User Guide for Campus Manager 3.0.1 (Voice Update)
Tracking Packet Flow Using Path Analysis
Download this chapter
Tracking Packet Flow Using Path AnalysisTracking Packet Flow Using Path Analysis
give_us_feedback

Table of Contents

Tracking Packet Flow Using Path Analysis
 Starting and Navigating in Path Analysis
 Using Path Analysis
 Path Analysis Concepts

Tracking Packet Flow Using Path Analysis

Path Analysis is an operations and diagnostic application that traces the connectivity between two specified points on your network.

Use Path Analysis to:

  • Analyze paths between two specified Layer 2 or Layer 3 devices using device host names or IP addresses, and show results visually in a network map, in a table, or in a textual "trace" display.
  • Highlight Layer 2 and/or Layer 3 paths on the topology view.
  • Display Layer 3 paths between two specified devices in the managed domain and, where possible, display the Layer 2 path between two specified end user hosts known to User Tracking.
  • Display information about interface properties such as Maximum Transmission Unit (MTU) size, speed, MAC address, and media type.
  • Display information about device properties such as node name, device type, chassis type, up-time, and one alias.
  • Trace the paths that take VoIP (Voice over IP) traffic takes on data networks.
  • Save and print path trace information.
  • Run CiscoView from devices displayed on the Path Analysis map.
  • Run Visual Switch Manager from Cisco 1900, 2900XL, and 3500XL devices displayed on the Path Analysis map.
  • Start Telnet (remote terminal) connections with the Cisco Systems Console from supported devices displayed on the Path Analysis map.

The following topics provide you with information about:

Starting and Navigating in Path Analysis

From the CiscoWorks2000 desktop, select Campus Manager > Path Analysis. The Path Analysis main window appears (see Figure 4-1). Refer to Table 4-1 for a description of the elements of the Path Analysis main window.


Figure 4-1   Path Analysis Main Window


Table 4-1  

Item Description Usage Notes

Menu Bar

Contains Path Analysis Commands

None.

Tool Bar

Provides quick access to frequently used menu options

None.

Endpoint Specification Panel

Contains fields for specifying the start and end points for a trace

You can specify a Cisco devices or end user stations.

Trace Results Tabbed Panel

Displays the results of the trace in Map, Trace, and Table format

Click on the desired tab to display the results in each format.

Status Bar

Displays informational, diagnostic, and warning messages.

A complete list of status bar messages appears in "Troubleshooting Campus Manager," "What do the status bar and alert box messages mean?"

Path Analysis Main Window Elements

Using Path Analysis

Table 4-2 lists the main tasks that you can perform using Path Analysis. All actions begin from the Path Analysis main window, unless otherwise noted.

Table 4-2   Main Path Analysis Tasks

Task Purpose Action

Discover the network for Path Analysis.

Use the Discover All function in Path Analysis to run ANI discovery, ping sweeps, and user and node acquisition to obtain information for Path Analysis to use to perform Layer 3 and Layer 2 traces.

Select Action > Discover All.

Modify the subnet mapping table.

Review previously supplied information and update it if necessary.

 1. Select Edit > Subnet Mapping.

2. Click Discover.

3. Modify desired information.

4. Click Apply.

Perform a trace between two end points.

Determine the path packets take from one device to another, including Layer 2 and Layer 3 devices.

 1. Enter IP addresses in the From and To fields.

2. Select Action > Start Trace.

Reverse a trace.

Check the reverse direction connectivity between two end points.

 1. Select Action > Reverse Trace Direction.

2. The IP addresses in the From and To fields are automatically reversed.

3. Select Action > Start Trace.

View the trace in a graphical map format.

Display a graphical representation of the path trace.

 1. Perform a path trace.

2. Click the Map tab.

View the trace in a command line output format.

Display the trace information as it would be shown on the device command line interface.

 1. Perform a path trace.

2. Click the Trace tab.

View the trace in a table format.

Display the trace information in tabular columns.

 1. Perform a path trace.

2. Click the Table tab.

Save a trace.

Save a trace and view it later.

 1. Select File > Save Trace As....

2. Enter a unique name for the trace in the label field.

3. Click OK.

View the path in Topology Services.

Display the path in the Topology Services network view.

 1. Launch Topology Services, if it is not already running.

2. Select Action > Highlight Devices in Map.

Launch CiscoView from Path Analysis.

Use CiscoView, a GUI-based device management application, to obtain dynamic status, statistics, and comprehensive configuration for Cisco internetworking devices.

Right-click a device icon in Map view to launch CiscoView for that device.

Perform a VoIP trace on a completed call.

Trace the paths that VoIP traffic for a completed call follows on your data network.

A completed call is a call that was answered and completed without error; therefore, a CDR exists for the call.

First you retrieve the CDRs that contain the data relevant to the call you are interested in, and then perform the trace based on the telephone numbers in the CDR.

 1. Select Voice Trace.

2. Click Find Call....

3. Select (or clear) the Match Calling Number check box to enable (or disable) filtering on the calling telephone number.

4. If the Match Calling Number check box is selected, enter the source telephone number in the Match Calling Number field.

5. Select (or clear) the Match Called Number check box to enable (or disable) filtering on the called telephone number.

6. If the Match Called Number check box is selected, enter the destination telephone number in the Match Called Number field.

7. Select (or clear) the Match Time Call Placed check box to enable (or disable) filtering on the time the call was placed.

8. If the Match Time Call Placed check box is selected, enter the time the call was placed.

9. Click Get Records.

10. Select the desired CDR.

11. Click Start Trace.

Perform traces:

  • To or from a gateway to Cisco CallManager server.
  • To or from an IP telephone to a Cisco CallManager.
  • To or from two end points for a call in progress.
  • To or from two end points for a potential call.

Trace the signaling path from a gateway or IP telephone to CCM if you are experiencing latency, dropped packets, jitter, or missing dial tone with IP phone functionality.

Trace a call in progress or a potential call to determine the most likely path using IP addresses rather than telephone numbers as the source and destination.

 1. Obtain IP addresses in User Tracking for the voice-enabled devices and gateways in your network, including IP phones and CCM.

2. In the Path Analysis main window, select Data Trace.

3. Enter the IP address for the gateway or IP phone in the From field.

4. Enter the IP address for CCM in the To field.

5. Click Start Trace.

Path Analysis Concepts

You should understand these concepts when using Path Analysis:

Path Analysis Requirements

There are four main components in Path Analysis as shown in Figure 4-2:

  • CiscoWorks2000 Client running Path Analysis
  • CiscoWorks2000 Server
  • Source of the path
  • Destination of the path

Path Analysis investigates and reports on Layer 3 and Layer 2 paths between a source and destination (Leg 3 in Figure 4-2). For Path Analysis to be able to perform this analysis on Leg 3, Legs 1 and 2 must be functional.

For the path between the client and server (Leg 1) to be functional, there must be problem-free communication between server and client. (For example, problematic communication results when a firewall exists between the client and server.)

For the path between the server and the source (Leg 2) to be functional, the following requirements must be met:

  • IP connectivity
  • SNMP communication
  • No routers configured to block source-routed IP packets. Make sure the router configuration does not contain the following statement:
no ip source-route
Note   By default, Cisco routers are configured to not block source-routed IP packets.

Figure 4-2   Path Analysis Components


For Layer 2 analysis to take place between the source and destination (Leg 3), the following conditions must be met:

  • Both ends of a Layer 3 hop are managed Cisco devices known to the Topology Services application (device is a green icon on the topology view) or end user stations known to the User Tracking application. A question mark icon (unknown or inaccessible device) on either end of the Layer 3 hop indicates that the previously mentioned prerequisites are not met.
  • All Cisco devices are running CDP.
  • Path Analysis supports Layer 2 tracing on Ethernet, Fast Ethernet, Gigabit Ethernet, and LAN Emulation networks. LAN Emulation support includes tracing on the path inside an ATM cloud. For this release, Path Analysis Layer 2 tracing does not support FDDI, Token Ring, and WAN interfaces or router bridge groups.
  • Subnet to VLAN/ELAN mappings (automatically discovered or manually provided through the editor) are correct and complete.
  • Connectivity information for the subnet in question is known to Topology Services.
  • VLAN configuration is one that is supported by Campus Manager. If VLANs are defined, there must be at least one VTP server per domain. If there are no VLANs, you do not need to have a VTP server.
  • The VLAN/ELAN information is known to Topology Services.
  • The Layer 2 path does not involve router bridging (bridge groups).
  • All Layer 2 devices are SNMP accessible.
    • Note   As a general rule, do not expect to see a Layer 2 path for every Layer 3 hop.

For Voice over IP (VoIP) tracing, CDR logging must be enabled on all Cisco CallManager servers.

Valid Data Path Trace End Points

You can select source and destination end points for a data path trace:

  • By entering a Domain Name System (DNS) name or IP address
  • By copying and pasting node names or IP addresses selected from Topology Services
  • By copying and pasting node names or IP addresses highlighted in User Tracking

A trace source end point must be inside the managed organization for accurate Path Analysis results, and can be either:

  • A device known to the ANI Server or User Tracking, such as a LAN switch, an ATM switch, a router, or a fast hub that supports Cisco Discovery Protocol (CDP)
  • An end user host discovered by User Tracking

A trace source end point must be a Cisco device for Layer 2 tracing. Layer 3 tracing supports any trace source end point inside the managed organization.

A trace source end point must be reachable from the CiscoWorks2000 server. If it is not reachable, an alert message appears. See the See the "What do the status bar and alert box messages mean?" section in section in "Troubleshooting Campus Manager."

A trace destination end point can be any IP address or DNS name on the Internet, including addresses outside the managed organization. But firewalls and devices along the path that do not support source-routed IP packets can prevent Path Analysis from completing a trace to its intended destination. Layer 2 tracing, where possible, occurs only inside the managed organization.

Note   Layer 3 tracing does not support PCs or workstations with more than one network adapter. In this release, Path Analysis does not support devices using the AppleTalk or IPX protocols.

It is possible to specify a source end point outside of the managed domain, but trace results from this usage might not be completely accurate. Therefore, Cisco Systems recommends against this usage.

Valid VoIP Trace End Points

You can trace the flow of packets for three types of VoIP telephone calls on your data network, and the the type of end points you specify depends on the type of call you are interested in (see Table 4-3).

Table 4-3   Types of VoIP Telephone Calls

Type of Call Description Trace Methods

Completed call

Telephone call that has occured and completed. Call Detail Records (CDRs) exist only for completed calls.

Trace as voice data, using the telephone number of the called (destination end point) telelphone.

Call in progress

Telephone call that has begun, but has not yet concluded.
  • Obtain IP addresses in User Tracking for the voice-enabled devices and gateways in your network.
  • Trace the packets as standard data (select Data Trace), using end point IP addresses.
  • Do not use telehone numbers. (No CDRs exist for a call in progress.)

Potential call

Telephone call that has not occured, but might occur in the future.
  • Obtain IP addresses in User Tracking for the voice-enabled devices and gateways in your network.
  • Trace the packets as standard data (select Data Trace), using end point IP addresses.
  • Do not use telehone numbers. (No CDRs exist for a call in progress.)

Call Detail Records and VoIP Tracing

Call Detail Records (CDRs) exist only for completed calls (calls that have occured and have been successfully completed). CDRs contain the called and calling telephone numbers, which are required to perform a voice trace.

To find the required CDRs, you can filter your search criteria by any combination on the following three filters available in the Voice Trace Query window:

  • Called Time—the approximate time at which the call began and time zone. When you enable Called Time filtering, you include among your CDR search the time at which you have specified that the call occurred.
  • Called Number—all or part of the telephone number for which the call was intended (destination end point). Complete telephone numbers narrow the search; incomplete telephone numbers broaden it. When you enable Called Number Filtering, you include among your CDR search criteria the destination end point to which the call was directed.
  • Calling Number—all or part of the telephone number from which the call took place. The Calling Number value is an unreliable source of information and might not provide valid matches to your query. Therefore, data entry in the Calling Number field is disabled by default.

If your search query proves too broad to produce the desired results, you can narrow your search by providing a Calling Number value. When you enable Calling Number Filtering, you include among your CDR search criteria the source end point to which the call was directed.

Call Detail Record (CDR) results appear in the large white space within the Voice Trace Query window. This area contains a collapsable tree display of CDRs received from the server.

You can expand a CDR to display additional information about the segment, such as the date and time of the call, the IP address of the VoIP device, the port, and the cause of termination. Information in the tree view allows you to confirm you have found the correct CDR before you start to trace the path between the end points.

Layer 3 Paths

The Layer 3 path is the logical path on the network that packets follow through Cisco devices such as routers. Layer 3, known also as the network layer, represents the logical network, the network at the Internet Protocol (IP) level. Layer 3 path displays the end points and routers on the network.

Layer 3 output from Path Analysis is similar to the output of the UNIX and Windows NT traceroute command, but is more detailed.

Path Analysis supports only the IP protocol at this time. AppleTalk and IPX are not supported.

Layer 3 tracing does not support PCs or workstations with more than one network adapter.

Layer 2 Paths

The Layer 2 path is the physical path on the network that packets follow through Cisco devices.

The Layer 2 path includes devices that are either Simple Network Management Protocol (SNMP) accessible and known through Topology Services, or are SNMP inaccessible but have been discovered by User Tracking (for example, end user hosts).

The Layer 2 path provides further resolution of the Layer 3 path, but is not necessarily a complete representation of all Layer 2 devices. For example, hubs or other devices that do not support the Cisco Discovery Protocol (CDP) do appear in the Layer 2 traces.

Path Analysis uses Asynchronous Network Interface (ANI) information to build Layer 2 paths, combining:

Path Analysis supports Layer 2 tracing on Ethernet, Fast Ethernet, Gigabit Ethernet, and LAN Emulation networks. LAN Emulation support includes tracing on the path inside an ATM cloud. For this release, Path Analysis Layer 2 tracing does not support FDDI, Token Ring, and WAN interfaces or router bridge groups.

Note   As a general rule, do not expect to see a Layer 2 path for every Layer 3 hop.

Shortcuts

Shortcut connections occur in the Layer 2 path where packets are IP-switched after the router has determined the next-hop destination.

Shortcuts appear in the Layer 2 path as connections between switch ports, which bypass intervening routers. Currently, the only shortcuts reported are those provided by the Cisco Catalyst 5000 switches.

You can recognize shortcuts in the Map display in one of two ways:

  • Where shortcutting exists and the Layer 2 path is known, the shortcutting switches are highlighted in blue and connected by an arrow.
  • Where shortcutting exists but the complete Layer 2 path is unknown, the recognized shortcutting switch is highlighted in blue.

Subnet to VLAN/ELAN Mapping

The VLAN/ELAN Subnet Mapping Table displays VLAN, ELAN, and associated subnet mappings. This information can be useful when performing Layer 3 traces and is required in order to perform Layer 2 traces.

You should view the VLAN/ELAN Subnet Mapping Table during the initial setup of Path Analysis and whenever your subnet mapping changes. To view the table, select Action > Subnet Mapping. The VLAN/ELAN Subnet Mapping Table window appears, similar to the one shown in Figure 4-3. If you need to, you can add or delete entries in the table, or discover a fresh set of information.


Figure 4-3   VLAN/ELAN Subnet Mapping Table


On a typical network, information displayed in the table is discovered automatically by the Path Analysis application. It is therefore unlikely that you would need to insert additional entries manually.

The first three columns in the VLAN/ELAN Subnet Mapping Table contain text that cannot be edited. The column headings are Entry Type, VTP Domain/ATM Fabric, and VLAN/ELAN. You can edit the text in any Subnet column.

One of three font styles is used to render information in a cell. The use of a particular font conveys information about the source and validity of a mapping:

  • Black, plain text indicates an automatically discovered mapping that is known to the system.
  • Blue, italic text indicates a manually provided mapping that is unknown to the system.
  • Red, bold type indicates invalid information (for example, bad syntax).
    • Note   You must click Apply for any changes to take affect on the server. No changes take affect on the server until you click Apply.

To verify whether you must enter information manually, click Clear, and then Discover to see the automatically discovered mapping of subnets to VLANs or ELANs, as well as subnets that do not map to any VLAN or ELAN. If you know the information is incomplete, you must enter the missing information manually.

The results of automatic discovery might vary slightly over time, even if the structure of your network is unchanged. If you obtain a complete set of information using discovery, you might want to apply that information to the server, in case subsequent discoveries are incomplete.

Note   If you remove a VLAN/ELAN from your network, you must remove the corresponding information from the table.

VLAN/ELAN Subnet Mapping Table and Layer 2 Tracing

There are three types of entries in this table: VLAN, ELAN, and Subnet. For each VLAN or ELAN entry in the table, the user can specify the subnets that reside on that VLAN/ELAN. If this information is not provided manually and cannot be discovered automatically, Layer 2 tracing cannot occur on that subnet.

Therefore, you should check the automatically discovered values following an installation, and enter any needed information. If information is missing from the VLAN/ELAN mapping table, no Layer 2 traces are performed on those subnets with missing mapping information.

The following conditions are acceptable mappings:

  • A VLAN/ELAN is not to be mapped to a subnet if that is the actual case in the network. This can occur, for example, when a VLAN or ELAN is used for non-IP traffic.
  • A VLAN/ELAN is mapped to more than one IP subnet. This is not a common configuration, but does occur occasionally in some networks.
  • A single subnet is mapped to multiple VLAN/ELAN entries. This occurs when you have multiple VLANs and ELANs bound together to form a larger LAN that corresponds to a subnet.

VLAN/ELAN Subnet Mapping Table and Layer 3 Tracing

Layer 3 path tracing uses the Subnet Mapping Table in a limited way.

Successful Layer 3 tracing requires that all subnets within the managed domain are listed in one of the table rows.

Use this information to identify non-Cisco or non-Cisco Discovery Protocol (CDP) devices. These are devices that are not discovered or displayed in Topology Services views.

Layer 3 traces would generally access these devices through SNMP unless they reside on a known, managed subnet within the organization. Layer 3 path traces determine whether these devices are on a known, managed subnet by referencing them to the VLAN/ELAN Mapping Table.

If a subnet has no entry in the table, there will be no SNMP information in the table view or outgoing interface information for the non-Cisco or non-CDP devices on that subnet. Layer 3 path traces will function properly in all other respects, however.

The Entry Type column shows three types of entries: Vlan, Elan, and Subnet.

If the Entry Type column shows Vlan or Elan, subnets for corresponding VLANs or ELANs are listed in the Subnet column(s) for that row.

If the Entry Type column shows Subnet, the stand-alone subnet (one that does not map to a VLAN or ELAN) appears in the first Subnet column for that row. Do not add entries in the Subnet column for stand-alone subnets.