Cisco Services Modules

Cisco Branch Routers Series Network Analysis Module 4.2

  • Viewing Options

  • PDF (1.0 MB)
  • Feedback

Today's enterprises heavily rely on applications for communication, collaboration, and effective day-to-day operations. At the same time, IT is being challenged to manage application delivery in a rapidly changing environment. The number of employees is growing at branch and remote offices, application architectures are increasing in complexity, application traffic is proliferating, and traffic patterns are becoming difficult to predict. Further, driven by security, regulatory, and economic considerations, enterprises are embracing server consolidation, desktop virtualization, and network and application convergence to maximize the value of their IT investments. With this confluence of new business demands, comprehensive application and network visibility is no longer simply nice to have. This visibility is now essential in helping make branch and remote offices more productive, more collaborative, and more operationally efficient.

Cisco ® Network Analysis Module (NAM) is a powerful network-aware performance monitoring and troubleshooting solution that delivers unparalleled visibility into application and network performance to help meet application delivery challenges head on and ensure an exceptional end-user experience.

Product Overview

Cisco Branch Routers Series Network Analysis Module (Figure 1) combines performance monitoring, traffic analysis, and advanced troubleshooting to meet the performance management needs of today's dynamic, evolving enterprises. It is designed to provide deeper insight into the branch both at the network and application levels. It offers real-time visibility into the applications running on the network, how the network resources are being utilized, and how the end users experience the services being delivered in Cisco Borderless Access networks. The visibility enables IT to effectively use control and optimization mechanisms, such as quality of service (QoS) and Wide Area Application Services (WAAS), to improve performance of these services.

Figure 1. Cisco Branch Routers Series NAM, NME-NAM

The unique design of Cisco Branch Routers Series NAM brings together a rich set of embedded data collection capabilities and performance analytics with a remotely accessible, web-based management console, all of which reside on a single network module that is installed into Cisco 3900 Series, Cisco 2900 Series, Cisco 2800 Series or Cisco 3800 Series Integrated Services Routers, or Cisco 3700 Series Multiservice Access Routers.
Cisco Branch Routers Series NAM directly monitors and analyzes the WAN data streams using Cisco Express Forwarding to copy the actual packets traversing the router interfaces to the internal NAM interface. The direct access to the data path from inside the routers gives Cisco NAM the advantage in providing granular packet-level analytics to accurately characterize application performance and quality of experience. Cisco NAM also uses Cisco IOS ® Software features, such as Cisco NetFlow, from both local and remote routers and switches to provide insight into network traffic in Cisco Borderless Access networks.
Cisco NAM includes an embedded, web-based Traffic Analyzer GUI, which provides quick access to the configuration menus and application performance views for voice, video, and TCP-based applications. Figure 2 highlights the deployment of Cisco Branch Routers Series NAM, Cisco Catalyst ® 6500 Series NAM, Cisco NAM Appliance, and the new Cisco Nexus 1000V NAM Virtual Service Blade offering the deployment flexibility and comprehensive visibility required to deliver consistent performance levels across the network. As illustrated in the figure, Cisco NAM deployed in the branch provides end-to-end visibility for branch-to-branch applications, such as voice, and for TCP-based applications hosted in the data center.

Figure 2. Cisco NAM Offers Deployment Flexibility to Enable Performance Visibility across Cisco Borderless Network

Features and Benefits

Intelligent Application Performance Analytics

Cisco Branch Routers Series NAM provides comprehensive intelligent application performance (IAP) measurements to accurately characterize end-user experience. It analyzes the TCP-based client/server messages to provide transaction and session-based statistics. Intelligence derived from integrated application and network visibility helps to isolate application problems to the network, the application, or the server. It also helps to quickly analyze the root cause and resolve problems minimizing any impact to the end users.
The Cisco NAM GUI allows network administrators to correlate the end-user experience with network performance metrics, such as network delay, round-trip time, retransmission time, and so on, to identify the cause of degradation. For example, the source of network latency affecting the end-user experience can be identified by analyzing network delay metrics, namely client network delay, server network delay, and network delay. Similarly, server resource issues can be identified by network metrics such as application delay and server response time.
Figure 3 provides an example of the application response time report for an HTTP application. The report shows reduction in the application delay after the administrator restarted a hung process on the application server.

Figure 3. Troubleshooting Response Time in Cisco Borderless Access Networks

The application performance data can also be analyzed over time to identify trends, track service-level objectives, and establish meaningful thresholds to receive proactive actionable alerts. Thus, degradations in application performance can be preempted, and the underlying cause can be promptly investigated and resolved before it affects the end user. The changes in network and application usage can also be correlated with fluctuations in response times. The capability allows administrators to assess and predict the impact of new application rollouts, WAN optimization, or changes in user populations on application performance.

Visibility into WAN-Optimized Networks

Cisco Wide Area Application Services is a powerful application acceleration and WAN optimization solution that optimizes the performance of TCP-based applications operating in a WAN environment. This optimization allows IT organizations to consolidate costly branch-office servers and storage in centrally managed data centers and to deploy new applications directly from the data center while offering LAN-like application performance for any employee, regardless of location.
In a typical WAN-optimized deployment, the interception of application traffic obscures the response time, data transfer time, and other performance metrics; hence the traditional monitoring techniques fail to accurately characterize the impact of optimization.

Figure 4. Assessing the Impact of WAAS Optimization

Cisco Branch Routers Series NAM uses the built-in instrumentation on the Wide-Area Application Engine devices as additional data sources to gather flow data for optimized and passthrough traffic to provide end-to-end application performance visibility in a WAAS environment. It measures and reports on application response time, transaction time, bandwidth usage, and LAN/WAN data throughput among other performance metrics. As a result, it can accurately quantify the impact of WAAS optimization as illustrated in Figure 4.
Cisco NAM can also help to assess which applications would benefit the most from deploying WAN optimization and application acceleration services. Analyzing the response time data over a period of time, the administrator can identify the applications where the response time improvement can be significant with an increase in available bandwidth. In addition, understanding the traffic mix provides a sense of how much compression could be achieved with WAAS based on the type of applications in the mix.
Finally, Cisco NAM can be used to provide real-time visibility for ongoing optimization improvements, to monitor optimized and nonoptimized applications, and to troubleshooting any performance degradation issues.

Superior Voice Quality Monitoring

Cisco NAM offers real-time voice quality monitoring using Mean Opinion Score (MOS) and key performance indicators such as jitter and packet loss. It calculates MOS based on R-Factor (ITU-T G.107 Recommendations). It also integrates with Cisco Unified Communications Management Suite to deliver an enterprisewide voice management solution. Cisco NAM offers scalable and flexible deployment options complementing Cisco Unified Communications Management Suite with networkwide visibility allowing enforcement of end-to-end service-level objectives.
Figure 5 presents the last 60-minute view summarizing the voice quality for the active calls. The interface allows the user to filter the data by quality grade (Poor, Fair, Good, Excellent) and identify any anomalous behavior.

Figure 5. Monitoring Voice Quality (MOS) for Active Calls

Cisco NAM combines superior voice characterization with real-time troubleshooting capabilities to help improve the quality of voice services delivered to the end user. It can generate proactive alerts to notify of possible voice quality degradations. Acting on the alerts, the administrator can rapidly pinpoint the degraded voice stream and correlate it with network performance indicators such as jitter and packet loss to analyze the underlying cause. Voice performance issues can be further investigated using the traffic analysis capabilities of Cisco NAM. The administrator can use Cisco NAM's DiffServ monitoring capabilities (Figure 6) to monitor traffic by differentiated services code point (DSCP) allocations defined by QoS policies. This allows administrators to detect whether voice is misclassified or whether non-business-critical traffic is contending with voice for network resources, hence affecting voice quality.

Figure 6. Analyzing QoS Using DSMON

WAN Usage Monitoring at the Application Level

One of the foundations of Cisco NAM is its ability to look inside the live packet to gather information on applications, hosts, and conversations. Application monitoring identifies every application that has consumed bandwidth, reports how much bandwidth has been consumed, and detects which hosts are using which applications. Host and conversation-pair monitoring provides bandwidth consumption per host and shows which hosts are talking to each other along with the amount of traffic each host is generating. Monitoring applications, hosts, and conversations can help to proactively spot bottlenecks before the network suffers blows to performance and availability. It can also help improve WAN traffic performance, since these metrics reveal usage patterns for users as well as for router and switch, interface, server, and application resources.
Besides delivering a real-time snapshot of bandwidth usage and consumption, Cisco NAM also delivers a continuous historical view of how the bandwidth was used so the network administrator can quickly decide when and where to make changes in network resources. As an example, Figure 7 presents the report highlighting the applications utilizing the most bandwidth. Data can also be collected over a select period of time and then analyzed after the event to discover when an anomaly has occurred so it can be quickly resolved.

Figure 7. Identifying the Top Applications

Advanced Troubleshooting

On detecting degradation in performance, Cisco NAM can automatically trigger packet capture to help investigate and analyze the root cause. Captures can be performed using a web browser from any desktop, and packet decodes can be viewed through the Traffic Analyzer GUI. Cisco NAM capture and decode capability provides depth and insight into data analysis using trigger-based captures, filters, decodes, and a capture analysis toolset to quickly pinpoint and resolve problem areas (Figure 8).

Figure 8. Capturing and Decoding Packets with Cisco Branch Routers Series NAM

Analyzing Quality of Service

Cisco NAM supports both the planning and management of quality of service deployments for voice, video, and other critical IP-based services. It supports the Differentiated Services Monitoring (DSMON) MIB, which monitors traffic by DSCP allocations defined by QoS policies. Using the Cisco NAM DiffServ monitoring capabilities, applications, hosts, and conversations participating in each grouping of DiffServ classes can be identified. This information can be used to validate and tune planning assumptions and QoS allocations. It can also be used to detect incorrectly marked or unauthorized traffic.

Bring It All Together Your Way

As flexible advanced Cisco instrumentation, the Cisco NAMs can export computed NAM data to third-party and homegrown applications to meet end-to-end performance reporting needs. The application performance overview provided by these reporting applications can complement the granular performance visibility offered by Cisco NAMs to help enable you to monitor how applications are being delivered enterprisewide, yet isolate and resolve delivery problems proactively and promptly at their source.

Supported Router Platforms

The Cisco Branch Routers Series NAM, models NME-NAM-80S and NME-NAM-120S, can be deployed in any network module slot in the Cisco router platforms indicated in Table 1. An NM Adapter Card is required to successfully integrate the NME-NAM into supported ISR G2 platforms. The NME-NAM supports the router platforms with NAM software version 3.6.1b or later. Only one Cisco NAM can be installed in each Cisco branch router.

Table 1. NME-NAM Supported Router Platforms

Router Platform

Minimum IOS Version Required

NM Adapter Card Required

Cisco 3945 ISR

Cisco IOS Software 15.0(1)M


Cisco 3925 ISR

Cisco IOS Software 15.0(1)M


Cisco 2951 ISR

Cisco IOS Software 15.0(1)M


Cisco 2921 ISR

Cisco IOS Software 15.0(1)M


Cisco 2911 ISR

Cisco IOS Software 15.0(1)M


Cisco 3845 ISR

Cisco IOS Software 12.4(9)T


Cisco 3825 ISR

Cisco IOS Software 12.4(9)T


Cisco 2851 ISR

Cisco IOS Software 12.4(9)T


Cisco 2821 ISR

Cisco IOS Software 12.4(9)T


Cisco 2811 ISR

Cisco IOS Software 12.4(9)T


Cisco 3745 MSR

Cisco IOS Software 12.4(9)T


Cisco 3725 MSR

Cisco IOS Software 12.4(9)T


Cisco Branch Routers Series NAM Software License Options

Cisco NAM offers two license options for monitoring voice traffic. One license allows the monitoring of 50 voice (RTP) streams; the other, the monitoring of 100 voice streams. Both license options are supported on Cisco Branch Routers Series NAM, NME-NAM-120S.

Product Specifications

Table 2 provides the specifications for Cisco Branch Routers Series NAM.

Table 2. Product Specifications



Hardware Architecture

1.0 GHz Intel Celeron M CPU with 1 GB RAM and a 120 GB hard disk drive

Monitoring Interfaces

Two monitoring interfaces: One internal backplane interface for receiving a copy of LAN or WAN traffic through a special packet-monitoring feature in the router's Cisco IOS Software and one external Gigabit Ethernet interface for receiving traffic directly from local or remote LAN ports. Either can be used for management traffic and for receiving NetFlow data.


Using the internal monitoring interface, traffic monitoring throughput of up to 100 Mbps has been benchmarked for the NME-NAM-120S installed in Cisco 3900 Series and Cisco 3800 Series Integrated Services Routers, and up to 45 Mbps in Cisco 2900 Series and Cisco 2800 Series Integrated Services Routers. The external monitoring interface has been benchmarked to support up to 200 Mbps throughput monitoring. Your monitoring performance may differ based on factors such as packet size, traffic burstiness, collections enabled on the NAM, and features enabled on the router. Contact your Cisco sales representative to obtain further information about NME-NAM-120S performance characteristics.

Topologies and Data Sources: WAN

Packets on WAN interfaces are copied by a special packet-monitoring feature in Cisco IOS Software using Cisco Express Forwarding and sent to Cisco NAM through the internal backplane interface for analysis at the IP layer and up. NetFlow (versions 1, 5, 6, 7, 8, and 9) data from local and remote devices is sent through the internal or external interface.

Topologies and Data Sources: LAN

An external Gigabit Ethernet interface receives packets directly from local and remote LAN ports. NetFlow (versions 1, 5, 6, 7, 8, and 9) data from local and remote devices is sent through the internal or external interface.

Interfaces and External Applications

HTTP and HTTPS with the embedded web-based NAM Traffic Analyzer

Simple Network Management Protocol (SNMP) versions 1 and 2c with other standards-based applications

NAM Traffic Analyzer

• Embedded in Cisco NAM Software 4.2
• Web-based: Requires Microsoft Internet Explorer 7.0 or Firefox 3.0; supports both English and Japanese versions of browsers
• Supports Secure Sockets Layer (SSL) security with up to 256-bit encryption
• Role-based user authorization and authentication locally or using TACACS+
• Real-time and historical statistics (up to 100 days) on LAN and WAN traffic and network-based services

Cisco NAM Software 4.2

Supports Cisco Branch Routers Series NAM, NME-NAM-120S and NME-NAM-80S


Cisco NAM is standards compliant and supports Remote Monitoring (RMON) and RMON2 MIBs as well as several extensions; major MIB groups supported in the Cisco NAM are:

• MIB-II (RFC 1213)
• RMON (RFC 2819)
• RMON2 (RFC 2021)
• DSMON (RFC 3287)
• HC-RMON (RFC 3273)
• NBAR-Protocol Directory
• Application Response Time


Cisco NAM provides RMON2 statistics on several hundred unique protocols, including those defined in RFC 2896 and several Cisco proprietary protocols.

Automatically detects unknown protocols.

Users have the flexibility to customize the protocol directory by defining protocols on a single port or on a range of ports.

Supports protocols discovered using Cisco NBAR-PD MIB in Cisco IOS Software (requires Cisco IOS Software Release 12.3(7)T or later).

Protocols supported include (this list is not all-inclusive):

• TCP and User Datagram Protocol (UDP) over IP including IPv6
• Voice over IP (VoIP) including Skinny Client Control Protocol (SCCP), Real Time Protocol/Real Time Control Protocol (RTP/RTCP), Media Gateway Control Protocol (MGCP), and Session Initiation Protocol (SIP)
• Mobile IP protocols including GPRS Tunneling Protocol (GTP)
• Storage area network (SAN) protocols including Fibre Channel over TCP/IP
• AppleTalk, DECnet, Novell, Microsoft
• Database protocols, including Oracle and Sybase
• Peer-to-peer protocols such as Gnutella, FastTrack, and WinMX
• Bridge and router protocols
• Cisco proprietary protocols such as Cisco Discovery Protocol
• Unknown protocols by TCP/UDP ports, Remote Procedure Call (RPC) program numbers, and so on

Physical Dimensions

Dimensions (H x W x D): 1.55 x 7.10 x 7.2 inches (3.9 x 18.0 x 18.3 centimeters)

Weight: 1.5 pounds (0.7 kilograms) maximum

Operating Environment

Operating temperature: 41 to 104ºF (5 to 40ºC)

Nonoperating and storage temperature: -40 to 158ºF (-40 to 70ºC)

Operating humidity: 5 percent to 85 percent (noncondensing)

Operating altitude: -197 ft to 6,000 ft (-60 to 1,800 m)


• UL 60950-1, Second Edition Safety of Information Technology Equipment - Safety - Part 1: General Requirements (USA). Plastic materials that are exposed to the end user shall meet the requirements of fire enclosure (UL94V-1) as defined in UL 60950.
• CSA 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements (Canada)
• IEC 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements, including all national deviations as specified in the current CB Bulletin
• EN 60950-1, Second Edition, Safety of Information Technology Equipment - Safety - Part 1: General Requirements (European Union) incorporating all deviations, as applicable
• GB 4943-95, Safety of Information Technology Equipment (Including Electrical Business Equipment) (standard for China, equivalent to IEC 60950)
• AS/NZ 60950.1 Information Technology Equipment, Safety Part 1: General Requirements (Australia)


• Emission:
• 47 CFR Part 15 Class A
• CISPR22 Class A
• EN300386 Class A
• EN55022 Class A
• EN61000-3-2
• EN61000-3-3
• VCCI Class I
• AS/NZS CISPR 22 Class A
• Immunity:
• EN300386
• EN50082-1
• EN55024
• EN61000-6-1

Ordering Information

Cisco Branch Routers Series NAM is available for purchase through regular Cisco sales and distribution channels worldwide. To place an order, visit the Cisco Ordering Homepage. To download software, visit the Cisco Software Center. Table 3 provides ordering information for the Cisco Branch Routers Series NAM.

Table 3. Ordering Information for Cisco Branch Routers Series NAM

Product Name

Part Number

Cisco Branch Routers Series NAM (Spare)


Cisco Branch Routers Series NAM Software 4.2


Voice Monitoring Software License for NME-NAM-120S, 50 RTP Streams (Spare)


Voice Monitoring Software License for NME-NAM-120S, 100 RTP Streams (Spare)


NM Adapter Card for integration of NME-NAM into supported ISR G2 platforms (Spare)


Cisco and Partner Services for the Branch

Services from Cisco and our certified partners can help you transform the branch experience and accelerate business innovation and growth in the Borderless Network. We have the depth and breadth of expertise to create a clear, replicable, optimized branch footprint across technologies. Planning and design services align technology with business goals and can increase the accuracy, speed, and efficiency of deployment. Technical services help improve operational efficiency, save money, and mitigate risk. Optimization services are designed to continuously improve performance and help your team succeed with new technologies. For more information, visit

For More Information

For more information about Cisco Branch Router Series NAM, visit or contact either your local account representative or the Cisco NAM product marketing group at