

Variable value (per second) for each client/server conversation.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose the sorting option from the Variable list.

The specified option displays in the chart.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Server/Client Network Response Time

The Server/Client Network Response Time window shows information about network connectivity (also known as network flight time) between servers and clients.

Viewing the Server/Client Network Response Time

To view the Server/Client Network Response Time window:

Step 1 In the contents, click Server/Client Network.

Figure 4-42 shows the Server/Client Network Response Time window.

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Figure 4-44 Server/Client Network Response Time Window

Table 4-51 describes the fields of the Server/Client Network Response Time window.

Table 4-52 Server/Client Network Response Time Window

Field

Description

Server

Host address of the server.

Client

Host address of the client.

App

Application being used by server

# of Conns

Current number of connections

Client Network Delay

Minimum, average, and maximum values of time

Server Network Delay

Minimum, average, and maximum values of total network delay

Network Delay

Minimum, average, and maximum values of total network delay

Step 2 Choose the data source to be monitored from the Data Source list.

Step 3 Choose a variable to filter from the filter list.

Step 4 Enter the name of the variable to filter in the filter box, then click Filter.

The specified variable displays.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Viewing Server/Client Response Time Details

To view details for a specific client/server conversation, click the radio button in the Select column, and click Details. The Server/Client Response Time Detail window displays. You can view detailed information from the client/server conversation as well as a chart displaying the response time distribution.

Capturing Protocol Data from the Client/Server Application Response Time Window

You can capture data for a specific protocol directly from the Client/Server Response Time table.

Choose the server protocol from the table, then click Capture. The Packet Browser displays. For more information on viewing packets using the Packet Browser, see the "Viewing Detailed Protocol Decode Information" section.

The Capture button is available only for a subset of reported protocols. For protocols such as IP, IPv6, and GRE, you must set up a custom filter. For more information on setting up custom filters, see the "Creating Custom Capture Filters" section.

Note The Capture button is disabled for NetFlow-based data sources.

Viewing Reports from the Client/Server Response Time Window

You can view reports directly from the Client/Server Response Time table. Choose the protocol you wish to view a report on, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected client/server and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Client-Server Network Response Time TopN Chart

To view the Server/Client Network Response Time Top N chart:

Step 1 In the contents, click Client/Server.

Step 2 Click the TopN Chart radio button.

The Client/Server Network Response Time Top N Chart (Figure 4-43) displays.

Figure 4-45 Client/Server Network Response Time Top N Chart

1

Data Source list.

4

Top N clients sorted by color.

2

Variable list.

5

Protocol used for the conversation.

3

Top N servers sorted by color.

6

Variable value (per second) for each client/server conversation.

Step 3 Choose the data source to be monitored from the Data Source list.

Step 4 Choose the sorting option from the Variable list.

The specified option displays in the chart.

Tip•To turn off auto refresh, deselect the Auto Refresh check box.

•To view the full protocol name, move the cursor over the protocol name in the Protocol column of the table.

Viewing Port/Interface Statistics Data

To view the various data collected for the switch or router, click Monitor, then Switch or Router. The Port Stats or Interface Stats table displays with three radio buttons above it.

For Port Stats, you can click a radio button for:

•Viewing the Port Stats Current Rates Table.

•Viewing the Top N Port Stats Chart.

•Viewing the Port Stats Cumulative Data Table.

For Interface Stats you can click a radio button for:

•Viewing the Interface Stats Current Rates Table.

•Viewing the Top N Interface Stats Chart.

•Viewing the Interface Stats Cumulative Data Table.

Note For NM-NAM and NME-NAM devices, if you have set up Interfaces under Setup > Data Sources, you will be able to view hosts, conversations, and applications in the Details window.

Viewing the Port Stats Current Rates Table

The Port Stats Current Rates table enables you to view the various data collected for the switch. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

The Count Types drop down menu enables you to view the default Traffic Rates

To view the Port Stats Current Rates Table (Traffic Rates):

Step 1 Click the Current Rates Table radio button.

The Port Stats Current Rates Table (Traffic Rates) (Table 4-53) lists the fields displayed when the Count Type is set to Traffic Rates.

Table 4-53 Port Stats Current Rates Table (Traffic Rates)

Field

Description

Port Name

Port number.

Depending on the IOS running on the Supervisor, port names are displayed differently. Earlier versions of CatOS displayed port names as 2/1 and 3/1 meaning module 2, port 1 and module 3 port 1.

Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1.In the Virtual Switch software (VSS), a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

Utilization %

Utilization percentage of the port.

Bytes/s

Number of bytes collected on the port per second.

Packets/s

Number of packets collected on the port per second.

Broadcast Packets/s

Number of broadcast packets collected per second.

Multicast Packets/s

Number of multicast packets collected per second.

Errors

Number of all types of errors detected. See Table 4-54 for a list of all errors.

The Port Stats Current Rates Table (Error Rates) (Table 4-54) lists the fields displayed when the Count Type is set to Error Rates.

Table 4-54 Port Stats Current Rates Table (Error Rates)

Field

Description

Port Name

Port number

Depending on the IOS running on the Supervisor, port names are displayed differently. Earlier versions of CatOS displayed port names as 2/1 and 3/1 meaning module 2, port 1 and module 3 port 1.

Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1.In the Virtual Switch software (VSS), a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

Utilization %

Utilization percentage of the port

Dropped Events/s

Number of dropped events per second

CRC Align Errors/s

Number of CRC align errors collected per second

Undersize packets/s

Number of packets collected under 64 octets in length

Oversize Packets/s

Number of packets collected over 1518 octets in length

Fragments/s

Number of packets collected per second that were less than 64 octets in length and had bad a Frame Check Sequence (FCS)

Jabbers/s

Number of collected packets collected per second that were longer than 1518 octets in length and had a bad Frame Check Sequence (FCS)

Collisions/s

Number of collisions collected per second on the Ethernet segment

Note Table 4-53 and Table 4-54 are also valid for the Cumulative Data radio button.

Step 2 Enter the port name to filter in the Port Name text box, then press Filter.

The specified port name displays.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the Interface Stats Current Rates Table

The Interface Stats Current Rates table enables you to view the various data collected for the router. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Interface Stats Current Rates table:

Step 1 Click the Current Rates radio button.

The Interface Stats Current Rates Table (Table 4-55) displays.

Table 4-55 Interface Stats Current Rates Table

Field

Description

Interface

Interface number.

In % Utilization

Utilization percentage of the port.

Out % Utilization

Utilization percentage of the port.

In Packets/s

Number of packets collected per second.

Out Packets/s

Number of packets sent out per second.

In Bytes/s

Number of bytes collected per second.

Out Bytes/s

Number of bytes sent out per second.

In Non-Unicasts/s

Number of non-unicasts collected per second.

Out Non-Unicasts/s

Number of non-unicasts sent out per second.

In Discards/s

Number of discards collected per second.

Out Discards/s

Number of discards sent out per second.

In Errors/s

Number of errors collected per second.

Out Errors/s

Number of errors sent out per second.

Step 2 Enter the name of the to filter in the Filter text box, then click Filter.

The specified interface name displays.

Tips

•To turn off auto refresh, deselect the Auto Refresh check box.

Viewing Port/Interface Details

To view packet distribution details on a specific port or interface, click the number of the port in the Port Name column or the number of the interface in the Interface column. The detail window displays a chart that shows. the packet distribution per second on the specified port or interface.

Depending on the IOS running on the Supervisor, port names are displayed differently. Earlier versions of CatOS displayed port names as 2/1 and 3/1 meaning module 2, port 1 and module 3 port 1. Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1. In the VSS, a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

Note

Note For NM-NAM and NME-NAM devices, if you have set up an interface on the Setup > Data Source > Interface window, applications, hosts, and conversation TopN tables are displayed in the detail window.

Viewing Real-Time Traffic Data from the Port/Interface Stats Table

You can view real-time data in a graphical format for a specific switch port or interface in the Port Stats or Interface Stats table.

Choose the switch port or interface from the table, then click Real-Time. The Real-Time Graph(Figure 4-46) displays.

Note The Real-Time button is disabled for NetFlow-based data sources.

Figure 4-46 Real-Time Graph

Viewing Reports from the Port/Interface Stats Table

You can view reports directly from the Port Stats or Interface Stats table. Choose the switch port or interface for which to view a report, then click Report. The Basic Reports graph displays. If a report is not configured, the Basic Reports screen appears and a new report is created for the selected port and data source.

For more information on viewing and creating reports, see "Creating and Viewing Reports."

Viewing the Top N Port Stats Chart

The Port Stats Top N Chart enables you to view the various data collected for each port in a graphical format. The information displayed represents the data collected per second over the last time interval.

To view the Top N Port Stats chart:

Step 1 Click the TopN Chart radio button.

The Top N Port Stats Chart(Figure 4-47) displays.

Figure 4-47 Top N Port Stats Chart

1

Variable list.

3

Variable value (per second) for each switch port.

2

Top N switch ports.

Step 2 Choose one of the following from the Variable list:

•Utilization—Sorts the interface number based on the utilization percentage. If the utilization percentage is less than 0.1%, the percentage is displayed as 0.0% in the chart.

•Dropped Events—Sorts the interface number based on the number of dropped events.

•Bytes—Sorts the interface number based on the number of bytes.

•Packets—Sorts the interface number based on the number of packets.

•Broadcast Pkts—Sorts the interface number based on the number of broadcast packets.

•Multicast Pkts—Sorts the interface number based on the number of multicast packets.

•CRC Align Errors—Sorts the interface number based on the number of CRC Align errors.

•Undersize Pkts—Sorts the interface number based on the number of undersize packets.

•Oversize Pkts—Sorts the interface number based on the number of oversize packets.

•Fragments—Sorts the interface number based on the number of fragments.

•Jabbers—Sorts the interface number based on the number of jabbers.

•Collisions—Sorts the interface number based on the number of collisions.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the Top N Interface Stats Chart

The Interface Stats Top N Chart enables you to view the various data collected for each interface in a graphical format. The displayed information represents the data collected per second over the last time interval.

To view the Top N Interface Stats chart:

Step 1 Click the TopN Chart radio button.

The Top N Interface Stats Chart(Figure 4-48) displays.

Figure 4-48 Top N Interface Stats Chart

1

Variable list.

3

Variable value (per second) for each interface.

2

Top N interfaces.

Step 2 Choose one of the following from the Variable list:

•In Packets/s—Sorts the interface number based packets collected per second.

•Out Packets/s—Sorts the interface number based on the number of packets sent out per second.

•In Bytes/s—Sorts the interface number based on the number of bytes collected per second.

•Out Bytes/s—Sorts the interface number based on the number of bytes sent out per second.

•In Non-Unicast Pkts/s—Sorts the interface number based on the number of non-unicast packets collected per second.

•Out Non-Unicast Pkts/s—Sorts the interface number based on the number of non-unicast packets sent out per second.

•In Errors/s—Sorts the interface number based on the number of errors collected per second.

•Out Errors/s—Sorts the interface number based on the number of errors sent out per second.

•In Discards/s—Sorts the interface number based on the number of discards collected per second.

•Out Discards/s—Sorts the interface number based on the number of discards sent out per second.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the Port Stats Cumulative Data Table

The Port Stats Cumulative Data table enables you to view the various data collected for the switch. The information displayed represents the total data collected since the collection was created or since the NAM was restarted. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Port Stats Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The Port Stats Cumulative Data Table (Table 4-56) displays. When you select Traffic Rates, only the traffic data are shown along with a field for total errors. When you select Error Rates, the Port Name and Utilization fields are shown with fields for each error type. Choose All to view all traffic rates and all errors at once.

Table 4-56 Port Stats Cumulative Data Table

Field

Description

Port Name

Port number.

Depending on the IOS running on the Supervisor, port names are displayed differently. Earlier versions of CatOS displayed port names as 2/1 and 3/1 meaning module 2, port 1 and module 3 port 1.

Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1.In the VSS, a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

Utilization

Utilization percentage of the port.

Bytes

Number of bytes collected on the port.

Packets

Number of packets collected on the port.

Broadcast Packets

Number of broadcast packets collected.

Multicast Packets

Number of multicast packets collected.

Errors

Total of all errors

Note This field is shown only when you select Traffic Rates.

Dropped Events

Number of dropped events.

CRC Align Errors

Number of CRC align errors collected.

Undersize packets

Number of collected packets under 64 octets long.

Oversize Packets

Number of collected packets over 1518 octets long.

Fragments

Number of collected packets collected that were less than 64 octets long and had bad Frame Check Sequence (FCS).

Jabbers

Number of collected packets collected that were longer than 1518 octets long and had bad Frame Check Sequence (FCS).

Collisions

Number of collected collisions on the Ethernet segment.

Step 2 To refresh the data in the table, click Refresh.

Step 3 Enter the port name to filter in the Port Name text box, then press Filter.

The specified port name displays.

Viewing the Interface Stats Cumulative Data Table

The Interface Stats Cumulative Data table enables you to view the various data collected for the router. The displayed information represents the total data collected since the collection was created or since the NAM was restarted. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the Interface Stats Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The Interface Stats Cumulative Data Table (Table 4-57)displays.

Table 4-57 Interface Stats Cumulative Data Table

Field

Description

Interface

Interface number.

In Packets/s

Number of packets collected per second.

Out Packets/s

Number of packets sent out per second.

In Bytes/s

Number of bytes collected per second.

Out Bytes/s

Number of bytes sent out per second.

In Non-Unicasts/s

Number of non-unicasts collected per second.

Out Non-Unicasts/s

Number of non-unicasts sent out per second.

In Discards/s

Number of discards collected per second.

Out Discards/s

Number of discards sent out per second.

In Errors/s

Number of errors collected per second.

Out Errors/s

Number of errors sent out per second.

Step 2 To refresh the data in the table, click Refresh.

Step 3 Enter the interface name to filter in the Filter text box, then click Filter.

The specified interface name displays.

Viewing Interface Details

To view packet distribution details on a specific interface, click the interface number in the Interface column. The detail window displays with a chart that shows the total packet distribution on the specified interface.

Viewing System Health

You can use the NAM Traffic Analyzer to view system health data. To view system health data collected for the switch or router, choose Monitor > Router or Monitor > Switch then select Health from the Content Menu.

Depending on the type of device, one of the following windows displays:

•Switch Health

•Router Health

Switch Health

The Switch Health window is displays with a drop-down menu that provides the following options:

•Switch Health

•Switch Information

•Crossbar Switching Fabric

•Ternary Content Addressable Memory Information

Switch Health

The Switch Health window (Figure 4-49) displays two real-time graphs.

Figure 4-49 Switch Health Window

CPU usage within the last five seconds

CPU type

•Usage for last 1 minute (%)

•Usage for last 5 minutes (%)

Traffic Bandwidth

•Peak %

•Peak Time (For example: Mon October 1 2007, 15:26:55)

The Switch Health window also displays a matrix with the following information:

•Minor Alarm (on, off)

•Major Alarm (on, off)

•Temperature Alarm (on, off)

•Fan Status (other, ok, minorFault, majorFault, unknown)

Table 4-58 Switch Memory Information

Column

Description

Memory Type

Type of memory including DRAM, FLASH, NVRAM, MBUF, CLUSTER, MALLOC.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.

Switch Information

The Switch Information window (Figure 4-50) displays.

Figure 4-50 Switch Information Window

Table 4-59 Switch Information

Field

Description

Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Backplane

The chassis backplane type.

Supervisor Software Version

The full name and version identification of the system's software operating-system and networking software.

UpTime

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud rate

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown
ac
dc
externalPowerSupply
internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

1: normal
2: warning
3: critical
4: shutdown
5: notPresent
6: notFunctioning

Power Redundancy Mode

Power Redundancy Mode:

The power-supply redundancy mode.
1: not supported
2: redundant
3: combined

Power Total

Total current available for FRU usage.

When Redundancy Mode is redundant, the total current available will be the capability of a power supply with the lesser power capability of the two power supplies.

When Redundancy Mode is combined, the total current available will be the sum of the capacities of all operating power supplies.

Power Drawn

Total Current Drawn by powered-on FRUs.

Crossbar Switching Fabric

This option shows the Crossbar Switching Fabric information.

Table 4-60 Crossbar Switching Fabric Information

Field

Description

Crossbar Switching Fabric

Physical and configuration information about the module:

Active slot—Indicates the slot number of the active switching fabric module. A value of zero indicates that the active switching fabric module is either powered down or not present in the chassis.

Backup slot—Indicates the slot number of the backup switching fabric module. A value of zero indicates that the backup switching fabric module is either powered down or not present in the chassis.

Bus Only Mode Allowed—Determines the value of each module. If set to True, each and every module is allowed to run in bus-only mode. If set to False, none of the modules are allowed to run in bus-only mode. (All the non-fabric capable modules will be powered off.) Absence of fabric module results in all the fabric capable modules being powered off.

Truncated Mode Allowed—Indicates whether truncated mode is administratively enabled on the device or not.

Module Switching Mode

Indicates switching mode of the module:

busmode—Module does not use fabric. Backplane is used for both lookup and data forwarding.

crossbarmode—Module uses the backplane for forwarding decision and fabric for data forwarding.

dcefmode—Module uses fabric for data forwarding and local forwarding is enabled.

Module-Channel

Module slot number

Module-Status

Status of the fabric channel at the module

Fabric Status

Status of the fabric channel at the slot

Speed (MB)

Speed (MB/second) of the module

Module-Channel

Channel for the module

In Errors

The total number of error packets received since this entry was last initialized.

Our Errors

The total number of error packets transmitted since this entry was last initialized.

Dropped

The total number of dropped packets transmitted since this entry was last initialized.

In Utilization (%)

Input utilization of the channel for the module.

Our Utilization (%)

Output utilization of the channel for the module.

Ternary Content Addressable Memory Information

Shows the Ternary Content Addressable Memory (TCAM) (Figure 4-51) usage information. Table 4-61 lists and describes the TCAM information.

Figure 4-51 Ternary Content Addressable Memory Information

Table 4-61 Ternary Content Addressable Memory Information

Field

Description

Security Acl Mask

Indicates that TCAM space is allocated to store ACL masks.

Security Acl Value

Indicates that TCAM space is allocated to store ACL value.

Dynamic Security Acl Mask

Indicates that TCAM space is allocated to dynamically store ACL masks.

Dynamic Security Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Qos Acl Mask

Indicates that TCAM space is allocated to store QoS masks.

Qos Acl Value

Indicates that TCAM space is allocated to store QoS value.

Dynamic Qos Acl Mask

Indicates that TCAM space is allocated to dynamically store QoS masks.

Dynamic Qos Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Layer 4 Port Operator

Indicates that TCAM space is allocated for layer 4 port operators purpose.

Interface Mapping Module

Indicates that TCAM space is allocated for interface mapping purpose.

Router Health

If your device is a router, the Router Health window displays with a drop-down box that provides the following options:

•Router Health

•Router Information

Router Health

The Router Health window displays a real-time graph and out information about the health of a router as shown in Figure 4-52. Table 4-62 describes the contents of the Router Health window.

Figure 4-52 Router Health Window

Table 4-62 Router Health Information

Field

Description

CPU Usage (graph)

Overall CPU busy percentage in the last 5 second period

CPU Type

Describes type of CPU being monitored

Last 1 minute

Overall CPU busy percentage in the last 1 minute period.

Last 5 minutes

Overall CPU busy percentage in the last 5 minute period.

Temperature Description

Description of the test point being measured

Temperature Status

The current state of the test point being instrumented; one of the following are the states:

•Normal

•Warning

•Critical

•Shutdown

•Not Present

•Not Functioning

•Unknown

Failures

The failing component of the power supply being measured:

•None—No failure

•inputVoltage—Input power lost in one of the power supplies

•dcOutputVoltage—DC output voltage lost in one of the power supplies

•Thermal—Power supply thermal failure.

•Multiple—Multiple failures.

•Fan—Fan failure

•Overvoltage—Over voltage.

Memory Type

Type of memory including processor and I/O.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.

Router Information

The Router Information window(Figure 4-53) displays router information. Table 4-63 lists and describes the fields of the Router Information window.

Figure 4-53 Router Information Window

Table 4-63 Router Information

Field

Description

Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Supervisor Software Version

The full name and version identification of the system's software operating-system and networking software.

Up Time

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown
ac
dc
externalPowerSupply
internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

1: normal
2: warning
3: critical
4: shutdown
5: notPresent
6: notFunctioning

Viewing NBAR

You can use the NAM Traffic Analyzer to view Network Based Application Recognition (NBAR) data. To view the NBAR data collected for a switch or router, select Monitor > Router or Switch > NBAR.

Note

The NBAR Current Rates Table displays with three radio buttons above it.

You can click a radio button for:

•Viewing the NBAR Current Rates Table.

•Viewing the Top N NBAR Chart.

•Viewing the NBAR Cumulative Data Table.

Viewing the NBAR Current Rates Table

The NBAR Current Rates table enables you to view the protocol data collected for the device. The information displayed represents the data collected per second over the last time interval. For information on setting the time interval, see the "Setting Global Preferences" section.

To view the NBAR Current Rates table:

Step 1 Click the Current Rates radio button.

The NBAR Current Rates Table (Table 4-64) displays.

Table 4-64 NBAR Current Rates Table

Field

Description

Protocol/s

Protocol type.

In Packets/s

Number of packets collected per second.

Out Packets/s

Number of packets sent out per second.

In Bytes/s

Number of bytes collected per second.

Out Bytes/s

Number of bytes sent out per second.

In Bit rate/s

In bound bit rate per second.

Out Bit rate/s

Out bound bit rate per second.

Step 2 (Optional) Enter the protocol name to filter in the Filter text box, then click Filter.

The specified protocol displays.

Step 3 (Optional) Choose the interface name in the drop-down box.

The specified interface displays.

Step 4 (Optional) Choose a protocol and click Real-Time.

A Real-Time graph of the specified protocol displays.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the Top N NBAR Chart

The NBAR Top N Chart enables you to view the various data collected for each protocol in a graphical format. The information displayed represents the data collected per second over the last time interval.

To view the NBAR Top N chart:

Step 1 Click the TopN Chart radio button.

The Top N NBAR Chart(Figure 4-54) displays.

Figure 4-54 Top N NBAR Chart

1

Interface list (for example, Fa0/0)

3

Variable value (per second) for each protocol

2

Variable list (In Packets/s, Out Packets/s, In Bytes/s, Out Bytes/s, In Bit Rate, Out Bit Rate)

4

Top N protocols

Step 2 Choose an interface from the Interface list:

Step 3 Choose one of the following from the Variable list:

•In Packets/s—Sorts the interface number based on the number of in packets/s.

•Out Packets/s—Sorts the interface number based on the number of out packets/s.

•In Bytes/s—Sorts the interface number based on the number of in bytes/s.

•Out Bytes/s—Sorts the interface number based on the number of out bytes/s.

•In Bit Rate—Sorts the interface number based on the in bit rate.

•Out Bit Rate—Sorts the interface number based on the out bit rate.

Tip To turn off auto refresh, deselect the Auto Refresh check box.

Viewing the NBAR Cumulative Data Table

The NBAR Cumulative Data table enables you to view the various data collected for the switch or router. The information displayed represents the total data collected since the collection was created or since the NAM was restarted. For information on setting the time interval, see Setting Global Preferences.

To view the NBAR Cumulative Data table:

Step 1 Click the Cumulative Data radio button.

The NBAR Cumulative Data Table(Table 4-65) displays.

Table 4-65 NBAR Cumulative Data Table

Field

Description

Protocol

Name of protocol.

In Packets/s

Number of packets collected per second.

Out Packets/s

Number of packets sent out per second.

In Bytes/s

Number of bytes collected per second.

Out Bytes/s

Number of bytes sent out per second.

In Bit rate/s

In bound bit rate per second.

Out Bit rate/s

Out bound bit rate per second.

Step 2 (Optional) Enter the protocol name to filter in the Filter text box, then click Filter.

The specified protocol displays.

Step 3 (Optional) Choose the interface name in the drop-down box.

The specified interface displays.

Step 4 (Optional) Choose a protocol and click Real-Time.

A Real-Time graph of the specified protocol displays.

Viewing MPLS Traffic Statistics

When data packets containing MPLS tag are spanned to the NAM, the traffic can be monitored by the tag inside the data packet. This feature is especially useful in a network that deploys MPLS/VPN where each VPN is uniquely identified by an MPLS tag. When NAM encounters stacked MPLS tags, only the relevant inner-most tag is used for monitoring.

Viewing All Labels

To view MPLS traffic statistics, click Monitor > MPLS. The GUI displays the Current Rates Table, the default view. You can also choose two other display formats, the TopN Chart or Cumulative Data.

Figure 4-55 shows the MPLS Traffic Statistics display for all MPLS-tagged traffic received from the NAM data ports.

Figure 4-55 Viewing MPLS Traffic Statistics

Traffic Statistics per MPLS Tag

Like VLAN monitoring, you should be able to see traffic statistics broken down by tag. MPLS tagged traffic statistics can be monitored by the following:

•Total number of packets

•Total number of bytes

•Total number of non-unicast packets

•Total number of non-unicast bytes

Custom RMON Data Source

To enable RMON monitoring, you must first configure a data source. To enable monitoring of MPLS traffic, create a form of virtual interface to be tied to a particular MPLS tag. You can select a particular MPLS tag and create a custom data source for that tag.

Monitoring Application per MPLS Tag

After you create a custom data source, you can enable application monitoring on the data source. This capability gives you insight into the applications being carried using a particular MPLS tag.

Monitoring Host per MPLS Tag

After you create a custom data source, you can enable host monitoring on this data source. This capability gives you insight into the traffic being generated by hosts using a particular MPLS tag.

Monitoring Host Conversation per MPLS Tag

After you create a custom data source, you can enable application monitoring on this data source. This capability gives you insight into host conversations being carried using a particular MPLS tag.

Viewing VRF and VC Statistics

VRF and VC statistics are displayed in the same formatas shown in Figure 4-56.

Figure 4-56 VRF/VC Statistics

Table 4-66 explains the fields of the VRF/VC Statistics window.

Table 4-66 VRF/VC Statistics Window

Field

Description

VRF/VC Name

Name of the VRF or VC data source

InPackets

The number of packets received

In Bytes

The total number of bytes received

Out Packets

The total number of bytes delivered

Out Bytes

The number of packets delivered