Preface

and provides general information about Cisco Prime NAM software documentation. This preface has the following sections:

Chapter Overview

Audience

Conventions

Notices

Obtaining Documentation and Submitting a Service Request

.

Chapter Overview

This guide contains the following chapters:

Table 1 Organization

Chapter

Title

Description

Chapter 1

Summary of how Prime NAM provides deeper visibility into the network to accelerate troubleshooting and optimization decisions.

Chapter 2

Information about where to find quick start and Prime NAM customization tasks.

Chapter 3

Options for viewing and monitoring various types data.

Chapter 4

Information about setting up multiple sessions for capturing, filtering, and decoding packet data, managing the data in a file control system, and displaying the contents of the packets.

Chapter 5

Information about performing user and system administration tasks and generating diagnostic information for obtaining technical assistance.

Chapter 6

Scenarios for Prime NAM deployment and the details you may need to know about them.

Chapter 7

Setup details you can review to determine if you want to use advanced features.

Appendix A

Explains the various data sources that you can configure for Prime NAM.

Appendix B

Includes details on how Prime NAM e.works including how to navigate and use the control elements in the user interface

Appendix C

Describes critical user interface fields.

Appendix D

Lists common NAM and its network connection issues with recommendations on how to tackle them.

Audience

This publication is intended primarily for network administrators who are responsible for setting up and configuring Network Analysis Modules (NAMs) to monitor traffic and diagnose emerging problems on network segments. As a network administrator, you should be familiar with:

Basic concepts and terminology used in internetworking.

Network topology and protocols.

Basic UNIX commands or basic Windows operations.

Conventions

This document uses the following conventions:

Convention

Description

Commands and keywords.

Command input that is supplied by you.

[ ]

Keywords or arguments that appear within square brackets are optional.

{ x | x | x }

A choice of keywords (represented by x) appears in braces separated by vertical bars. You must select one.

^ or Ctrl

, you should hold down the Control key while you press the D key.

Examples of information displayed on the screen.

Examples of information that you must enter.

italic screen font

Examples of variables that you must enter.

< >

Nonprinting characters, such as passwords, appear in angled brackets.

[ ]

Default responses to system prompts appear in square brackets.

Selecting a menu item.

Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the publication.

Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Notices

). This document is available on www.cisco.com with the Prime NAM technical documentation.

Obtaining Documentation and Submitting a Service Request

.

. The RSS feeds are a free service.

Overview

This chapter contains information about the Cisco Prime Network Analysis Module (NAM) software and describes task overviews.

This chapter contains the following sections:

Introducing Cisco Prime NAM

Overview of the Cisco NAM Platforms

How to Use Prime NAM to Analyze Your Traffic

Before You Begin

Introducing Cisco Prime NAM

The Cisco Prime Network Analysis Module (Prime NAM) software is a network monitoring and analysis tool that combines flow-based and packet-based analysis into a single tool set. Prime NAM software provides network operations and engineering with user, command line, and application programming interfaces that you use for traffic analysis of applications, hosts, and conversations, performance-based measurements on application, server, and network latency, quality of experience metrics. as well as ways to see deeper into your network. The robust graphical user interface makes traffic monitoring and troubleshooting simple and cost-effective.

for details on high-level task areas and how they map to the user interface.

.

Table 1-1 Prime NAM Task Areas

Task Area

Menu Mapping

Task Description

Used By

Plan and Prepare

Setup menu

Create a list of your network performance goals. Set expected goals and limits for response time, expected ranges for MOS values, bandwidth usage per application, and utilization on critical WAN links. Determine on which performance issues you want to concentrate.

Network Engineers, Designers, and Architects

Monitor and Analyze

Home, Capture, Analyze and Monitor menus

View dashboards which give you a quick view of traffic performance information, and various incidents. Use interactive reports filter data when monitoring specific network traffic and troubleshooting problems.

Monitor your network and perform other day-to-day operations related to proactive and reactive traffic analysis and troubleshooting.

Analyze QoS policy traffic using alarms, syslogs, traps, and e-mail alerts.

See Monitoring and Analyzing Traffic and Capturing and Decoding Packets.

Network Engineers, NOC Operators, and Service Operators

Administer

Administer menu

Change default system display, notification, and user settings, as well as manage database access control and view system diagnostics.

See Performing User and System Administration.

Network Engineers

Deploy

Setup and Admin menus

Configure devices to share data with NAM. Configure managed devices and data sources.

Perform customized setup of NAM including sites, alarms and thresholds, scheduled exports, and so on.

Monitor an extended level of your managed device’s data (health and interface information).

Determine which locations are ingress or egress points of a logical network boundary (aggregation layer, core, campus edge, and so on) that can offer valuable insights into the network activity within that partition.

Create a baseline of current metrics including applications, bandwidth per application, top conversations and hosts, QoS values used in the network, unrecognized protocols, and current server and end-to-end response time measurements.

See Customizing Cisco Prime NAM.

Network Engineers, Designers, and Architects

Troubleshoot

Capture, Analyze and Monitor menus

Resolve common NAM issues including login problems and unresponsiveness, understand error messages, and troubleshoot network issues using Prime NAM.

See Troubleshooting Network and NAM Issues.

Network Engineers, NOC Operators, and Service Operators

Overview of the Cisco NAM Platforms

Cisco NAM is supported on a variety of platforms. This guide does not discuss platforms, but focuses on tasks and capabilities.

.

It is important to note that the portfolio of Cisco NAM models differ in memory, performance, disk size, and other capabilities. Therefore, some allow for more features and capabilities (for example, the amount of memory allocated for capture).

Throughout this guide, there may be notes explaining that some features apply only to specific platforms. If there is no note, then that feature or aspect applies to all Cisco NAM platforms.

.

How to Use Prime NAM to Analyze Your Traffic

The Cisco Prime NAM software helps you to address the following major areas:

Network Layer Traffic Analysis. Prime NAM provides comprehensive traffic analysis to identify what applications are running over the network, how much network resources are consumed, and who is using these applications. Prime NAM software offers a rich set of reports with which to view traffic by Hosts, Application, or Conversations. See the discussions about Dashboards, starting with Using Traffic Summary.

Application Response Time. Prime NAM can provide passive measurement of TCP-based applications for any given server or client, supplying a wide variety of statistics like response time, network flight time, and transaction time. See Using Response Time Summary.

Voice Quality Analysis. Prime NAM provides application performance for real time applications like Voice and Video. Prime NAM can compute MOS, as well as provide RTP analysis for the media stream. See Analyzing Media.

Advanced Troubleshooting. Prime NAM provides robust capture and decode capabilities for packet traces that can be triggered or terminated based on user-defined thresholds. See Application Performance Monitoring Using Capture and Decode.

WAN Optimization insight. Prime NAM provides insight into WAN Optimization offerings that compress and optimize WAN Traffic for pre- and post-deployment scenarios. This is applicable for Optimized and Passthru traffic. See

Open instrumentation. Prime NAM is a mediation and instrumentation product offering, and provides a robust API that can be used by partner products as well as work with customer-created applications. Contact your account representative for a copy of the Cisco Prime Network Analysis Module API Programmer’s Guide .

.

Table 1-2 Data Source Monitoring Capabilities

Data Sources

Monitoring Capabilities

Capture

Traffic

ART

RTP/Voice

URL

SPAN/VACL/ERSPAN

Yes

Yes

Yes

Yes

Yes

WAAS

No

Yes

Yes

No

No

NetFlow

No

Yes

No

No

No

.

Before You Begin

Depending on your Cisco NAM, ensure the following list of requirements are complete before you use Prime NAM. For detailed instructions, see your platform installation guide, except where noted:

Reset your Cisco NAM root password

Set up a data source to send traffic to the Cisco NAM

Configure access to the Prime NAM user interface or CLI

Synchronize your Cisco NAM to the standard time source outside the NAM in addition to the router or switch (depending on your platform). For detailed instructions, see Synchronizing Your System Time.

For optional advanced customizations, such as adding sites or configuring alarms and thresholds, see Advanced Configuration Overview.

Getting Started

This chapter contains getting started information for both users that want to use the NAM quickly without customizing the product or that want to customize the NAM. It includes some simple workflows that illustrate how to use Prime NAM to quickly to help troubleshoot performance and optimization issues.

There are many additional workflows for which Prime NAM can be used. These tasks are documented in the following chapters.

This chapter contains the following sections:

Before You Begin

Quick Start

Where to Go to Learn How to Customize Your NAM

Before You Begin

This section contains tasks that must be performed prior to using NAM.

2. Ensure that the NAM system time is configured correctly. If the system time is incorrect, NAM data presentation may be inaccurate due to time ranges, hence providing incorrect interpretations of NAM data. Although some platforms are synchronized automatically, you must also synchronize the standard time source outside the NAM in addition to the NAM and the router or switch in order for the data to be accurate. For details, see Synchronizing Your System Time.

Quick Start

Use the following workflows to get started using your product. These tasks do not require additional configuration or setup. You can see other workflows and tasks within this user guide in the task-specific chapters.

Troubleshooting Application Slowness

Using Traffic Summary

Using Response Time Summary

Using Site Summary

Using Alarm Summary

Filtering Data Using Global Search

Filtering Traffic for Viewing on the Dashboards

Filtering Data Using Global Search

Where to Go to Learn How to Customize Your NAM

There are many capabilities beyond the tasks you can perform out-of-the box. These tasks require some level of customization before you can access some of the additional functionality within NAM.

To review the customization you may need to perform, see Advanced Configuration Overview.

Monitoring and Analyzing Traffic

Cisco Prime Network Analysis Module, or Prime NAM, provides several dashboards and tools to help you to monitor and analyze your network traffic data. Prime NAM starts collecting data once your network device’s IP address is shared with the NAM. You can view the monitor dashboard, analyze traffic using various views, troubleshoot suspicious traffic using the capture tool, and decode capture sessions without any additional configuration on your part.

This chapter provides information about monitoring your network traffic and analyzing the information presented.

This chapter contains the following sections:

How To Make Dashboards Work for You

Troubleshooting Application Slowness

Using Traffic Summary

Using Response Time Summary

Using Site Summary

Using Alarm Summary

Analyzing Traffic

Optimizing WAN

Measuring Response Time

Analyzing Device Interface and Health Data

Analyzing Media

Using the NAM Application Programming Interface

If you want to customize Prime NAM to use more advanced configurations such as sites and filtering, see Customizing Cisco Prime NAM.

How To Make Dashboards Work for You

menu).

The Monitor dashboards allow you to view graphic depictions of network traffic, application performance, site performance, and alarms at a glance. From there, you can isolate one area, for example an application with response time issues, and then drill down to the Analyze dashboard for further investigation.

The following are some of the configuration tasks that enhance NAMs ability to provide more traffic details on dashboards:

Turn on deep application classification in order to identify applications regardless of the ports on which the applications may be running. To enable deep packet inspection, see Adding More Detail into Dashboard and Application Reports. For an example of how to troubleshoot using deep packet inspection, see Troubleshooting Application Slowness.

To understand how to use filters to easily find information and significantly change what you view in the dashboards, see Filtering Traffic for Viewing on the Dashboards and Filtering Data Using Global Search.

To make your custom application traffic more visible on the dashboards and reports, add HTTP URL or Server IP/Port definitions. See Creating Deeper Visibility Into Application Traffic

For more details about when or why to use specific dashboards, see How Do I Solve My Problem?.

How Do I Solve My Problem?

This section includes a table that provides various problems you can solve with specific dashboards, as well as what details you might want to know and what dashboards are associated with that data.

What Problem Needs Solving

Why Do I Need to Know This

Where to Go

My application is slow

Dashboards provide multiple entry points into data.

Troubleshooting Application Slowness

My phone quality is poor.

NAM detects and computes Mean Opinion Scores (MOSs) for VoIP calls transported through Real Time Protocol (RTP) streams.

Using Site Summary see Top N Sites by Average MOS and RTP Streams

Has my server reached capacity?

You can filter by data source and analyze host details

Filtering Traffic for Viewing on the Dashboards and Filtering Data Using Global Search

I want more or specific details in my captures

Use various filters to select what gets included in your captures

Understanding Global Capture Settings and Configuring Hardware Filters

Is my interface overloaded?

to see list of all interfaces and errors or discards on each interface.

Analyzing Device Interface and Health Data

I’m seeing a lot of unexpected or excessive applications traffic

This may be tied to the occurrence of multiple Unknown applications.

video traffic for example

Configuring Application Classification

I want to identify my homegrown applications

Your traffic visibility into your application can be improved by adding your custom application details so it can be classified

Creating Deeper Visibility Into Application Traffic

How do get notified before a problem occurs?

Set up alarms and thresholds to notify you via email.

Setting Up Alarms and Alarm Thresholds

Troubleshooting Application Slowness

This section contains a sample workflow that describes one way to use Prime NAM to help troubleshoot common network slowness.

This example concentrates on how to troubleshoot application performance issues that stem from using common server applications (such as HTTP or Sharepoint).

Tip This case applies to any instance where an application is suspected of causing network latency.

Before You Begin

, see Synchronizing Your System Time.

To determine what may be causing network slowness for the remote desktop users:

and ensure the Deep Packet Inspection checkbox is selected. If not, see Adding More Detail into Dashboard and Application Reports for instructions.

in order to find the network devices that use a specific protocol or application.

a. In the Interactive Report Filter select the name of your application (for example, Sharepoint) as the Application option in order to collect network traffic details for that application only. If you do not see your application, you may need to download the latest protocol pack.

b. You can also customize the time range to ensure that your data collection provides enough data or focuses on specific points of time that have heavy traffic.

If you do not see any data, select a different time range in the filter and submit the search again in order to locate the surge traffic.

Step 3 Use the zoom/pan chart slider at the bottom of the Application Traffic chart in order to focus in on those details that are most important to you.

Focus on the traffic surges in the chart in order to identify the participating servers and the remote clients.

Step 4 Use the Top Hosts Traffic In and Out charts in order to drill down for more bandwidth details.

a. Select the server with the most traffic and review the maximum and average bandwidth used by your application in order to pinpoint the source of the issue.

For the select server, assess the amount of traffic in order to view:

– A breakdown by each site

– Conversations by individual users

Step 5 Assess if there is enough capacity on the link connecting the site to the data center in order to determine if this might be part of the problem. Since this is out of this product’s scope, we recommend you use other applications to perform this task.

Step 6 If your network capacity is limited, for example, a 256 Kbps link shared across multiple applications and there is a requirement to support multiple clients, consider the following options:

Apply a control mechanism, for example Quality of Service policies

Upgrade the link so that it can handle a higher bandwidth

Using Traffic Summary

.

.

When you log into Prime NAM for the first time, the default view will be the Traffic Summary dashboard, and the top data source is selected by default.

provides an at-a-glance summary of the Traffic Summary dashboard. For each chart described below, you can left-click on any colored bar to get to a context menu, with which you can get more detailed information about that item. You can also place your cursor over the colored bar to see the number of bits per second collected or the total bits over the last time interval. To toggle your view from chart to table, select the icon under the table.

Table 3-1 Traffic Summary At-a-Glance

Basics

Chart

Description

View top application traffic rate or traffic volume, based on the Interactive Report filter selection (data rate or cumulative, respectively)

This chart reports application-level (L7 payload) bits.

from the context menu, you can start a capture on this data (see Capturing and Decoding Packets for more information). You can also select other options to view various application traffic details. See Analyzing Application Traffic.

View traffic rate or volume for top application groups

, where rate is the bits per second, and cumulative is the total number of bits.

View host activity

To get more specific details about the host activity, left-click on the colored bar and make a selection. If you left-click on a colored bar, you can select additional options for host activity data. See Analyzing Host Traffic.

View IP protocol traffic

Shows the percentages of bits being distributed to IP protocols (for example, IPv4 TCP).

View statistics for top DSCP aggregation groups

For more detail, hover over the colored bar or left-click to select Details option. See DSCP

View encapsulation traffic

In the Interactive Report, you can select a VLAN and filter specific encapsulation protocols from within this chart (including OTV, VxLAN, LISP, and others). You can also narrow your data by filtering on certain time ranges. The default time range is 15 minutes. See Encapsulation.

Tip To change from bits to bytes, choose Administration > System > Preferences and change the Data displayed in selection.

To see a chart in table format, use the Show Chart/Show Table toggle buttons on the bottom left corner of the chart.

. On that page, you can also configure the number of Top N entries you would like to display.

Using Response Time Summary

).

After the NAM is started, these metrics will begin to populate automatically. When you first navigate to Response Time Summary dashboard, the top data source is selected by default. This dashboard shows you performance statistics for site, data source, encapsulation, and a specific amount of time.

Use the Interactive Report window on the left side of the window to change the parameters for the information displayed. To see a chart in table format, use the Show Chart / Show Table toggle button on the bottom right corner of the chart.

The dashboard charts will show you the following information:

Top N Applications by Transaction Time

would show you the average response time of HTTP servers seen in the traffic category you have selected in the Interactive Report window. The data displays in microseconds (μ), milliseconds, or seconds depending on your preference settings.

Top N Site-to-Site Network Time

This chart displays the top network time between the client site and the server site in the category you selected. The data displays in microseconds (μ), milliseconds, or seconds depending on your preference settings.

Top N Servers By Server Response Time

This chart allows you to see how well servers are performing, by showing you the server that has the longest response time (the item appearing at the top). The data is shown in microseconds.

Top N Servers By Bits (or Bytes)

.

Top N Clients By Transaction Time

This chart displays the transaction time per client. The client with the highest response time appears on top. The data displays in microseconds (μ), milliseconds, or seconds depending on your preference settings.

Top N Clients By Bits (or Bytes)

This chart displays the total bits or rate of traffic for the top clients.

Using Site Summary

) will show you information about the sites in your network. You can use the Interactive Report on the left side of the window to change the information displayed. For more information about sites, see Configuring Sites.

The charts displayed on the Site Summary dashboard are:

Top N Sites by Average Transaction Time

This chart shows the average transaction time by site.

Top N Site Pairs by Traffic

This chart shows top site to site traffic.

Top N Sites by Average MOS

This chart shows sites that have the highest average Mean Opinion Score (MOS).

MOS will normally range from 1-5, denoting the perceived quality of the transmission, where 1 is the lowest perceived quality, and 5 is the highest perceived quality measurement. The MOS is weighted depending on the duration.

Top N Sites by Traffic

This chart shows the sites that have the most traffic (which are the most active). It is a total of all the traffic sent or received for hosts that belong to the particular site, which means that this traffic includes intra-site traffic as well.

To see any of the charts in table format, use the Show Chart / Show Table toggle button on the bottom right corner of the chart.

Using Alarm Summary

) will show you the top alarms occurring in the network.

). You can also choose the desired amount of time from the Time Range drop-down menu, or you can customize the time range.

On any chart on the Alarm Summary Dashboard, you can click on a colored bar to see the Context menu, with which you can get more information.

If you do not set any alarms or thresholds, the Alarm Summary Dashboard will have no data. For information on setting up alarms and thresholds, see Setting Up Alarms and Alarm Thresholds.

Note You could see a count of two alarms for the same occurrence if:
- both the source and the destination are in the same site in the Top N Site - Host Pair chart.
- both the source and the destination are in the same site in the Top N Site chart.
- both the source and the destination are in the same site using the same application in the Top N Site - Application Pair chart.

Note You will not have any data in Top N Site - Application and Top N Application if there is no threshold configured that involves an application (for example: Response Time threshold or Application threshold).

NetFlow Interface alarms are not related to any site; therefore, they will not appear on the four colored site alarm charts on the Alarm Summary dashboard. Instead, the New Alarms Raised and Last 50 Alarms tables at the bottom of this window will contain NetFlow Interface alarms raised.

The five charts displayed on the Alarm Summary dashboard are:

Top N Sites by Alarm Count

This chart lists the top sites that have the most alarm triggers during the selected time range. The number of sites displays based on the maximum number you set in preferences. If no thresholds are configured, this chart contains no data.The number on the bottom of the chart is the alarm count.

.

Top N Hosts by Site and Alarm Count

This chart shows the number of alarm messages during the selected time range that are triggered for Hosts across all sites, by the Site - Host Pair.

Top N Applications by Alarm Count

This chart shows the number of alarms during the selected time range for Applications across all sites.

Top N Applications by Site and Alarm Count

This chart shows the most alarm triggers during the selected time range by the application and site pair.

New Alarms Raised

The New Alarms Raised table shows you all alarms that occurred during the interval selected in the Interactive Report window. Some alarms may have been triggered outside of the time period, but may still be occurring.

Last 50 Alarms

.

to display a separate window, which shows all the alarms from that particular time interval.

You can also use the Filter button, both in this window and the All Alarms window, to display only alarms that meet the criteria you enter.

Utilizing Sites to Create a Geographically- or Organizationally-Familiar Deployment

In Prime NAM you can define a site, which enables you to aggregate and organize performance statistics. If you want to limit the view of your network analysis data to a specific city, a specific building, or even a specific floor of a building, you can use the sites function.

Figure 3-1 shows a centralized NAM deployment analyzing multiple data sources from different locations in the network.

Figure 3-1 Site Level Aggregation

For this deployment, multiple sites can be created such as SanJose-Campus, SanJose-Datacenter, NewYork-NetFlow-Bldg1, and NewYork-WAAS-Bldg2. The data that does not match the site configuration will be displayed in the Default site. This helps to isolate the view and information for monitoring and troubleshooting so you can drill down to the specific area of interest.

You can also include multiple types of data sources in the site definition, and you can then get an aggregated view of all network traffic.

makes it easy to bring up a NAM without having to configure user-defined sites. Hosts that do not belong to any user-defined site will automatically belong to the Unassigned Site.

. Unassigned sites cannot be changed.

The interactive dashboard can be used to drill down into either San Jose or New York sites to see Top applications, hosts, Encapsulations, DSCP, and application response time.

From each of the charts in the dashboard, you can access the context menu to further drill down to analyze data such as detailed application, host, and conversation traffic.

Analyzing Traffic

Prime NAM offers many ways to analyze your network traffic data using graphs, charts, and detailed views.

Use the links below to locate information about:

Analyzing Site Traffic

Analyzing Application Traffic

Analyzing Host Traffic

NetFlow Interface Traffic Analysis

DSCP

Encapsulation

URL Hits

Detailed Traffic Analysis Views

About Analyze Traffic Charts

Analyzing Site Traffic

To show you the traffic level for a given site over a selected period of time:

.

Step 2 To change the data to see the top application traffic coming into a specific site, out of a specific site, or all traffic within, coming in and moving out of that site, use the traffic selector buttons.

Step 3 To see site conversations about the conversation between sites to pinpoint specific applications or sites, select the Site Conversations button and choose filters from the Interactive Report to further pinpoint an application, data source, or time frame in question.

Step 4 To view top applications transmitting and receiving traffic for the selected time period and drill down to collect more data utilizing capture data, real-time graphs, and application group detail), left click the Top N Application dashboard.

Step 5 To see the criteria by which the NAM classifies the amount of application traffic on this site over this period of time, use the view Application Distribution graph. Hover over graph parts to view detailed information on speed and percentages or left-click a graph element for other menu options.

Analyzing Application Traffic

To show you the traffic level for a given application over a selected period of time:

.

on the Interactive Report, and expand the time range to allow more data to be viewed.

Step 3 To focus in on a spike or area of interest, use the slider under the Application Traffic graph. Hover over the data points to see specific traffic details.

and choose filters from the Interactive Report to further pinpoint a data source, encapsulation method, or time frame in question.

Step 5 To view top hosts transmitting and receiving traffic for the selected time period and drill down to collect more data utilizing capture data, real-time graphs, and application group detail), left-click a Top N Hosts graph element and select a specific task.

describes the fields in this window.

to configure specific applications in your network. For detailed instructions, see Creating Deeper Visibility Into Application Traffic.

Analyzing Host Traffic

. It will show you:

Input and output traffic for the host

Top N application activity of the host over the selected interval

Total application usage distribution for the host

Host Conversations—Shows detailed lists of all the conversations for a particular host.

Applications Detail

describes the fields in this window.

NetFlow Interface Traffic Analysis

To view data collected for individual interfaces on a switch or router that is exporting NetFlow packets to the NAM, use the NetFlow Interface Analysis page. The displayed information represents the total data collected since the collection was created, or since the NAM was restarted.

Before You Begin

1. Ensure Auto-create is enabled for the NetFlow Data Export (NDE) data source. Once NDE data is sent to the NAM, an NDE data source is created.

For more information, see Creating NetFlow Data Sources Using the Web GUI or html#33517" CLASS="cXRef_Color">Creating NetFlow Data Sources Using the CLI

) to ensure all information is populated.

To view NetFlow Interface Analysis:

. The default view is Interface View.

Step 2 Select an interface from the Interface Selector to see traffic in the charts. Click the arrow icon to the left of the NetFlow data source name to display all interfaces, and then select an interface to see data for that interface.

, and the charts on the right will sum up the metrics and display them for each group.

Note If the charts show no data, and you see a message “Interface needs to be selected,” you have not yet chosen an interface.

Once you have chosen the interface, you will see the following charts populated:

Interface Traffic (Ingress % Utilization and Egress % Utilization)

Top N Applications - Ingress

Top N Applications - Egress

Top N Hosts - Ingress

Top N Hosts - Egress

Top N DSCP Aggr - Ingress

Top N DSCP Aggr - Egress

The interface speed can be entered manually through the Interface capacity table, or it can be auto configured if the SNMP settings for the NetFlow device are entered in data source table.

DSCP Detail

button on the right.

describes the fields in this window.

DSCP

Differentiated services monitoring (DiffServ) is designed to monitor the network traffic usage of differentiated services code point (DSCP) values.

To monitor DSCP groups, you must configure at least one aggregation profile and one or more aggregation groups associated with each profile. For more information on configuring an aggregation profile, see Configuring DSCP Groups.

. The data provided to you includes:

Traffic volume over time for DSCP group

Top N applications and application groups using that DSCP group

Top N hosts transmitting and receiving traffic on that DSCP group

Encapsulation

You can analyze the encapsulation traffic collected by Prime NAM (for setup, see Filtering Encapsulations). This section contains the following use cases:

Viewing Collected Encapsulation Data—see Viewing Collected URLs

Filtering Various Encapsulations—see Filtering a URL Collection List

URL Hits

You can analyze the URLs collected by the NAM (for setup, see Configuring URL Collections).

This can help you determine what URLs are used in the network and then see what applications are affiliated with those URLs.

This section contains the following:

Viewing Collected URLs

Filtering a URL Collection List

Viewing Collected URLs

To view collected URLs and optionally create URL-based custom applications:

The URL Hits Window displays with the collected URLs.

Note Only one URL collection can be active at one time. The data source is for information only.

.

Filtering a URL Collection List

To filter a URL collection list:

, choose which part of the URL to filter:

URL —You can filter on any part of the URL

Host —This filter applies only to the host part of collected URLs.

Path— This filter applies only to the path part of the collected URLs

Arguments— This filter applies only to the argument part of the collected URLs.

Step 2 Enter filter string.

to apply the filter.

Note To remove any display filter and show all URLs collected, click Clear.

Detailed Traffic Analysis Views

Prime NAM offers several detailed traffic analysis views which allow you to analyze the following data:

Sites Detailed Views

Site Conversations Detailed Views

Applications Detailed Views

Application Groups Detailed Views

Application Traffic By Hosts Detailed Views

Top Application Traffic Detailed Views

Hosts Detailed Views

Host Conversations Detailed Views

DCSPs Detailed Views

Sites Detailed Views

Displays data for each site (including all unassigned sites) and see packet per second and bits per second details. Use the Interactive report filter to pinpoint specific attributes. There are no filter time limits for this data.

Site Conversations Detailed Views

Displays site traffic for all or selected sites. To pinpoint site traffic data between two devices, select the Interactive Report Filter.

Applications Detailed Views

To view the All Applications window and the detailed information about all application and filter on specific applications or other filter attributes, use the Interactive Report filter.

Application Groups Detailed Views

describes the fields in the All Applications window.

Application Traffic By Hosts Detailed Views

Shows the traffic for a given application broken out by individual hosts using the application. You may specify the time period to view, as well as the application, site (optional), data source (optional), and VLAN (optional).

The NAM only supports a maximum Time Range of one hour filter for the Host Conversations, RTP Streams, Voice Calls Statistics, Calls Table, and RTP Conversations.

Top Application Traffic Detailed Views

Shows the top applications by traffic rate over a selected time and for the specified site and/or data source.

Top Application Traffic Detailed Views shows you all of the applications that have been running for the time period interval. The color-coded legend shows you what the applications are running.

data in addition to the data for the N number of applications.

If you place your cursor over any of the data points, you will get more details about the exact values for each of the applications that are running.

Hosts Detailed Views

button in the Interactive Report (left side of the window) to change the parameters of the information displayed.

Host Conversations Detailed Views

Shows detailed lists of all the conversations for a particular host.

You can view the following data:

A table of hosts which are sending and receiving packets to the selected host, along with application, encapsulation, and traffic rate information.

A breakout of application usage for the selected host.

button in the Interactive Report (left side of the window) to change the parameters of the information displayed.

The NAM only supports a maximum time range of one hour filter for the Host Conversations, RTP Streams, Voice Calls Statistics, Calls Table, and RTP Conversations.

Encapsulations Detailed Views

.

button in the Interactive Report to change the information displayed and target data.

DCSPs Detailed Views

.

button in the Interactive Report to change the information displayed and target data.

For details about setting your TOS key and the implications of doing so, see Customizing System Preferences.

About Analyze Traffic Charts

menu show statistics that occur over time. You can use the Zoom/Pan feature, with which you can drag the beginning or end to change the time interval or distribution.

The time interval change on the zoom/pan chart will affect the data presented in the charts in the bottom of the window. The zoom/pan time interval also affects the drill down navigations; if the zoom/pan interval is modified, the context menu drill downs from that dashboard will use the zoom/pan time interval.

Note In a bar chart which you can zoom/pan, each block represents data collected during the previous interval (the time stamp displayed at the bottom of each block is the end of the time range). Therefore, you may have to drag the zoom/pan one block further than expected to get the desired data to populate in the charts in the bottom of the window.

Optimizing WAN

Prime NAM can provide insight into WAN Optimization offerings that compress and optimize WAN traffic for pre- and post-deployment scenarios. This is applicable for optimized and passthru traffic.

WAN Optimization tasks include:

Ensuring WAN Optimization

Analyzing Traffic for Optimization Using the Top Talkers Detail

Analyzing Application Performance after WAAS Optimization

Monitoring WAAS Traffic Across Multi-Segments

Monitoring WAAS Single-Segment Traffic

Note To monitor the WAAS data, you must select the correct WAAS data source.

Ensuring WAN Optimization

In order to ensure that your applications are performing optimally and your WAN is optimized:

.

If you do not have sites identified, you can use the Unknown site category or to learn about how to create sites, see Configuring Sites.

Step 2 Look for sites with the highest average transaction time and highest traffic rate.

Step 3 To quantify the application performance:

.

b. Set up a filter that targets key areas such as a specific location and different time ranges (one day and one week). This allows you to focus in on exactly the data you want to analyze.

c. Right-click the application with the highest server response time and choose Analyze Application Response Time.

d. Specify a filter time range using the Interactive Filter. We recommend viewing data over a one day range to allow for possible peak times.

e. Identify applications with poor performance and quantify the response time by network time, server response time, and data transfer time.

Step 4 To validate the impact of WAN optimization:

.

b. Minimize WAN Opt Impact analysis filter (on the left pane).

c. View the effect of optimizing one of your applications (for example, to determine if your HTTP browser has lower transaction times and thus better end-client experience, lower compression ratios for better utilization of the WAN, and fewer average concurrent connections for better utilization of server through connection reuse).

Step 5 To perform ongoing monitoring of WAN optimization and troubleshoot WAN optimized traffic:

.

b. View a detailed breakdown of latency and bandwidth measures for the server, WAN, and client network segments.

Analyzing Traffic for Optimization Using the Top Talkers Detail

While you are in the process of deploying WAAS devices, you can get data to assist in the WAAS planning and configuration.

This window allows you to display response time and concurrent connections for the top Application, Network Links, Clients, and Servers from WAN data sources before WAAS optimization.

To analyze traffic for optimization using the Top Talkers Detail:

Step 1 Choose Analyze > WAN Optimization > Top Talkers Detail and filter data using the Interactive Report window to select the traffic you want to analyze for optimization.

If the data source is from SPAN or WAAS, it does not include the packet header; if the data source is NetFlow, it will include the packet header.

Note You can choose to display NAM data in either Bits or Bytes in Administration > System > Preferences.

Based on the results, you can then configure the WAAS products to optimize your network.

Analyzing Application Performance after WAAS Optimization

.

The tasks associated with this analysis include:

Comparing Transaction Time (Client Experience)

Comparing Traffic Volume and Compression Ratio

Planning Capacity Using Average Concurrent Connections (Optimized vs. Passthru)

Optimizing Usage Using Multi-Segment Network Time (Client LAN - WAN - Server LAN)

Comparing Transaction Time (Client Experience)

using this chart. It displays the average client transaction time. One line represents pass-through traffic (in which optimization is turned off), and the second represents optimized traffic. After setting up optimization for a certain period, you can compare the two lines and see where the vertical drop in the chart occurs. Depending on your Response Time Display unit preference setting, the data may display in microseconds, milliseconds, or seconds.

Comparing Traffic Volume and Compression Ratio

You can compare the bandwidth reduction ratio between the number of bits before compression and the number of bits after compression using this chart.

Planning Capacity Using Average Concurrent Connections (Optimized vs. Passthru)

You can use the number of concurrent connections during a specified time to assist with peak and off-period identification. This information can be used for capacity planning.

Optimizing Usage Using Multi-Segment Network Time (Client LAN - WAN - Server LAN)

You can use the network time between the multiple segments to identify lagging performance issues. The data is shown in microseconds.

Monitoring WAAS Traffic Across Multi-Segments

.

The window shows network time, server response time, and other metrics of the selected server or client-server pair from applicable segments. The relevant metrics from all segments are combined into one row per client-server conversation.

Monitoring WAAS Single-Segment Traffic

.

The window shows network time, server response time, and other metrics of the selected server or client-server pair (one row per segment).

Measuring Response Time

The NAM monitors TCP packet flow between client and server, and measures response time data to provide more visibility into application response times (ART) and network latency. Prime NAM response time monitoring provides end-to-end response times to help you locate possible network and application delays.

Note Prime NAM software supports IPv6 for response time monitoring.

You can set up the NAM to measure network time, client response time, server response time, and total transaction time to improve application performance. Figure 3-2 shows the various points in network packet flow where the NAM gathers data and the trip times you can monitor. This is one example that represents only a subset of measurements.

Figure 3-2 NAM Application Response Time Measurements

Figure 3-3 shows a representation of total transaction time as opposed to application response time.

Figure 3-3 Transaction Time versus Response Time Measurements

lists and describes the ART metrics measured by Prime NAM.

), which allows you to see a summary view of the data.

:

Application Response Time

Network Response Time

Server Response Time

Client Response Time

Client-Server Response Time

, you will be able to select one of the following, each of which contains detailed lists of the response events.

Server Application Responses

Server Application Transactions

Server Network Responses

Client-Server Application Responses

Client-Server Application Transactions

Client-Server Network Responses

Application Response Time

The Application Analysis window allows you to view the performance of a particular application over time. It is accessed from Analyze > Response Time > Application.

The Transaction Time chart shows you the average transaction time for the application you have selected. It is broken down into three components: Network Time, Server Response Time, and Data Time.

The Other Metrics chart allows you to see information over time after you have selected the desired metrics from the Metric Group 1 and Metric Group 2 drop-down.

Next are the Top Clients and Top Servers charts. These show you the clients and servers with the most bits of traffic for the chosen application.

Note You can choose to display NAM data in either Bits or Bytes in Administration > System > Preferences.

Network Response Time

After you have selected a client site and a server site, the chart will show you the transaction time of the network link between the client site and server site. It is accessed from Analyze > Response Time > Network.

Note If you do not specify any application, the chart will show the network time instead of transaction time.

The Other Metrics chart allows you to see information about the network link between sites, after you have selected the desired metrics from the Metric Group 1 and Metric Group 2 drop-down.

The Top Clients and Top Servers charts show you the top clients and servers that are communicating through the network link (in bits or bytes).

Server Response Time

Choose the Client Site and Server Site from the Interactive Report on the left, and enter the IP address for the server that you want to analyze. The Server Transaction Time Composition chart will display the network time, server response time, data time, and transaction time.

The Other Metrics chart allows you to see information about the server performance after you have selected the desired metrics from the Metric Group 1 and Metric Group 2 drop-down.

Top Client shows you top client talking to the server you have selected; Server Top Clients Sites shows the top client sites (traffic bits).

Note You can choose to display NAM data in either Bits or Bytes in Administration > System > Preferences.

Client Response Time

After entering the client IP address and application in the Interactive Report Filter, you can analyze the transaction time of that client in the Client Transaction Time Composition chart.

The Other Metrics chart allows you to see client performance over time after you have selected the desired metrics from the Metric Group 1 and Metric Group 2 drop-down.

The Clients Top Applications chart show you the applications being used the most by the client selected, and the Top Servers chart show you the servers being used most by the client.

Client-Server Response Time

After you enter the client IP address and server IP address in the Interactive Report, you can analyze the transaction times between the client and server you have selected in the Client-Server Transaction Composition Over Time chart.

The Other Metrics chart allows you to see Client-Server transaction information after you have selected the desired metrics from the Metric Group 1 and Metric Group 2 drop-down.

Server Application Responses

.

to see more information.

provides definitions of each field of the Server Application Responses window.

Server Application Transactions

.

The Server Application Transactions window provides a summary of the server application transaction response times (ART) per server application displaying the server IP address, application used, and minimum, average, and maximum response times for the following:

Application Response Time

Data Transfer Time

Retransmit Time

Round Trip Time

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

provides definitions of each field of the Server Application Transactions window.

Server Network Responses

.

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

provides definitions of each field of the Server Network Response Times window.

Client-Server Application Responses

.

provides definitions of each field of the Client-Server Application Responses window.

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

Client-Server Application Transactions

The Client-Server Application Transactions window provides a summary of the server application transaction response times (ART) per server application displaying the server IP address, application used, and minimum, average, and maximum response times for the following:

Application Response Time

Data Transfer Time

Retransmit Time

Round Trip Time

Note NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

. You can also view the TopN Chart to view the most active network.

provides definitions of each field of the Client-Server Application Responses window.

Client-Server Network Responses

The Client-Server Network Responses window shows information about network connectivity (also known as network flight time) between servers and clients.

.

NAM uses the TCP three-way handshake to calculate network delay. If there are no new TCP connections during the polling interval, the NAM GUI displays a dash (-) for the delay value indicating there is no delay data for that interval.

describes the fields of the Server-Client Network Response Time window.

Analyzing Device Interface and Health Data

window. The menu selections for analyzing Managed Devices are:

Viewing Interface Information

Viewing Health Data

Viewing Interface Information

You can view the following interface information:

Interfaces Stats Table

Interface Statistics Over Time

Interfaces Stats Table

. The Interfaces Stats table displays and shows the total packet distribution on all interfaces. Depending on the interface chosen, the chart below the table refreshes with that information. Use the Interactive Report and the Filter button on the left to change the time range displayed. The Discards and Errors are measured in packets per second.

Interface Statistics Over Time

When you select an interface in the Interface Statistics Table, the statistics for that interface updates in the graph below the Interface Statistics Table.

You can check the check boxes for the information you would like displayed in the graph:

Bits: In Bits, Out Bits

Packets: In Packets (inUcastPkts + inNUcastPkts), Out Packets (outUcastPkts + outNUcastPkts)

Discards: In Discards, Out Discards

Errors: In Errors, Out Errors

Note You can choose to display NAM data in either Bits or Bytes in Administration > System > Preferences.

Viewing Health Data

from the menu.

For more details on the options available in each windows, see:

Switch Health Options

Router Health Options

Note This section applies to all NAM platforms except the NAM-NX1.

Switch Health Options

For a switch, the Health window is displayed with a drop-down menu that provides the following options:

Chassis Health

Chassis Information

Crossbar Switching Fabric

Ternary Content Addressable Memory Information

Chassis Health

The Chassis Health window displays two real-time graphs: CPU usage and Backplane Utilization.

CPU usage

CPU type

Usage for last 1 minute (%)

Usage for last 5 minutes (%)

Backplane Utilization

Peak %

Peak Time (For example: Mon October 1 2007, 15:26:55)

The Health window also displays a matrix with the following information:

Minor Alarm (on, off)

Major Alarm (on, off)

Temperature Alarm (on, off)

Fan Status (other, ok, minorFault, majorFault, unknown)

Table 3-2 Chassis Memory Information

Column

Description

Memory Type

Type of memory including DRAM, FLASH, NVRAM, MBUF, CLUSTER, MALLOC.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.

Chassis Information

describes the Chassis Information window.

Table 3-3 Chassis Information

Field

Description

Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Backplane

The chassis backplane type.

Supervisor Software Version

The full name and version identification of the system’s software operating-system and networking software.

UpTime

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud rate

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown

ac

dc

externalPowerSupply

internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

6: notFunctioning

Power Redundancy Mode

Power Redundancy Mode:

3: combined

Power Total

Total current available for FRU usage.

When Redundancy Mode is redundant, the total current available will be the capability of a power supply with the lesser power capability of the two power supplies.

When Redundancy Mode is combined, the total current available will be the sum of the capacities of all operating power supplies.

Power Drawn

Total Current Drawn by powered-on FRUs.

Crossbar Switching Fabric

describes the Crossbar Switching Fabric information.

Table 3-4 Crossbar Switching Fabric Information

Field

Description

Crossbar Switching Fabric

Physical and configuration information about the module:

—Indicates the slot number of the active switching fabric module. A value of NONE indicates that the active switching fabric module is either powered down or not present in the chassis.

—Indicates the slot number of the backup switching fabric module. A value of NONE indicates that the backup switching fabric module is either powered down or not present in the chassis.

—Determines the value of each module. If set to True, each and every module is allowed to run in bus-only mode. If set to False, none of the modules are allowed to run in bus-only mode. (All the non-fabric capable modules will be powered off.) Absence of fabric module results in all the fabric capable modules being powered off.

—Indicates whether truncated mode is administratively enabled on the device or not.

Module Switching Mode

Indicates switching mode of the module:

—Module does not use fabric. Backplane is used for both lookup and data forwarding.

—Module uses the backplane for forwarding decision and fabric for data forwarding.

—Module uses fabric for data forwarding and local forwarding is enabled.

Module-Channel

Module slot number

Module-Status

Status of the fabric channel at the module

Fabric Status

Status of the fabric channel at the slot

Speed (MB)

Speed (MB/second) of the module

Module-Channel

Channel for the module

In Errors

The total number of error packets received since this entry was last initialized.

Our Errors

The total number of error packets transmitted since this entry was last initialized.

Dropped

The total number of dropped packets transmitted since this entry was last initialized.

In Utilization (%)

Input utilization of the channel for the module.

Out Utilization (%)

Output utilization of the channel for the module.

Ternary Content Addressable Memory Information

lists and describes the TCAM information.

Table 3-5 Ternary Content Addressable Memory Information

Field

Description

Security Acl Mask

Indicates that TCAM space is allocated to store ACL masks.

Security Acl Value

Indicates that TCAM space is allocated to store ACL value.

Dynamic Security Acl Mask

Indicates that TCAM space is allocated to dynamically store ACL masks.

Dynamic Security Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Qos Acl Mask

Indicates that TCAM space is allocated to store QoS masks.

Qos Acl Value

Indicates that TCAM space is allocated to store QoS value.

Dynamic Qos Acl Mask

Indicates that TCAM space is allocated to dynamically store QoS masks.

Dynamic Qos Acl Value

Indicates that TCAM space is allocated to dynamically store ACL values.

Layer 4 Port Operator

Indicates that TCAM space is allocated for layer 4 port operators purpose.

Interface Mapping Module

Indicates that TCAM space is allocated for interface mapping purpose.

Router Health Options

If your device is a router, the Router Health window displays with a drop-down box that provides the following options:

Router Health

Router Information

Router Health

describes the contents of the Router Health window.

Table 3-6 Router Health Information

Field

Description

CPU Usage (graph)

Overall CPU busy percentage in the last 5 minute period

CPU Type

Describes type of CPU being monitored

Last 1 minute

Overall CPU busy percentage in the last 1 minute period.

Last 5 minutes

Overall CPU busy percentage in the last 5 minute period.

Temperature Description

Description of the test point being measured

Temperature Status

The current state of the test point being instrumented; one of the following are the states:

Normal

Warning

Critical

Shutdown

Not Present

Not Functioning

Unknown

Failures

The failing component of the power supply being measured:

None—No failure

inputVoltage—Input power lost in one of the power supplies

dcOutputVoltage—DC output voltage lost in one of the power supplies

Thermal—Power supply thermal failure.

Multiple—Multiple failures.

Fan—Fan failure

Overvoltage—Over voltage.

Memory Type

Type of memory including processor and I/O.

Used

Number of used MB for a particular memory type.

Free

Number of free MB for a particular memory type.

Largest Free

Number of largest contiguous free MB for a particular memory type.

Router Information

lists and describes the fields of the Router Information window.

Table 3-7 Router Information

Field

Description

Name

Name an administrator assigned to this managed node, this is the node's fully-qualified domain name.

Hardware

A textual description which should contain the manufacturer's name for the physical entity and be set to a distinct value for each version or model of the physical entity.

Supervisor Software Version

The full name and version identification of the system's software operating-system and networking software.

Up Time

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Location

The physical location of this node.

Contact

The textual identification of the contact person for this managed node and information on how to contact this person.

Modem

Indicates whether the RS-232 port modem control lines are enabled.

Baud

The baud rate in bits per second of the RS-232 port.

Power Supply

Description of the power supply being instrumented.

Power Supply Type

The power supply source:

unknown

ac

dc

externalPowerSupply

internalRedundant

Power Supply Status

The current state of the power supply being instrumented.

6: notFunctioning

Analyzing Media

The menu selections for Analyzing Media are:

RTP Streams

Voice Call Statistics

Calls Table

RTP Conversation

Site MOS

RTP Streams

Understanding the RTP Stream Data

Monitoring RTP Streams

Understanding the RTP Stream Data

To view RTP stream information, summary statistics on the stream, and per-interval statistics, use the RTP Streams.

This window shows you three pieces of information:

RTP Stream Information

Source IP Address and Port: IP address and UDP port of the originator of the RTP stream.

Destination IP Address and Port: IP address and UDP port of the receiver of the RTP stream.

SSRC: Synchronization source number as it appeared in the RTP header of the RTP stream.

codec: encoding decoding format of the RTP stream.

RTP Stream Stats Summary

This shows you the summary of the RTP stream for the entire duration of RTP stream.

Duration: duration of the RTP stream. This may not be the entire duration of the stream. It depends on the viewing time interval of the window which launched this RTP stream detail window.

Worst / Duration Weighted / Max MOS: the lowest score among per-interval reports, the score of all per-interval reports that takes duration into account, and the highest score among per-interval reports of the stream.

Note Duration-weighted is calculated with the following formula:
SUM (per-minute-mos * duration) / SUM (duration)

Worst / Duration Weighted / Min Jitter: the largest jitter among per-interval reports, the jitter that takes into account of the duration of all per-interval reports, and the smallest jitter values among per-interval reports of the stream.

Note Duration-weighted are used with the following formula:
SUM (per-interval-jitter * duration) / SUM (duration)

Worst / Overall / Min Actual Packet Loss: Loss percent of RTP packets that are not seen by NAM and RTP packets that arrived beyond the buffer capability of the receiving endpoint. This includes the highest percentile among per-interval reports, the sum of packets loss against total packets of all per-interval reports, and the lowest percentile loss among per-interval reports.

Worst / Overall / Min Actual Packet Loss: Similar to above, but the percent loss only includes RTP packets that were not seen by the NAM.

Worst / Total / Min Concealment Seconds: Number of seconds in which NAM detected packet loss during the duration of the stream. This includes lowest concealment seconds among per-interval reports, total concealment seconds of the entire duration of the stream, and highest concealment seconds among per-minute stream reports.

Severe Concealment Seconds: Similar to above; severe condition is met when the seconds have more than 5 percent loss.

RTP Stream Stats Details

This table shows the per-interval stats calculated by NAM at each interval. The columns of the tables are:

Report Time: time when the stats were calculated. This is the end time of the interval.

Report Duration: the stream duration during the report interval.

Worst MOS: the lowest score of the stream among 3-second MOS score. NAM internally evaluates the MOS value of the stream every 3 seconds. This is the lowest score among them.

Average MOS: average score of the 3-second score values during the duration of the stream in the interval. This value is used in deriving the Duration Weighted MOS value in NAM.

Jitter: variation of packet arrival time compare to the expected time.

Actual Packet Loss percentile: percentile of packets that are not seen by NAM.

Adjusted Packet Loss percentile: percentile of packets that include the actual packets lost an packets that had arrived too late to get into buffer prior to paying back at the endpoint.

Concealment Seconds: number of seconds in which the NAM sees packet loss.

Severe Concealment Seconds: number of seconds in which the NAM detected more 5 percent of packet loss.

Packets: total packets NAM have seen for the interval.

Monitoring RTP Streams

Use Prime NAM to monitor the network to ensure that call quality is good. If quality issues appear, isolate and troubleshoot the problem rapidly.

. You can access this from the RTP Conversation table by clicking on a specific stream or from the Call Detail window by clicking on the stream that is associated with the call.

This chart indicates current voice quality of all RTP streams being monitored. MOS values range from 1 to 5, where 1 is poor and 5 is excellent (see the legend for a breakdown into categories-Poor, Fair, Good and Excellent). Use the Top N RTP Streams source and destination endpoints to view whether there are calls that are in the poor range.

Step 2 To isolate calls that have had a poor MOS, scroll down to Top N RTP Streams and click on the chart to drill down into the RTP Stream Details. Note that MOS values for calls below 3.0 might be considered low. You can also look at the other metrics provided in the same row (for example, row one. note the jitter and packet loss rate scores to see if they also result in a low MOS value. This information can help you determine if jitter is the root cause of the poor calls; or if it is instead packet loss somewhere in the network.

Step 3 With the endpoints’ IP addresses, you can look at the network topology to identify where in the network your subnet is located.

. This page lists all interfaces and errors or discards on each interface. Look up the link that leaves the site in question. That interface is likely the source of the packet loss. Check the interface for faults and fix as needed.

Understanding RTP Streams

. You can also arrive at this page by:

From the RTP Conversation table, clicking on a specific stream

From the Call Detail window, clicking on the stream that is associated with the call

In this window, at least one of the following is required: Site or data source.

The five charts available in this window are:

RTP Streams : Number of streams that fall in the quality bands of excellent, good, fair, and poor during the selected interval.

Top N Source Endpoints : Endpoints that generated the lowest duration weighted MOS during the selected interval.

Top N Destination Endpoints : Endpoints that experienced the lowest duration weighted MOS during the selected interval.

Top N RTP streams : RTP streams that have the lowest duration weighted MOS during the selected interval.

Top N RTP streams by Adjusted Packet Loss : RTP streams that have the highest overall adjusted packet loss percent during the selected interval.

Voice Call Statistics

. The charts will provide an overview of voice quality.

The charts available are:

Voice Call Statistics : Number of calls per signaling protocol (SCCP, SIP, MGCP, and H.323) at each interval during the selected interval.

Top N End Points by Jitter (ms) : Endpoints that have the largest average of endpoint reported jitter during the selected interval.

Top N End Points by Packet Loss (%) : Endpoints that have the largest average of endpoint reported packet loss during the selected interval.

Top N Calls by Jitter (ms) : Calls that have the longest endpoint-reported jitter during the selected interval.

Top N Calls by Packet Loss (%) : Calls that have the most endpoint reported packet loss percent during the selected interval.

Calls Table

The Calls Table shows you calls that the NAM detected by inspecting voice signaling protocols’ payload. For this table to have data, the NAM must see:

SCCP protocol: Call Information message of the call.

SIP protocol: SIP INVITE message of the call. Note that SIP protocol will be detected as per call leg.

H.323 protocol: Call SETUP of the call.

MGCP protocol: Create connection message of the call. Note that MGCP will be detected per call leg.

Note SIP and MGCP will be detected per call leg. Each call could be two or more parties. Each party has its own call leg from the call party to control entity; for example, Cisco Unified Communications Manager or MGCP gateway. Any information that is not detected by NAM will be displayed as “-” or blank.

. The Calls Table and RTP Streams for the Selected Call Table display. These tables show a list of all currently active calls.

Note Some values in the Calls table are not available until the end of the call, and Cisco Unified Communications Manager must be configured to have the IP phones send out the call status and quality information.

Note All calculated metrics in Table C-44, Calls Table, are based on a one minute interval.

provides descriptions of the Calls Table fields.

If you click on a call row in the table, in the RTP Streams for the Selected Call display at the bottom of the page you will see all streams that are associated with the call. It will display the RTP streams that:

have source address and port matched the call’s calling host address and calling port or called host address and called port

have destination address and port that matched the call’s calling host address and calling port or called address and called port

Note There is a delay of two minutes of RTP streams statistics. As the result, there may not be any RTP stream information of the call.

.

button. A pop up window will show more detailed information of the stream displayed.

RTP Conversation

. This table shows you the overview of RTP streams analyzed by NAM during the selected interval. You can drill down to each stream to get stream statistics, which are analyzed by the NAM at each interval. To get more detailed information, you can:

Click on the RTP stream for which you want to see more information.

Click on the “RTP Stream Details” context menu. A pop up window will show you the detailed information of the stream.

.

Site MOS

You can use the Mean Opinion Score (MOS) to quantify the perceived level of quality you are receiving in your network voice traffic. This allows you to assess the work of codecs, or algorithms, which compress audio traffic to save on bandwidth utilization but may result in a drop in quality.

You must first set up the software to monitor voice data, then you can view the collected voice data using Analyze > Media > Detailed Views > Site MOS.

contains details on Site MOS scores.

Using the NAM Application Programming Interface

NAM provides an Application Programming Interface (API) that allows you to configure and retrieve data from the NAM. The API follows the commonly used Representational State Transfer (REST) style of providing services over HTTP or HTTPS. The NAM REST API is also referred to as the Northbound Interface (NBI).

.

Capturing and Decoding Packets

You can set up multiple sessions to capture, filter, and decode packet data using the Capture feature. You can then manage the data in local or remote storage and display the contents of the packets to collect troubleshooting information.

Note This software feature may be limited depending on your hardware platform. For details, see the NAM Compatibility Matrix or the Cisco Prime Network Analysis Module Release Notes.

This chapter contains the following sections:

How Do I Solve My Problem?

Manually Starting a Capture

Using Alarm-Triggered Captures

Scheduling Captures

Troubleshooting Application Slowness Using Alarms

Application Performance Monitoring Using Capture and Decode

Creating and Managing Capture Sessions

Working with Capture Files

Utilizing Capture Data Storage

Inspecting Packet Decode Information for Suspicious Traffic

How Do I Solve My Problem?

This section provides an overview of how to collect and analyze packet data to ensure your network is running well or pinpoint network issues.

for details on how to get a quick capture.

provides an at-a-glance summary of capture tasks you can perform to ensure your network is optimized and trouble-free.

Table 4-1 Data Collection and Analysis At-a-Glance

Basics

Operation

Description

Capture the traffic quickly from any NAM dashboard when anomalies are present

Quick Capture

Targets data collection based on the dashboard graph you select and provides a capture session and decode window to analyze the traffic immediately. See Manually Starting a Capture.

to configure and start your capture.

Proactively capture packet data to learn the cause of a network issue

Continuous capture or schedule capture

Allows you to set up data collection to:

Collect data prior to a network problem

Set up data collection based on an anomaly that reoccurs

See Using Alarm-Triggered Captures or Scheduling Captures.

Create hardware and software filters to focus on specific long-term packet data

On supported NAM hardware, helps to limit the amount of packet data processing. See Configuring Hardware Filters and Configuring Software Filters.

Storing packet data for problem identification

Continuous capture

Allows you to save data to external storage targets, potentially for larger disk capacity and higher capture throughput or to offload capture files. Continuous capture overwrites itself in memory when the buffer is full.

See About Capturing to Data Storage.

Create targeted monitoring for problem isolation

Stop Capture and Save to File

.

See Configuring Alarm Actions and Using Alarm-Triggered Captures.

Set up storage for data collection

Allows you to save data for extended periods either to memory or storage. See About Capturing to Data Storage.

Analyze data for potential issues

Decode

See Inspecting Packet Decode Information for Suspicious Traffic.

Manually Starting a Capture

. Figure 4-1 shows an example of a context menu for Top N Applications dashboard.

For details on how to use the decode window to analyze your data, see Inspecting Packet Decode Information for Suspicious Traffic.

Figure 4-1 Quick Capture

Using Alarm-Triggered Captures

You can configure multiple alarm-triggered captures that start and stop automatically by alarm events you define.

To set up an alarm-triggered capture:

and create a capture session. For detailed instructions, see Configuring Capture Sessions.

to make a new trigger capture action which uses the session from Step 1.

Configure an alarm event for the type of event for which you want to capture data. For detailed instructions, see Configuring Alarm Actions.

window.

To configure the threshold of parameters of interest in the associated Alarm Event, see Defining Thresholds.

Scheduling Captures

You can configure multiple time-based triggered captures that start and stop automatically based on a certain time or period of time that you define. This is also referred to as continuous capture. Continuous capture overwrites itself in memory when the buffer is full. The following is an example of setting a 60 minute window to schedule capture packet data.

To set up a schedule capture:

window.

check box.

.

.

Step 5 Select appropriate software filters.

.

.

Troubleshooting Application Slowness Using Alarms

This section describes how to use Prime NAM to use triggered alarms and capture files to help you determine the source of some network problems.

Before You Begin

You must already create an alarm that notifies you when there is a surge in application traffic. If you need to create an alarm, thresholds, and set up email notification, see Setting Up Alarms and Alarm Thresholds.

To use existing alarms to help you to create and analyze captured packet files:

to view the Top N Applications by Alarm Count dashboard.

, you could view the top sites by alarm count dashboard in order to see the alarm details and determine what threshold variable is causing the alarm to trigger.

in order to analyze the response time during the time interval of the alarm trigger. If you application is not listed in the graph, you can select the table icon to choose your application from the list of all the applications and drill down from there to analyze the response time.

Step 3 Adjust the Interactive filter to view specific time ranges and severity levels in order to view where the spike in response time occur. This helps to determine if the occurrence is limited to a one-time event, if it occurs more than once in a short period of time, or is an event related to a specific time of the day. For example, by changing the time range filter from 1 hour to 4 hours to 1 day, you can see the latest data trends that help you to determine what to do next. See Filtering Traffic for Viewing on the Dashboards.

Step 4 In the graph that displays, focus in on the time frame when the event occurs by using the slider to pinpoint the event. Look for peak or valleys; these may be critical changes that require investigation. Using the legend you can determine whether the event was caused by the network or server. See Changing the Time Interval Using Zoom/Pan Charts.

Step 5 Select any of the metrics provided below the application average response time graph.

a. To view if there are specific clients that have significant transaction time differences, see the Top Clients By Average Transaction Time graph in order to identify data such as Client-Server Application Transactions using an application-specific filter.

To view a table of response time metrics and add new metrics for additional data (such as average server response time) and use the drop down menu to select which other metric data you want to appear in the graph.

Application Performance Monitoring Using Capture and Decode

This task explains how to proactively monitor your application performance, then use it to help isolate and troubleshoot application latency issues experienced by your end user.

Before You Begin

, see Synchronizing Your System Time.

and select the Deep Packet Inspection checkbox.

For detailed instructions, see Adding More Detail into Dashboard and Application Reports.

.

For detailed instructions, see Setting Up Alarms and Alarm Thresholds.

and use the Top N Applications by Transaction Time dashboard to identify which application may be impacted.

You can select the table view to see more than the top default applications. You can also use the other dashboards to view server or client transaction times. See Using Response Time Summary.

Step 4 Analyze the application performance behavior over time using the Interactive Report filter. Determine if the behavior is transient, persistent, recurring, and so on. For details on using the Interactive Report filters, see Filtering Traffic for Viewing on the Dashboards.

Step 5 Zoom in to view specific spikes in the performance, and drill down to isolate whether the cause of the degradation stems from your network, server or application. See Changing the Time Interval Using Zoom/Pan Charts.

Step 6 Analyze the server response time and network performance metric in order to eliminate one of them as the cause. See Server Response Time and Network Response Time.

Step 7 Analyze server activity based on the traffic the server is placing on the network and assess the cause of increase in the server response time. See Analyzing Host Traffic.

Step 8 Perform packet captures in order to identify the root-cause. For details on quick captures or trigger captures, see Capturing and Decoding Packets.

Step 9 Perform additional actions to isolate and troubleshoot the problem including: QoS analysis and interface analysis.

Creating and Managing Capture Sessions

You can use capture sessions to capture, filter, and decode packet data, manage the data in a local or remote storage, and display the contents of the packets. The captured packets can be decoded and analyzed using Prime NAM for more efficient problem isolation.

This section contains the following topics:

Configuring Capture Sessions

Configuring Software Filters

Configuring Hardware Filters

Understanding Hardware and Software Capture Sessions Filters

Viewing Capture Sessions

Understanding Global Capture Settings

Configuring Capture Sessions

Because it may be important for you to collect data over time and have various locations for which you want to analyze data, we support multiple sessions per capture location/target. You can collect data using multiple sessions per target, but only one session can be running per target. Prime NAM now supports up to 25 capture sessions. If you have external storage you can save to local disk and some number of LUNs. As part of configuring a capture session, you can also create software filters, if desired (see Creating a Software Capture Filter for a Capture Session).

To configure a new capture session:

.

to set up a new capture. The NAM displays the Configure Capture Session window.

) as appropriate.

, and so on.

to finish configuration for this session, or configure Software Filters for this session (see Understanding Global Capture Settings).

Configuring Software Filters

You can create and save specialized filters that will disregard all capture data except the information in which you are interested (see Figure 4-3). You can configure multiple software filters for each session (up to six). This allows you to narrow in on the traffic that you are interested in, and it also saves resources (either memory or disk space).

Use the following topics for help on filtering network traffic using software filters:

Creating a Software Capture Filter for a Capture Session

Editing a Software Capture Filter

Understanding Software Capture Filter Options

Creating a Software Capture Filter for a Capture Session

You can create software capture filter for many variables. This workflow examines how to create a capture session with a software filter.

To create a software capture filter:

.

to create a new capture session.

If you already have a capture session to which you want to add a software filter, see Editing a Software Capture Filter for detailed instructions.

for descriptions of the fields.

to close the dialog box without creating a software filter.

Editing a Software Capture Filter

To edit software capture filters:

.

.

.

Step 3 Enter information in each of the fields as appropriate.

Step 4 Do one of the following:

To apply the changes, click Submit .

To cancel the changes, click Cancel .

Important Notes about Software Capture Filters

This section contains important software capture filters details that may be helpful to know.

For NAM-3 and NAM-NX1 service modules, multiple software filters use the “OR” logic; in other words, if a packet passes any software filter, it is captured.

If you create a session and then start it, you cannot edit the session or analyze it without stopping it. If you edit a session containing already captured data, you get a warning stating that the session will be cleared and the data removed. If clearing the session and removing the data is acceptable, ignore the warning dialog message, then add a filter to the session and click Submit to enable the new filter settings.

The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or TCP), you will need to use the IP Protocol selector. Selecting, for example, TCP in the “IP Protocol” selector will filter on all packets using TCP.

Tip Be careful when setting capture software filtering for encapsulation. If you set a software capture filter with encapsulation for the top three network traffic layers only, data displays only if the top three layers match the specified encapsulation type.

Understanding Software Capture Filter Options

You can define a software filter to filter based on any of the following options:

Source host address

Destination host address

Network encapsulation

VLAN or VLAN range

Application

Source port or port range

Destination port or port range

Software capture filtering is not supported on URL-based applications.

contains descriptions of the Software Filter dialog box fields.

Note The parameters described in the table above are independently evaluated by the NAM. Therefore, the NAM will allow you to enter parameters that are contradictory, but you will not be able to get meaningful results if they do not match.

For example, the parameters Network Encapsulation and Source/Destination Address are independently evaluated. If a filter is specified with contradicting parameters such as “Network Encapsulation=IP4” and “Source Address=an IPv6 address”, it will never match any traffic, and the result will be 0 packets captured.

Configuring Hardware Filters

You can use hardware filtering to help limit the amount of traffic allowed into the NAM for processing. In service modules, there is a hardware datapath throughput limitation and hardware filtering helps to reduce the traffic into the NAM. The NAM hardware platforms that support hardware filtering include:

Service Modules—NAM-3 and NAM-NX1

Specific NAM 2000 Series Appliances—2204, 2220, and 2320

Depending on your NAM, the hardware filter support varies:

Creating NAM Service Modules Hardware Filters

Creating NAM Appliance Hardware Filters

Creating NAM Service Modules Hardware Filters

This section is applicable only for NAM-3 and NAM-NX1 service modules.

NAM-3 and NAM-NX1 service modules have specific hardware filter logic. These hardware filters allow you to improve capture performance by eliminating extraneous traffic, since packets excluded from capture processing.

Hardware filters and global packet slicing affect all capture sessions, except for ERSPAN capture sessions. See Figure 4-3, “NAM Capture Sessions Example” for an architectural overview.

NAM-3 and NAM-NX1 support up to four hardware filters. You can disable hardware filters without deleting them.

Within each filter, you can set up conditions with the AND/OR logic. Only the same logic type can be used within the same filter; you cannot mix the AND/OR logic within the same filter. Also, you can combine the filters together with the AND/OR logic. See Figure 4-2 for examples of filter logic you can use.

Figure 4-2 Hardware Filter Logic (AND/OR)

The selections are described in the following sections. For information about how you can achieve specific results, see Configuring Hardware Filter Examples.

Tip Software filters add flexibility to your filtering, but hardware filters are most efficient. The less traffic that requires software filtering, the more efficient the filtering.

See these topics for information about setting up and managing hardware filters:

Creating or Editing a NAM Services Modules Hardware Filter

Configuring Hardware Filter Settings

Configuring Hardware Filter Examples

to view the status and settings of hardware filters that are configured on the Cisco NAM. The Hardware Filters box appears at the bottom of the Sessions page.

Creating or Editing a NAM Services Modules Hardware Filter

The Hardware Filters window displays the status and settings of the hardware filters if they have been defined. To configure a capture with hardware filters:

. The top half of the window shows Capture Sessions, and the bottom half of the window shows Hardware Filters.

. The Hardware Filter Dialog appears.

Step 3 Enter a name for the hardware filter in the Name field. The name should be less than 40 characters and contain only supported characters.

check box.

).

.

to complete the configuration of the hardware filter.

Configuring Hardware Filter Settings

The Hardware Filter Settings allows you to set global settings for all capture hardware filters.

To add settings that apply to all hardware filters:

.

.

Combination Logic, which will be applied to all configured hardware filters. This logic is used to combine the filters; see the green text in Figure 4-2.

Packet Match Logic. This selection will apply to all configured hardware filters.

will drop packets that match all of the hardware filters you have configured. Meanwhile, all packets that do not match will be captured.

.

Configuring Hardware Filter Examples

Use these topics to configure the following network traffic:

IP Subnet + L4 Port (L5 Application)

VLAN + L4 Protocol

Multiple Hosts

VLAN Range

Data Port + Frame Length

MPLS

IP Subnet + L4 Port (L5 Application)

To capture all HTTP traffic emanating from the 10.1.1.0/24 subnet:

.

Step 2 Enter a name in the Name field.

radio button (this will combine the selections you make below).

check box and enter the subnet “10.1.1.0/24”.

check box and enter the port “80” for HTTP.

.

To see the opposite direction of the HTTP conversations:

.

Step 2 Enter a name in the Name field.

radio button.

and enter the same subnet as before, 10.1.1.0/24

and enter the same port, 80.

.

logic. This will combine the two hardware filters with the OR logic.

VLAN + L4 Protocol

To see all TCP traffic from VLAN 100:

.

Step 2 Enter a name in the Name field.

radio button.

and enter the VLAN, 100.

and choose TCP.

.

Multiple Hosts

To see traffic sent to and from multiple hosts: 1.1.1.1, 2.2.2.2, ...:

.

Step 2 Enter a name in the Name field.

radio button.

check box and enter the first host: 1.1.1.1.

and enter the same host: 1.1.1.1.

.

to make a second hardware filter.

Step 8 Enter a name for the hardware filter in the Name field.

radio button.

check box and enter the second host, “2.2.2.2”.

check box and enter the second host, “2.2.2.2”.

.

Step 13 Repeat Step 7 through Step 12 for a third and fourth host, if desired.

radio button.

VLAN Range

To see all traffic from VLANS 10 through 20:

.

Step 2 Enter a name in the Name field.

from the drop-down menu.

Step 4 In the empty field, enter the bottom VLAN range boundary, “9.”

.

to make a second filter.

Step 7 Enter a name in the Name field.

from the drop-down menu.

Step 9 In the empty field, enter the bottom VLAN range boundary, “21.”

.

radio button, which will combine the logic of all hardware filters.

Data Port + Frame Length

To see all traffic spanned to DATA PORT 1 that is less than 200 bytes:

.

Step 2 Enter a name in the Name field.

radio button.

.

from the drop-down menu.

Step 6 In the empty field, enter the frame length ceiling, “200.”

.

MPLS

To see traffic in which the first MPLS label is 300:

.

Step 2 Enter a name in the Name field.

.

Step 4 In the empty field, enter the label, “300.”

.

Bi-Direction Conversation

To see both directions of a conversation between hosts 1.1.1.1 and 2.2.2.2:

.

Step 2 Enter a name in the Name field.

radio button.

from the drop-down menu, and enter the first host: “1.1.1.1”.

from the drop-down menu, and enter the second host: “2.2.2.2.”

.

to make a second hardware filter.

Step 8 Enter a name for the hardware filter in the Name field.

radio button.

from the drop-down menu, and enter the second host: 2.2.2.2.

from the drop-down menu, and enter the first host: 1.1.1.1.

.

.

.

Negative Filter Logic

In the previous example, you set up filters that match the packets. For negative filter logic, these now need to be blocked.

To see everything except the conversation from the previous example:

.

radio button.

.

Go to the next section, Understanding Global Capture Settings, for information about configuring software filters for capture sessions.

Creating NAM Appliance Hardware Filters

This section describes how to create NAM appliance hardware filters.

Hardware filters allow you to improve capture performance by eliminating extraneous traffic, since packets filtered out are excluded from capture processing. This section applies to the NAM 2204, 2220, and 2320 appliances.

Note The NAM 2304 does not support hardware filters.

Software filters add flexibility to your filtering, but a capture session is most efficient when you use only hardware filters. The less traffic requiring software filtering, the more efficient the filtering.

For the NAM appliances that support hardware filtering, you can set up to five hardware filters per appliance.

Hardware filters and global packet slicing affect all capture sessions, except for ERSPAN capture sessions.

See Configuring Supported NAM Appliance Hardware Filters for detailed steps.

Configuring Supported NAM Appliance Hardware Filters

window. To configure a hardware filter:

.

.

Step 3 Enter a name in the Name field.

Step 4 Choose any or all of the following types of filters:

Frame Length

VLAN IDs

MPLS Label

Source Address/Mask

Destination Address/Mask

L4 Protocol

L4 Source Port

L4 Destination Port

IP and Payload Data

Payload Data

Step 5 Data fields will then appear that correspond with the type of hardware filter you select. Fill in the desired fields.

to complete the configuration of the capture session.

IP and Payload Data

To configure an IP and Payload Data hardware filter:

Step 1 Enter a Filter Name and select your options.

Step 2 Enter a Source Address / Mask (optional).

Step 3 Enter a Destination Address / Mask (optional).

Step 4 Choose a Layer 4 Protocol, either TCP or UDP.

Step 5 Enter the values for Pattern Match:

Enter a Value of up to four bytes (eight hex characters).

Enter a Mask of up to four bytes (eight hex characters).

Enter an Offset from 1-1023. The offset is relative to the beginning of the payload (Layer 5).

Note Only one payload segment (one row) is required and provided. This is to guard against overlapping payload segments. If overlapping segments have different values the filter will never match anything due to the inherent AND logic.

.

Payload Data

To configure a Payload Data hardware filter:

Step 1 Enter a Filter Name.

Step 2 Choose a Layer 4 Protocol, either TCP or UDP.

Step 3 Enter the values for Payload Data:

Enter a Value of up to four bytes (eight hex characters).

Enter a Mask of up to four bytes (eight hex characters).

Enter an Offset from 1-1023. The offset is relative to the beginning of the payload (Layer 5).

Note Only one payload segment (one row) is required and provided. This is to guard against overlapping payload segments. If overlapping segments have different values the filter will never match anything due to the inherent AND logic.

.

Understanding Hardware and Software Capture Sessions Filters

You can filter specific traffic data and manage that information in local or remote storage. This increases your visibility into network issues and allows you to filter out unnecessary information. You can use either hardware or software filters to target specific packet data to receive.

As shown in Figure 4-3, if network packets coming into the NAM pass through the hardware filters you have configured, the packets go on to the next step. If no hardware filters are configured, all packets pass through.

Note Hardware filters are supported on specific Prime NAM platforms. See Configuring Hardware Filters for details.

Packets must then pass at least one software filter in that particular session to be saved by that session. If no software filters are configured for a session, then all packets are captured. For more information about software filters, see Configuring Software Filters.

For better performance for the supported NAM platforms, hardware filters are recommended over software filters, and fewer sessions are recommended over more sessions.

You do not have to configure the items in Figure 4-3 in any particular order. For example, you can set Global Capture Settings first, and then configure Capture Sessions, and then create filters; or, you can create Hardware and Software filters first, and then configure Capture Sessions, and finally apply Global Capture Settings. We recommend that you “Start” the session last; otherwise, you will start capturing before you have configured any filters and before doing any packet slicing.

Global Capture Settings and Hardware Filters can be changed at any time, even when the session is running; they will affect running capture sessions immediately. We recommend that you first stop your capture session to edit it since you may capture some unexpected packets during the filter change. See Understanding Global Capture Settings for details.

Figure 4-3 NAM Capture Sessions Example

Viewing Capture Sessions

.

describes the Capture Sessions fields and operations that you can perform from the Capture Sessions window.

Understanding Global Capture Settings

You can limit the size of the captured packets by using the Global Capture Settings to apply a custom packet slice and error settings for all capture sessions. This setting applies to NAM-3 and NAM-NX1 only. You can change these settings even when a filter is running since they affect the running sessions immediately.

and complete your selections.

To understand these settings see:

Global Packet Slicing

Error Packets

Global Packet Slicing

Global packet slicing affects all capture sessions, as opposed to the per-session Packet Slice Size parameter, and is performed in hardware. Use this feature to capture packets more efficiently when only the first N bytes are of interest to you. The capture buffer/file is smaller and the NAM is able to capture more packets per second.

The default setting for Global Packet Slicing is Disabled.

This setting overrides individual capture session software slicing settings if it is shorter. For example, if you have a capture session with the slicing field set to 100, but you also have Global Packet Slicing set to 56, then all packets will be sliced down to 56 bytes.

Hardware filters and global packet slicing affect all capture sessions, except for ERSPAN capture sessions.

In addition to global packet slicing you can set choose to allow error packets in the packet. For details on error packet settings, see Error Packets.

Error Packets

Error packets are packets that would normally be dropped by the network interface card, such as under size and over size packets, as well as packets with CRC errors. Error packets can be very helpful for troubleshooting the network.

If you want to customize how Prime NAM treats error packets use the following options:

Include in capture (Default)—Includes packets with and without errors.

Exclude from capture —Omits error packets. The packet capture only includes packets without errors.

Only error packets in capture —Omits packets without errors. The packet capture includes only packets with errors. This option will save disk space but may not be as helpful since you may be unable to see the big picture view of all packet details.

This setting applies to all capture sessions on NAM-3 and NAM-NX1 only.

This setting is applied to all capture sessions. In addition to setting error packets, you can also enable global packet slicing. For details on global packet slicing settings, see Global Packet Slicing.

Working with Capture Files

To decode, download, rename, convert/merge, delete, analyze, or error-scan saved packet capture files use the Files option.

This section covers the following topics:

Analyzing Capture Files

Downloading Capture Files

Deleting a Capture File

Deleting Multiple Capture Files

Understanding Capture Sessions

Analyzing Capture Files

) enables you to obtain various statistics including traffic rate (bytes/second) over a capture period and lists of hosts and protocols associated with network traffic.

button.

Note After clicking the Drill-Down button, the Host Statistics results table will display both source and destination hosts, if either the source or destination host of the traffic belongs to the Host/Subnet that you had specified.

graph displays the amount of traffic for the amount of time set in the Granularity of the capture file.

address.

describes the different areas of the Capture Analysis window.

Drilling Down into Packet Error Details

You can further investigate, or drill down, into packet error details by viewing the decode packet data available on Prime NAM.

The Capture Errors and Warnings Information window shows warnings and errors, and packet irregularities. From here, you can launch the Packet Decode Window, where you can drill down to packet details.

button.

Downloading Capture Files

You can only download one capture file at a time. To download a capture file to your computer:

.

Step 2 Choose a capture file from the list of captures.

.

”

.

dialog box opens and provides a way for you to rename and save the file at a location of your choice.

Deleting a Capture File

To delete a capture file:

.

Step 2 Check the check box to select a capture file from the list of captures, or select more than one if desired.

” and displays the file name.

to allow the file(s) to remain.

Deleting Multiple Capture Files

To delete all capture files at once:

.

Step 2 Check at least one check box to select a capture.

to delete all captures.

”

to allow them to remain.

Understanding Capture Sessions

To understand how Prime NAM creates capture files with saved packet data, it is important to learn about how NAM handles capture session triggers.

This section contains the following topics:

Types of Capture Triggers

Resolving Session Conflicts

Manipulating Capture Files

Types of Capture Triggers

Packet capture sessions can be triggered on the Prime NAM in several ways:

Manually, by starting a capture using the Capture menu option or clicking the Start capture button.

Scheduled, by specifying a start date/time and maximum duration when you create or edit a capture session.

Alarmed, by creating an alarm with an associated trigger capture action that starts a particular capture session.

Resolving Session Conflicts

Prime NAM supports multiple capture sessions associated with the same capture storage location, but only one of these sessions can be running at any given time. Since there are several ways for such capture session to be started, it is possible for conflicts to arise among such capture sessions.

For example, suppose one capture session is started manually, but another capture session is scheduled to begin capturing while the first is still running. If these two sessions capture to the same storage location, there is a conflict. In this case, Prime NAM resolves the conflict by automatically stopping the manual session and allowing the scheduled session to begin.

In general, NAM resolves capture session conflicts by prioritizing them in the following (descending) order:

1. High-severity alarm triggered capture

2. Low-severity alarm triggered capture

3. Scheduled capture

4. Manual capture

For example, if a manually started capture session is saving data to the local disk and a scheduled capture is set to begin capturing to the same local disk, Prime NAM stops the manual session before the scheduled session begins.

If there are existing capture sessions already running on the same storage target, this means there is a conflicting alarm trigger. An alarm trigger is created when you configure an alarm threshold to start collecting packet data. Each alarm has a severity option.

Once a capture session is completed, you can manipulate the file. See

Manipulating Capture Files

.

For information about how to save capture sessions to files, see Creating and Managing Capture Sessions.

Caution If you have capture files with a state of Full and the NAM is rebooted, the capture is triggered again and these files may be overwritten by the new capture. If you want to retain the file, save the file before you reboot.

Table 4-2 Actions You Can Complete with Capture Files

Action

Description

Decode

Display the packets in a file.

Download

file format (based on your settings in Administration > System > Preferences).

Note Do not add a file suffix when you provide the filename. The suffix .pcap is added automatically.

Rename

Give the file a new name. A dialog box displays and asks you to enter the new name for the selected capture file.

Merge

Merges capture files that were captured simultaneously in chronological order.

Note Merged files cannot exceed 2,000 MB.

Delete

Delete selected capture files.

Analyze

View statistical analysis of the selected capture. See Analyzing Capture Files.

Errors Scan

View more information about the file (Packed ID, Protocol, Severity, Group, and Description). From here you can also decode the packet. For more information see Drilling Down into Packet Error Details.

Utilizing Capture Data Storage

Cisco Prime Network Analysis Module platforms offer external storage connectivity for extended capture durations and higher capture bandwidths. All platforms support iSCSI data storage. Some platforms may support other forms of data storage, but this document covers only iSCSI data storage.

This section covers the following topics:

About Capturing to Data Storage

Installing and Configuring Local and External Storage

Recovering Data Storage

Figure 4-4 External Storage Setup

.

About Capturing to Data Storage

page.

.

This release supports 32 external data storage targets, or Logical Unit Numbers (LUNs).

You can create multiple capture sessions per target. Only one capture per storage target (file location) is allowed at a time. Additionally you can have multiple sessions to memory.

Installing and Configuring Local and External Storage

You can use local or external storage as a repository for long term data for performance comparisons.

This topic covers:

Configuring the iSCSI Array

Preparing LUNs for File Storage

Connecting the Storage Array

Using LUNs to Store Packets from a Capture Session

Logging In and Out of External Storage LUNs

Connecting and Disconnecting External Storage

Configuring the iSCSI Array

You may decide that in addition to or instead of local storage that you want to set up an external storage drive using iSCSI. This section contains the required settings for Prime NAM.

Use your vendor's user documentation to ensure you have properly configured the iSCSI array. The Prime NAM is independent of most array settings, but some are important for accessibility and performance.

Step 1 To configure the disk volumes on the array there is often a Segment Size setting. Larger segment sizes can improve write speeds. Configure the Segment Size setting to use the largest possible segment size (up to 512 KB).

Multiple volumes can be configured on a single array.

Step 2 Assign a Logical Unit Number (LUN) to the disk volume. This number is used for volume identification by the host.

Step 3 Map the LUNs to iSCSI Qualified Names (IQNs) on the array. Each IQN represents a different list of LUNs which hosts (such as the Prime NAM) can access.

Prime NAM supports up to 32 LUNs between all protocols and multiple LUNs mapped to one IQN.

Step 4 Prime NAM also has an IQN, which represents the host side of an iSCSI session. You must give the Prime NAM’s IQN access to the iSCSI array’s LUNs. The array calls this Host Access. Be sure to give the Prime NAM’s IQN read-write access. Most arrays require this for security reasons to ensure that only certain hosts can access the LUNs.

Each Prime NAM has a unique IQN, so perform this required step for each Prime NAM that requires access and for each target LUN that you want to access. For more details about which CLI command to use, see Locating the Prime NAM IQN.

Caution Only one Prime NAM should connect to a LUN because only one host can have write access at a time. If multiple Prime NAMs connect to the same LUN simultaneously, there will be access conflicts and capture operations may not work properly.

Step 5 Ensure the Prime NAM management port has IP connectivity to the iSCSI array. For details on how to complete this required task, see Connecting the Storage Array.

Locating the Prime NAM IQN

To find the Prime NAM IQN, use the remote-storage iscsi local-iqn CLI command:

root@nam.domain# remote-storage iscsi local-iqn

Local iSCSI Qualified Name: iqn.1987-05.com.cisco:WS-SVC-NAM3-6G-K9.00:19:55:07:15:9A

For details on how to complete the storage array configuration, see Connecting the Storage Array.

Connecting the Storage Array

After you configure the iSCSI storage arrays, ensure that the array has an IP path to the Prime NAM management port. The array can be connected while the Prime NAM is running.

Some arrays come with multiple storage controller modules. As a security feature, module ownership must often be mapped to each LUN or IQN.

The Prime NAM logs into the storage to start an iSCSI session using the IP address and IQN(s) of the storage array.

To connect the storage array using the user interface:

.

Step 2 Click iSCSI Login and enter the iSCSI array IP address. Then click Search IQN Targets.

A list of IQNs available to the Prime NAMs host IQN appear.

Step 3 Depending on the outcome, perform one of the following steps:

a. If the IQNs do not appear, check remote-storage iscsi list to verify the iSCSI session was properly started.

The follow example shows how to verify the iSCSI session.

helps you identify one LUN from others mapped to the same IQN. This number is unique to each IQN, meaning two LUNs from different IQNs can have the same number.

b. If the iSCSI session was properly started, check the storage array configuration to verify that:

The LUNs are mapped to the target IQN, and

The Prime NAM IQN has been given Read/Write access to the LUNs.

. All LUNs mapped to that target IQN will be disconnected from the Prime NAM.

Preparing LUNs for File Storage

Some arrays come with multiple storage controller modules, and the module ownership must often be mapped to each LUN (Logical Unit Numbers). This is a common security feature.

To see if the NAM can access the storage array LUNs and prepare them to store files:

.

.

a. Skip to Step 3 if your LUNs are formatted.

b. If no LUNs appear, see Installing and Configuring Local and External Storage and Configuring the iSCSI Array for detailed instructions on how to set up your storage array.

.

.

The Label dialog appears with information about the current label and the last time the LUN was formatted.

You are now ready to use the external storage for capture files.

Using LUNs to Store Packets from a Capture Session

To use a LUN to store packets from a capture session:

.

.

option.

state.

to create the session.

. At that point, no other session can use that LUN until the session is deleted. This prevents contention, corrupted data, and write bandwidth degradation.

Logging In and Out of External Storage LUNs

You can use iSCSI to facilitate data transfers over intranets and to manage your remote capture data storage.

Prime NAM provides a more streamlined workflow to log in and out of your data storage targets. You must log into iSCSI in order to save capture sessions to remote storage. If you do not log in, capture sessions are saved to either local disk or memory locations.

To log in or out of your available remote data storage LUNs:

Step 1 Ensure you have configured your target iSCSI system with read/write permission to your NAM for at least one LUN in the storage array. For details, see About Capturing to Data Storage.

.

.

All available IQNs for that location display in the table.

. The list of IQNs to which you are currently logged into displays in a table.

Step 5 To view the LUNs which the system will log you out, select one of the IQNs and a popup displays the associated LUNs to select.

.

Connecting and Disconnecting External Storage

in the status column, and it is safe to remove the external storage device. External storage is automatically unmounted in this manner when the Cisco NAM is powered down.

Caution If this step is skipped, it is possible to corrupt the storage data upon physical disconnect.

button. It will restore the storage target’s previous state. This makes it unnecessary to physically disconnect and reconnect the storage, which can be particularly useful if the storage is located far away from you.

Recovering Data Storage

.

The following shows a iSCSI recovery example:

root@nam.cisco.com# remote-storage iscsi list

Storage ID: 16

Label:

Status: Unformatted

Protocol: ISCSI

Target IP: 172.20.10.81

Target IQN: iqn.2011-09:celeros.target11

Model: IET VIRTUAL-DISK

LUN: 4

Capacity: 24.98GB

Available: 24.98GB

Storage ID: 15

Label: target 16

Status: In Use

Protocol: ISCSI

Target IP: 172.20.10.81

Target IQN: iqn.2011-09:celeros.target16

Model: IET VIRTUAL-DISK

LUN: 5

Capacity: 24.98GB

Available: 16.47GB

Active iSCSI Sessions:

tcp: [8] 172.20.10.81:3260,1 iqn.2011-09:celeros.target11

tcp: [7] 172.20.10.81:3260,1 iqn.2011-09:celeros.target16

root@nam.cisco.com# remote-storage iscsi fsck 16

FS check completed successfully.

root@nam.cisco.com# remote-storage iscsi list

Storage ID: 16

Label:

Status: Ready

Protocol: ISCSI

Target IP: 172.20.10.81

Target IQN: iqn.2011-09:celeros.target11

Model: IET VIRTUAL-DISK

LUN: 4

Capacity: 24.98GB

Available: 9.87GB

Storage ID: 15

Label: target 16

Status: In Use

Protocol: ISCSI

Target IP: 172.20.10.81

Target IQN: iqn.2011-09:celeros.target16

Model: IET VIRTUAL-DISK

LUN: 5

Capacity: 24.98GB

Available: 16.47GB

Active iSCSI Sessions:

tcp: [8] 172.20.10.81:3260,1 iqn.2011-09:celeros.target11

tcp: [7] 172.20.10.81:3260,1 iqn.2011-09:celeros.target16

Inspecting Packet Decode Information for Suspicious Traffic

After you have captured some traffic data packets, you can use the NAM Packet Analyzer to view the packet contents and inspect for suspicious traffic.

This section includes the following sections:

Analyzing Packets in the NAM Packet Analyzer

Filtering Packets Displayed in the NAM Packet Analyzer

Viewing Detailed Protocol Decode Information

Understanding the NAM Packet Analyzer

Analyzing Packets in the NAM Packet Analyzer

Figure 4-5 NAM Packet Analyzer Window

Note To use these decode features, you must be capturing to memory with the no rotate option selected. Otherwise, captures must be paused or stopped. For detailed descriptions about the features in this window, see Understanding the NAM Packet Analyzer.

To inspect packet decode information for suspicious traffic:

.

.

Step 3 To quickly filter on a key word or phrase, for example rtp to focus on voice quality, enter the word in the Filter text box (see callout 1 in Figure 4-5). The window refreshes displaying only data that includes the filtered information.

. This action displays only the distribution of the packets that match your filter. For detailed steps, see Filtering Packets Displayed in the NAM Packet Analyzer.

on the Display Filter window. You can also edit or remove existing filters as needed.

Step 6 To view the packet capture flow and focus in on a specific time interval or area of interest click on the slider in the Packet Histogram and move the left or right cursors to zoom in (see callout 2 in Figure 4-5). To pan this filtered data, click and hold the slider while moving it inside the histogram. This provides a visual of packet capture flow and enables you to navigate through the packet list.

Step 7 To toggle

between a one and two-column layout view, choose Tools > Toggle Layout .

between the Packet Histogram and the packet paging controls, choose Tools > Show ...

.

.

. Only visible when filters are in use. Saves to memory or to the capture file based on the options in your Capture Sessions window. See Configuring Capture Sessions.

.

Step 12 Use the Tools menu to perform validation tasks—options have limited support. Options include:

– TCP Checksum Validation check box—filter on TCP in the decode window and use the TCP pane to verify that the checksum has been validated.

– UDP Checksum Validations check box—filter on UDP in the decode window and use the UDP pane to verify that the checksum has been validated.

– IP Host Name Resolution—perform global host name resolution for NAM. Synchronizes with the Administration preferences.

Step 13 To view packet details including packet range displayed, data port, and number of filtered packets, see the heading in the upper right corner of the NAM Packet Analyzer window.

Filtering Packets Displayed in the NAM Packet Analyzer

To filter packets based on multiple options for display in the NAM Packet Analyzer:

. The NAM Packet Analyzer - Display Filter Window displays.

Step 2 Do the following:

Choose a Filter Mode :

displays packets that match the condition(s.)

displays packets that do not match the condition(s).

Choose an Address Filter :

address filters on IP address.

address filters on MAC address.

allows you to specify the source address, or leave it blank if not applicable.

allows you to specify the destination address, or leave it blank if not applicable.

allows you to match of packets traveling in both directions.

Define a Protocol Filter :

to display packets that match any of the protocols or fields.

or

to display packets that match all of the protocols or fields.

list.

Note You can enter the first few letters of the protocol name to go directly to the protocol. If you make a typo, press ESC or SPACE to reset.

– Choose a protocol field from the Fields list, then specify the field value if applicable.

sign.

sign.

to apply the filter and keep the window open.

Viewing Detailed Protocol Decode Information

To view detailed protocol information:

Step 1 Highlight the packet number about which you want more information.

Detailed information about that packet is displayed in the Protocol Decode and hexadecimal dump panes at the bottom of the window.

Note If you highlight the details in the Protocol Decode pane, the corresponding bytes are highlighted in the hexadecimal dump pane below it.

Step 2 To review the information, use the scrolling bar in the lower panes.

Note When you decode SCCP traffic, Prime NAM lists the protocol as skinny, not SCCP.

Tip • Protocols are color coded both in the Packet Browser and the Protocol Decode pane.

Tip • Protocols are color coded both in the Packet Browser and the Protocol Decode pane.

Choose the protocol name in the Protocol Decode pane to collapse and expand protocol information.

To adjust the size of any of the panes, click and drag the pane frame up or down.

Understanding the NAM Packet Analyzer

The NAM Packet Analyzer, also known as the packet decoder, uses two levels of packet analysis: basic and full. Because preparing a large capture file for full analysis can take a long time, NAM automatically chooses which level to use based on your filtering complexity. This allows you to browse your captured packet data more quickly without having to wait for analysis.

When you select a capture file to analyze for the first time, NAM limits some of the more complex display filters you can use. For example, you can filter using protocol identifiers such as TCP, UDP, SDP, and SIP which allow the packet decode to display more quickly than an advanced filtering selection.

If you enter more advanced filters (such as those with and/or logic operators on the protocol field), NAM automatically begins the full analysis of the capture file and then applies your complex filter to display the results. For example, if you filter using ‘ip.src==192.168.1.1 && tcp.dstport==80’, the NAM Packet Analyzer starts the full analysis and displays it only after the results have been filtered.

Understanding the NAM Packet Analyzer Window and Browser Pane

The NAM Packet Analyzer window shows three views of a packet:

a summary line briefly describes the packet type

the protocol field of interest can be shown and analyzed in the portion of the window directly below the summary line

a hexadecimal dump shows exactly what the packet looks like when it goes across the wire.

There are many unique features in the NAM Packet Analyzer decode window; for example, it can assemble all the packets in a TCP conversation and highlight the ASCII data in that conversation. You can use the expanded display filter functionality to allow you to view more focused data.

describes the packet decoder operations on the NAM Packet Analyzer decoder window.

You can perform the following tasks in the NAM Packet Analyzer window:

Show Packet histogram display the number of packets over a specific time range. This provides a feel of the packet flow for the capture. You can use the histogram selector control to navigate through the packet list as well. You can apply a display filter to make the histogram show the distribution of the packets that match the applied filter. Can set time range and move across histogram. Firefox is faster than IE performance with this feature.

Toggle to Show Packet Paging Controls displays the buffer divided into pages.

Toggle layout changes how the three content panes in the decoder are arranged.

Display Hex data font size by hovering over two buttons in the top right corner of the hex data content pane of the decoder. You can increase or decrease the font size of the contents.

Display the current range of packets in the packet list by selecting the Packet range button. You can also enter the range of packets to view.

Use the Display Filter button yo display Saved Display Filters and Manage Display Filters windows.

Alter Protocol coloring. You can map custom colors to specific protocols in this release. Default colors

Use the Tools menu—options have limited support. Options include:

– TCP Checksum Validation check box—filter on TCP in the decode window and use the TCP pane to verify that the checksum has been validated.

– UDP Checksum Validations check box—filter on UDP in the decode window and use the UDP pane to verify that the checksum has been validated.

– IP Host Name Resolution—perform global host name resolution for NAM. Synchronizes with the Administration preferences.

Display Filter input field to manually enter display filters.

Customizing Display Filters

Use custom display filters to create and save customized filters to use in the NAM Packet Analyzer decode window to limit which packets are displayed.

NAM supports most software display filters with the following exceptions:

Filters using Perl Regular Expressions. For example:

http.request.uri matches "gl=se$"

Filters on a protocol payload (a protocol section in a packet). For example:

udp[8:3]==81:60:03

See these topics for help setting up and managing custom display filters:

Creating Custom Display Filters

Editing or Deleting Custom Display Filters

Creating Custom Display Filters

To create custom display filters:

.

The Hardware Filters box is displayed at the bottom of the page.

.

Step 3 Enter information in each of the fields as appropriate.

Step 4 Do one of the following:

To create the filter, click Submit .

To cancel filter creation, click Cancel .

Tips for Creating Custom Decode Filter Expressions

.

Table 4-3 Logical and Comparison Operators

Operator

Meaning

and

Logical AND

or

Logical OR

xor

Logical XOR

not

Logical NOT

==

Equal

!=

Not equal

>

Greater than

to help you add filter expressions.

Examples of Custom Decode Filter Expressions

provides some examples of basic NAM display filters you can use to filter on application types.

Table 4-4 Basic NAM Display Filters (Limited to Application Types)

Filter

Meaning

tcp

Find all TCP-based applications

udp

Find all UDP-based applications

! eth

Find all packets other than Ethernet

tcp and not vlan

Find all TCP traffic NOT running over vlan

http

Find all src/dst HTTP application packets (may be not standard port 80 if different application 'decode as' port specified; e.g. 'tcp.port==8080,http')

ftp || http

Find either ftp or http packets

not tcp

Exclude all TCP packets

! tcp

Exclude all TCP packets

! (ftp || http)

Exclude all FTP and HTTP packets

provides some examples of complex NAM display filters.

Table 4-5 Compound NAM Display Filters

Filter

Meaning

tcp.port eq 80

Find all src/dst HTTP packets on standard HTTP port 80

ip.addr == 192.168.1.0/24

Find all packets in Class C network (subnet)

tcp.flags.reset == 1

Find all TCP resets

tcp.window_size == 0 && tcp.flags.reset != 1

Src is instructing dst to stop sending data (TCP buffer full)

Ipv6.addr == ::1

Correct statement with IPv6 label and IPv6 address.

provides some examples of protocol field hexbyte filters.

Table 4-6 Protocol Field Hexbyte Filters

Filter

Meaning

eth.src==00:3c:06:0a:02:68

Find source MAC

eth.dst==00:3c:06:0a:02:68

Find destination MAC

eth.addr==00:3c:06:0a:02:68

Find source or dest MAC

! (eth.addr==00:3c:06:0a:02:68)

Find all MAC except specific address

eth.addr contains 00:3c

Find bytes in any protocol field subrange

provides some examples of protocol field hexbyte subrange filters.

Table 4-7 Protocol Field Hexbyte Subrange Filters

Filter

Meaning

eth.addr[0:2]==00:3c

Find specific subrange in MAC

eth.addr[1:3]==3c:06:0a

Find specific subrange in MAC

provides some examples of hexbyte data representations syntax.

Table 4-8 Hexbyte Data Representations (Syntax)

Filter

Meaning

eth.dst == ff:ff:ff:ff:ff:ff

Hexbyte separators can be colons

eth.dst == ff-ff-ff-ff-ff-ff

Hexbyte separators can be dashes

eth.dst == ffff.ffff.ffff

Hexbyte separators can be dots (one or two bytes

Note You can use a filter expression with other fields in the Custom Decode Filter dialog box. In this case, the filter expression is ANDed with other conditions. Invalid or conflicting filter expressions result in no packet match.

Editing or Deleting Custom Display Filters

To edit custom display filters:

.

.

Step 3 Change the information in each of the fields as appropriate.

.

Performing User and System Administration

This chapter provides information about what user and system administration tasks are required or optional, how to generate diagnostic information when requesting technical assistance, and provide user access.

This chapter contains the following topics:

Performing System Administration

Troubleshooting Using Diagnostics Tools

Controlling User Access

Managing System Data

Performing System Administration

You can perform the following system administration tasks:

Monitoring Prime NAM Health and Traffic Statistics

Setting Network Parameters

Setting the SNMP Agent

Synchronizing Your System Time

Sharing NAM Data by Enabling Web Data Publication

Setting Remote Servers to Receive Syslog Messages

Configuring Hosts to Receive SNMP Traps from Prime NAM

Customizing System Preferences

Upgrading Your License

.

Table 5-1 System Administration At-A-Glance

Task

Choose...

View system health and traffic details

Use IP hostname resolution/DNS lookup

Add extra security and allow additional host details to be displayed in NAM traffic information

Ensure that the NAM system time is configured correctly (required)

Provide e-mail notification of alarms and reports

Allow general web users and websites to access selected NAM monitor and report windows without a login session

Specify whether syslog messages should be logged locally on the NAM, on a remote host, or both

Set a host destination to which Prime NAM sends trap

Change the Prime NAM display or logging characteristics

Monitoring Prime NAM Health and Traffic Statistics

Ensuring that your Cisco NAM processes your traffic efficiently and effectively without becoming overloaded is a critical task.

.

Use the data provided in the Inputs and Resources tabs to determine scalability issues and to assist with troubleshooting.

describes the types of information of the System Overview window.

Setting Network Parameters

If you want to use IP hostname resolution in Prime NAM, you must configure the nameservers first. Prime NAM supports three DNS servers. If this task is not complete, you will be unable to perform DNS lookup. You can also set

Tip Ensure your name server addresses are correct, otherwise some of your Monitor dashboards and Capture Decode windows may seem slow to load.

To view and set your name servers:

.

The Network Parameters window displays.

Step 2 Enter or change the IPv4 or IPv6 information.

Step 4 Do one of the following:

To save the changes, click Submit .

To cancel the changes, click Reset .

.

Setting the SNMP Agent

An SNMP Agent is a network management software module that resides in a managed device. It has local knowledge of management information and translates that information into a form compatible with SNMP.

.

Also, to further alleviate any security concerns, the SNMP exchanges between NAM blades and the switch take place on an internal backplane bus. These SNMP packets are not visible on any network, nor any interface outside of the switch. It is a completely secure out-of-band channel inside the switch.

For other platforms, such as Cisco NAM appliances, you can type in any IP address and use it as the managed device. In setting managed devices, virtual NAM platforms managed devices function just like the NAM appliances. On all platforms, NAM can only monitor and display data for one managed device at a time.

In this case, the managed device may only want to use SNMPv3 since it is more secure.

Note NAM blades use SNMPv2 to manage the locally managed device.

To view and set the NAM SNMP Agent:

.

.

.

.

.

Working with NAM Community Strings

You use community strings so that other applications can send SNMP get and set requests to the NAM, set up collections, poll data, and so on.

Creating NAM Community Strings

To create the NAM community strings:

.

under NAM Community Strings.

displays.

Step 3 Enter the community string (use a meaningful name).

Step 4 Enter the community string again in the Verify Community field.

Step 5 Assign read-only or read-write permissions using the following criteria:

Read-only allows only read access to SNMP MIB variables (get).

Read-write allows full read and write access to SNMP MIB variables (get and set).

.

Deleting NAM Community Strings

To delete the NAM community strings:

.

.

Caution Deleting the NAM community strings blocks SNMP requests to the NAM from outside SNMP agents.

Testing the Router Community Strings

Before the router can send information to the NAM using SNMP, the router community strings set in the NAM must match the community strings set on the actual router. The Router Parameters dialog box displays the router name, hardware, Supervisor engine software version, system uptime, location, and contact information.

The local router IP address and the SNMP community string must be configured so that the NAM can communicate with the local router.

To set the community strings on the router, use the router CLI. For information on using the CLI, see the documentation that accompanied your device.

Caution The router community string you enter must match the read-write community strings on the router. Otherwise you cannot communicate with the router.

To test router community strings:

.

The Device Information dialog box displays.

Step 2 Enter the Device's Community String.

.

.

Synchronizing Your System Time

Ensure that the NAM system time is configured correctly. If the system time is incorrect, NAM data presentation may be inaccurate due to time ranges, hence providing incorrect interpretations of NAM data.

.

You can configure the NAM system time by using one of the following methods:

Configuring the NAM System Time with an NTP Server

This is valid for all platforms and is the recommended option.

Synchronizing the NAM System Time with the Switch or Router

This option is valid only for NAM-3, SM-SREs, and NAM-NX1.

Synchronizing the NAM System Time Locally

This option is valid for Cisco NAM appliances, Nexus 1000 VSB, and vNAM.

Configuring the NAM System Time with Precision Time Protocol (IEEE 1588)

This option is valid for NAM-3 and NAM-NX1.

Configuring the NAM System Time with an NTP Server

To configure the NAM system time with an NTP server:

.

radio button.

Step 3 Enter one or two NTP server names or IP address in the NTP server name/IP Address text boxes.

Step 4 Select the Region and local time zone from the lists.

.

Synchronizing the NAM System Time with the Switch or Router

Note This section is valid only for NAM-3, SM-SREs, and NAM-NX1. For additional platform options, see Synchronizing Your System Time.

To configure the NAM system time from the switch or router:

.

Step 2 Choose:

Local to sync to your switch or router. If you choose this option you must <is there anything on the router side that needs to be done?>

NTP Server

Step 3 Select the Region and local time zone from the lists. This should be the region in which your NAM is located.

.

Synchronizing the NAM System Time Locally

Note This section is valid for Cisco NAM appliances, Nexus 1000V, and vNAM. For additional platform options, see Synchronizing Your System Time.

To configure the NAM system time locally using the NAM command line:

Step 1 Log into the NAM command line interface.

command.

.

radio button.

Step 5 Select the Region and local time zone from the lists.

to save the changes.

Configuring the NAM System Time with Precision Time Protocol (IEEE 1588)

To use Precision Time Protocol (PTP), you will need to have a PTP-aware or multicast-enabled switch connected to the sync port on the front of the NAM-3 or NAM-NX1, as well as a PTP master connected to the switch.

Note This section is applicable to the NAM-3 and NAM-NX1. For details on any hardware setup requirements related to this feature, see your specific NAM installation guide. For additional platform options, see Synchronizing Your System Time.

To configure the NAM system time using PTP:

.

radio button.

Step 3 Enter the IP address of the PTP interface in the PTP Interface IP Address field.

Tip Set the PTP interface IP address so that it is not in the same subnet as the management interface. If they are in the same subnet, there may be routing issues for outbound management traffic (http, for example).

Step 4 Enter the subnet mask in the PTP Interface Subnet Mask field.

Step 5 For NAM Local Time Zone, select the Region and the Zone from the drop-down lists.

.

Understanding NAM System Time

Ensure that the Prime NAM software application's Linux system time is synchronized with the packet timestamp and the standard time source outside of the NAM platform. Packet timing analysis uses system time to support application response time measurements, voice and video quality metrics, packet decode data, reporting, and many other network statistics.

The NAM gets the UTC (GMT) time from several sources, depending on its NAM platform type. All NAMs can be set up to get their time from an external NTP server. Other NAM platforms may prefer to use an IEEE 1588 Precision Time Protocol (PTP)-based time master due to its high accuracy and precision.

You should also configure any PTP switches that are between the NAM and the master clock to use Edge-to Edge (E2E) mode. E2E is preferred because it reduces PTP messaging bandwidth and eliminates delay accumulation when daisy chaining many nodes. If the master clock and/or PTP switches are not configured correctly, all of the clocks on the NAM will be synced with each other, but to the wrong time.

Caution Both the client computer and the NAM server must have the time set accurately for their respective time zones. If either the client or the server time is incorrect, then the data shown in the GUI is incorrect.

The clock identity is the first three octets of the MAC address, followed by “ff fe,” and then the last three octets of the MAC address, as shown in the example below.

0xec:44:76:ff:fe:5d:12:0

After the NAM acquires the time, you can set the local time zone using the NAM System Time configuration window.

For details on how to configure the NAM system time for your specific hardware platform, see Synchronizing Your System Time.

Setting Up E-Mail Notifications for Alarms

You can configure Prime NAM to provide e-mail notification of alarms and to e-mail reports.

To set up e-mail notifications:

.

check box and enter the required or optional field information.

describes the Mail Configuration Options.

check box and enter the details in the fields provided.

to clear the dialog of any characters you entered or restore the previous settings.

Sharing NAM Data by Enabling Web Data Publication

Web Data Publication allows general web users and websites to access (or link to) selected NAM monitor and report windows without a login session.

Web Data Publication can be open or restricted using Access Control List (ACL) and/or publication code. The publication code, if required, must be present in the URL address or cookie to enable access to published data.

To enable Web Data Publishing:

.

check box.

would be able to access the following published window:

Step 4 Enter an ACL Permit IP Address/Subnets to permit only those IP addresses or subnets access to web publications. No entry provides open access to all.

to clear the dialog of any characters you entered.

Note Before the new iSCSI storage entry takes effect, you must reboot the NAM system.

Setting Remote Servers to Receive Syslog Messages

NAM syslogs are created for alarm threshold events, voice threshold events, or system alerts. You can specify whether syslog messages should be logged locally on the NAM, on a remote host, or both. You can use the NAM to view the local NAM syslogs.

is handled properly.

To set up the NAM syslog:

.

The NAM Syslog Setting window displays.

Step 2 In the Remote Server Names field, enter the IP address or DNS name of up to five remote systems where syslog messages are logged. Each address you enter receives syslog messages from all three alarms (Alarm Thresholds, Voice Signaling Thresholds, and System).

to cancel.

Configuring Hosts to Receive SNMP Traps from Prime NAM

Traps are used to store alarms triggered by threshold crossing events. When an alarm is triggered, you can trap the event and send it to a separate host. Trap-directed notifications can result in substantial savings of network and agent resources by eliminating the need for frivolous SNMP requests.

To configure, edit, or delete a host destination to which Prime NAM will send traps:

.

The SNMP Trap Setting window displays.

.

Step 3 In the Community field, enter the community string set in the NAM Thresholds.

Step 4 In the IP Address field, enter the IP address to which the trap is sent if the alarm and trap community strings match.

Step 5 In the UDP Port field, enter the UDP port number.

to cancel and leave the configuration unchanged.

Customizing System Preferences

describes the fields of the Preferences window and why you may want to change the defaults.

Upgrading Your License

Certain software-only NAM platforms require software licenses to run. You can see your NAM platform installation guide for details.

To obtain a NAM license, go to the following URL:

Follow the instructions on this page to obtain a NAM license file. You will need your NAM platform’s PID and SN to obtain the license file.

Tip Use the Prime NAM show inventory command to obtain the PID and SN for licensing.

After you enter the PID and SN or the Product Authorization Key, a license file will be sent to you by e-mail. Store this license file on an available FTP server. Use the license install command to install the license after the NAM software installation completes.

Several Cisco Prime Network Analysis Module platforms require you to install a product license in the form of a text file (see your release notes as platform support changes with each release). An evaluation license allows you to use the software for up to 60 days. The NAM login window indicates how many days remain before the evaluation license expires. After that time, you will be unable to log into the NAM GUI.

You can provide licensing information, also known as node-locking information, during software installation or after software installation using the NAM CLI.

.

There is no license required for the protocol pack usage in Prime NAM.

Troubleshooting Using Diagnostics Tools

menu provides tools to aid in troubleshooting. You can use these tools when you have a problem that might require assistance from the Cisco Technical Assistance Center (TAC). There are options for:

System Alerts

Audit Trail

Tech Support

For additional information on troubleshooting NAM, see Troubleshooting Network and NAM Issues.

System Alerts

.

to see all of the alerts.

to remove the list of alerts to see if additional alerts occur.

Audit Trail

.

The following user activities are logged in the audit trail:

All CLI commands

User logins (including failed attempts)

Unauthorized access attempts

SPAN changes

NetFlow data source changes

Enabling and disabling data collections

Starting and stopping captures

Adding and deleting users

Each log entry will contain the following:

User ID

Time stamp

IP address (in case of remote web access)

Activity description

To access the audit trail window:

.

The Audit Trail Window displays.

The Audit Trail window provides a way to view the user access log and filter entries based on time, user, (IP address) from or activity. The internal log files are rotated after reaching certain size limits.

Tech Support

.

This information is unlikely to be meaningful to the average user. It is intended to be used by your technical support team for debugging purposes. You are not expected to understand this information; instead, you should save the information and attach it to an e-mail message to your support team or, if applicable, Cisco TAC.

Before You Begin

.

Note You can also view this information from the NAM CLI. For information on using the NAM CLI, see Cisco Network Analysis Module Command Reference.

To view the tech support information:

.

After a few minutes, extensive diagnostic information generates and displays in the window.

. Save the files to your local disk. You can analyze the files locally or, if requested forward on to your technical support team for review.

Downloading Core Files

and follow the instructions.

Controlling User Access

In order to make your Cisco NAM solution more secure, you can take several steps including:

Enable Secure Sockets Layer (SSL) on the Cisco NAM for secure, encrypted HTTP sessions. See your installation guide for details.

Enable Secure Shell (SSH) protocol for secure Telnet to the Cisco NAM.

Enable TACACS+ for authentication and authorization. Cisco NAMs provide support for multiple TACACS+ servers.

This section covers how to control your user’s access using the Administration options:

Local Database

Establishing TACACS+ Authentication and Authorization

Configuring a TACACS+ Server to Support NAM Authentication and Authorization

Current User Sessions

Local Database

When you first install the NAM, use the NAM command-line interface (CLI) to enable the HTTP server and establish a username and password to access the NAM for the first time.

After setting up the initial user accounts (root, admin, and webuser), you can create additional accounts, enabling or disabling different levels of access independently for each user.

provides information about User Privileges and describes each privilege.

.

If you have forgotten your password, use the helper utility to reset your root or user passwords (see Resetting Passwords).

Resetting Passwords

based on your needs.

Table 5-2 Password Reset Options

NAM User

Method

Description

Root, Admin, and webuser

Boot into helper utility

at the NAM CLI.

Root and webuser

NAM CLI command

The easiest way to reset NAM passwords. This command resets both the root and guest user passwords to the factory default state. You must have appropriate privileges to reset passwords.

Root, Admin, and webuser

CLI commands on the switch or router

.

NAM Admin users

Delete the user for whom you have forgotten the password; then create a new one.

Webuser

NAM CLI command

Use if no other local users are configured other than the user for whom you have forgotten the password. Then enable http or https to prompt for the creation of a NAM user.

Changing Predefined NAM User Accounts on the Switch or Router

command or a Telnet login to the NAM CLI) are static and independent of the NAM. You cannot change these static accounts nor can you add other CLI-based users with the NAM.

Creating a New User

To create a new user:

.

The GUI displays the users in the local database. Checks indicate the privileges each user has for the functions listed.

.

The GUI displays the New User Dialog Box.

describes the fields in the New User Dialog Box.

Note If you delete user accounts while users are logged in, they remain logged in and retain their privileges. The session remains in effect until they log out. Deleting an account or changing permissions in mid-session affects only future sessions. To force off a user who is logged in, restart the NAM.

provides information about each privilege.

to clear the dialog of any characters you entered.

Invalid User Name and Password Characters

For usernames, do not use the following:

Exclamation point !

At sign @

Pound sign #

Dollar sign $

Percent %

Carot ^

Ampersand &

Asterisk *

Left or right parentheses ( )

Greater than <

Less than >

Comma ,

Period .

Double quote "

Single quote '

Forward slash /

Backward slash \

For web user passwords, do not use the following:

Double quote "

Single quote '

Greater than <

Less than <

For root or guest user passwords, only the single quote is not allowed.

Establishing TACACS+ Authentication and Authorization

Terminal Access Controller Access Control System (TACACS) is an authentication protocol that provides remote access authentication, authorization, and related services such as event logging. With TACACS, user passwords and privileges are administered in a central database instead of an individual switch or router to provide scalability.

TACACS+ is a Cisco Systems enhancement that provides additional support for authentication and authorization.

When a user logs into the NAM, TACACS+ determines if the username and password are valid and what the access privileges are.

To establish TACACS+ authentication and authorization:

. The TACACS+ Authentication and Authorization Dialog Box displays.

.

Step 3 Do one of the following:

To save the changes, click Submit .

To cancel, click Reset .

Tip If you cannot log into the NAM with TACACS+ configured, verify that you entered the correct TACACS+ server name and secret key.

Configuring a TACACS+ Server to Support NAM Authentication and Authorization

In addition to enabling the TACACS+ option, you must configure your TACACS+ server so that it can authenticate and authorize NAM users. NAM supports ACS versions 5.2, 5.1 (including Patch 1), and 4.2.

Note Configuration methods vary depending on the type of TACACS+ server you use. When configuring NAM within ACS 5.x, uncheck the check box for the Single Connect Device option under the TACACS+ settings.

Continue to the section specific to your particular version:

Configuring a Cisco ACS Server, Version 4.2

Configuring a Cisco ACS Server, Version 5.x

Configuring a Generic TACACS+ Server

Configuring a Cisco ACS Server, Version 4.2

To configure a version 4.2 Cisco ACS server, you must perform two tasks:

Configure the NAM hostname and IP address on the ACS server. See Configuring NAM on ACS for Windows NT and 2000 Systems for Version 4.2 .

Add a NAM user or user group. See Adding a NAM User or User Group for Version 4.2.

Configuring NAM on ACS for Windows NT and 2000 Systems for Version 4.2

To configure a Cisco ACS TACACS+ server (version 4.2):

Step 1 Log into the ACS server.

.

.

Step 4 For the Network Access Server, enter the NAM hostname and IP address.

Step 5 Enter the secret key.

Note The secret key must be the same as the one configured on the NAM.

.

.

Step 8 Continue to Adding a NAM User or User Group for Version 4.2 to complete the next configuration task.

Adding a NAM User or User Group for Version 4.2

To add a NAM user or user group:

.

Step 2 Enter the user login name.

.

Step 4 Enter the user data.

Step 5 Enter a user password.

Step 6 If necessary, assign a user group.

Step 7 In the TACACS+ settings:

.

.

.

.

.

f. In the Arguments field, enter:

permit capture
permit system
permit collection
permit account
permit alarm
permit view

.

.

Configuring a Cisco ACS Server, Version 5.x

To configure a version 5.1 (Patch 1) or 5.2 Cisco ACS server, you must perform these tasks. There is an additional configuration task that enables you to set up policy rules for your users or groups.

Use the following sections to configure your Cisco ACS server:

Configure the NAM hostname and IP address on the ACS server. See Configuring NAM on ACS For Windows NT and 2000 Systems for Version 5.x.

Add a NAM user or user group. See Adding a NAM User or User Group for Version 5.x.

Set up your policy rules. See Configuring Access Policies for ACS and NAM for Version 5.x.

Configuring NAM on ACS For Windows NT and 2000 Systems for Version 5.x

To configure a Cisco ACS TACACS+ server (version 5.1(P1) or 5.2):

Step 1 Log into the ACS server.

.

to add NAM devices.

Step 4 For the Network Access Server, enter the NAM hostname and IP address.

.

Step 6 Enter the secret key and deselect the check box for the Single Connect Device option under the TACACS+ settings.

Note The secret key must be the same as the one configured on the NAM.

.

Step 8 Continue to Adding a NAM User or User Group for Version 5.x to complete the next configuration task.

Adding a NAM User or User Group for Version 5.x

To add a NAM user or user group:

.

Step 3 Enter the user login name.

Step 4 Enter the user data.

Step 5 If necessary, assign a user group.

Step 6 Enter the password information.

.

Configuring Access Policies for ACS and NAM for Version 5.x

In versions 5.1(P1), 5.2, and 5.3 you must set up access policies to complete your ACS and NAM configuration.

to create NAM command sets.

.

when you have completed entering the NAM command sets. Ensure you include all of the following commands:

permit capture
permit system
permit collection
permit account
permit alarm
permit view

; Service Type = Device Administration.)

with the service you created in this step.

to set up the condition to qualify all login requests. NAM devices use these conditions and follow the command set (created in Step 1). For example, your condition may be == NDG: Device Type is All Device Types: NAM device which you set up in Step 2.

to choose a service (for example, the service you created in Step 3).

to set up the ACS server IP and secret key.

Configuring a Generic TACACS+ Server

To configure a generic TACACS+ server:

Step 1 Specify the NAM IP address as a Remote Access Server.

Step 2 Configure a secret key for the TACACS+ server to communicate with the NAM.

Note The secret key must be the same as the one configured on the NAM.

Step 3 For each user or group to be allowed access to the NAM, configure the following TACACS+ parameters:

Parameter

Enter

service

shell

cmd

web

cmd-arg

One or more the following:

accountmgmt
system
capture
alarm
collection
view

password authentication method—Password Authentication Protocol (PAP)

pap

Current User Sessions

a user session times out, that row is removed from the table.

To view the current user sessions table:

.

) displays.

Managing System Data

One of the roles of an administrator is to manage Prime NAM’s network data collection and retention so that it:

Scales to fit the real needs of the system’s users.

Minimizes the burden on monitored devices, applications, and network bandwidth.

Survives hardware failures.

The following sections explain how to achieve these goals, and how to perform other data management tasks.

Handling Backups

Shrinking Storage Requirements

Handling Backups

.

Shrinking Storage Requirements

Network administrators are consistently looking for ways to shrink their network storage requirements and improve bandwidth efficiency on tasks like backup and recovery.

By configuring Prime NAM packet deduplication on supported platforms, packets whose inspected segments match another packet within the specific time window are marked as duplicates and not forwarded.

For configuration guidelines and instructions, see Configuring Hardware Deduplication.

You can also move capture files to an external storage location to save on local disk space. See About Capturing to Data Storage.

NAM Deployment

This chapter describes some usage cases on how to deploy NAM in your networks. It contains details on network performance management as well as usage scenarios for the Cisco Prime Network Analysis Module Software.

.

The use cases focus on a specific need to be addressed or a problem to be solved. Each scenario takes into account the deployment considerations discussed in Overview and then uses one or more of NAM’s features to meet the need or solve the problem. The goal of these use cases is to provide real-world examples. These examples discuss best practices and approaches to effective NAM deployment and are grouped into several categories.

This chapter contains the following sections:

Deploying in the Data Center

Deploying in a Campus Environment

Deploying in the Branch

General Usage Scenarios

NAM Integrations with Monitoring and Reporting Applications

Note Some of the graphics represented in this section may be different than what you see on the screen. These illustrations are for examples only.

Deploying in the Data Center

Monitoring the Nexus 1000V Switch Environment

Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications

Using NAM to Evaluate Application-Level Performance Monitoring for UDP Real-Time Applications

Using NAM to Monitor QoS/DiffServ (DSCP)

Monitoring Cisco WAAS and Measuring Its Impact

Deploying in a Campus Environment

Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications

Using NAM to Evaluate Application-Level Performance Monitoring for UDP Real-Time Applications

Using NAM to Monitor QoS/DiffServ (DSCP)

Using NAMs to Monitor VoIP Quality

Deploying in the Branch

Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications

Using NAM to Evaluate Application-Level Performance Monitoring for UDP Real-Time Applications

Using NAM to Monitor QoS/DiffServ (DSCP)

Monitoring Cisco WAAS and Measuring Its Impact

Using NAMs to Monitor VoIP Quality

General Usage Scenarios

These use cases are applicable to any part of the network:

Using NAM for Historical Trends via Interactive Report

Using NAM for Problem Isolation

Creating Custom Applications

Autodiscovery Capabilities of NAM

Using NAM for SmartGrid Visibility

NAM Integrations with Monitoring and Reporting Applications

Integrating NAM with Prime Infrastructure

Integrating NAM with Third Party Reporting Tools

Deployment Examples

Using NAMs to Monitor VoIP Quality

Autodiscovery Capabilities of NAM

Creating Custom Applications

Integrating NAM with Third Party Reporting Tools

Integrating NAM with Prime Infrastructure

Monitoring Cisco WAAS and Measuring Its Impact

Using NAMs to Monitor VoIP Quality

Voice quality analysis has been significantly enhanced in Cisco NAM. The software is now capable of accurately measuring voice quality by using the industry-standard MOS algorithm. Call quality measurements are computed every 1 minute and made available through the GUI. Note that the voice-related screens on the NAM GUI are significantly different from previous releases. Changes have been made to provide useful information quickly and automatically, while allowing easy navigation to details.

Deployment: NAM deployments for voice quality analysis require that NAM be able to monitor VoIP packets from the calling phone to the called phone. The branch edge location in the network provides visibility into all calls entering and leaving the branch; similarly a campus edge location monitors calls crossing the campus boundary. Often, the distribution layer is a good location to deploy NAMs for this purpose, especially if specific phones or particular portions of the network are to be monitored. For example, a new Multi protocol Label Switching (MPLS) link is being piloted and three buildings that are part of Company X's headquarters are part of the pilot. In order to monitor voice quality for those three buildings, a NAM could be deployed at the distribution Catalyst 6500 that serves those users.

Note The data center is typically not an appropriate location for RTP stream analysis because calls will seldom go through the data center. However, the data center is a good location to monitor signaling messages between phones and Cisco Unified Communications Manager. NAM decodes signaling messages to track call history, caller names, phone numbers, and other relevant call details.

Use the following steps to monitor the network to make sure that call quality is good. If quality issues appear, isolate and troubleshoot the problem rapidly.

. This chart indicates current voice quality of all RTP streams being monitored. MOS values range from 1 to 5, where 1 is poor and 5 is excellent (see the legend for a breakdown into categories-Poor, Fair, Good and Excellent). The figure below displays the Top N RTP Source and Destination endpoints. Notice that there are calls that are in the poor range.

Step 2 To isolate calls that had a poor MOS, scroll down to Top N RTP Streams and click on the chart to drill down into the RTP Stream Details. As shown in Figure 6-1, notice that the MOS value for the calls listed on top is 2.88, which is low. Further, looking at the other metrics provided in the same row (for example, row one), notice that jitter is 3.49 and the packet loss rate is 11 percent, resulting in the low MOS value. This information tells you that jitter is the root cause of the poor calls; instead, it is packet loss somewhere in the network.

Figure 6-1 Top N RTP Streams by MOS

Step 3 With the endpoints’ IP addresses, you can look at the network topology to identify where in the network the 50.5.10.38 subnet is located. For the purposes of this use case, this subnet is in Building 3 of the main campus. You know that the Building 3 distribution switch has a NAM located in it.

. This page lists all interfaces and errors or discards on each interface. Look up the link that leaves Building 3 and connects to the core. That interface is likely the source of the packet loss. Check the interface for faults and fix as needed.

See Analyzing Traffic, RTP Streams and Setting Voice Signaling Thresholds.

Autodiscovery Capabilities of NAM

If you are an existing NAM 4.x or NAM 6 user, you will not need to configure the SPAN sessions, and they will be automatically created on the NAM (not on the device). If you are a new NAM 5.x user, you will need to configure SPAN or NetFlow.

SPAN or NetFlow must be already configured on the device to forward traffic to NAM for auto creating the data source. See Setting Up Prime NAM Data Sources.

Creating Custom Applications

NAM identifies applications/protocols based on the TCP/UDP port number, so if there are applications using custom ports, the NAM can be configured to identify those applications by name instead of the port.

See Creating Deeper Visibility Into Application Traffic.

Integrating NAM with Prime Infrastructure

Cisco Prime supports integrated lifecycle management of networks, services, and endpoints for Cisco borderless network, data center, and collaboration architectures with end-to-end assurance. You can use Cisco Prime Infrastructure to centrally manage the Cisco Prime NAM platforms such as the NAM appliance to track inventory, view configurations, and perform image and fault management. Prime Infrastructure also rolls up the performance intelligence from NAMs deployed across the network into a consolidated dashboard.

on Cisco.com.

Step 1 Ensure you configure NTP and DNS for all the NAMs in your network. You can now configure those without going to the CLI or logging in to the individual NAM web GUI. Use the Cisco Prime Infrastructure Device Work Center to perform this task. For detailed steps, see your Prime Infrastructure product documentation.

Step 2 Add the NAM HTTPS credentials from the Prime Infrastructure’s Device Work Center Edit Device window so that Prime Infrastructure can retrieve data from them. You must add them only after the discovery process is complete or the modules have been added to the Prime Infrastructure inventory.

If you have licensed Assurance features, most Assurance features depend on NAM data to work so this is a required step.

You can repeat this task for all NAMs from which you want Prime Infrastructure to collect data.

Step 3 To ensure that you can collect data from your NAMs using Prime Assurance, you must enable NAM data collection and configure your NetFlow-enabled switches, routers, and other devices (ISR/ASR) to export this data to Prime Infrastructure. You can do this for each discovered or added NAM, or for all NAMs at the same time.

Step 4 To manage and troubleshoot a network problem such as a suspected network attack, you can use multiple NAMs to create packet captures, save them as files, and then decode them to inspect the suspicious traffic.

For application developers who want to use the NAM REST API to connect with Prime NAM, ask your Cisco representative about using the Cisco Prime Network Analysis Module REST API.

Integrating NAM with Third Party Reporting Tools

Prime NAM integrates with the CA NetQoS SuperAgent for the purpose of aggregating Application Response Times. Prime NAM also integrates with CompuWare Vantage and InfoVista 5View for Host, Conversation, RTP, and Response Time.

to find out more about the NAM Northbound Interface, also referred to as the REST API (Application Programming Interface). The API enables you to provision Prime NAM and extract performance data.

You can write your own scripts based on the Prime NAM Northbound API, but you must perform some setup in the GUI.

For details on what data can be collected, see Using Response Time Summary.

Point to the Design Guide

Monitoring Cisco WAAS and Measuring Its Impact

Cisco Wide Area Application Services (WAAS) is a comprehensive WAN optimization solution that accelerates applications over the WAN, delivers video to the branch office, and provides local hosting of branch-office IT services. Cisco WAAS allows IT departments to centralize applications and storage in the data center while maintaining LAN-like application performance and provides locally hosted IT services while reducing the branch-office device footprint.

One of the challenges facing IT personnel who deploy WAAS is to measure and report on the benefits provided by their WAN optimization deployment. Accurate measurement provides many benefits: IT can show return on investment; IT can assess whether the improvement gained meets originally advertised expectations from the solution; and finally, IT can use WAAS ongoing for monitoring, troubleshooting, and planning information for expanding the deployment.

The NAM can monitor WAAS-optimized flows by using WAE devices as the data source. Using this capability, the NAM is able to provide visibility into optimization-related metrics for the three distinct segments that are created by WAAS: the branch, the WAN, and the data center segments.

Placing a Cisco NAM appliance at the edge of the data center is recommended for WAAS deployments. From this location in the network, the NAM can measure local metrics using SPAN technology, and for information on the remote branch segment, it relies on flow agent exports from the remote WAE device. If SM-SREs are available, deploying one at the remote branch site is very useful. This SM-SRE can provide user experience at the site before WAAS is enabled and then contrast it to user experience after WAAS is enabled. See Figure 6-2.

Figure 6-2 Cisco NAM's Ability to Analyze from Multiple Data Sources

To deploy this solution:

. The Top Talker display includes such data as utilization, concurrent connections, and average transaction time for top applications, network links, clients, and servers that are possible candidates for optimization.

Step 2 Create a WAAS Client Side and WAAS Server Side for the WAAS flows from the DC and Branch WAEs.

Step 3 The NAM provides an interactive dashboard to view the analyzed data. Figure 6-3 displays Client Transaction Time, Traffic Volume and Compression Ratio, Number of Concurrent Connections (Optimized vs. Passthru), and Multi-Segment Network Time (Client LAN - WAN - Server LAN). As you can see in the first graph, all non-optimized traffic is displayed as Passthru.

Figure 6-3 Application Performance Analysis -- Optimized

The screen shot above illustrates the significant improvement experienced by users in the branch when WAAS is turned on. Such reports are very useful to justify an investment in WAN optimization technologies and to show returns on those investments in terms of increase in employee productivity and improved user experience from remote sites.

Figure 6-4

Step 4 From the perspective of the NAM located in the data center, there are two sources of information for response time measurements. SPAN provides measurement at the data center and exports from the branch; WAAS flow or PA via Prime Infrastructure provides measurements from the branch. Using these two sources of information, the NAM at the data center can continuously monitor current response times for each branch and help IT personnel keep user experience within known bounds. When abnormal response times are detected, the NAM can be configured to send alerts to appropriate personnel with information relevant to troubleshooting the problem.

Note The NAM 2x20 in the above scenario can be substituted with the NAM Virtual Blade on the WAVE-574 and WAE-674 to obtain the same type of reports.

Monitoring

Using NAM to Monitor QoS/DiffServ (DSCP)

Using NAM for Historical Trends via Interactive Report

Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications

Using NAM to Evaluate Application-Level Performance Monitoring for UDP Real-Time Applications

Monitoring the Nexus 1000V Switch Environment

Using NAM to Monitor QoS/DiffServ (DSCP)

Differentiated Services (DiffServ) provides insight into how traffic is being classified by QoS and detects incorrectly marked or unauthorized traffic. The NAM identifies the application/protocol based on the type of service (ToS) bits setting. The administrator can configure DSCP Groups or use the ones provided (as shown in Figure 6-5). The voice template can be used to monitor whether voice traffic is marked properly. Figure 6-7 displays the DiffServ application statistics for all DSCP value. Looking at this, you will notice that RTP and Session Initiation Protocol (SIP) are listed, which indicates that they are not being correctly marked throughout its path.

In the following scenario, IT has deployed QoS to prioritize VoIP traffic to improve voice quality across the network. The NAMs are deployed in the data center and branches and utilized to monitor the DSCP to validate QoS policies.

to display the default groups.

Figure 6-5 Default DSCP Groups

for details.

to find any misclassified traffic. In Figure 6-6, the RTP protocol is displayed for ToS0 classification.

Figure 6-6 DSCP Group - ToS0

button to view all DSCP and applications.

Step 5 In Figure 6-7, RTP and SIP are highlighted. The protocols are listed for DSCP 0, which is incorrect since the standard classification for voice traffic is DSCP 46 and 24. This means that some of the voice traffic is misclassified on the network. You can also view the branch NAMs to investigate whether voice traffic is being misclassified.

Figure 6-7 All DSCP Table

to display the clients using those protocols. This helps to troubleshoot why RTP or SIP traffic from these clients is not marked correctly. As shown in Figure 6-8, the NAM displays the IP addresses of the phones using those protocols. This helps you review the QoS policy implemented on the routers and switches between the clients.

Figure 6-8 RTP Host Table

Using NAM for Historical Trends via Interactive Report

Historical trending is an important component of network performance management. While real-time analysis provides information about events, historical trending provides visibility into event sequences. Such sequences offer valuable information about various aspects of the network such as changes in network traffic behavior, anomalies and unusual activities, and network usage in peak times versus low times. It is also helpful in planning future network upgrades, application roll outs, and hardware buildouts. Here are some things to take note of regarding NAM’s historical trending capabilities:

Use the Interactive Report > Filter button (located on the left side of the NAM window) to look at short term and long term trends by changing the Time Range. The interactive reports can be exported or the filter setting saved for quick view in the future. The exported data can be sent via e-mail in CSV or PDF format.

Figure 6-9 displays host traffic for the last day, and using the middle graph you can zoom down to the time range of 10:00 - 16:00 to view what other application this host is using.

Figure 6-9 Host Traffic for Last 1 Day

In the following deployment scenario, you will predict the capacity needed for a new branch build out due in six months by studying the usage of an existing branch office of a similar size. To deploy a NAM located in the branch router (ISR) of the existing branch:

(enter a date covering a month).

Step 2 Open a conversation report from today and find a stream that has a mildly increasing trend but is unable to confirm the rate at which it is increasing (see Figure 6-10).

Figure 6-10 A Stream with a Mildly Increasing Trend

Step 3 Change the Time Range dynamically in the Interactive Report to study the trend with a granularity of one month. You may find that the pattern does show periodic increases, but it always hits a ceiling between 4.5 Kbps and 5.x Kbps (see Figure 6-11). You are then able to conclude that the ISP link needed at the new site would be similar, and so a standard T1 line would be more than sufficient for the needs of the new remote office.

Figure 6-11 The Trend Shown with a Granularity of 1 Month

Studying historical trends is a valuable exercise in planning and creating baselines in a network. Monitor and trend on business critical applications and servers. These trends should provide handy information in a variety of day-to-day decisions.

Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications

Application Performance Response Time Analysis provides up to 45 metrics. You can configure thresholds based on many of these metrics, and receive an alert when the thresholds are passed. Thresholds should be set for critical applications or servers using Average Server Response Time, or Average Transaction Time, or Average Network Time and Average Server Network Time. These thresholds will help identify where the problem lies in the application performance, and show whether the problem is a server or network issue. Depending on the alarm, you can access the NAM to see the applications and clients accessing the server, or to check the devices in the traffic path monitoring device and interface utilization.

See Application Response Time.

See Defining Thresholds.

Using NAM to Evaluate Application-Level Performance Monitoring for UDP Real-Time Applications

The NAM monitors and analyzes RTP streams and voice calls statistics by intercepting the data collected by endpoints. So, when a phone call ends, the endpoints calculate the information and send it to the Unified Communications Manager (aka the Call Manager), the NAM collects the data (as log as it is along that path).

NAM uses the voice call statistics from the endpoint with the RTP stream to correlate the phone number with the IP address of the endpoint. Alerts are sent based on analysis of the RTP streams for MOS, Jitter, and Packet Loss.

To use NAM to monitor the application-level performance for UDP real-time applications:

.

.

See Analyzing Traffic, RTP Streams.

, Voice Monitor Setup Window.

Monitoring the Nexus 1000V Switch Environment

As networks and applications move into the virtualization environment, the challenge for you is to find tools to gain insight into that environment. The NAM VSB provides that function by integrating with the Cisco Nexus 1010 virtualization appliance. Using the NAM VSB, you can gain operational visibility into the virtual switching layer and is able to see virtual machine (VM) to VM statistics. See Figure 6-12.

The Nexus 1000V switch can also be monitored by other NAM platforms running the Prime NAM software.

You are deploying applications in the ritualized environment and the Nexus 1000V switch is providing the network connectivity. The NAM VSB installed on the Nexus 1010 Virtual Services Appliance is used to monitor the environment.

Note If Nexus 1000V switches and NAMs are already deployed in the network, ERSPAN or NetFlow data source can be directed by any one of those NAMs. You should directly connect the 1000V switch and NAM to the same physical switch.

Figure 6-12 Cisco Nexus 1000V NAM Virtual Service Blade Deployment

To monitor the Nexus 1000V environment:

Step 1 Install and configure either the NAM VSB on the Nexus 1110 Virtual Services Appliance. See the Installation and Configuration Guides for the NAM on Cisco.com.

Step 2 For the NAM VSB:

1. Verify that ERSPAN or NetFlow are configured on the Cisco 1000V Switch Virtual Supervisor Module (VSM) that is providing data to NAM.

2. Configure the ERSPAN or NetFlow data source, depending on your NAM:

3. Enable all applicable monitoring parameters in NAM for ERSPAN and NetFlow. Use the Traffic Summary window to display Top N information such as applications, hosts, protocol, and server response time. You can view and display details for each of the categories listed.

4. Using the Interactive Report, configure reports for trending on the application response time, hosts, and conversation traffic patterns.

The physical and virtual interfaces table provides VM-to-VM traffic utilization. Because one virtual interface connects to one VM, the data shows which VMS are utilizing the switch resources. You can then view the hosts and conversations tables to identify the culprit utilizing the resources.

Note NAM VSB provides the same complement of features except that it supports only ERSPAN and NetFlow data sources and performs no voice monitoring and packet capture.

Troubleshooting

Using NAM for Problem Isolation

Using NAM for SmartGrid Visibility

Using NAM for Problem Isolation

). An example of the alarm is:

2013 SEPT 28 9:17:0:Application:Exceeded rising value(1000);packets;60653;Site(San Jose), Application)

to view which conversations are chatty, and therefore causing the increase traffic for this application.

to drill down on what hosts are accessing the application. Identify the application server and view what other applications are hosted and all the clients accessing that server.

See Monitor: Using Response Time Summary.

See Analyze: Measuring Response Time.

Using NAM for SmartGrid Visibility

, you will see all hosts using that application. It will be identified as a Telnet application.

Customizing Cisco Prime NAM

This chapter provides set up details for advanced tools and customization. You can use these tools to take your network monitoring to another level. It provides information about functions that will begin automatically, optional tasks, and other setup tasks you will need to perform for advanced feature configuration.

This chapter contains the following sections:

Advanced Configuration Overview

Setting Up Traffic Configurations

Setting Up Alarms and Alarm Thresholds

Scheduling Data Report Exports

Accessing Device Interface and Health Details

Configuring Network Parameters

Configuring Application Classification

Setting Up Prime NAM Monitoring

For information about how to install the product, configure it, and log in, see the installation guide for your specific Cisco NAM platform.

Advanced Configuration Overview

leads you through the advanced configuration steps you can follow for Prime NAM. See the description to understand why or when to perform these tasks.

Table 7-1 Advanced Configuration Overview

Action

Description

GUI Location

User Guide Location

Configure the Managed Device information

If you want to monitor an extended level of your managed device’s data (health and interface information), you can set up your managed device using Cisco NAM. If you do not set up this feature, your data collection is limited.

GUI.

For service module NAM blades such as NAM-3, NAM-NX1, and SM-SRE NAM, the NAM managed device is the switch or router where NAM is located. Managed device SNMP credentials are automatically synchronized to the NAM upon NAM boot up.

For other NAM platforms, the NAM managed device IP address, SNMP, and/or NetConf interface credential must be provided for NAM to get managed device health and interface information.

See Accessing Device Interface and Health Details.

Configure sites

A site is a collection of hosts (network endpoints) partitioned into views that help you monitor traffic and troubleshoot problems.

If you want to limit the view of your network data to a specific city, a specific building, or even a specific floor of a building, you can use the sites function.

We recommend that sites are configured using prefix-based subnets instead of based on data source.

Setup > Network > Sites

See Configuring Sites.

Define alarms and thresholds

Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both. You can choose for what types of events you want the software to notify you, and how you want to be notified.

Create alarms that will be used for thresholds, then create the thresholds.

and

See Viewing Alarm Actions.

See Defining Thresholds.

Configure capture

Capture allows you to configure up to ten sessions for capturing, filtering, and decoding packet data, manage the data in local or remote storage, and display the contents of the packets.

Per file location, you can have only one capture session. We support up to ten capture sessions.

Note NAM virtual blades do not support capture.

See Capturing and Decoding Packets.

Configure scheduled export

You can set up scheduled jobs that generate daily reports at a specified time, in a specified interval, and then e-mail it to a specified e-mail address or addresses.

Some windows may not support data export.

. Scheduled Export can only be done from a Monitor or Analyze window.

See Scheduling Data Report Exports.

Set up TACACS+ server

TACACS+ is a Cisco Systems enhancement that provides additional support for authentication and authorization.

When a user logs into Prime NAM, TACACS+ determines if the username and password are valid and what the access privileges are. For TACACS+ to work, both NAM and the TACACS+ server has to be configured.

See Configuring a TACACS+ Server to Support NAM Authentication and Authorization.

Change system preferences

You can change many preferences, such as refresh interval, Top N Entries, Data Displayed, and enabling Audit Trail, as needed.

Setting Up Traffic Configurations

To set up Prime NAM traffic, you should perform the following:

Configuring Traffic to Monitor

(Optional) Setting Up Prime NAM Data Sources

(Optional) Configuring Hardware Deduplication (For specific NAM appliances only)

.

Configuring Traffic to Monitor

Prime NAM can monitor your network traffic to perform many tasks including helping you to optimize your network resources and troubleshoot performance issues. Before you can monitor data, you must direct specific traffic flowing through a switch or router to the Prime NAM software for monitoring purposes.

A switched port analyzer (SPAN) session is an association of a destination port with a set of source ports, configured with parameters that specify the monitored network traffic.

The following sections describe SPAN sessions on devices running Prime NAM:

Understanding How the Prime NAM Uses SPAN

Creating a SPAN Session

Editing a SPAN Session

Note This functionality is only available when working with devices that support the CISCO-RMON-CONFIG-MIB. If you are using a switch that does not support this MIB, the SPAN screen may not show the existing SPAN sessions and will not allow SPAN configuration.

Creating a SPAN Session

To create a SPAN session on a switch:

. The SPAN window displays.

.

The Create SPAN Session Dialog displays. DataPort is the default for the SPAN Type. Contents of this window may be different depending on your NAM platform.

.

. The Active Sessions window displays.

in the active SPAN session window.

Note For switches running Cisco IOS software, all pending running-configuration changes will be saved to the startup-configuration.

).

Editing a SPAN Session

You can only edit SPAN sessions that have been directed to the NAM. You can only delete certain SPAN sessions using the user interface.

Note Editing an existing SPAN session that has multiple SPAN destinations will affect all destinations.

To edit a SPAN session:

.

The Active SPAN Sessions dialog box displays.

.

. Depending on your NAM platform, there may be different fields that display.

Step 3 Make the appropriate changes on the Edit SPAN Session window.

Setting Up Prime NAM Data Sources

Data sources are where the traffic sent to Prime NAM originates. Some examples are: physical dataports of the Prime NAM where you get SPAN data, a specific router or switch that sends NetFlow to the NAM, a WAAS device segment that sends data to Prime NAM, or ERSPAN and which goes to NAM management port.

Caution If you have configured sites (see Configuring Sites), you can assign data sources to that particular site. If you do this, and you also configure data sources, the two could overlap since sites can also be a primary “view” into data sources. If there is a mismatch between the two, you will not see any data.

Note We recommend that you configure a site using subnets instead of selecting a data source. For examples on how to specify a site using subnets, see Configuring Sites Using Subnets.

The following sections contains setup steps and specific information about the types of data sources available:

Data Source Overview

Forwarding SPAN Traffic

Forwarding ERSPAN Traffic

Forwarding VACL Traffic

Forwarding NetFlow Traffic

Managing WAAS and WAN Traffic

Ports and Hardware Details

Forwarding SPAN Traffic

.

For more information about SPAN sessions, see Configuring Traffic to Monitor or your platform operating system documentation.

Forwarding ERSPAN Traffic

This section describes how to configure Encapsulated Remote Switched Port Analyzer (ERSPAN) on your remote device as a Prime NAM data source. You configure ERSPAN as a Prime NAM data source from the remote device command line interface, not the Prime NAM GUI.

.

As an ERSPAN consumer, Prime NAM can receive ERSPAN packets on its management port from devices such as Cisco routers and switches. Those packets are analyzed as if that traffic had appeared on one of the Prime NAM dataports. Prime NAM supports ERSPAN versions 1 and 3. Incoming ERSPAN data is parsed by Prime NAM, stored in its internal database, and presented in the GUI in the same way as traffic from other data sources.

Before You Begin

For the Prime NAM to receive ERSPAN from an external switch or router, that device must be configured to send ERSPAN packets to the IP address of the Cisco NAM.

To enable ERSPAN as a data source:

Enabling Autocreation of ERSPAN Data Sources Using the Web GUI

Enabling Autocreation of ERSPAN Data Sources Using the CLI

Disabling Autocreation of ERSPAN Data Sources Using the Web GUI

Disabling Autocreation of ERSPAN Data Sources Using the CLI

Creating ERSPAN Data Sources Using the Web GUI

Creating ERSPAN Data Sources Using the CLI

Deleting ERSPAN Data Sources Using the Web GUI

Deleting ERSPAN Data Sources Using the CLI

Configuring ERSPAN on Devices

Note Depending on the Cisco IOS/Nexus OS version on the managed device, the CLI format for configuring an ERSPAN session may be different than what appears in this document. For details on using ERSPAN as a data source, see your specific OS product documentation.

Enabling Autocreation of ERSPAN Data Sources Using the Web GUI

There is a convenient autocreate feature for data sources, which is enabled by default. With the autocreate feature, a new data source will automatically be created for each device that sends ERSPAN traffic to the NAM, after the first packet is received. Manual creation of ERSPAN data sources using the Prime NAM GUI or the CLI is typically not necessary. When manually creating a data source, you may specify any name you want for the data source. A data source entry must exist on the Prime NAM in order for it to accept ERSPAN packets from an external device.

. You can edit these autocreated data sources and change the name if desired.

check box, and enter a Session ID in the Value field, the data source will only apply to that specific session. If you leave the check box unchecked, all ERSPAN traffic from the device will be grouped together into this data source, regardless of Session ID.

To configure Prime NAM to automatically create data sources when it receives ERSPAN packets from an external device, use the following steps. Remember however, that the autocreate feature is turned on by default, so these steps are typically not necessary.

.

on the bottom left of the window.

check box to toggle autocreation of ERSPAN data sources to “on”.

.

Enabling Autocreation of ERSPAN Data Sources Using the CLI

Configuration of the autocreate feature is also possible using the Prime NAM CLI. Because the autocreate feature is turned on by default, in most cases these steps are not necessary.

command as follows:

root@172-20-104-107.cisco.com# autocreate-data-source erspan

ERSPAN data source autocreate successfully ENABLED

Prime NAM will now automatically create a ERSPAN data source for each device that sends ERSPAN packets to it. The data source will have the specific Session ID that is populated by the device in the ERSPAN packets sent to the NAM. If the same device happens to send ERSPAN packets to the Prime NAM with different Session ID values, a separate data source will be created for each unique Session ID sent from the device.

Disabling Autocreation of ERSPAN Data Sources Using the Web GUI

.

on the bottom left of the window.

check box to toggle autocreation of ERSPAN data sources to “off”.

.

Disabling Autocreation of ERSPAN Data Sources Using the CLI

command as follows:

root@172-20-104-107.cisco.com# no autocreate-data-source erspan

ERSPAN data source autocreate successfully DISABLED

root@172-20-104-107.cisco.com#

Creating ERSPAN Data Sources Using the Web GUI

To manually configure a ERSPAN data source on the GUI, for example if the autocreation feature is turned off, use the following steps:

.

along the bottom of the window.

.

Step 4 Enter the IP address of the device that will export ERSPAN to the NAM.

Step 5 Give the Data Source a name. This name will appear anywhere there is a Data Source drop-down list.

check box and enter an Session ID into the Value field if the data source should only apply to that specific session. If you leave the check box unchecked, all ERSPAN traffic from the device will be grouped together into this data source, regardless of Session ID.

Devices can be configured with multiple ERSPAN Sessions. The packets exported may have the same source IP address, but the Session ID exported will be a different for each session. If you want to include only one Session in the data source, you must check the “Session” box and provide the value of that Session ID.

.

Creating ERSPAN Data Sources Using the CLI

To manually configure a ERSPAN data source on the Prime NAM using the CLI (for example if the autocreation feature is turned off), use the following steps. Note that when using the CLI, there are two separate phases involved: First, you must create a “device” entry on the Prime NAM and remember the device ID, and then you must create a data source entry using this device ID. In the Prime NAM GUI, these two phases for creating ERSPAN data sources are combined together.

. You will now be in erspan device subcommand mode as shown here:

root@172-20-104-107.cisco.com# device erspan

Entering into subcommand mode for this command.

Type 'exit' to apply changes and come out of this mode.

Type 'cancel' to discard changes and come out of this mode.

root@172-20-104-107.cisco.com(sub-device-erspan)#

to see all the command options available, as in the example below:

root@172-20-104-107.cisco.com(sub-device-netflow)# ?

? - display help

address - device IP address (*)

cancel - discard changes and exit from subcommand mode

exit - create device and exit from sub-command mode

help - display help

show - show current config that will be applied on exit

(*) - denotes a mandatory field for this configuration.

root@172-20-104-107.cisco.com(sub-device-netflow)#

Step 3 Enter the IP address of the device as shown in this example (required):

root@172-20-104-107.cisco.com(sub-device-erspan)# address 192.168.0.1

to look at the device configuration that will be applied and verify that it is correct:

root@172-20-104-107.cisco.com(sub-device-erspan)# show

DEVICE TYPE : ERSPAN (Encapsulated Remote SPAN)

DEVICE ADDRESS : 192.168.0.1

root@172-20-104-107.cisco.com(sub-device-erspan)#

to come out of the subcommand mode and create the device. Remember the ID value that was assigned to the new device (you will need it to create the data source).

root@172-20-104-107.cisco.com(sub-device-erspan)# exit

Device created successfully, ID = 1

root@172-20-104-107.cisco.com#

. You will now be in erspan data source subcommand mode as shown here:

root@172-20-104-107.cisco.com# data-source erspan

Entering into subcommand mode for this command.

Type 'exit' to apply changes and come out of this mode.

Type 'cancel' to discard changes and come out of this mode.

root@172-20-104-107.cisco.com(sub-data-source-erspan)#

to see all the command options available, as in the example below:

root@172-20-104-107.cisco.com(sub-data-source-erspan)# ?

? - display help

cancel - discard changes and exit from subcommand mode

device-id - erspan device ID (*)

exit - create data-source and exit from sub-command mode

help - display help

name - data-source name (*)

session-id - erspan Session ID

show - show current config that will be applied on exit

(*) - denotes a mandatory field for this configuration.

root@172-20-104-107.cisco.com(sub-data-source-erspan)#

Step 8 Enter the device ID from Step 4.

root@172-20-104-107.cisco.com(sub-data-source-erspan)# device-id 1

Step 9 Enter the name you would like for the data source (required):

root@172-20-104-107.cisco.com(sub-data-source-erspan)# name MyFirstErspanDataSource

Step 10 If desired, supply the specific Session ID for this ERSPAN data source (optional):

root@172-20-104-107.cisco.com(sub-data-source-erspan)# session-id 123

to look at the data source configuration that will be applied and verify that it is correct:

root@172-20-104-107.cisco.com(sub-data-source-netflow)# show

DATA SOURCE NAME : MyFirstErspanDataSource

DATA SOURCE TYPE : ERSPAN (Encapsulated Remote SPAN)

DEVICE ID : 1

DEVICE ADDRESS : 192.168.0.1

SESSION ID : 123

root@172-20-104-107.cisco.com(sub-data-source-erspan)#

to come out of the subcommand mode and create the data source:

root@172-20-104-107.cisco.com(sub-data-source-erspan)# exit

Data source created successfully, ID = 3

The data source is now created, and ERSPAN records from the device will be received and accepted by Prime NAM as they arrive.

Deleting ERSPAN Data Sources Using the Web GUI

To delete an existing ERSPAN data source, use the following steps. Note that if the autocreation feature is turned on, and the device continues to send ERSPAN packets to the NAM, the data source will be recreated again automatically as soon as the next ERSPAN packet arrives. Therefore, if you wish to delete an existing ERSPAN data source, it is usually advisable to first turn the ERSPAN autocreate feature off, as described earlier.

Step 2 Choose the data source you would like to delete.

along the bottom of the window.

Deleting ERSPAN Data Sources Using the CLI

To delete a ERSPAN data source using the CLI, use the following steps. Note that when using the CLI, there are generally two separate phases involved. First you should delete the data source, then delete the device if you have no other data sources using the same device (for example with a different Engine ID value). As a shortcut, if you simply delete the device, then all data sources using that device will also be deleted.

Step 1 Show all data sources so you can find the ID of the one you want to delete:

root@172-20-104-107.cisco.com# show data-source

DATA SOURCE ID : 1

DATA SOURCE NAME : DATA PORT 1

TYPE : Data Port

PORT NUMBER : 1

-----------

DATA SOURCE ID : 2

DATA SOURCE NAME : DATA PORT 2

TYPE : Data Port

PORT NUMBER : 2

-----------

DATA SOURCE ID : 3

DATA SOURCE NAME : MyFirstErspanDataSource

TYPE : ERSPAN (Encapsulated Remote SPAN)

DEVICE ID : 2

DEVICE ADDRESS : 192.168.0.1

ENGINE ID : 123

-----------

root@172-20-104-107.cisco.com#

command to delete the data source:

root@172-20-104-107.cisco.com# no data-source 3

Successfully deleted data source 3

root@172-20-104-107.cisco.com#

Step 3 Show all devices so you can find the ID of the one you want to delete:

root@172-20-104-107.cisco.com# show device

DEVICE ID : 1

DEVICE TYPE : ERSPAN (Encapsulated Remote SPAN)

IP ADDRESS : 192.168.0.1

INFORMATION : No packets received

STATUS : Inactive

------

root@172-20-104-107.cisco.com#

command to delete the device:

root@172-20-104-107.cisco.com# no device 1

Successfully deleted device 1

root@172-20-104-107.cisco.com#

Note that if the autocreation mode is on, and the device continues to send ERSPAN packets to the NAM, the data source (and device entry) will be recreated again automatically as soon as the next ERSPAN packet arrives. Therefore, if you wish to delete an existing ERSPAN data source, it is usually advisable to first turn the ERSPAN autocreate feature off, as described earlier.

Configuring ERSPAN on Devices

There are two ways to configure ERSPAN so that the Prime NAM receives the data:

Sending ERSPAN Data to Layer 3 Interface

Sending ERSPAN Data Directly to the Cisco NAM Management Interface

Note Depending on the Cisco IOS or NX-OS version on your managed device, the CLI format for configuring an ERSPAN session may be different than what appears in this document. For details on using ERSPAN as a data source, see your specific OS product documentation.

Sending ERSPAN Data to Layer 3 Interface

To send the data to a layer 3 interface on the Switch housing the NAM, configure the ERSPAN source session. The ERSPAN destination session then sends the traffic to a Prime NAM data-port. After performing this configuration, you can select the DATA PORT X data source to analyze the ERSPAN traffic.

Note This method causes the ERSPAN traffic to arrive on one of the NAM dataports, which is the most efficient method and will not have any adverse effect on the NAM’s IP connectivity. Therefore, we recommend this method. The configuration below may be different depending on your platform and OS version. See your OS product documentation for additional help.

Sample Configuration of ERSPAN Source

monitor session 48 type erspan-source

erspan-id N

vrf default

destination ip aa.bb.cc.dd

source interface Ethernet7/47

no shut

monitor erspan origin ip-address ee.ff.gg.hh global

Where:

erspan-id N is the ERSPAN ID

aa.bb.cc.dd is the IP address of the destination switch (loopback address or any routable IP address)

ee.ff.gg.hh is the source IP address of the ERSPAN traffic

Sample Configuration of ERSPAN Destination

monitor session 48 type erspan-destination

erspan-id N

vrf default

source ip aa.bb.cc.dd

no shut

Where:

erspan-id N matches the ERSPAN ID at the source switch

aa.bb.cc.dd is the IP address defined at the destination

You can now connect to the Prime NAM to monitor and capture traffic of the Data Port 2 data source.

Sending ERSPAN Data Directly to the Cisco NAM Management Interface

To send the data directly to the Cisco NAM management IP address (management-port), configure the ERSPAN source session. No ERSPAN destination session configuration is required. After performing this configuration on the Catalyst 6500 switch, when ERSPAN packets are sent to the NAM, it will automatically create a data source for that packet stream. If the autocreate feature is not enabled, you will have to manually create the data source for this ERSPAN stream of traffic (see Creating ERSPAN Data Sources Using the Web GUI).

Note This method causes the ERSPAN traffic to arrive on the Cisco NAM management port. If the traffic level is high, this could have negative impact on the NAM’s performance and IP connectivity.

Sample Configuration

monitor session 1 type erspan-source

no shut

source interface Fa3/47

destination

erspan-id Y

ip address aa.bb.cc.dd

origin ip address ee.ff.gg.hh

Where:

Interface fa3/47 is a local interface on the erspan-source switch to be monitored

Y is any valid span session number

aa.bb.cc.dd is the management IP address of the NAM

ee.ff.gg.hh is the source IP address of the ERSPAN traffic

Forwarding VACL Traffic

.

VACL can forward traffic from either a WAN interface or VLANs to a dataport on some of the NAM platforms. A VACL provides an alternative to using SPAN; a VACL can provide access control based on Layer 3 addresses for IP and IPX protocols. The unsupported protocols are access controlled through the MAC addresses. A MAC VACL cannot be used to access control IP or IPX addresses.

Configuring VACL on a WAN Interface

Because WAN interfaces do not support the SPAN function, you must use the switch CLI to manually configure a VACL in order to monitor WAN traffic with the NAM. This feature only works for IP traffic over the WAN interface.

VACL can also be used if there is no available SPAN session to direct traffic to the NAM. In this case, a VACL can be set up in place of a SPAN for monitoring VLAN traffic.

The following example shows how to configure a VACL on an ATM WAN interface and forward both ingress and egress traffic to the NAM. These commands are for switches running Cisco IOS version 12.1(13)E1 or higher. For more information on using these features, see your accompanying switch documentation.

Cat6509#config terminal

Cat6509(config)# access-list 100 permit ip any any

Cat6509(config)# vlan access-map wan 100

Cat6509(config-access-map)# match ip address 100

Cat6509(config-access-map)# action forward capture

Cat6509(config-access-map)# exit

Cat6509(config)# vlan filter wan interface AM6/0/0.1

Cat6509(config)# analysis module 3 data-port 1 capture allowed-vlan 1-4094

Cat6509(config)# analysis module 3 data-port 1 capture

Cat6509(config)# exit

To monitor egress traffic only, get the VLAN ID that is associated with the WAN interface by using the following command:

Cat6509#show cwan vlan
Hidden VLAN swidb->i_number Interface

1017 94 ATM6/0/0.1

After you have the VLAN ID, configure the Cisco NAM dataport using the following command:

Cat6509(config)# analysis module 3 data-port 1 capture allowed-vlan 1017

To monitor ingress traffic only, replace the VLAN number in the capture configuration with the native VLAN ID that carries the ingress traffic. For example, if VLAN 1 carries the ingress traffic, you would use the following command:

Cat6509(config)# analysis module 3 data-port 1 capture allowed-vlan 1

Configuring VACL on a LAN VLAN

For VLAN Traffic monitoring on a LAN, traffic can be sent to Cisco NAM by using the SPAN feature of the switch. However, in some instances when the traffic being spanned exceeds the monitoring capability of the NAM, you might want to pre-filter the LAN traffic before it is forwarded. This can be done by using VACL.

The following example shows how to configure VACL for LAN VLAN interfaces. In this example, all traffic directed to the server 172.20.10.221 on VLAN 1 is captured and forwarded to the Cisco NAM located in slot 3.

Cat6509#config terminal

Cat6509#(config)#access-list 100 permit ip any any

Cat6509#(config)#access-list 110 permit ip any host 172.20.10.221

Cat6509#(config)#vlan access-map lan 100

Cat6509#(config-access-map)match ip address 110

Cat6509#(config-access-map)#action forward capture

Cat6509#(config-access-map)#exit

Cat6509#(config)#vlan access-map lan 200

Cat6509#(config-access-map)#match ip address 100

Cat6509#(config-access-map)#action forward

Cat6509#(config-access-map)#exit

Cat6509#(config)#vlan filter lan vlan-list 1

Cat6509#(config)#analysis module 3 data-port 1 capture allowed-vlan 1

Cat6509#(config)#analysis module 3 data-port 1 capture

Cat6509#(config)#exit

Forwarding NetFlow Traffic

NAM functions as a NetFlow consumer. You can configure NetFlow on the device side so that Prime NAM can receive NetFlow packets from devices such as Cisco routers and switches. Those records are stored in its collection database as if that traffic had appeared on one of the Cisco NAM dataports. Prime NAM understands NetFlow version 5 and version 9. Incoming NetFlow data is parsed by Prime NAM, stored in its internal database, and presented in the user interface in the same way as traffic from other data sources.

For Prime NAM to receive NetFlow packets from an external switch or router, you must configure that device to forward export flow records to the NAM’s IP address and the correct UDP port number. The default port number on which Prime NAM listens for NetFlow packets is port 3000. This port can be modified using the Prime NAM CLI, but it is critical that the same port be configured on the Cisco NAM and the exporting device or devices. Depending on the external device, you may need to enable the NetFlow feature on a per-interface basis.

See the following sections about NetFlow as a data source:

Understanding NetFlow Interfaces

Understanding NetFlow Flow Records

Managing NetFlow Data Sources

Configuring NetFlow on Devices

Configuring NetFlow on Devices

The configuration commands for NetFlow devices to export NetFlow packets to Prime NAM are platform and device specific. The example configuration commands provided here are the ones most commonly found for devices running Cisco IOS. For more detailed NetFlow configuration information, see your device documentation.

Enabling Autocreation of NetFlow Data Sources Using the Web GUI

To configure Prime NAM to automatically create data sources when it receives NetFlow packets from an external device, use the following steps. Remember however, that the autocreate feature is turned on by default, so these steps are typically not necessary.

.

on the bottom left of the window.

check box to toggle autocreation of NetFlow data sources on.

.

Enabling Autocreation of NetFlow Data Sources Using the CLI

Configuration of the autocreate feature is also possible using the Prime NAM CLI. Remember that the autocreate feature is turned ON by default, so in most cases these steps are not necessary.

To configure the Prime NAM to automatically create data sources when it receives NetFlow packets from an external device, use the following steps:

command as follows:

root@172-20-104-107.cisco.com# autocreate-data-source netflow

NetFlow data source autocreate successfully ENABLED

Prime NAM will now automatically create a NetFlow data source for each device that sends NetFlow packets to it. The data source will have the specific Engine ID that is populated by the device in the NetFlow packets sent to the NAM. If the same device happens to send NetFlow packets to the NAM with different Engine ID values, a separate data source will be created for each unique Engine ID sent from the device.

Disabling Autocreation of NetFlow Data Sources Using the Web GUI

.

on the bottom left of the window.

check box to toggle autocreation of NetFlow data sources off.

.

Disabling Autocreation of NetFlow Data Sources Using the CLI

command as follows:

root@172-20-104-107.cisco.com# no autocreate-data-source netflow

NetFlow data source autocreate successfully DISABLED

root@172-20-104-107.cisco.com#

Creating NetFlow Data Sources Using the Web GUI

To manually configure a NetFlow data source using the Prime NAM GUI, for example if the autocreation feature is turned OFF, use the following steps:

.

along the bottom of the window.

Step 3 Give the Data Source a name. This name will appear anywhere there is a Data Source drop-down list.

.

Step 5 Enter the IP address of the device that will export NetFlow to Prime NAM (required).

check box can be left blank and you don't have to worry about the Engine ID value).

Some devices have multiple Engines which independently export NetFlow records. For example, on some Cisco routers, NetFlow records can be exported by the Supervisor module as well as individual line cards. The packets exported may have the same source IP address, but the Engine ID exported by the Supervisor will be a different value than the Engine ID(s) exported by the line card(s). If you want to include only one Engine in the data source, you must check the “Engine” box and provide the value of that Engine ID.

Step 7 (Optional) SNMP v1/v2c RO Community String: If SNMP v1 or v2c will be used to communicate with the device, enter the community string that is configured on the device that is going to export NetFlow packets to the NAM.

Step 8 (Optional) “Enable SNMP v3”: If SNMP v3 will be used to communicate with the device, fill in the fields within the v3-specific dialog.

.

to see if the information you provided is accurate.

.

Creating NetFlow Data Sources Using the CLI

To manually configure a NetFlow data source on the Prime NAM using the CLI, for example if the autocreation feature is turned off, use the following steps. Note that when using the CLI, there are two separate phases involved. First you must create a “device” entry on the Prime NAM and remember the device ID. Then you must create a data source entry using this device ID. For convenience, these two phases are combined together when using the GUI to create NetFlow data sources.

. You will now be in netflow device subcommand mode as shown here:

root@172-20-104-107.cisco.com# device netflow

Entering into subcommand mode for this command.

Type 'exit' to apply changes and come out of this mode.

Type 'cancel' to discard changes and come out of this mode.

root@172-20-104-107.cisco.com(sub-device-netflow)#

to see all the command options available, as in the example below:

root@172-20-104-107.cisco.com(sub-device-netflow)# ?

? - display help

address - device IP address (*)

cancel - discard changes and exit from subcommand mode

community - SNMPv2c community string

exit - create device and exit from sub-command mode

help - display help

show - show current config that will be applied on exit

snmp-version - SNMP version to use to communicate with device

v3-auth-passphrase - SNMPv3 authentication passphrase

v3-auth-protocol - SNMPv3 authentication protocol

v3-priv-passphrase - SNMPv3 privacy passphrase

v3-priv-protocol - SNMPv3 privacy protocol

v3-sec-level - SNMPv3 security level

v3-username - SNMPv3 username

(*) - denotes a mandatory field for this configuration.

root@172-20-104-107.cisco.com(sub-device-netflow)#

Step 3 Enter the IP address of the device as shown in this example (required):

root@172-20-104-107.cisco.com(sub-device-netflow)# address 192.168.0.1

Step 4 If desired, enter the SNMP credentials for the device, as in the example below. If you specify snmp-version v2c, then you should enter the community string for the device. If you specify snmp-version v3, then you should enter the security level, username, authentication protocol, authentication passphrase, privacy protocol, and privacy passphrase.

root@172-20-104-107.cisco.com(sub-device-netflow)# snmp-version v2c

root@172-20-104-107.cisco.com(sub-device-netflow)# community public

to look at the device configuration that will be applied and verify that it is correct:

root@172-20-104-107.cisco.com(sub-device-netflow)# show

DEVICE TYPE : NDE (Netflow Data Export)

DEVICE ADDRESS : 192.168.0.1

SNMP VERSION : SNMPv2c

V2C COMMUNITY : public

V3 USERNAME :

V3 SECURITY LEVEL : No authentication, no privacy

V3 AUTHENTICATION : MD5

V3 AUTH PASSPHRASE :

V3 PRIVACY : DES

V3 PRIV PASSPHRASE :

root@172-20-104-107.cisco.com(sub-device-netflow)#

to come out of the subcommand mode and create the device. Remember the ID value that was assigned to the new device, you will need it to create the data source!

root@172-20-104-107.cisco.com(sub-device-netflow)# exit

Device created successfully, ID = 1

root@172-20-104-107.cisco.com#

. You will now be in netflow data source subcommand mode as shown here:

root@172-20-104-107.cisco.com# data-source netflow

Entering into subcommand mode for this command.

Type 'exit' to apply changes and come out of this mode.

Type 'cancel' to discard changes and come out of this mode.

root@172-20-104-107.cisco.com(sub-data-source-netflow)#

to see all the command options available, as in the example below:

root@172-20-104-107.cisco.com(sub-data-source-netflow)# ?

? - display help

cancel - discard changes and exit from subcommand mode

device-id - netflow device ID (*)

engine-id - netflow Engine ID

exit - create data-source and exit from sub-command mode

help - display help

name - data-source name (*)

show - show current config that will be applied on exit

(*) - denotes a mandatory field for this configuration.

root@172-20-104-107.cisco.com(sub-data-source-netflow)#

Step 9 Enter the device ID from Step 4 (required):

root@172-20-104-107.cisco.com(sub-data-source-netflow)# device-id 1

Step 10 Enter the name you would like for the data source (required):

root@172-20-104-107.cisco.com(sub-data-source-netflow)# name MyFirstNdeDataSource

Step 11 If desired, supply the specific Engine ID for this NetFlow data source (optional):

root@172-20-104-107.cisco.com(sub-data-source-netflow)# engine-id 123

to look at the data source configuration that will be applied and verify that it is correct:

root@172-20-104-107.cisco.com(sub-data-source-netflow)# show

DATA SOURCE NAME : MyFirstNdeDataSource

DATA SOURCE TYPE : NDE (Netflow Data Export)

DEVICE ID : 1

DEVICE ADDRESS : 192.168.0.1

ENGINE ID : 123

root@172-20-104-107.cisco.com(sub-data-source-netflow)#

to come out of the subcommand mode and create the data source:

root@172-20-104-107.cisco.com(sub-data-source-netflow)# exit

Data source created successfully, ID = 3

The data source is now created, and NetFlow records from the device will be received and accepted by the Prime NAM as they arrive.

Deleting NetFlow Data Sources Using the Web GUI

To delete an existing NetFlow data source, use the following steps. If the autocreation feature is turned on, and the device continues to send NetFlow packets to the NAM, the data source will be recreated again automatically as soon as the next NetFlow packet arrives. Therefore, if you wish to delete an existing NetFlow data source, it is usually advisable to first turn the NetFlow autocreate feature off, as described earlier.

.

Step 2 Click on the data source you would like to delete.

.

Deleting NetFlow Data Sources Using the CLI

To delete a NetFlow data source using the CLI, use the following steps. Note that when using the CLI, there are generally two separate phases involved. First you should delete the data source, then delete the device if you have no other data sources using the same device (for example with a different Engine ID value). As a shortcut, if you simply delete the device, then all data sources using that device will also be deleted.

Step 1 Show all data sources so you can find the ID of the one you want to delete:

root@172-20-104-107.cisco.com# show data-source

DATA SOURCE ID : 1

DATA SOURCE NAME : DATA PORT 1

TYPE : Data Port

PORT NUMBER : 1

-----------

DATA SOURCE ID : 2

DATA SOURCE NAME : DATA PORT 2

TYPE : Data Port

PORT NUMBER : 2

-----------

DATA SOURCE ID : 3

DATA SOURCE NAME : MyFirstNdeDataSource

TYPE : NDE (Netflow Data Export)

DEVICE ID : 2

DEVICE ADDRESS : 192.168.0.1

ENGINE ID : 123

-----------

root@172-20-104-107.cisco.com#

command to delete the data source:

root@172-20-104-107.cisco.com# no data-source 3

Successfully deleted data source 3

root@172-20-104-107.cisco.com#

Step 3 Show all devices so you can find the ID of the one you want to delete:

root@172-20-104-107.cisco.com# show device

DEVICE ID : 1

DEVICE TYPE : NDE (Netflow Data Export)

IP ADDRESS : 192.168.0.1

SNMP VERSION : SNMPv2c

V2C COMMUNITY : public

V3 USERNAME :

V3 SECURITY LEVEL : No authentication, no privacy

V3 AUTHENTICATION : MD5

V3 AUTH PASSPHRASE :

V3 PRIVACY : DES

V3 PRIV PASSPHRASE :

INFORMATION : No packets received

STATUS : Inactive

------

root@172-20-104-107.cisco.com#

command to delete the device:

root@172-20-104-107.cisco.com# no device 1

Successfully deleted device 1

root@172-20-104-107.cisco.com#

Note that if the autocreation mode is on, and the device continues to send NetFlow packets to the NAM, the data source (and device entry) will be re-created again automatically as soon as the next NetFlow packet arrives. Therefore, if you wish to delete an existing NetFlow data source, it is usually advisable to first turn the NetFlow autocreate feature off, as described earlier.

Testing NetFlow Devices

for a description of the fields.

If the device is sending NetFlow Version 9 (V9) and the Prime NAM has received the NetFlow templates, then a V9 Templates button appears below the Device System Information window.

Note NetFlow v9 templates do not appear in all NetFlow packets. When there are no templates, the V9 Templates button does not appear.

Managing WAAS and WAN Traffic

This section contains the following topics about using the Prime NAM GUI to manage WAAS data sources:

Understanding WAAS

Considering Deployment Scenarios

Using the WAAS Central Manager

Monitoring Response Time from WAAS Data Sources

Monitoring Client Data Sources

Monitoring WAN Data Sources

Monitoring Server Data Sources

Enabling WAAS Flow Agent

Adding Data Sources for New WAAS Device

Editing WAAS Data Sources

Deleting a WAAS Data Source

Auto Create of New WAAS Devices

Understanding WAAS

Cisco Wide Area Application Services (WAAS) software optimizes the performance of TCP-based applications operating in a wide area network (WAN) environment and preserves and strengthens branch security. The WAAS solution consists of a set of devices called Wide Area Application Engines (WAEs) that work together to optimize WAN traffic over your network.

When client and server applications attempt to communicate with each other, the network devices intercept and redirect this traffic to the WAEs to act on behalf of the client application and the destination server.

WAEs provide information about packet streams traversing through both LAN and WAN interfaces of WAAS WAEs. Traffic of interest can include specific servers and types of transaction being exported. Prime NAM processes the data exported from the WAAS and performs application response time calculations and enters the data into reports you set up.

The WAEs examine the traffic and use built-in application policies to determine whether to optimize the traffic or allow it to pass through your network not optimized.

You can use the WAAS Top Talkers Detail Dashboard to analyze the traffic for optimization. See Analyzing Traffic for Optimization Using the Top Talkers Detail for more information.

Cisco WAAS helps enterprises to meet the following objectives:

Provide branch office employees with LAN-like access to information and applications across a geographically distributed network.

Migrate application and file servers from branch offices into centrally managed data centers.

Minimize unnecessary WAN bandwidth consumption through the use of advanced compression algorithms.

Provide print services to branch office users. WAAS allows you to configure a WAE as a print server so you do not need to deploy a dedicated system to fulfill print requests.

Improve application performance over the WAN by addressing the following common issues:

– Low data rates (constrained bandwidth)

– Slow delivery of frames (high network latency)

– Higher rates of packet loss (low reliability)

.

Considering Deployment Scenarios

lists six different deployment scenarios you might consider to monitor the optimized traffic on your WAAS network. Scenario #1 is typical when using NAM-3 blades.

Table 7-2 WAAS Data Source Configurations

Deployment Scenario

Edge WAE Data Source

Core WAE Data Source

1

Clients in the edge (branch)

Servers in the core (data center)

NAM in the core

Client

Server

Server WAN

2

Clients in the edge (branch)

Servers in the core (data center)

NAM in the edge

Client

Client WAN

Server

3

Servers in the edge (branch)

Clients in the core (data center)

NAM in the core

Server

Client

Client WAN

4

Servers in the edge (branch)

Clients in the core (data center)

NAM in the edge

Server

Server WAN

Client

5

Clients and servers in the edge (branch) and the core (data center)

NAM in the core

Client

Server

Client

Server

Client WAN

Server WAN

6

Clients and servers in the edge (branch) and the core (data center)

NAM in the edge

Client

Server

Client WAN

Server WAN

Client

Server

Using the WAAS Central Manager

The Cisco WAAS is centrally managed by a scalable, secure, and simple function called the Cisco WAAS Central Manager, which runs on Cisco WAE Appliances. The Cisco WAAS Central Manager provides a centralized mechanism for configuring features, reporting, and monitoring, and can manage a topology containing thousands of Cisco WAE nodes.

Prime NAM is accessible from within the Central Manager interface. Prime NAM integration with WAAS Central Manager provides for easier viewing of Prime NAM reports that are directly associated with Application Response Time measurements through the WAN, in both WAAS optimized and non-optimized environments.

Below is a standard configuration workflow that you can follow.

Prerequisites are that the WAAS Central Manager is installed and functional, and the Cisco NAM (device or virtual blade) is installed and functional.

Step 1 From the WAAS Central Manager, configure the Cisco NAM IP address and login credentials.

Step 2 From the router or switch, configure the data source(s) for baseline (SPAN).

Step 3 From the WAAS Central Manager, configure the Site definition. See Configuring Sites for more information.

Step 4 In the Monitor section of WAAS Central Manager, one can observe the Top Talkers under the Network Analysis tab. See Analyzing Traffic for Optimization Using the Top Talkers Detail for more information.

Step 5 From the WAAS Central Manager, configure the WAAS Flow Agent and branch/data center WAEs.

Step 6 Create Device Groups for the branch and data center on the WAAS Central Manager, and assign a device to the Device Groups.

Step 7 Enable the Flow Agent on the WAAS, pointing to the Cisco NAM IP. Segments are automatically selected (enabled only if Cisco NAM is configured). Prime NAM will start to compute baseline ART, protocol distribution, and Top Talkers. See Enabling WAAS Flow Agent.

Step 8 Turn on WAAS optimization. See Optimizing WAN for more information.

Step 9 Turn on the Flow Agent and identify the servers to monitor to get ART improvements. See Editing WAAS Data Sources.

Monitoring Response Time from WAAS Data Sources

Prime NAM processes the TCP flow data exported from the WAAS and performs application response time (ART) calculations and reports. You use the Prime NAM GUI to create a WAAS data source to monitor WAAS traffic statistics. In addition to ART, Prime NAM monitors and reports other traffic statistics of the WAAS data sources including application, host, and conversation information.

Prime NAM provides different ART metrics by collecting data at different points as packets flow along their paths. Prime NAM provides five different collection points, each represented by a WAAS data source. Figure 7-1, WAAS Data Sources (Data Collection Points), shows an example of the data collection points. The solid line represents data exported from a WAAS device and/or directly monitored traffic like SPAN. The broken line represents data exported from a WAAS device only.

Figure 7-1 WAAS Data Sources (Data Collection Points)

.

Table 7-3 WAAS Data Collection Points

Setting

Description

Client

This setting configures the WAE device to export the original (LAN side) TCP flows originated from its clients to Prime NAM for monitoring. To monitor this point, configure a Client data source.

Client WAN

This setting configures the WAE device to export the optimized (WAN side) TCP flows originated from its clients to Prime NAM for monitoring. To monitor this point, configure a Client WAN data source.

Server WAN

This setting configures the WAE device to export the optimized (WAN side) TCP flows from its servers to Prime NAM for monitoring. To monitor this point, configure a Server WAN data source.

Server

This setting configures the WAE device to export the original (LAN side) TCP flows from its servers to Prime NAM for monitoring. To monitor this point, configure a Server data source.

Passthrough

This setting configures the WAE device to export the TCP flows that are passed through unoptimized.

You can also configure a data source to use Export Passthrough data. For more information about configuring WAAS data sources, see Editing WAAS Data Sources.

Monitoring Client Data Sources

By monitoring the TCP connections between the client and the WAE device (Client segment in Figure 7-1), you can measure the following ART metrics:

Total Response Time as experienced by the client

Total Transaction Time as experienced by the client

Bandwidth usage (bits/packets) before optimization

Number of transactions and connections.

Network Time broken down into two segments: client-edge and edge-server

submenu.

Monitoring WAN Data Sources

By monitoring the TCP connections between the edge and core WAE devices (Client WAN and Server WAN segments in Figure 7-1), you can measure the following:

Bandwidth usage (bits/packets) after optimization

Network Time of the WAN segment

Monitoring Server Data Sources

By monitoring the TCP connections between the core WAE devices and the servers (Server segment in Figure 7-1), you can measure the following ART metrics:

Server Response Time (without proxy acceleration/caching server)

Network Time between the core WAE device and the servers

Note Prime NAM measures Network Time by monitoring the TCP three-way handshake between the devices.

Enabling WAAS Flow Agent

command to enable the Flow Agent on the WAAS:

flow monitor tcpstat-v1 enable

After you enable flow export to the Prime NAM using WAAS CLI commands like those above, WAAS devices will be detected and automatically added to the NAM’s WAAS device list.

You must then configure the WAAS segments you want to monitor as WAAS data sources: Client, Client WAN, Server WAN, and/or Server. See Editing WAAS Data Sources, for more detailed information.

You can also use the WAAS Central Manager to centrally issue WAAS CLI commands to configure a large number of WAEs at one time. Prime NAM is accessible from within the WAAS Central Manager interface. For more information about WAAS Central Manager, refer to the WAAS technical documentation.

Note In addition to configuring the WAAS devices, you must specify which application servers you want to monitor among the servers being optimized by WAAS devices. See Configuring WAAS Monitored Servers, for more detailed information.

.

This section contains the following topics:

Adding Data Sources for New WAAS Device

Editing WAAS Data Sources

Deleting a WAAS Data Source

Adding Data Sources for New WAAS Device

Prime NAM uses WAAS data sources to monitor traffic collected from different WAAS segments: Client, Client WAN, Server WAN, and Server. Each WAAS segment is represented by a data source. You can set up Prime NAM to monitor and report other traffic statistics of the WAAS data sources such as application, host, and conversation information in addition to the monitored Response Time metrics.

Note This step is not usually necessary because export-enabled WAAS devices are detected and added automatically. See Enabling WAAS Flow Agent, for more information about how to enable WAAS export to the NAM.

To manually add a WAAS device to the list of devices monitored by Prime NAM:

.

.

The Prime NAM Data Source Configuration Dialog appears.

Step 3 Choose “WAAS” from the list of Types.

Step 4 Enter the device IP address in the IP field.

.

to add the new WAAS custom data source.

Editing WAAS Data Sources

Prime NAM uses WAAS data sources to monitor traffic collected from different WAAS segments: Client, Client WAN, Server WAN, and Server. Each WAAS segment is represented by a data source. You can set up Prime NAM to monitor and report other traffic statistics of the WAAS data sources such as application, host, and conversation information in addition to the monitored Response Time metrics.

To edit a WAAS device’s custom data source:

. The data sources are displayed.

.

You can configure the WAAS data sources to monitor the following WAAS segments as shown in Figure 7-1, WAAS Data Sources (Data Collection Points):

Client—This setting configures the WAE device to export the original (LAN side) TCP flows originated from its clients to Prime NAM for monitoring.

Client WAN— This setting configures the WAE device to export the optimized (WAN side) TCP flows originated from its clients to Prime NAM for monitoring.

Server WAN—This setting configures the WAE device to export the optimized (WAN side) TCP flows from its servers to Prime NAM for monitoring.

Server—This setting configures the WAE device to export the original (LAN side) TCP flows from its servers to Prime NAM for monitoring.

. For example, if you already configure SPAN to monitor the server LAN traffic, it is not necessary to enable the Server data source on the WAE device.

Note The following step is optional and applies only when Prime NAM is configured to export data to an External Response Time Reporting Console, such as the NetQos Super Agent.

Deleting a WAAS Data Source

To delete a WAAS custom data source:

. The data sources are displayed.

.

A dialog box displays the device address and asks if you are sure you want to delete the device.

Auto Create of New WAAS Devices

If you have numerous WAE devices, you can set up Prime NAM to configure newly discovered WAE devices using a predefined configuration template using the Prime NAM auto configuration option.

Note If most of your WAE devices are edge WAE, you might want to set the auto configuration to be that of the edge device, then manually configure the data center WAE. For example, select the Client segment for monitoring.

To configure WAAS autoconfiguration:

. The data sources are displayed.

.

The Prime NAM Data Source Configuration Dialog displays.

check box.

Step 4 Check the check boxes for the desired Segments. See Editing WAAS Data Sources, for more information.

Configuring Hardware Deduplication

Note This section applies only to Cisco NAM 2320, 2220, and 2204 appliances.

Prime NAM supports hardware-based detection of duplicate packets and allows you to configure a single deduplication filter that reduces the amount of duplicate traffic across all adapter ports.

You can use deduplication to eliminate redundant data. This can help to significantly shrink storage requirements and improve bandwidth efficiency on tasks like backup and recovery.

After you enable deduplication, the NAM appliance detects and filters the duplicated packets. The packet is identified as duplicated if all inspected segments match another packet within the specific time window.

be dropped.

To configure packet deduplication:

.

check box to enable packet deduplication.

Enter a value in the Time Window (1-127 in microseconds (μs)) for the search or buffer period.

The value you set in the Time Window indicates the length of time (n microseconds) in which two packets can be considered duplicates. If the Time Window is 100 μs but two identical packets arrive 120 μs apart, the second packet would not be dropped. If the identical packets arrive 80 μs apart, the second packet would be dropped.

Step 3 Click to choose a segment of the packet to inspect for deduplication.

The default inspects the entire packet. The second option inspects all segments except the ISL portion of the packet. The third option inspects all segments except the ISL, MAC, and VLAN portions of the packet. The fourth option inspects all segments except the ISL, MAC, and VLAN portions of the packet. The final (bottom) option inspects only the UDP/TCP and payload segments of the packet.

Note Regardless of the option you choose, the packet checksum is ignored.

to cancel any change.

Setting Up Alarms and Alarm Thresholds

Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both. You can choose what types of events for which you want Prime NAM to notify you, and how you want to be notified. Monitoring alarms enables you to watch problem areas and collect data on areas such as increased utilization, severe application response delays, and voice quality degradation.

This is the order that you typically follow for setting up alarms and alarm thresholds:

Step 1 Define the way you would like to be notified when an alarm occurs (by e-mail, trap, trigger capture, or syslog).

For e-mail server settings: Choose Administration > System > E-Mail Setting

For trap settings: Choose Administration > System > SNMP Trap Setting

For capture session settings: Choose Capture > Packet Capture/Decode > Sessions

For syslog settings: Choose Administration > System > Syslog Setting

.

.

The tasks for setting up alarms are:

Configuring Alarm Actions

Viewing Alarm Actions

Defining Thresholds

Configuring Alarm Actions

Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both.

When a threshold’s rising water mark is crossed, the alarm condition is met. This triggers the alarm action to take effect.

To configure an alarm action:

.

.

Step 3 Enter a Name for the action (up to 63 characters).

Step 4 Choose the type of alarm action. Prime NAM supports any combination of these four actions in one alarm condition:

Alarm Action

Description

Important Notes

An alarm action that e-mails the syslog content of the alarm condition. To avoid e-mail flooding the network, Prime NAM does not send more than five e-mails in any given hour.

. Prime NAM alarm mail is sent as a result of Prime NAM alarms, not router or switch alarms.

Prime NAM sends up to five e-mails per hour per function (traffic and NetFlow, voice signaling, RTP, and application response time). Also, in each e-mail, there could be up to five alarm messages. These limits are in place to avoid e-mail overload.

If you have configured e-mail alarms and do not receive e-mail, then your Prime NAM does not have any alarms.

If Prime NAM sends you many alarm messages, the e-mail may state, for example, “5 of 2,345 alarm messages.”

An alarm action that sends Prime NAM trap messages to one or more trap servers. Any trap server that has the same community string will receive the trap message. Prime NAM uses Cisco Syslog MIB in the trap message. To avoid trap flooding, the limit is ten trap messages per interval.

. After the “Community field appears, choose the community string from the drop-down list.

An alarm action to start or stop a pre-defined capture session or stop a capture to save it to a file.

radio button. For more details, see Understanding Trigger Capture.

An alarm action that sends syslog messages to remote syslog servers. The limit is ten syslog messages per interval to avoid flooding the network.

.

Step 5 To edit or delete alarm actions, select the alarm and use the appropriate button.

.

The Alarm Action table displays the newly configured action in its list.

Viewing Alarm Actions

Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both. You can set thresholds and alarms on various network parameters such as increased utilization, severe application response delays, and voice quality degradation and be alerted to potential problems.

Prime NAM supports IPv6 for all alarm functionality.

Note You could see two alarms for the same occurrence if both the source and the destination are in the same site.

for descriptions of the fields on the Alarm Configuration window.

To configure alarm actions, see Configuring Alarm Actions.

Understanding Trigger Capture

This section describes how to use a trigger capture to start a capture session based on the alarm parameters you set. For example, you can set alarm parameters on various thresholds to start a capture session which can be used to investigate some kind of questionable network activity.

You must set your alarm threshold parameters so that Prime NAM has defined rising or falling numbers that will cause an action, or trigger, to start a capture session. You can also use the stop-and-save option. The actions are defined below:

Trigger Capture Start —An alarm condition occurs based on threshold parameters you have set; the capture session starts automatically.

Trigger Capture Stop : An alarm condition occurs based on the threshold parameters you have set; the capture session stops automatically.

Trigger Capture Stop Capture and Save to File —An alarm condition occurs, stopping the capture session. If the captured packet data is in memory, it is saved to a file. The buffer memory is then clear to wait for next alarm event.

When an event occurs that you have defined as an alarm threshold, NAM stops any existing capture session and saves the captured packets from memory into a file. The capture session then restarts. NAM can save up to five files, depending on your local hard disk storage.

NAM monitors for threshold parameters every minute. For real-time data, the default is 5 minutes.

Defining Thresholds

Prime NAM can inspect incoming performance records and apply a configured set of thresholds to the most recent interval of data. Using thresholds allows you to target specific network traffic issues and set up notifications that are triggered when certain thresholds are crossed. For example:

if a server's CPU load exceeds 90%

if a device or the whole network uses more bandwidth than usual, or

if the remaining file size on a disk drive is less than 15% or 100 MB.

In general, you should set thresholds so that only severe traffic problems that impact quality of service generate events. These critical events are intended to provide actionable notification of problems to network operators. When setting thresholds try to identify a traffic level that will have a noticeable effect on network service levels. Set a duration that corresponds to an unacceptable period of poor service. The goal is to generate very few, significant events indicating severe problems that require immediate attention. Thresholds are not intended as a reporting tool to generate statistical information about network traffic.

To set up alarm thresholds for variables with values that trigger alarms, see Viewing Alarm Actions.

Note You could receive two alarms for the same occurrence if both the source and the destination are in the same site.

You can also decide whether you want to be notified if the threshold is being crossed just once, or whether you only want an alarm to be triggered if this state persists for a certain time. This helps you to ensure an effective network monitoring system, which will not bombard you with unnecessary notifications.

) displays thresholds you have configured. If you hover over the arrow next to the threshold Name a detailed view of the selected threshold displays.

.

You can set up alarm thresholds by defining threshold conditions for monitored variables on the NAM.

You can configure the following thresholds:

Setting Host Thresholds

Setting Conversation Thresholds

Setting Application Thresholds

Setting Response Time Thresholds

Setting DSCP Thresholds

Setting RTP Stream Thresholds

Setting Voice Signaling Thresholds

Setting NetFlow Interface Thresholds

Related Topics

Configuring Alarm Actions

Viewing Alarm Actions

Setting Host Thresholds

.

tab.

Step 3 The Host Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available on this window.

Note If you leave a selection blank, it means that the parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting Conversation Thresholds

.

tab.

Step 3 The Conversation Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available in this window.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting Application Thresholds

.

tab.

Step 3 The Application Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available in this window.

Note If you leave a selection blank, it means that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting Response Time Thresholds

.

tab.

Step 3 The Response Time Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available in this window.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting DSCP Thresholds

.

tab.

Step 3 The DSCP Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available in this window.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting RTP Stream Thresholds

Prime NAM sends syslog, trap, e-mail, and trigger captures for RTP streams that violate stream statistics thresholds on the following metrics:

– Number of Consecutive Packet Loss

Each RTP packet has an RTP header that contains a sequence number. The sequence number increments by one for each RTP packet received in the same RTP stream. A gap in the sequence numbers identifies a packet loss. If the gap in sequence numbers jump is more than the threshold, the software raises an alarm condition.

– Packet Loss percent

There are two types of percent packet loss percent: Adjusted Packet Loss and Actual Packet Loss. Actual Packet Loss indicates expected packets that never appear in Prime NAM. Adjusted Packet Loss includes actual packets lost and packets that arrive with large delay beyond the expected buffer capacity of the endpoint.

– Jitter: Packets delay compare to the expected receiving time

– Concealment Seconds: Seconds in which there is one or more packets lost

– Severe Concealment Seconds: Seconds in which there is more than 5% of packet lost

To set thresholds for RTP streams:

.

tab.

Step 3 The RTP Stream Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available in this window.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting Voice Signaling Thresholds

You can set up software to monitor voice call quality. When Cisco Unified Communication Manager’s call detail records option is enabled, Cisco IP phones, both SCCP and SIP, will report the call’s jitter and packet loss at the end of the call. Prime NAM intercepts this information and raises an alarm when the alarm condition crosses the rising threshold.

To set up a voice signaling threshold:

.

tab.

Step 3 The Voice Signaling Alarm Threshold Configuration window displays. Fill in the fields as appropriate.

describes the fields available under the Voice Signaling Metrics drop-down menu.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Setting NetFlow Interface Thresholds

.

tab.

.

Note If you leave a selection blank, it means that that parameter will not be considered. If you select Any, it will use any of the selections for that parameter, if encountered.

to remove any changes you might have made.

Editing or Deleting an Alarm Threshold

You can edit alarm thresholds on an as-needed basis. You can delete thresholds when you no longer need them. Any changes take effect immediately.

To edit or delete an alarm threshold:

.

The Thresholds table displays.

.

Step 3 Depending on your selection:

If you selected to edit, the dialog box displays for the type of alarm; for example, Host Threshold . Make the necessary changes. Then

to save your changes

to reset the thresholds to the values set before you edited them, or

to cancel the edit and return to the previous page.

If you selected to delete, click OK to confirm deletion, or click Cancel to leave the configuration unchanged.

Scheduling Data Report Exports

You can use Prime NAM to schedule data collection over a period of time for trend analysis and troubleshooting activities and then export the reports to be viewed at your convenience. For example, if you see a spike in application response time on a certain day or time you can set up a scheduled report. The report exports collected data from a specific range of time so that you have a snapshot of what might be causing issues.

You can set up scheduled jobs that will generate a daily report at a specified time, in a specified interval, and e-mail it to a specified e-mail address or addresses.

button, rather than wait for the scheduled time. This report can also be sent after you preview it.

Tip Prime NAM displays time in this report based on the browser that initiated the report. So if your browser is in San Jose, CA, the time zone displayed in the report is based on the time zone of that machine. The data is not based on the Cisco NAM server time if the two machines are not synchronized. To synchronize your time, see Synchronizing Your System Time.

This section covers the following topics:

Creating a Scheduled Report Export

Editing a Scheduled Export Job

Deleting a Scheduled Export Job

Creating a Scheduled Report Export

Scheduled export of data reports is a convenient way to collect traffic of interest in Prime NAM. We strongly recommend you to define your data report time range first and then set your export time right after your report end time. This is the most straight-forward way to use this feature.

To set up a scheduled report and export it to an e-mail address or addresses:

.

time.

Step 3 Choose the Export Time (which is the day of the week on which to generate the weekly report and hour that report will be sent). Multiple days are supported. You can also specify what time to start the export.

The actual data time range used to generate the report for export is always the last available and complete time span specified in the Report Time step above. Prime NAM does not generate reports using data in any future time. For example:

Export Time

Report Time

Data Reported and Exported

If Every Day and Hour is 09:00

07:00 to 08:00

07:00 to 08:00 the same day (recommended use case)

If Monday and Friday and Hour is 03:00

05:00 to 05:59

Sunday and Thursday 05:00 to 05:59

If Every Day and Hour is 00:00

18:00 to 01:00

Previous day from 18:00 to 01:00

Tip Set your Export Time to occur right after the end of Report Time. This gives you the most recent data and is the easiest way to use this feature.

Step 4 Enter the e-mail address to which you would like the report delivered.

Step 5 Choose the delivery option (CSV or PDF).

Step 6 Enter the Report Name and Report Description, which appear at the end of the report delivered to you.

Step 7 Click:

Submit to submit the request for the scheduled job.

Preview to generate the report immediately.

Note Remember that report results are based on the local time of the browser that initiated the report.

Editing a Scheduled Export Job

.

Step 2 Click the job you want to edit.

.

Step 4 Modify the information as desired.

to submit the request for the scheduled job.

Deleting a Scheduled Export Job

.

Step 2 Click the job you want to delete.

.

to return to the previous window without deleting the job.

Accessing Device Interface and Health Details

You can enable your NAM to access interface and health device details if they are available on the device you identify using the Prime NAM Managed Device feature.

This section contains the following topics:

Understanding How Platform-Specific NAMs Handle Managed Device Data

Configuring Managed Device Information

Viewing Managed Device Information

Understanding How Platform-Specific NAMs Handle Managed Device Data

A managed device can represent a router or switch being monitored by Prime NAM. Depending on your Cisco NAM platform, the managed device is accessed by the NAM differently and may support different MIBs based on the device support.

The following details list how NAM accesses the managed device:

For a physical or virtual blade or service module, the managed device is the device in which NAM software or hardware is located. The managed device information is automatically updated without user intervention and cannot be modified on the NAM. One of the benefits of having a blade or service module is that there is no configuration required for this feature.

For a physical appliance, you identify the managed device as a switch or router that shares its traffic using SPAN or user credentials. You must enter the device address and either the SNMP credentials or NetConf credentials to configure the NAM SPAN session on the managed device. On certain platforms, NetConf is an alternative for NAM to configure a NAM SPAN session on a managed device which does not support configuring NAM SPAN sessions using SNMP. If you choose to use NetConf, you must enable NetConf on the managed device interface and enable SSH to support the SPAN session. This enables you to monitor managed device information such as interface statistics.

All supported NAM platforms, except NAM-NX1 and vNAM, require if-mib (ifTable) to provide the managed device interface data. NAM-NX1 gets this data by exchanging messaging with the Supervisor card (SUP) on the EOBC channel. SPAN session configuration from a managed device is not allowed on Cisco Prime vNAMs.

All supported NAM platforms, except for NAM-NX1, vNAM, and NAM appliance platforms, require entity-mib and if-mib to get and configure SPAN sessions. NAM-NX1 uses EOBC and proprietary messages with SUP on EOBC to get and configure SPAN sessions. Appliances have two options to get and configure SPAN sessions: SNMP (which use the MIBs required by the other NAM platforms) or NetConf interface (which require no MIBs). SPAN session configuration from a managed device is not allowed on Cisco Prime vNAMs.

. For MIB support, see .

Configuring Managed Device Information

The managed device information that is required is dependent on your platform device type. For details, see Understanding How Platform-Specific NAMs Handle Managed Device Data.

For details on how to ensure NAM is managing your device interface and other traffic, see:

Configuring Managed Device Information on Blades or Modules

Configuring Managed Device Information on Appliances and other Virtual Platforms

Configuring Managed Device Information on Blades or Modules

You are not required to configure NAM blades or modules on the NAM side.

Note NAM-3 platform requires SNMP MIBS (SNMPv3 is not required). SNMP requests and responses are communicated over an internal interface within the chassis and SNMPv3 is not used. NAM-NX1 requires some SNMP MIBs.

Ensure you follow the configuration instructions in your platform documentation so that your managed device communicates network traffic to NAM.

. For details, see Viewing Managed Device Information.

For details about how NAM treats managed devices, see Accessing Device Interface and Health Details.

Configuring Managed Device Information on Appliances and other Virtual Platforms

window. Enter your device address and credentials to allow NAM SPAN session configuration. You will need to configure SNMP credentials to receive details about managed device interface statistics. You may need to configure NetConf credentials to enable a NAM SPAN session to and from the managed device. To use NetConf, your managed device must support the NetConf interface and have SSH enabled. You can use NetConf as an alternative to configuring a NAM SPAN session on your managed device if your device does not support configuring NAM SPAN sessions via SNMP.

Note This section applies to all Cisco NAM platforms except the NAM-NX1 and NAM-3 blades. SPAN session configuration via managed device is not allowed on vNAMs.

To set your managed device parameters:

.

.

when finished.

to submit the information and close the window.

Viewing Managed Device Information

.

.

Configuring Network Parameters

This section describes how to set up the network parameters including:

Configuring Sites

Setting Interface Speed using NetFlow Interface Capacity

Configuring DSCP Groups

Configuring Sites

.

is a collection of hosts (network endpoints) partitioned into views. You can limit the view of your network analysis data to a specific city, a specific building, or even a specific floor of a building, and can use sites to focus collection and analysis of data. Sites are optional, but recommended.

See the following sections to set up sites:

Defining a Site

Viewing Defined Sites

Configuring Sites Using Subnets

Defining a Site

A site can be defined as a set of subnets specified by an address prefix and mask, or using other criteria such as a remote device data source (for example, remote WAE device and segment information).

Configuring Sites Using Subnets gives specific information about various scenarios.

To set up a site or sites:

.

Step 2 The Site Configuration window appears. Enter a Name, Description, Subnet, and Data Source as appropriate.

for field descriptions.

to tell the software to look for subnets in the traffic. See Detecting Site Subnets.

.

Note The “Unassigned” site (with a description of “Unclassified hosts”) includes any that do not match any of your site configurations. Sites are classified at the time of packet processing.

Detecting Site Subnets

for information about the fields.

, Prime NAM finds those subnets that meet the criteria that you entered.

Viewing Defined Sites

To view already-defined sites:

.

Step 2 The Sites window appears. Defined sites will be listed in the table.

.

Editing a Site

You can edit sites that have been created. The Unassigned site cannot be edited or deleted.

.

Step 2 Highlight the site that you have configured.

and edit the desired field.

.

to cancel any changes and return to the main Sites page.

Configuring Sites Using Subnets

for examples of site definitions.

Note VLAN option is removed from the Site definition.

For details on how Prime NAM resolves overlapping IP addresses, see Resolving Ambiguity (Overlapping Site Definitions)

Table 7-4 Site Definition Details

Site Definition

Example

Notes

Subnet (IP address prefix)

Preferred. Normally, subnets alone are sufficient to define a site.

Overlapping IP addresses (subnet from data source)

data source.

data source.

data source.

data source.

In certain scenarios when there are overlapping IP address spaces in the networks (for example, in private networks where hosts from different sites have the same IP addresses), then data sources can be used to differentiate the subnets.

WAE device serving the site

For WAAS traffic, you can define a site associated with a WAE device without specifying the site’s subnets. Simply select all of the WAAS data sources coming from the WAE device(s) serving that site.

We recommend that you use subnets to specify WAAS-optimized sites. Use this method only if the site’s subnets cannot be determined.

If you are configuring a WAAS device, you will need to add WAAS servers to Prime NAM. See Auto Create of New WAAS Devices.

Multiple Rules

You can define a site using a combination of multiple rules described in this table. For example, if a site has both optimized and non-optimized traffic, it can be defined using a combination of WAAS data sources and a subnet from a NetFlow data source.

When defining a site using multiple data sources, be careful to make sure that those data sources do not have duplicated traffic to avoid double counting the site traffic statistics.

Unassigned site

The Unassigned site includes hosts that do not match any of your site configurations. Sites are classified at the time of packet processing.

Cannot be edited or deleted.

Resolving Ambiguity (Overlapping Site Definitions)

Conflicting rules are not allowed in site definitions. Of the following two scenarios, the second one is not allowed.

1.2.3.0/24 from DATASOURCE1 = SiteA

Using a prefix is the preferred method. Data source is secondary. In the following two scenarios, the first would receive the higher priority.

WAE1-Client datasrc = Site E

The longest prefix has higher priority (same data source). In the following two scenarios, the first would receive the higher priority.

1.2.0.0/16 from DATASOURCE1 = Site C

The more refined (specific) rule has higher priority. In the following two scenarios, the first would receive the higher priority.

1.2.3.0/24 (any datasrc) = Site D

Setting Interface Speed using NetFlow Interface Capacity

). Otherwise, the Prime NAM software can only display the throughput of the interface, but cannot show its utilization.

.

To add a new or edit an existing interface, continue to Creating or Editing a NetFlow Interface.

Creating or Editing a NetFlow Interface

.

Note It is normally not necessary to manually create NetFlow interfaces. They should be discovered automatically when the device sends NetFlow packets to the NAM.

.

Configuring DSCP Groups

Differentiated services monitoring (DiffServ) is designed to monitor the network traffic usage of Differentiated Services Code Point (DSCP) values. To monitor DSCP, you must configure at least one aggregation profile, and one aggregation groups associated with each profile. This section describes how to set up the DSCP groups.

You can define two or three different groups of traffic, and assign the various DSCP values to each group. Or you can assign one particular value for the first group and give it a name, and then assign all the rest to the other (or default) group and give that a name.

http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a00800949f2.shtml

The following tasks help you set up and manage the DSCP groups:

Creating a DSCP Group

Editing a DSCP Group

Deleting a DSCP Group

Creating a DSCP Group

To create a DSCP Group:

.

The DSCP Groups table displays.

.

The DSCP Group Configuration window displays.

.

shows the available formats and associated values.

to save your changes.

Editing a DSCP Group

To edit a DSCP group:

.

The DSCP groups window displays.

.

to cancel.

Deleting a DSCP Group

.

Configuring Application Classification

Prime NAM provides two ways of enhancing how your traffic is displayed in the dashboard and reports. Prime NAM uses application classification to:

Expand the number of application’s for which Prime NAM can provide down to Layer 7 application details. See Adding More Detail into Dashboard and Application Reports.

Create custom applications using a list of rules based on HTTP URL or Server /Port definition. This is referred to as the classic application classification model. See Creating Deeper Visibility Into Application Traffic.

You can use one or both of these methods to ensure Prime NAM provides the level of traffic detail you need.

Adding More Detail into Dashboard and Application Reports

You can add more detail enable deep packet inspection to see Layer 7 application visibility by using application classification. To understand more about application classification and Layer 7 application visibility, see About Deeper Application Classification.

In order to enable application classification for deep packet inspection in Prime NAM:

. Then select the Deep Packet Inspection checkbox in order to enable your Prime NAM dashboards to display key critical details, such as hostname and port, in your traffic captures and reports.

in the Protocol Pack pane to download the latest NBAR2 Protocol Pack (PP). Prime NAM stores the default plus one additional PP.

product links at the CCO software download location at following URL:

Timesaver Use Downloads Home >Products > Cloud and Systems Management > Network Analysis Module (NAM) Products > Cisco Prime Network Analysis Module Software to locate the protocol pack.

.

About Deeper Application Classification

This release of Prime NAM supports a more comprehensive, or deeper, application classification method. This method allows you to see more details in your monitoring dashboards and packet captures (including application names, interface details, and so on).

To expand the level of application information your Prime NAM can monitor and analyze, enable the deeper level of application classification and download application signature updates when you need them.

In addition to providing the application name, this method also brings attributes to simplify application management for both classification and reporting. Application categorization, for example, allows the grouping of similar applications.

When this method is enabled you can view extracted information from applications such as HTTP URL, HTTP User Agent, and SIP URL, for export or classification.

Note Depending on your installation or upgrade method you may need to enable deep packet inspection.

You can use protocol packs to add new and update existing application signatures. NAM support of protocol packs allows you to see any new and updated application signatures in Prime NAM traffic monitoring. For more details on Protocols Packs, see About Protocol Packs and Application Classification.

You can also use the Prime NAM CLI to change the classification status to use the deeper application classification method and check which classification setting your NAM is using.

on Cisco.com.

.

About Protocol Packs and Application Classification

Prime NAM uses Cisco’s Network-Based Application Recognition to recognize and classify a wide variety of protocols and applications, including web-based and other difficult-to-classify applications and protocols that use dynamic TCP/User Datagram Protocol (UDP) port assignments. The support of Protocol Packs (PP) allow you to update your application signatures so that dashboard and traffic data provide the most detailed information available. Prime NAM Protocol Packs can be found in the CCO software download location. These are the only protocol packs you should use with Prime NAM.

You do not need a license to download a protocol pack for Prime NAM. For this release, updating the protocol pack may cause a temporary interruption of operation for several seconds, similar to changing the system time.

.

For details, see Adding More Detail into Dashboard and Application Reports.

If you choose not to use the deep application classification method, Prime NAM defaults to a less comprehensive classification method that may not include all applications or protocols.

About NAM Classic Deep Packet Application Classification

This section covers how you can customize your Prime NAM to provide a deeper level of visibility into the application data presented in the dashboard and reports.

Prime NAM uses the application ID classification system. When defining applications, you can view and select from a list of protocols and port numbers, and candidate IP addresses and port numbers for the traffic being analyzed. You can also create URL-based application classifications. For an in depth overview of application types, see Understanding Application Traffic.

You can also configure custom applications using the Application Programming Interface (API), also referred to as the North Bound Interface (NBI). This is needed to ensure uniform application classification across a number of NAMs. See your customer service representative for details on how to get access to the NBI documentation.

To set up classifications use the following tasks:

Creating Deeper Visibility Into Application Traffic

Configuring Application Groups

Filtering Encapsulations

Creating Deeper Visibility Into Application Traffic

This section provides details into the application classification method known as Network Based Application Recognition (NBAR) classic.

You can use Prime NAM to monitor pre-determined or custom applications in your Data Center so that your traffic analysis is more focused and therefore optimal.

. This means that you may not have enough insight into the monitoring traffic. After configuring your application or ports, you can gain visibility into those application details on the monitoring screens. Similarly for the URL-based applications, instead of having all web traffic being grouped under the HTTP URL, you can specify a more granular layer of monitoring by using the application and port.

This section describes the following tasks:

Creating Custom Applications

Editing Custom Application Classifications

Adding More Detail into Dashboard and Application Reports

Deleting an Application Rule

Understanding Application Traffic

To find out more about Layer 7 visibility and deep packet inspection, see Adding More Detail into Dashboard and Application Reports.

Creating Custom Applications

You can create a custom applications using the list of rules based on HTTP URL, Protocol, or Server IP addresses. If you create a custom application, you can later edit it if you choose. Standard, pre-defined applications cannot be edited.

For details on application types or other options, see Understanding Application Traffic.

To create a new application classification:

..

.

Step 2 Enter an application classification name.

Step 3 (Optional) Enter an application description that gets displayed in the view table. There is a 75 character limit.

Step 4 (Optional) You can skip the Selector value. This is an arbitrary number, unique within an engine-id. It will be automatically assigned if left blank.

Step 5 Select the application classification rule type drop-down menu.

in the Application Classification Rule drop-down menu.

Then select the definition drop-down menu to enter the following required information.

– To choose a Server, Protocol, and Port or Port Range, select the drop-down menu then enter the required information.

.

– To choose a port or port range, enter the required information.

in the Application Classification Rule drop-down menu then enter the required information. (See Understanding URL-Based Application Classification for additional field details.)

Tip You can also add or remove multiple rule definitions to this application classification by clicking the gear icon and selecting Insert new rule or Delete.

to create the new application classification signature.

You can now monitor the new applications using the Interactive Report filter with the application dashboards.

Editing Custom Application Classifications

in the Engine ID column.

To edit an application:

.

.

The Application configuration window displays.

Step 3 Make the desired changes.

Step 4 Do one of the following:

To accept the changes, click Submit .

To leave the configuration unchanged, click Cancel .

To delete the application rule, click Delete .

Deleting an Application Rule

You may want to delete an application rule when you are no longer using it in your network.

.

You cannot delete preconfigured system applications, only custom applications.

Understanding Application Traffic

This section contains information on application types, rules, and other details you may find helpful.

There are two types of application classification rules:

rules defines a a server IP address. For server-based application classification, Prime NAM analyzes traffic for the candidate IP addresses and port number or numbers you specify. You can also define port or protocol-based application (for example, based on a TCP port). You can create additional ports to enable Prime NAM to handle additional traffic for standard applications. Port ranges for IP are 1-255 for IP. TCP and UDP port ranges are1-65535.

engine ID.

Tip To create Protocol or Server IP Address applications, you can check the Application Configuration table in Analyze > Traffic > Application. To create an HTTP URL-based application, you can analyze the incoming URLs on Analyze > Traffic > URL Hits. NBAR is enabled through CLI.

Prime NAM recognizes an application based on either:

An application which resides on a specific server IP address—You can filter using an IP address, a protocol, and a port or range of port numbers. After configuring the server information, the monitoring dashboard displays more detailed application information instead of just the unknown grouping.

A set list of application IDs—The protocol, port number, or port number range, along with the focused inspection of traffic (for example, voice signaling traffic or FTP), heuristics (for example, DCE-RPC or SUN-RPC), or standardized application identifiers exported by Cisco platforms with NetFlow.

. You can configure the application reported as unknown to create custom applications.

A custom application based on a URL-based HTTP request—You can include URL Host, URL Path, or a Prime NAM Content Type. This allows you to gain additional visibility instead of grouping all web traffic HTTP. For details, see Understanding URL-Based Application Classification.

.

Caution There is no limit on the number of URL-based applications that can be created. It is important to consider that these types of applications use large amounts of CPU bandwidth and may impact your performance if too many are defined.

describes the fields on the Applications view page.

Understanding URL-Based Application Classification

URL-based applications are extensions to the list of applications. When the URL in an HTTP request (a URL on any port that is part of the iana-l4:http protocol, or protocol named http under the iana-l4 engine ID) matches the criteria of a URL-based application, the traffic is classified as that protocol. The device interface statistics are collected by regularly (once a minute) polling the ifTable statistics of all interfaces on the managed device.

A URL-based application can be used the same way as any other application. For example, a URL-based application can be used in collections, captures, and reports.

An incoming URL is matched against the criteria of the configured URL-based applications in the order of the selector in ascending order. When a match is found, the remaining URL-based applications are not considered.

A URL consists of the following parts:

a host (host.domain.com)

a path (dir_nam/dir_name)

an argument/content type

Tip Content-type argument should rarely be used in combination with the other two fields. It can be used alone, for example to identify WAP traffic you could define an application with a content type of *wap.*. In almost all other cases, we recommend you use host and path only.

Example—Creating an URL-Based Application

).

enter:

the host part is host.domain.com , for example, Cisco.com

the path part is /go/nam

the argument part is null/empty

.

Note The host, path, and argument parts of a URL are matched against the corresponding POSIX regular expressions specified in the application definition. For details on regular expression syntax, refer to the IEEE Std.

Configuring Application Groups

An application group is a set of applications that can be monitored as a whole. The following topics help you set up and manage the application group:

Creating an Application Group

Editing or Deleting an Application Group

Deleting an Application Group

Creating an Application Group

To create an application group:

.

The Application Groups window displays.

and enter the name in the Application Group Name field.

, all applications with that name appear in the list below.

. Applications appear in the Selected Applications box.

to save your changes.

Editing or Deleting an Application Group

To edit or delete an application group:

.

.

Note You can only delete one application group at a time.

Deleting an Application Group

button.

Filtering Encapsulations

Using encapsulation gives you increased flexibility when trying to view different types of application traffic (such as counting or grouping). The encapsulation settings affect how traffic of certain IP-based tunneling protocols are treated.

You can use this software to set up the way you want to view different types of encapsulations in network traffic for the following protocols:

CAPWAP Data—Control And Provisioning of Wireless Access Points

ERSPAN—Encapsulated Remote Switched Port Analyzer

FabricPath

GRE—IP over GRE tunneling (Generic Routing Encapsulation)

GTP—GPRS (General Packet Radio Service) Tunneling Protocol

IP.IP4—IP4 over IP4/IP6

IP.IP6—IP6 over IP6

IPESP—IP with Encapsulating Security Payload

L2TP Data—Layer 2 Tunneling Protocol

LISP Data—Locator/ID Separation Protocol

LWAP Data—Lightweight Access Point Protocol

MPLS—Multiprotocol Label Switching

OTV—Overlay Transport Virtualization

PPPoE—Point to Point Protocol over Ethernet

Segment ID—Rule to match one or more fields with a regular expression.

SGT—Security Group Tag

VNTAG—Virtual Network Tag

VxLAN—Virtual Extensible LAN

To filter encapsulations:

.

to display the filter options,

Step 3 Use the available options to select filtering for the encapsulation traffic reports. Unavailable options will be grayed out.

Step 4 Enter whether you want to include filtering on the site and specify the data source.

Step 5 Select encapsulation options to filter on including the time range.

Step 6 If you add a filter name, the filter is saved below the Interactive Report pane for reuse.

to run the filter and update the Encapsulation Traffic graphs and Top N dashboards based on your filter settings.

.

Setting Up Prime NAM Monitoring

This section discusses how to set up monitoring over and above the default monitoring parameters. You can customize these monitoring parameters.

To set up Prime NAM monitoring perform these tasks:

Setting Aggregation Intervals

Configuring Response Time

Setting Up Voice Monitoring

Creating RTP Filters

Configuring URL Collections

Configuring WAAS Monitored Servers

Setting Aggregation Intervals

Prime NAM has short-term and long-term aggregation intervals (this was referred to as long-term reporting in earlier NAM releases). Aggregated data is displayed in the dashboards if the query is longer than one day.

The purpose of gathering short term aggregation interval data is for troubleshooting. It has a finer granularity than long term data (by default, the short term aggregation interval for Traffic/Media is one minute, and short term response time interval is five minutes).

The purpose of gathering long term interval data is for trending analysis. The smallest aggregation interval for long term data is one hour (60 minutes).

Caution If you modify the aggregation intervals, existing collected data that is not in the same aggregation interval will be completely removed. Data will then start being collected from the beginning again at the moment the intervals are modified and applied.

Traffic and Media refer to applications, hosts, RTP streams, and voice calls monitoring. Response Time refers only to application response time. Prime NAM does not support long term aggregations of data for the following media: conversations, RTP streams, and voice signaling calls monitoring.

To set up aggregation intervals:

.

Step 2 Choose the desired durations for Short Term Interval and Long Term Interval.

check box if you want the Prime NAM long term data to contain information only for hosts classified to the user-defined sites. This check box only applies to the long term data; short term always collects all hosts.

Note Enabling the “Collect only hosts from user-define sites” option can significantly speed up report queries, because it excludes unclassified hosts’ statistics from the database.

When you first start the NAM, in monitoring windows that show site information, you will see a site named “Unassigned” and with a description of “Unclassified Hosts.” The Unassigned site includes any that do not match the site configurations. By default, long-term storage will include data for all sites, including the Unassigned site. In some cases, you may not want to view long term data of hosts that are not in your network, in which case you would check the check box.

.

for information about short and long-term data retention. This calculation is based on a worst case scenario where tables are full or almost full. It is based on recommended database sizes.

Table 7-5 Data Retention

Short-Term Aggregated Data (Normal)

Short-Term Aggregated Data (Minimum)

Long-Term Aggregated Data (Normal) 1

Long-Term Aggregated Data (Minimum)

All supported platforms

72 hours

14 hours

100 days (with default polling interval)

30 days (with default polling interval)

1.Can depend on how the user configures the LT polling interval. The more frequent polling, the shorter the duration.

1.Can depend on how the user configures the LT polling interval. The more frequent polling, the shorter the duration.

Configuring Response Time

To configure the timing parameters for response time data collections:

.

The Response Time Configuration page displays. The settings you make on this window comprise the time distribution in microseconds for the detailed Server Application Response Time data collection.

check box.

. Click Configure Filter to configure a filter if you need to enable your monitor server filter.

.

to save your changes.

Setting Up Voice Monitoring

You can use the Mean Opinion Score (MOS) to quantify the perceived level of quality you are receiving in your network voice traffic. This allows you to assess the work of codecs, or algorithms, which compress audio traffic to save on bandwidth utilization but may result in a drop in quality.

. For more information on viewing the voice data, see Analyzing Media.

Note Voice monitoring features are supported with Cisco IP telephony devices only.

To set up voice monitoring:

.

The Voice Monitoring page displays.

check box.

.

Note To report jitter and packet loss for the SCCP protocol, you must enable CDR on Cisco Unified Communications Manager. For more information on Cisco Unified Communications Manager, see the Cisco Unified Communications Manager documentation.
http://www.cisco.com/en/US/products/sw/voicesw/ps556/tsd_products_support_series_home.html

to cancel and revert to the previous settings.

Creating RTP Filters

to apply the change.

To create an RTP filter:

.

.

Step 3 From the drop-down menu, choose the protocol (IP or IPv6).

Step 4 Enter the Source Address, Source Mask, Destination Address, and Destination Mask.

.

Configuring URL Collections

The URL collection listens to traffic on TCP port 80 of a selected data source and collects URLs. Any protocol which has its master port set to TCP port 80 can be used for URL collections. Only one collection on a single data source can be enabled at a time.

).

Note Since the argument is matched against a regular expression, a literal ?id=123 is not a valid regular expression. The ? needs to be escaped with a backslash character, \ , so the actual regular expression needed is \?id=123.

The collection can be configured to collect all parts or it can configured to collect only some of the parts and ignore others.

This section contains the following procedures:

Enabling a URL Collection

Changing a URL Collection

Disabling a URL Collection

Enabling a URL Collection

To enable a URL collection:

check box to initiate URL Collection.

Note The collection will not begin until you click Submit.

.

to return to the entire list of data sources.

Note Depending on which radio button option is collected, the format of the URL varies. For example, the leading http: part is only present if the host part is collected. Keep this variable in mind, when configuring a match only expression.

check box to recycle entries.

Step 5 Select the check box for one of the following:

Collect complete URL (Host, Path and Arguments)—You might use this if you are a network security engineer and suspect a virus infection may be caused by a website. This information could be used to identify which web page has the virus embedded and how it may have spread. It can also be shared for further analysis to help create a solution to stop the spread.

Collect Host only (ignore Path and Arguments)—You might use this if your network administrator changed your firewall policies to block certain hosts.

Collect Host and Path (ignore Arguments)

Collect Path and Arguments (ignore Host)

Collect Path only (ignore Host and Arguments)

to cancel.

Changing a URL Collection

To change a URL collection:

.

.

Note Changing any parameters and applying the changes flushes the collected URLs and restarts the collection process.

to cancel.

Disabling a URL Collection

When you disable URL collection monitoring, all collection stops immediately and any collection that was in progress is deleted.

To disable a URL collection:

.

check box.

.

Configuring WAAS Monitored Servers

WAAS monitored servers specify the servers from which WAAS devices export traffic flow data to the Prime NAM monitors. To enable WAAS monitoring, you must list the servers to be monitored by Prime NAM using the WAAS device's flow monitoring.

until you set up WAAS monitored servers.

To configure a WAAS monitored server:

. The WAAS Servers page displays.

check box if you want Prime NAM to compute response time data only for the servers from this list for all data sources, including non-WAAS data sources. All other servers will be ignored in response time monitoring views. This enables you to reduce Prime NAM workload and to improve its overall performance.

and enter the server IP address in the Server Address field. You can paste multiple IP addresses here as well.

Tip Specify the WAAS monitored servers from which WAAS devices export traffic flow data to the Prime NAM monitors. Do not use the WAE device IP address.

.

Understanding Prime NAM Traffic Sources

Before you can monitor data using Prime NAM software, you must direct specific traffic flowing through a switch or router to the Prime NAM. This appendix explains the various data sources that you can configure for Prime NAM.

This appendix contains the following topics:

Data Source Overview

Understanding How the Prime NAM Uses SPAN

Understanding How the Prime NAM Uses VACLs

Understanding How the Prime NAM Uses NetFlow

Understanding How the Prime NAM Uses WAAS

.

Data Source Overview

Prime NAM uses various data sources to deliver its performance troubleshooting functionality:

.

Table A-1 Methods of Directing Traffic

Method

Usage Notes

Switch SPAN 1

You can direct a set of physical ports, a set of VLANs, or a set of EtherChannels to the NAM.

Selecting an EtherChannel as a SPAN source is the same as selecting all physical ports comprising the EtherChannel as the SPAN source.

On some NAM platforms, using SPAN allows for NAM configuration without having to use the switch.Forwarding SPAN Traffic.

Switch Remote SPAN (RSPAN)1

You can monitor packet streams from remote switches, assuming that all traffic from a remote switch arrives at the local switch on a designated RSPAN VLAN. Use the RSPAN VLAN as the SPAN source for the NAM.

Encapsulated Remote Switched Port Analyzer (ERSPAN)1

You can monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports using ERSPAN. ERSPAN sends traffic to a network analyzer such as a SwitchProbe device or other Remote Monitoring (RMON) probe. ERSPAN supports source ports, source VLANs, and destination ports on different routers or switches, which provides remote monitoring of multiple routers or switches across your network. See Forwarding ERSPAN Traffic.

NetFlow Data Export (NDE)

Prime NAM analyzes NetFlow from Managed Devices (Routers/Switches) You can monitor NetFlow records directly from remote switches or routers. You must configure the NetFlow packet source to the NAM from a local switch or remote router using the device CLI. For received NetFlow traffic, a default site will be created including all interfaces from that device. See Configuring Sites.

SPAN and NetFlow sources can be in effect simultaneously. See Forwarding NetFlow Traffic.

WAAS

You can access Prime NAM from within the Central Manager interface. Prime NAM integration with WAAS Central Manager provides for easier viewing of Prime NAM reports that are directly associated with Application Response Time measurements through the WAN, in both WAAS optimized and non-optimized environments. See Configuring WAAS Monitored Servers.

SNMP

Used as a southbound interface for configuration and data retrieval from switches and routers. Prime NAM uses web services as the northbound interface for data objects. The software continues to support baseline manageability features of SNMP such as MIB-2 and IF-TABLE for the NAM, and the health status and interface statistics that can be used by external products like Fault and Configuration Management offerings (for example, CiscoWorks LMS and Prime Infrastructure).

Network Tap Device

Applies to NAM appliances only. For details, see your appliance installation guide.

null

describes the fields in the NAM Data Sources window.

summarizes the traffic sources that are used for Prime NAM monitoring.

Table A-2 Summary of Traffic Sources for Prime NAM Monitoring

Traffic Source

LAN

WAN

Ports

VLANs

Ports

VLANs

VACL capture

Yes

Yes

Yes

N/A

NetFlow Data Export NDE (local)

Yes

Yes

Yes

Yes

NetFlow Data Export NDE (remote)

Yes

Yes

Yes

Yes

SPAN

Yes

Yes

No

No

ERSPAN

Yes

Yes

No

No

Ports and Hardware Details

NAM-3 and NAM-NX1 each have two dataports. Each dataport can accept one SPAN session. Depending on the managed device operating system (OS) version, the number of SPAN sessions allowed may vary. Most IOS versions support two SPAN sessions. Nexus OS may support more than two SPAN sessions.

Depending on the IOS running on the Supervisor, port names are displayed differently. Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1. In the VSS, a port name might be displayed as Gi1/2/1 to represent a Gigabit port on switch 1, module2, port 1. On NAM-NX1, a port name might be displayed at Ethernet1/1/1.

On NAM hardware, one of the two interfaces must be selected as the Prime NAM management port for IP traffic (such as HTTP and SNMP). Prime NAM can monitor traffic for analysis on the internal interface, the external interface, or both simultaneously. A typical configuration is to monitor LAN and WAN traffic on the internal interface. However, the external interface can be used to monitor LAN traffic.

Some Cisco switches do not support SNMP MIB objects that are required by NAM when configuring SPAN sessions. On these switches, you can use the switch device CLI command to configure the SPAN session for NAM. Alternatively, for the NAM appliances only, if the NAM managed device supports NetConf interface over SSH, you can configure the NAM to use NetConf to configure SPAN sessions on the managed device.

Understanding How the Prime NAM Uses SPAN

A switched port analyzer (SPAN) session is an association of a destination port with a set of source ports, configured with parameters that specify the monitored network traffic. You can configure up to two SPAN sessions in a Catalyst 6500 chassis. Newer Cisco IOS images may support more than two SPAN sessions. Consult the Cisco IOS document for the number of SPAN sessions supported per switch or router.

describes the types of SPAN sources and the possible ways to configure them.

Table A-3 SPAN Sources

SPAN Source

Configured with one of the following:

Any set of physical ports

Prime NAM (the GUI)2

Switch CLI

Any EtherChannel

Prime NAM (the GUI)

Switch CLI

Any set of VLANs configured on the local switch

Prime NAM (the GUI)

Switch CLI

2.See the NAM Compatibility Matrix for detailed list of NAM devices that can be configured using the GUI.

2.See the NAM Compatibility Matrix for detailed list of NAM devices that can be configured using the GUI.

for a description of the fields on the SPAN Sessions window.

lists the possible SPAN states. The SPAN state displays in parenthesis in the Source - Direction column.

Table A-4 Possible SPAN States

State

Description

Active

SPAN source is valid and packet traffic from the source is copied to the SPAN destination (NAM Dataport).

Inactive

Packet traffic from the source is not copied to the SPAN destination (NAM Dataport).

Up

For NAM-NX1 only, the Supervisor displays this when packets are forwarded to the NAM.

Down

For NAM-NX1 only, the Supervisor displays this when packets are not forwarding to the NAM.

The NAM-3 platform provides two possible destination ports for SPAN and VLAN access control list (VACL) sessions. Multiple SPAN sessions to the Prime NAM are supported, but they must be destined for different ports. The Prime NAM destination ports for use by the SPAN graphical user interface (GUI) are named DATA PORT 1 and DATA PORT 2 by default. In the CLI, NAM-3 SPAN port is named dataport1 and dataport2.

For more information about SPAN and how to configure it on the various NAM platforms, see your device documentation on Cisco.com.

Note Due to potentially very high volume of ERSPAN traffic from the source, we recommend that you do not terminate the ERSPAN session on the NAM management port. Instead, you should terminate ERSPAN on the switch, and use the switch’s SPAN feature to SPAN the traffic to NAM dataports.

Understanding How the Prime NAM Uses VACLs

A VLAN access control list can forward traffic from either a WAN interface or VLANs to a dataport on the NAM. A VACL provides an alternative to using SPAN; a VACL can provide access control based on Layer 3 addresses for IP and IPX protocols. The unsupported protocols are access controlled through the MAC addresses. A MAC VACL cannot be used to access control IP or IPX addresses.

There are two types of VACLs: one that captures all bridged or routed VLAN packets and another that captures a selected subset of all bridged or routed VLAN packets. Catalyst operating system VACLs can only be used to capture VLAN packets because they are initially routed or bridged into the VLAN on the switch.

A VACL can provide access control for all packets that are bridged within a VLAN or that are routed into or out of a VLAN or, with Release 12.1(13)E or later releases, a WAN interface. Unlike regular Cisco IOS standard or extended ACLs that are configured on router interfaces only and are applied on routed packets only, the VACLs apply to all packets and can be applied to any VLAN or WAN interface. The VACLs are processed in the hardware.

A VACL uses Cisco IOS access control lists (ACLs). A VACL ignores any Cisco IOS ACL fields that are not supported in the hardware. Standard and extended Cisco IOS ACLs are used to classify packets. Classified packets can be subject to a number of features, such as access control (security), encryption, and policy-based routing. Standard and extended Cisco IOS ACLs are only configured on router interfaces and applied on routed packets.

After a VACL is configured on a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VACL. Packets can either enter the VLAN through a switch port or through a router port after being routed. Unlike Cisco IOS ACLs, the VACLs are not defined by direction (input or output).

A VACL contains an ordered list of access control entries (ACEs). Each ACE contains a number of fields that are matched against the contents of a packet. Each field can have an associated bit mask to indicate which bits are relevant. Each ACE is associated with an action that describes what the system should do with the packet when a match occurs. The action is feature dependent. Catalyst 6500 series switches and Cisco 7600 series routers support three types of ACEs in the hardware: IP, IPX, and MAC-Layer traffic. The VACLs that are applied to WAN interfaces support only IP traffic.

When you configure a VACL and apply it to a VLAN, all packets entering the VLAN are checked against this VACL. If you apply a VACL to the VLAN and an ACL to a routed interface in the VLAN, a packet coming into the VLAN is first checked against the VACL and, if permitted, is then checked against the input ACL before it is handled by the routed interface. When the packet is routed to another VLAN, it is first checked against the output ACL applied to the routed interface and, if permitted, the VACL configured for the destination VLAN is applied. If a VACL is configured for a packet type and a packet of that type does not match the VACL, the default action is deny.

When configuring VACLs, note the following:

VACLs and context-based access control (CBAC) cannot be configured on the same interface.

TCP Intercepts and Reflexive ACLs take precedence over a VACL action on the same interface.

Internet Group Management Protocol (IGMP) packets are not checked against VACLs.

Note You cannot set up VACL using the Prime NAM interface.

For details on how to configure a VACL with Cisco IOS software, see Cisco.com.

For details on how to configure a VACL on a WAN interface and on a LAN VLAN, see Forwarding VACL Traffic.

Understanding How the Prime NAM Uses NetFlow

The Prime NAM uses NetFlow as a format for the ongoing streaming of aggregated data, based on the configured set of descriptors or queries of the data attributes in NAM. NetFlow Data Export (NetFlow) is a remote device that allows you to monitor port traffic on the NAM; the Prime NAM can collect NetFlow from local or remote switches or routers for traffic analysis.

To use an NetFlow data source for the Prime NAM, you must configure the remote device to export the NetFlow packets. The default UDP port is 3000, but you can configure it from the Prime NAM CLI as follows:

root@nam2x-61.cisco.com# netflow input port ?

<port> - input NetFlow port number

The distinguishing feature of the NetFlow v9 format, which is the basis for an IETF standard, is that it is template-based. Templates provide an extensible design to the record format, a feature that must allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format.

For more detailed information about Prime NAM and NetFlow, see Forwarding NetFlow Traffic.

(contact your Cisco account representative if you need to refer to this document).

Understanding NetFlow Interfaces

To use a device as an NetFlow packet data source for the Prime NAM, you must configure the device itself to export NetFlow packets to UDP port 3000 on the NAM. You might need to configure the device itself on a per-interface basis. A NetFlow packet device is identified by its IP address. In the NAM, the default UDP port of 3000 can be changed with a Prime NAM CLI command (see Configuring NetFlow on Devices).

You can define additional NetFlow packet devices by specifying the IP addresses and (optionally) the community strings. Community strings are used to upload convenient text strings for interfaces on the managed devices that are monitored in NetFlow records.

), you can view information for any selected interface on the device. This page will display the interface utilization or throughput over time, as well as show the top Applications, Hosts, and DSCP groups in both the input and output directions for the interface.

Understanding NetFlow Flow Records

A NetFlow packet contains multiple flow records. Each flow record has two fields:

Input SNMP ifIndex

Output SNMP ifIndex

Note This information might not be available because of NetFlow feature incompatibility with your Cisco IOS version, or because of a NetFlow flow-mask configuration.

direction of the interface. As a result, the input SNMP ifIndex field in the flow record has the ifIndex of the interface on which NetFlow was turned on. Sample NetFlow Network, Figure A-1, shows a sample network configuration with a NetFlow router.

Figure A-1 Sample NetFlow Network

lists the reported flows if NetFlow is enabled on interface a.

Table A-5 Reporting Flow Records

Input Interface

Output Interface

Are Flows Reported?

a

b

Yes

a

c

Yes

b

c

No

b

a

No

c

a

No

c

b

No

Managing NetFlow Data Sources

A data source entry must exist on Prime NAM in order for it to accept NetFlow records from an external device. Data source entries may be created manually using the Prime NAM web GUI or the CLI. When manually creating a data source, you may specify any name you want for the data source.

For convenience, manual creation of NetFlow data sources is not necessary. There is an “autocreate” feature which is enabled by default. With the autocreate feature, a new data source will automatically be created for each device which sends NetFlow packet traffic to the Prime NAM when the first packet is received.

is the Engine-ID that the device populates in the packets (part of the NetFlow Data Export standard). An example might be “NetFlow-10.10.0.1-ID-12” for device 10.10.0.1 sending NetFlow packets with the Engine ID field set to 12. You can edit these autocreated data sources and change the name if you want to, as well as optionally specifying SNMP credentials for the device, as described later in this guide.

Understanding How the Prime NAM Uses WAAS

Cisco Wide Area Application Services (WAAS) software optimizes the performance of TCP-based applications operating in a wide area network (WAN) environment and preserves and strengthens branch security. The WAAS solution consists of a set of devices called Wide Area Application Engines (WAEs) that work together to optimize WAN traffic over your network.

When client and server applications attempt to communicate with each other, the network devices intercepts and redirects this traffic to the WAEs to act on behalf of the client application and the destination server.

WAEs provide information about packet streams traversing through both LAN and WAN interfaces of WAAS WAEs. Traffic of interest can include specific servers and types of transaction being exported. Prime NAM processes the data exported from the WAAS and performs application response time and other metrics calculations and enters the data into reports you set up.

The WAEs examine the traffic and using built-in application policies to determine whether to optimize the traffic or allow it to pass through your network not optimized.

You can use the WAAS Central Manager GUI to centrally configure and monitor the WAEs and application policies in your network. You can also use the WAAS Central Manager GUI to create new application policies so that the WAAS system will optimize custom applications and less common applications. Prime NAM is accessible from within the Central Manager interface. The Cisco Prime NAM integration with WAAS Central Manager provides for easier viewing of Prime NAM reports that are directly associated with Application Response Time measurements through the WAN, in both WAAS optimized and non-optimized environments. See Using the WAAS Central Manager.

For more information about WAAS data sources and managing WAAS devices, see Understanding WAAS.

Understanding Prime NAM Behavior Reference

This appendix includes details on how Cisco Prime Network Analysis Module (Prime NAM) works including how to navigate and use the control elements in the user interface.

This section includes the following topics:

Menu Bar

Displaying Detailed Views

Accessing Context Menus

Performing a Quick Capture

Filtering Traffic for Viewing on the Dashboards

Switching Chart Formats Using the Chart View / Table View

Accessing Other Tasks Using Mouse-Over for Details

Changing the Time Interval Using Zoom/Pan Charts

Using Sort Grid to Change Sort Order

Displaying Bits or Bytes or Packets in Charts

Statistics

Context-Sensitive Online Help

on Cisco.com.

Menu Bar

.

Table B-1 Summary of Menu Tasks

Menu Name

Description

Brings you to the Traffic Summary Dashboard (Monitor > Overview > Traffic Summary).

View summary dashboards with network traffic, application performance, site performance, and alarms information at a glance.

See various views for traffic over a time period, WAN optimization, response time, managed device, and media functions.

Configure multiple sessions for capturing, filtering, and decoding packet data, manage the data in local or remote storage, and display the contents of the packets.

Perform setup options needed to access Prime NAM features.

Set dashboard preferences, perform user and system administration tasks, and generate diagnostic information for obtaining technical assistance.

Filters

You can use the Filter feature to display specific information on the Prime NAM interface. The Filter icon is provided wherever the data is displayed in a tabular format. The following types of filters are available:

Quick Filter

Advanced Filter

Quick Filter

This filter allows you to narrow down the data inside a table by applying a filter to a specific table column or columns. To apply different operators, use the Advanced Filter option.

from the Filter drop-down menu.

To clear the Quick Filter, click the Filter icon.

Advanced Filter

This filter allows you to narrow down the data in a table by applying a filter using multiple operators such as Does not contain, Does not equal, Ends with, Is empty, and so on. For example, you can choose the filter pattern by table column names and operator from the drop-down menu. In addition, you must enter filter criteria based on the data available in the Prime NAM database.

from the Filter drop-down list.

To clear the Advanced Filter, click the Filter icon.

Displaying Detailed Views

. For an example of the Applications submenu see Figure B-1.

Accessing Context Menus

On most charts that appear on the dashboards (except for pie charts), you can left-click on a colored bar of data to get a context menu, with which you can get more detailed information about that item. See Figure B-1.

Figure B-1 Context Menu Showing Application Submenus

).

The menu items above the separator line are specific to the selected element of the Top N chart. The items below the separator line are not specific to the selected element, but apply to the Top N chart. The selections with no icons display in the current page. Selections with icons open in a separate page.

Performing a Quick Capture

From the Context menu of many of the bar charts that show Applications or Hosts or VLANs. you can start a Capture. For example, when you click on an Application in a bar chart (as in Figure B-1) and choose Capture, the following is done automatically:

A memory-based capture session is created

A software filter is created using that application

The capture session is started

The decode window pops open and you can immediately see packets being captured.

Note Quick Capture does not use site definition/filter.

From both the selectors in the upper left of the dashboards and from the item the user clicks on in the barchart, the following are carried into the context for the capture session:

Application

VLAN

Host

Data Source (if it is a DATA PORT)

If you open up the associated Capture Session and its associated Software Filter, the above settings will be shown.

Determining How to Use Sites to View Data

is an optional collection of hosts, or network endpoints, partitioned into views that help you monitor traffic and troubleshoot problems (see Configuring Sites for more detailed information).

and view data relevant to that site only. In some cases, you can select both a Client Site and a Server Site to view data pertaining to interaction between hosts at different sites.

Filtering Traffic for Viewing on the Dashboards

data and the Analyze windows to view data over time.

button to change the parameters of the information displayed in the charts. An asterisk represents required fields.

button and enter the Layer 1 VLAN options on which you want to filter. You can select multiple values and additional layers.

.

You may need to enter the time range filter several times before seeing the data that you need. The default filter time range is for the last hour.

The reporting time interval selection changes depends upon both the dashboard you are viewing and your NAM platform.

.

.

The software supports up to five saved filters. Saved reports display at the bottom of the Interactive Report panel. You can also edit or delete filters after creating them using the icons in the saved filter dialog box.

Filtering Data Using Global Search

You can use the global search filter to limit your overall view to specific host data. The global search tool appears in the top-right corner of the user interface.

Step 1 From your Monitor or Analyze dashboard enter your IPv4, IPv6, and Layer 2 traffic MAC addresses. You may also search using hostnames if you have enabled hostname (DNS lookup) in Prime NAM.

Specified host filters are also in effect for context menu charts. For example, if you specify a hostname filter in Monitor > Response Time Summary, the dashboard refreshes with only data specific to this host (including the IP address and site, if applicable). You can hover over table data for instant details. drill down menus also reflect this host’s data.

Step 2 To change the time range, select one of the default ranges or create a custom range.

Switching Chart Formats Using the Chart View / Table View

Using the Chart view lets you see an overview of the data in an integrated manner, and can show you trending information. To get the exact value of any data in the graphical view, hover over a data point to see the tool tip. The chart view may be To toggle between the two views, use the Chart and Table icons at the bottom of the panel:

Accessing Other Tasks Using Mouse-Over for Details

When in Chart view, you can mouse over the chart to get more detailed information about what occurred at a specific time.

Many of the line charts in Prime NAM are dual-axis, meaning there is one metric shown on the left axis of the chart and another metric shown on the right axis of the chart.

For example, in the DCSP Group Traffic chart, Megabits per second is shown on the left axis, and Packets per second is shown on the right axis.

Changing the Time Interval Using Zoom/Pan Charts

For many charts, you can drag the beginning or end to change the time interval, as shown below.

The time interval change on the zoom/pan chart affects the data presented in the charts in the bottom of the window. The zoom/pan time interval also affects the drill down navigations; if the zoom/pan interval is modified, the context menu drill downs from that dashboard will use the zoom/pan time interval.

Note In a bar chart which you can zoom/pan, each block represents data collected during the previous interval (the time stamp displayed at the bottom of each block is the end of the time range). Therefore, you may have to drag the zoom/pan one block further than expected to get the desired data to populate in the charts in the bottom of the window.

Using Sort Grid to Change Sort Order

When looking at information in Grid view, you can sort the information by clicking the heading of any column. Click it again to sort in reverse order.

Displaying Bits or Bytes or Packets in Charts

.

.

Statistics

The Statistics legend gives you the minimum, maximum, and average statistics of the data. This will display the initial data retrieved for the selector.

Context-Sensitive Online Help

link on the top-right corner of the Prime NAM interface to bring you to the Help page for that particular window of the GUI.

If available, the Help link appears on the top-right corner of each page; some pages also have a blue “i”, which provides help for that specific subject.

On some fields, hovering over the field displays tip information.

GUI Field Descriptions

This appendix describes critical field descriptions for the following windows. Not all fields are described as some are self-explanatory and others have tips that appear in the user interface.

Setup User Interface Windows

Monitor User Interface Windows

Capture User Interface Windows

Administration User Interface Windows

Report Descriptions

Setup User Interface Windows

This section describes the field descriptions for the following dialog boxes:

Create SPAN Session Dialog Box

Prime NAM Data Sources

Edit SPAN Session Dialog Box

SNMP Credential Options in NAM Data Sources Window

Device System Information Dialog Box

Alarm Configuration Window

Threshold Configuration

Host Alarm Thresholds

Conversation Alarm Thresholds

Application Alarm Thresholds

Response Time Thresholds

DSCP Alarm Thresholds

RTP Streams Thresholds

Voice Signaling Thresholds

NetFlow Interface Alarm Thresholds

Router/Managed Device System Information

Switch Device Information

NBAR Interface Details

Site Configuration

Subnet Detection

Sites Window

Add NetFlow Interface Capacity

Create or Edit Applications

DSCP Group Setup Dialog Box

Applications

URL-Based Applications

Response Time Configuration Window

Voice Monitor Setup Window

URL Collection Configuration Dialog Box

Create SPAN Session Dialog Box

describes the critical fields on the Create SPAN Session dialog box.

Table C-1 Create SPAN Session Dialog Box

Field

Description

Session ID

Span Session Options

Extended: Allows for IP extended input ACLs to receive a copy of a dropped packed on a destination port even if the actual incoming packet is dropped.

Multicast Best Effort:  Multicast packets are delivered to a group using best - effort reliability, just like IPv6 unicast packets.

Sampling: Collects NetFlow statistics for a subset of incoming (ingress) IPv4 traffic on the interface, selecting only one out of "N" sequential packets, where "N" is a configurable parameter.

MTU Truncation: Maximum bytes allowed for each replicated packet in a SPAN session

Rate Limit: Sets Committed Access Rate and Distributed Committed Access Rates for the interface's bandwidth

SPAN Type

Switch Port

VLAN

EtherChannel

RSPAN VLAN

You can have only one RSPAN VLAN source per SPAN session.

SPAN Destination Interface

The NAM interface to which you want to send data.

Switch Module

SPAN Traffic Direction

Available and Selected Sources

SPAN sources available for the selected SPAN type.

Prime NAM Data Sources Dialog Box

describes the critical fields on the Prime NAM Data Sources dialog box.

Table C-2 Prime NAM Data Sources

Field

Description

Device

DATA PORT if it is a local physical port or the IP address of the device that is sending NAM data.

Type

The source of traffic for the NAM.

DATA PORT if it is a local physical port.

WAAS, ERSPAN, or NETFLOW, if a data stream exported from the router or switch or WAE device.

Activity

Status

ACTIVE or INACTIVE.

Data Source

Data Source Details

Physical Port or information about the data source being Enabled or Disabled.

Edit SPAN Session Dialog Box

describes the critical fields on the Edit SPAN Session dialog box.

Table C-3 Edit SPAN Session Dialog Box

Field

Description

Session ID

SPAN Type

SPAN Destination Interface

The Prime NAM interface to which you want to send data.

SPAN Traffic Direction

Direction of the SPAN traffic.

Available and Selected Sources

SPAN sources available for the selected SPAN type.

SNMP Credential Options in NAM Data Sources Window

describes the options on the NAM Data Sources window for SNMP Credentials.

Table C-4 SNMP Credential Options in NAM Data Sources Window

Field

Description

Mode: No Auth, No Priv

SNMP will be used in a mode with no authentication and no privacy.

Mode: Auth, No Priv

SNMP will be used in a mode with authentication, but no privacy.

Mode: Auth and Priv

SNMP will be used in a mode with both authentication and privacy.

User Name

Enter a username, which will match the username configured on the device.

Auth Password

Enter the authentication password associated with the username that was configured on the device. Verify the password.

Auth Algorithm

Choose the authentication standard which is configured on the device (MD5 or SHA-1).

Privacy Password

Enter the privacy password, which is configured on the device. Verify the password.

Privacy Algorithm

Enter the privacy algorithm, which is configured on the device (AES or DES).

Device System Information Dialog Box

describes the critical fields on the Device System Information dialog box.

Table C-5 Device System Information Dialog Box

Field

Description

Hardware

Device Software Version

The current software version running on the device.

System Uptime

Total time the device has been running since the last reboot.

SNMP read from device

SNMP read test result. For the local device only.

Alarm Configuration Window

describes the critical fields on the Alarm Configuration Window.

Table C-6 Alarm Configuration Window

Field

Description

Name

Name given to the alarm at setup.

E-mail

.

Trap

.

Trigger Capture

.

Syslog Remote

.

Status

means that the trap configured for that alarm action has been deleted.

means the Alarm action was successfully created.

Threshold Configuration Window

describes the critical fields on the Threshold Configuration window.

Table C-7 Threshold Configuration

Field

Description

Type

You can configure eight types of thresholds.

Application

Site

Host

Severity

). You can choose to view High, Low, or High and Low alarms.

Action

Rising action and Falling action (if configured). Alarms are predefined conditions based on a rising data threshold, a falling data threshold, or both.

Status

).

Add Metrics (button)

Adds another row.

Delete (button)

Removes that Metrics row.

Host Alarm Thresholds Window

describes the critical fields on the Hold Alarm Threshold window.

Table C-8 Host Alarm Thresholds

Field

Description

Name

Site

Choose a site from the list. See Configuring Sites for information on setting up a site.

Host

Choose a host from the list.

You can enter the name of the host if the drop-down list does not contain the desired host.

Application

Choose an application from the list. You can enter the first few characters to narrow the selection in the drop-down list.

DSCP

Choose a DSCP value from the list. You can enter the first few characters to narrow the selection in the drop-down list.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

From the drop-down lists, choose a Rising action and a Falling action (optional). During threshold creation, by default, the falling action is the same as rising action. See Viewing Alarm Actions for information on setting up alarm actions.

Host Metrics
(per second)

Choose the type of metric from the list, and then enter a value for a Rising threshold and a Falling threshold.

Conversation Alarm Thresholds Window

describes the critical fields on the Conversation Alarm Thresholds window.

Table C-9 Conversation Alarm Thresholds

Field

Description

Name

Application

Choose an application from the list. You can start typing the first few characters to narrow the list.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Source Site/Host

. See Configuring Sites for information on setting up a site.

Destination Site/Host

. See Configuring Sites for information on setting up a site.

Actions

From the lists, choose a Rising action and a Falling action (optional). See Viewing Alarm Actions for information on setting up alarm actions.

Conversation Metrics (per second)

Choose from one of the six metrics, and then enter a Rising threshold and a Falling threshold.

Application Alarm Thresholds Configuration Window

describes the critical fields on the Application Alarm Thresholds Configuration window.

Table C-10 Application Alarm Thresholds

Field

Description

Name

Site

Choose a site from the list. See Configuring Sites for information on setting up a site.

Application

Choose an application from the list. You can start typing the first few characters to narrow the list.

DSCP

Choose a DSCP value 0-63, or Any.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

From the lists, choose a Rising action and a Falling action (optional). See Configuring Alarm Actions for information on setting up alarm actions.

Application Metrics (per second)

Choose Bits or Bytes, and then enter a Rising threshold and a Falling threshold.

Response Time Alarm Threshold Configuration Window

describes the critical fields on the Response Time Alarm Threshold Configuration window.

Table C-11 Response Time Thresholds

Field

Description

Name

Application

Choose an application from the list. You can start typing the first few characters to narrow the list.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Client Site/Host

Make a selection from the lists. See Configuring Sites for information on setting up a site.

Server Site/Host

Make a selection from the lists, or leave as “Any.” See Configuring Sites for information on setting up a site.

Actions

From the lists, choose a Rising action and a Falling action (optional). See Viewing Alarm Actions for information on setting up alarm actions.

Response Time Metrics

Choose a metric from the list, and then enter a Rising threshold and a Falling threshold. For the Packets and Bytes-related metrics, the entry is per second. For the time-related metrics, the unit is per microseconds (u).

DSCP Alarm Threshold Configuration Window

describes the critical fields on the DSCP Alarm Threshold Configuration window.

Table C-12 DSCP Alarm Thresholds

Field

Description

Name

Give the DSCP Alarm Threshold a name.

Site

Choose a site from the list. See Configuring Sites for information on setting up a site.

DSCP

Choose a DSCP value from the list.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

From the drop-down lists, choose a Rising action and a Falling action (optional).

DSCP Metrics (per second)

Choose one of the metric types from the list, and then enter a Rising threshold and a Falling threshold.

RTP Streams Threshold Configuration Window

describes the critical fields on the RTP Threshold Configuration window.

Table C-13 RTP Streams Thresholds

Field

Description

Name

Severity

), where you can choose to view High, Low, or High and Low alarms.

Codec

Choose a Codec from the list.

Source Site/Host

Make a selection from the drop-down lists, or leave as “Any.” See Configuring Sites for information on setting up a site.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

From the drop-down lists, choose a Rising action and a Falling action (optional). See Viewing Alarm Actions for information on setting up alarm actions.

RTP Stream Metrics

Choose a metric from the list:

Jitter: Variation of packet arrival time compare to expected arrival time.

Adjusted packet loss percent: Percent of packet loss which includes packets actually lost and packets that arrived beyond the expected buffering capability of the endpoint.

Actual packet loss percent: Percent of packets that Prime NAM has never seen.

MOS: Mean opinion score that is composed of both jitter and adjusted packet loss.

Concealment seconds: Number of seconds in which Prime NAM detected packets lost.

Severe concealment seconds: Number of seconds in which Prime NAM detected packets lost of more than 5%.

Enter a Rising threshold and a Falling threshold.

Voice Signaling Threshold Configuration Window

describes the critical fields on the Voice Signaling Threshold Configuration window.

Table C-14 Voice Signaling Thresholds

Field

Description

Name

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

Choose a Rising action and a Falling action from the lists (optional). See Viewing Alarm Actions for information on setting up alarm actions.

Voice Signaling Metrics

Choose Jitter to enable an alarm when the software detects jitter to be more than the value set here.

Check Packet Loss % to enable an alarm when the software detects Packet Loss percentage to be outside of the values you entered.

NetFlow Interface Threshold Configuration Window

describes the critical fields on the Network Interface Threshold Configuration window.

Table C-15 NetFlow Interface Alarm Thresholds

Field

Description

Direction

Choose Ingress or Egress.

Severity

), where you can choose to view High, Low, or High and Low alarms.

Actions

Choose a Rising action and a Falling action from the lists (optional). See Viewing Alarm Actions for information on setting up alarm actions.

Application Metrics (per second)

Choose Bytes or Packets, and enter a Rising and Falling threshold.

Router System Information Window

describes the critical fields on the Router System Information window.

Table C-16 Router/Managed Device System Information

Field

Description

Name

Hardware

Managed Device Software Version

Current software version of the router.

Managed Device System Uptime

Total time the router or switch has been running.

Location

Contact

Managed Device

IP address of the router.

SNMP v1/v2c RW Community String

Verify String

Enable SNMP V3

Check the check box to enable SNMP Version 3. If SNMPv3 is not enabled, the community string is used.

Mode: No Auth, No Priv

SNMP is used in a mode with no authentication and no privacy.

Mode: Auth, No Priv

SNMP is used in a mode with authentication, but no privacy.

Mode: Auth and Priv

SNMP is used in a mode with both authentication and privacy.

User Name

Enter a username, which will match the username configured on the device.

Auth Password

Enter the authentication password associated with the username that was configured on the device. Verify the password.

Auth Algorithm

Choose the authentication standard which is configured on the device (MD5 or SHA-1).

Privacy Password

Enter the privacy password, which is configured on the device. Verify the password.

Privacy Algorithm

Enter the privacy algorithm, which is configured on the device (AES or DES).

Switch/Managed Device System Information

describes the critical fields on the Switch System Information window.

Table C-17 Switch Device Information

Field

Description

SNMP Test information

Displays the IP address of the NAM and the switch on which the SNMP test occurred.

Name

Hardware

Supervisor Software Version

System Uptime

Total time the device has been running.

SNMP read from chassis

SNMP read test result.

SNMP write to chassis

SNMP write test result.

Mini-RMON on chassis

For Cisco IOS devices, displays the status if there are any ports with Mini-RMON configured (Available) or not (Unavailable).

NBAR on chassis

Displays if NBAR is available on the device.

VLAN Traffic Statistics on chassis

Displays if VLAN data is Available or Unavailable.

Note Catalyst 6500 Series switches require a Supervisor 2 or MSFC2 card.

NetFlow Status

.

NBAR Interfaces Window

describes the critical fields on the NBAR Interfaces window.

Table C-18 NBAR Interface Details

Field / Operation

Description

Enable
(check box)

Check indicates that NBAR is enabled.

Interface

Depending on the IOS running on the Supervisor, port names are displayed differently.

Newer versions of IOS software display a port name as Gi2/1 to represent a Gigabit port on module 2 port 1.

In the Virtual Switch software (VSS), a port name might be displayed as Gi1/2/1to represent a Gigabit port on switch 1, module2, port 1.

Interface Description

Description of the interface.

Site Configuration Window

describes the critical fields on the Site Configuration window.

Table C-19 Site Configuration

Field

Description

Name

Description

Disable Site
(check box)

If you check this check box, the software will skip this site when classifying traffic. This is useful if the site is no longer active, but the user would still like to access historical site data in the database. Otherwise, the user should delete sites that are not needed.

Subnet

to get information about Site Rules.

button to tell the software to look for subnets in the traffic. See Configuring Sites Using Subnets.

Data Source

Specify the data source from where the site traffic originates.

Leave this field blank if the site traffic can come from multiple data sources.

Subnet Detection Window

describes the critical fields on the Subnet Detection window.

Table C-20 Subnet Detection

Field

Description

Subnet Mask

Enter the subnet mask.

Note If the bit mask is 32 or less, the software will detect an IPv4 subnet. If the bit mask is between 33 and 64, then it will detect an IPv6 subnet.

Data Source

Choose the data source in which you would like to detect subnets.

Interface

Choose the interface in which you would like to detect subnets.

Filter Subnets Within Network

Enter an IPv4 or IPv6 address

Unassigned Site (check box)

The “Unassigned” site includes any that do not match any of your site configurations. Sites are classified at the time of packet processing.

Sites Window

describes the critical fields on the Sites window.

Table C-21 Sites Window

Field

Description

Name

Description

Rule

Lists the first rule assigned to the selected site. If you see periods next to the site rule (...), then multiple rules were created for that site. To see the list of all rules, click the quick view icon (after highlighting the site, click the small arrow on the right).

Status

Shows if the site is Enabled or Disabled.

Add NetFlow Interface Window

describes the critical fields on the NetFlow Interface Add window.

Table C-22 Add NetFlow Interface Capacity

Field

Description

Device

Enter the IPv4 or IPv6 address.

ifIndex

Unique identifying number associated with a physical or logical interface. Valid characters: 0-9.

ifName

Name of the interface. Valid characters are A-Z, a-z, 0-9.

ifSpeed(Mbps)

An estimate of the interface’s current bandwidth in bits per second.

DSCP Group Setup Dialog Box

describes the critical fields on the DSCP Group Setup dialog box.

Table C-23 DSCP Group Setup Dialog Box

Field

Description

Usage Notes

Name

Name of the profile.

Enter the name of the profile you are creating. The maximum is 64 characters.

Label Format

DSCP

DSCP numbers from 0 to 63. After selecting the DSCP radio button, you can freely choose any of the 64 possible values and assign them to Groups.

AF / EF / CS

Assured Forwarding (AF) guarantees a certain amount of bandwidth to an AF class and allows access to extra bandwidth,

Expedited Forwarding (EF) is used for traffic that is very sensitive to delay, loss and jitter, such as voice or video traffic.

Class Selector (CS) the last 3 bits of the 6-bit DSCP field, so these correspond to DSCP 0 through DSCP 7.

Bit Field

Six bits in the IP header of a packet.

DSCP Group Label Formats

describes the DSCP Group label formats.

Table C-24 DSCP Group Label Formats

DSCP Format (DSCP 0 through DSCP 63)

AF/EF/CS Format

Bit Field Format

DSCP 0

-

000000

DSCP 8

CS1

001000

DSCP 10

AF11

001010

DSCP 12

AF12

001100

DSCP 14

AF13

001110

DSCP 16

CS2

010000

DSCP 18

AF21

010010

DSCP 20

AF22

010100

DSCP 22

AF23

010110

DSCP 24

CS3

011000

DSCP 26

AF31

011010

DSCP 28

AF32

011100

DSCP 30

AF33

011110

DSCP 32

CS4

100000

DSCP 34

AF41

100010

DSCP 36

AF42

100100

DSCP 38

AF43

100110

DSCP 40

CS5

101000

DSCP 46

EF

101110

DSCP 48

CS6

110000

DSCP 56

CS7

111000

Application Window

describes the critical fields on the Add Application Window.

Table C-25 Create or Edit Applications

Field

Description

Name

Unique 1 to 64 character descriptive name.

Description

Selector

(Optional) Leave blank. An arbitrary number up to 4-digits, unique within an engine-id. It is automatically assigned if left blank. Identification number is autogenerated if left blank. Range is from 1 to 65535.

This allows you to configure applications consistently across multiple NAMs, so that the same user-created application is exported with the same value. This should be used when configuring the same custom applications on multiple NAMs.

The application tag for user-created applications is a combination of the engine ID and the Selector. The 32 bit is generated by using the engine ID as the highest order byte, and the Selector makes up the other 3 bytes. For standard application/protocols, the application tag is predefined.

Application Classification Rule

Select application type: Protocol, HTTP URL-based or Server IP Address.

Application Rule: Protocol/Port

Add the application protocol and port you want to track.

—Lists predefined protocols. If your option is not included, you can create a custom URL-based application classification.

—Enter the port number or port number range to monitor. The port is an arbitrary number you assign to handle the additional ports for the protocol family. This protocol number must be unique so it does not conflict with standard protocol/port assignments.

The port number range will vary depending on the protocol type selected. You can create additional ports to enable Prime NAM to handle additional traffic for standard applications.

Application Rule: HTTP URL

Create custom URL-based applications by selecting this option. Enter at least one of the values below.

—The host name identified in the header from which the traffic is originating.

—The specific URL path that identifies the traffic.

Engine ID

Identifies the type of application (including ethertype, iana-14, iana-13, lic, L7, or custom).

Application Tag

System generated tag which can be used when multiple NAMs are being monitored.

Description

(Optional) Custom description to define your application. Limited to 75 characters.

Status

Active means that network traffic is being analyzed. Inactive means that the application is not being analyzed, possibly due to a duplication of effort. The Interactive Report filter may still list inactive applications if there is any historical data for the inactive application in the database, but it is not collecting new data.

Applications Window

describes the critical fields on the Applications Window.

Table C-26 Applications

Field

Description

Application

Unique 1 to 64 character descriptive name.

Rule

Displays application type: Protocol, HTTP URL-based or Server IP Address.

Selector

An arbitrary number up to 4-digits, unique within an engine-id. It is automatically assigned if left blank.

This allows you to configure applications consistently across multiple NAMs, so that the same user-created application is exported with the same value. This should be used when configuring the same custom applications on multiple NAMs.

The application tag for user-created applications is a combination of the engine ID and the selector. The 32 bit number is generated by using the engine ID as the highest order byte, and the selector makes up the other 3 bytes. For standard application/protocols, the application tag is predefined.

Engine ID

Identifies the type of application (including ethertype, iana-14, iana-13, lic, L7, or custom)

Application ID

System generated tag which can be used when multiple NAMs are being monitored.

Description

If a system-defined, contains system information about the application type. If user-defined, enter custom description to define your application. Limited to 75 characters.

Status

Active means that network traffic is being analyzed. Inactive means that the application is not being analyzed, possibly due to a duplication of effort. The Interactive Report filter may still list inactive applications, but it is not monitored by NAM and is therefore not classified or displayed on NAM dashboards.

URL-Based Applications Window

describes the critical fields on the URL-Based Applications window.

Table C-27 URL-Based Applications

Field

Description

Index

A unique number (1-64) of each URL-based application. You can define up to 64 URL-based applications in NAM.

Host

Matching criteria in the host portion of the URL string appears in HTTP packets. This match is a POSIX Regular Expression1.

Path

.

Content-Type

.

Protocol Description

Description of this URL-based application.

1.A regular expression provides a concise and flexible means for matching strings of text, such as particular characters, words, or patterns of characters. A regular expression is written in a formal language that can be interpreted by a regular expression processor, a program that either serves as a parser generator or examines text and identifies parts that match the provided specification. The IEEE POSIX Basic Regular Expressions (BRE) standard (released alongside an alternative flavor called Extended Regular Expressions or ERE) was designed mostly for backward compatibility with the traditional (Simple Regular Expression) syntax but provided a common standard which has since been adopted as the default syntax of many Unix regular expression tools, though there is often some variation or additional features. Many such tools also provide support for ERE syntax with command line arguments. In the BRE syntax, most characters are treated as literals - they match only themselves (in other words, a matches "a").

1.A regular expression provides a concise and flexible means for matching strings of text, such as particular characters, words, or patterns of characters. A regular expression is written in a formal language that can be interpreted by a regular expression processor, a program that either serves as a parser generator or examines text and identifies parts that match the provided specification. The IEEE POSIX Basic Regular Expressions (BRE) standard (released alongside an alternative flavor called Extended Regular Expressions or ERE) was designed mostly for backward compatibility with the traditional (Simple Regular Expression) syntax but provided a common standard which has since been adopted as the default syntax of many Unix regular expression tools, though there is often some variation or additional features. Many such tools also provide support for ERE syntax with command line arguments. In the BRE syntax, most characters are treated as literals - they match only themselves (in other words, a matches "a").

Response Time Configuration Window

describes the critical fields on the Response Time Configuration Window.

Table C-28 Response Time Configuration Window

Field

Description

Usage Notes

Range 1 (μs)

Upper response time limit for the first container

Enter a number in microseconds. The default is 1 to 1,000 μs

Range 2 (μs)

Upper response time limit for the second container

Enter a number in microseconds. The default is 1,001 to 5,000 μs

Range 3 (μs)

Upper response time limit for the third container

Enter a number in microseconds. The default is 5,001 to 10,000 μs

Range 4 (μs)

Upper response time limit for the fourth container

Enter a number in microseconds. The default is 10,001 to 50,000 μs

Range 5 (μs)

Upper response time limit for the fifth container

Enter a number in microseconds. The default is 50,001 to 100,000 μs

Range 6 (μs)

Upper response time limit for the sixth container

Enter a number in microseconds. The default is 100,001 to 500,000 μs

Range 7 (μs)

Upper response time limit for the seventh container

Enter a number in microseconds. The default is 500,001 to 1,000,000 μs

Range 8 (μs)

Upper response time limit for the eighth container. This is the maximum interval that Prime NAM waits for a server response to a client request.

This range cannot be edited. Enter a number in microseconds. The default is 1,000,001 μs to infinity.

Voice Monitor Setup Window

describes the critical fields on the Voice Monitor Setup Window.

Table C-29 Voice Monitor Setup Window

Field

Description

Voice Monitoring

Enabled

Enables voice monitoring. Ensure this check box is selected if you are interested in voice monitoring.

MOS Values

Excellent

.

Good

.

Fair

.

Poor

. This default cannot be changed.

URL Collection Configuration Window

describes the critical fields on the URL Collection Configuration Window.

Table C-30 URL Collection Configuration Dialog Box

Element

Description

Usage Notes

Data Source

Identifies type of traffic incoming from the application.

Select one of the options from the drop- down box.

Max Entries

Maximum number of URLS to collect.

Select one of the following options from the drop-down box:

100

500

1000

Match only

The application URL to match.

Optional parameter to limit collection of URLs that match the regular expression of this field.

Monitor User Interface Windows

This section describes field descriptions for the following windows:

Applications Detail

Application Groups Detail

Client-Server Application Responses Window

Client-Server Application Transactions Window

Client-Server Network Responses Window

DSCP Detail

Host Detail

Interfaces Stats Table

Last 50 Alarms

Server Application Responses Metrics

Server Application Transactions Metrics

Server Network Responses Window

Applications Detail Window

describes the critical fields in this window.

Table C-31 Applications Detail

Field

Description

Application

Software services classified by NAM from analyze and monitor traffic.

Application Group

The application group (set of applications that can be monitored as a whole).

Bytes/sec

Traffic rate; number of bytes per second

Packets/sec

Traffic rate; number of packets per second

Application Groups Detail Window

describes the critical fields in this window.

Table C-32 Application Groups Detail

Field

Description

Application Group

The application group (set of applications that can be monitored as a whole).

Site

Applicable site (or Unassigned if no site)

Bytes/sec

Traffic rate; number of bytes per second

Packets/sec

Traffic rate; number of packets per second

Application Response Time (ART) Metrics

describes the metrics measured for response time.

Table C-33 Application Response Time (ART) Metrics

Metric

Description

Average Response Time

Response Time is the time between the client request and the first response packet from the server, as observed at the NAM probing point. Increases in the response time usually indicate problems with server resources, such as the CPU, Memory, Disk, or I/O due to a lack of necessary resources or a poorly written application.

This and other Response Time metrics are in microseconds (μs) units.

Min Response Time

Max Response Time

Number of Responses

Total number of request-response pairs observed during the monitoring interval

Number of Late Responses

Total number of responses that exceed the Max Response Time

Number of Responses 1

Number of responses with a response time less than RspTime1 threshold

Number of Responses 2

Number of responses with response time less than RspTime2 and larger than RspTime1

Number of Responses 3

Number of responses with response time less than RspTime3 and larger than RspTime2

Number of Responses 4

Number of responses with response time less than RspTime4 and larger than RspTime3

Number of Responses 5

Number of responses with response time less than RspTime5 and larger than RspTime4

Number of Responses 6

Number of responses with response time less than RspTime6 and larger than RspTime5

Number of Responses 7

Number of responses with response time less than LateRsp and larger than RspTime6

Client Bits

Number of TCP payload bits sent from the client(s) during the monitoring interval

Server Bits

Number of TCP payload bits sent from the server(s) during the monitoring interval

Client Packets

Number of TCP packets sent from the client(s) during the monitoring interval

Server Packets

Number of TCP packets sent from the server(s) during the monitoring interval

Average number of concurrent connections

Average number of concurrent TCP connections during the reporting interval

Number of new connections

Number of new TCP connections made (TCP 3-way handshake) during the monitoring interval

Number of closed connections

Number of TCP connections closed during the monitoring interval

Number of unresponsive connections

Number of TCP connection requests (SYN) that are not responded during the monitoring interval

Number of refused connections

Number of TCP connection requests (SYN) that are refused during the monitoring interval

Average Connection duration

Average duration of TCP connections during the monitoring interval

Average Server Response Time

, which is the time between the client request arriving at the server and the first response packet being returned by the server.

Increases in the server response time usually indicate problems with application and/or server resources, such as the CPU, Memory, Disk, or I/O.

Min Server Response Time

Max Server Response Time

Average Network Time

Network time between a client and a server. Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Min Network Time

Max Network Time

Average Client Network Time

Client Network Time is the network time between a client and the NAM switch or router.

In WAAS monitoring, Client Network Time from a WAE client data source represents the network RTT between the client and its edge WAE, while Client Network Time from the WAE server data source represents the WAN RTT (between the edge and core WAEs).

Min Client Network Time

Max Client Network Time

Average Server Network Time

Server Network Time is the network time between a server and NAM probing point.

In WAAS monitoring, Server Network Time from a server data source represents the network time between the server and its core WAE.

Min Server Network Time

Max Server Network Time

Average Total Response Time

Total Response Time is the total amount of time between the client request and when the client receives the first response packet from the server.

Use Total Response Time with care because it is not measured directly and mixes the server response time metric with the network time metric.

Min Total Response Time

Max Total Response Time

Average Transaction Time

Transaction Time is the total amount of time between the client request and the final response packet from the server.

Transaction times may vary depending upon client usages and application types. Transaction Time is a key indicator for monitoring client experiences and detecting application performance anomalies.

Min Transaction Time

Max Transaction Time

Number of Transactions

The number of transactions completed during the monitoring interval.

Average Data Transmission Time

Elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time.

Average Data Time

Data Time: Average data time portion of transaction time.

Packets Retransmitted

Number of retransmitted packets detected during the monitoring interval

Bits Retransmitted

Number of retransmitted bits detected during the monitoring interval

Average Retransmission Time

Average time to retransmit lost packets per transaction

Client ACK Round Trip Time

Average network time for the client to acknowledge (ACK) a server data packet as observed at NAM probing point

Number of Client ACK Round Trips

Number of client ACK RTs observed during the monitoring interval

Client Server Application Responses Window

provides definitions of the critical fields of the Client-Server Application Responses window.

Table C-34 Client-Server Application Responses Window

Field

Description

Number of Responses

Total number of responses observed during the monitoring interval

Minimum Client Network Time (ms)

Minimum network time measured by analyzing TCP three-way handshake sequence.

Average Client Network Time (ms)

Average network time measured by analyzing TCP three-way handshake sequence.

Maximum Client Network Time (ms)

Maximum network time measured by analyzing TCP three-way handshake sequence.

Minimum Server Network Time (ms)

Minimum network time between a server and NAM probing point.

Average Server Network Time (ms)

Average network time between a server and NAM probing point.

Maximum Server Network Time (ms)

Maximum network time between a server and NAM probing point.

Minimum Total Response Time (ms)

The total amount of time between the client request and the final response packet from the server.

Average Total Time (ms)

Average time (ms) elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Maximum Total Time (ms)

The total amount of time between the client request and the final response packet from the server.

Client-Server Application Transactions Window

provides definitions of critical fields in the Client-Server Application Transactions window.

Table C-35 Client-Server Application Transactions Window

Field

Description

Number of Transactions

Total number of transactions observed during the monitoring interval.

Average Transaction Time (ms)

Average time elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Average Server Response Time (ms)

Amount of time it takes a server to send the initial response to a client request as seen by the NAM.

Average Data Transmission Time (ms)

Elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time.

Average Retransmission Time (ms)

Average time to retransmit lost packets per transaction

Client ACK Round Trip Time (ms)

Average network time for the client to acknowledge (ACK) a server data packet as observed at NAM probing point

Client-Server Network Responses Window

describes the critical fields of the Client-Server Network Response Time window.

Table C-36 Client-Server Network Responses Window

Field

Description

Minimum Client Network Time (ms)

Minimum network time measured by analyzing TCP three-way handshake sequence.

Average Client Network Time (ms)

Average network time measured by analyzing TCP three-way handshake sequence.

Maximum Client Network Time (ms)

Maximum network time measured by analyzing TCP three-way handshake sequence.

Minimum Server Network Time (ms)

Minimum network time measured by analyzing TCP three-way handshake sequence.

Average Server Network Time (ms)

Average network time measured by analyzing TCP three-way handshake sequence.

Maximum Server Network Time (ms)

Maximum network time measured by analyzing TCP three-way handshake sequence.

Minimum Network Time (ms)

Minimum of the network time measured by analyzing TCP three-way handshake sequence.

Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Average Network Time (ms)

Average of the network time measured by analyzing TCP three-way handshake sequence.

Maximum Network Time (ms)

Maximum of the network time measured by analyzing TCP three-way handshake sequence.

DSCP Detail Window

describes the critical fields in this window.

Table C-37 DSCP Detail

Field

Description

Bytes/sec

, you can choose to display NAM data in Bits or Bytes.

Packets/sec

Traffic rate; number of packets per second

Host Detail Window

describes the critical fields in this window.

Table C-38 Host Detail

Field

Description

In Bits/sec

Number of bits per second incoming

In Packets/sec

Number of packets per second incoming

Out Bits/sec

Number of bits per second outgoing

Out Packets/sec

Number of packets per second outgoing

Interfaces Stats Table

. describes the critical fields in the Interfaces Stats table.

Table C-39 Interfaces Stats Table

Field

Description

Interface

Interface number.

In % Utilization

Utilization percentage of the port.

Out % Utilization

Utilization percentage of the port.

In Packets/s

Number of incoming packets collected per second.

Out Packets/s

Number of outgoing packets sent out per second.

In Bits/s

Number of bits collected per second.

Out Bits/s

Number of bits sent out per second.

In Non-Unicast/s

Number of non-unicasts collected per second.

Out Non-Unicast/s

Number of non-unicasts sent out per second.

In Discards/s

Number of discards collected per second.

Out Discards/s

Number of discards sent out per second.

In Errors/s

Number of errors collected per second.

Out Errors/s

Number of errors sent out per second.

Last 50 Alarms Table

describes the critical fields on the Last 50 Alarms table.

Table C-40 Last 50 Alarms

Field

Description

Site

This contains site or source and destination sites (source - destination) of the network traffic that generated the alarm message.

Alarm Triggered By

Details information of the network traffic that generated the alarm message. The format of the alarm triggered by string are:

Triggered by application threshold: application

Triggered by application with DSCP threshold: DSCP:codepoint - application

Triggered by host threshold: host

Triggered by host with application threshold: host - application

Triggered by host with application and DSCP: DSCP: code point - host - application

Triggered by host with DSCP: DSCP: code point - host

Triggered by conversation: source - destination

Triggered by conversation with application: source - application - destination

Triggered by response time: IAP: client - application - server.

Triggered by DSCP: DSCP: code point

Triggered by RTP stream: source - source port - codec(codec string) - SSRC(number) - destination - destination port

Triggered by voice signaling: Calling (address - number) Called (address - number) ID/References (id() - ref (calling:called))

Triggered by NetFlow interfaces: NetFlow: Device (address) - If-Index(number) - Ingress/Egress

Threshold Variable

Parameter of the threshold that is used to evaluate alarm condition.

Threshold Value

User defined rising value of the threshold variable.

Triggered Time

Time when the alarm condition was found occurred.

Triggered Value

Parameter value when the alarm condition was raised. Note: The triggered value could be - when the viewing window does not included the alarm when it was occurring.

Clear Time

Time when the alarm condition was resolved. The alarm variable has fallen below the falling threshold value.

Server Application Responses Window

provides definitions of the critical fields of the Server Application Responses window.

Table C-41 Server Application Responses Metrics

Field

Description

Average Client Network Time (ms)

Client Network Time is the network time between a client and the NAM switch or router.

In WAAS monitoring, Client Network Time from a WAE client data source represents the network RTT between the client and its edge WAE, while Client Network Time from the WAE server data source represents the WAN RTT (between the edge and core WAEs).

Maximum Client Network Time (ms)

Average Server Response Time (ms)

, which is the time between the client request arriving at the server and the first response packet being returned by the server.

Increases in the server response time usually indicate problems with application and/or server resources, such as the CPU, Memory, Disk, or I/O.

Maximum Server Response Time (ms)

Average Total Response Time (ms)

Total Response Time is the total amount of time between the client request and when the client receives the first response packet from the server.

Maximum Total Response Time (ms)

Server Application Transactions Window

provides definitions of the critical fields of the Server Application Transactions window.

Table C-42 Server Application Transactions Metrics

Field

Description

Average Transaction Time (ms)

Average time (ms) elapsed from the start of a client request to the completion of server response. Transaction times might vary significantly depending upon application types. Relative thresholds are useful in this situation.

Transaction time is a key indicator when detecting application performance anomalies.

Average Server Response Time (ms)

Amount of time it takes a server to send the initial response to a client request as seen by the NAM.

Average Data Transfer Time (ms)

Average elapsed time from the first server-response packet to the last server-response packet, excluding retransmission time. Data transfer time is always measured in the server-to-client direction and can be used to detect problems for a particular type of transaction of an application.

Average Retransmission Time (ms)

Average time to retransmit lost packets, per transaction.

Client ACK Round Trip Time (ms)

Average round trip time for the client to acknowledge (ACK) a server TCP packet.

Server Network Responses Window

provides definitions of the critical fields of the Server Network Response Times window.

Table C-43 Server Network Responses Window

Field

Description

Average Server Network Time (ms)

Average of the Server Network Time (network time between a server and NAM probing point).

Maximum Server Network Time (ms)

Maximum of the Server Network Time (network time between a server and NAM probing point).

Average Network Time

Average of the network time between client and server. Network Time is the sum of Client Network Time and Server Network Time. NAM measures the Network Time using TCP 3-way handshakes. If there are no new TCP connections made during the monitoring interval, this metric is not reported.

Maximum Network Time

Maximum of the network time between client and server.

Server Bytes

Number of TCP payload bytes sent from the server(s) during the monitoring interval.

Client Bytes

Number of TCP payload bytes sent from the client(s) during the monitoring interval.

Calls Table

.

Table C-44 Calls Table

Field

Description

Calling Number

Calling number as it appears in the signaling protocol.

Called Number

Called number as it appears in the signaling protocol.

Calling Host Address

RTP receiving address of the calling party detected by the NAM from inspecting the call signaling protocol.

Calling Port

RTP receiving port of the calling party detected by NAM from inspecting call signaling protocol.

Calling Alias

Calling party name detected by NAM from inspecting call signaling protocol.

Called Host Address

IP address of the phone receiving the call.

Called Port

Port of the phone receiving the call.

Called Alias

Alias name, MGCP endpoint ID, or SIP URI of the called party phone.

Calling Reported Jitter (ms)

Jitter value reported by calling party at the end of the call.

Calling Reported Packet Loss (%)

Percentage of packet loss reported by calling party at the end of the call.

Start Time

Time when the call was detected to start.

End Time

Time when the call was detected to end.

Duration

Duration of the call.

Note When the call signaling’s call tear down sequence is not detected by the NAM, the NAM will assume:
- the call ended after 3 hours in low call volume per interval
- the call ended after 1 hour in high call volume per interval (high call volume is defined as call table filled up during the interval.)

Called Reported Jitter (ms)

Jitter value reported by called party at the end of the call.

Called Reported Pkt Loss (%)

Percentage of packet loss reported by called party at the end of the call.

RTP Stream for Selected Call Report Statistics

provides definitions of the critical fields of the RTP stream statistics of a selected call calculated by the NAM.

Table C-45 RTP Streams for the Selected Call Table

Field

Purpose

Source Address

IP Address of the originator of the RTP stream

Source Port

UDP port of the originator of the RTP stream

Destination Address

IP address of the receiver of the RTP stream

Destination Port

UDP port of the receiver of the RTP stream

Codec

Encoding decoding format/algorithm of the RTP stream

SSRC

Synchronization source number as it appear in the RTP header

Duration Weighted MOS

NAM calculated score that takes into account of the duration of the stream

Duration Weighted Jitter

Jitter that takes into account of the duration of the RTP stream among all per-interval reports

Overall Adjusted Packet Loss

Percentile of adjust packets lost against total packets of all per-interval RTP reports.

RTP Conversations Table

provides definitions of the critical fields of the RTP Conversations Table.

Table C-46 RTP Conversations Table

Field

Purpose

Start Time

Time when the RTP stream was discovered by the NAM

Source Address

IP Address of the originator of the RTP stream

Source Port

UDP port of the originator of the RTP stream

Destination Address

IP address of the receiver of the RTP stream

Destination Port

UDP port of the receiver of the RTP stream

Codec

Encoding decoding format/algorithm of the RTP stream

SSRC

Synchronization source number as it appear in the RTP header

Duration Weighted MOS

NAM calculated score that takes into account of the duration of the stream

Capture User Interface Windows

This section includes the following topics:

Capture Analysis Window

Capture Session Fields

Capture Setting Fields

Custom Decode Filter Dialog Box

Custom Decode Subexpressions Fields

Error Scan Window

Hardware Filter Dialog Box

NAM Packet Analyzer Decode Window

Software Filter Dialog Box

Capture Analysis Window

describes the Capture Analysis window fields.

Table C-47 Capture Analysis Window Fields

Field

Description

Capture Overview

Provides a summary of the displayed capture including number of packets captured, bytes captured, average packet size, capture start time, duration of capture, and data transfer rate (both bytes and bits per second)

Traffic over Time

Displays a graphic image of network traffic (KB/second)

Protocol Statistics

Displays packets and bytes transferred for each protocol

Hosts Statistics

Displays packets and bytes transferred for each host address

Capture Session Fields

page.

Table C-48 Capture Session Fields

Operation

Description

Start Time

Time the capture was last started. You can stop and restart the capture as many times as necessary.

Size (MB) (Capture to Memory)

Size (MB) x No. files (Capture to Files)

Size of the session

indicates the capture is being stored in one or more files and is a link to those files.

The capture file size is limited to 500 MB on Nexus 1000V, SM-SRE, and vNAM. On all other NAM platforms, the capture file size limit is 2,000 MB.

State

The current status of the capture:

Running—Packet capture is in progress

Stopped—Packet capture is stopped. Captured packets remain in buffer, but no new packets are captured

Full—The memory or file is full, and no new packets will be captured.

Location

The location of the capture (Memory, Local Disk, and external storage).

Capture Operation Buttons

Create

Create a new capture session. See Configuring Capture Sessions.

Edit

Edit the settings of the selected capture.

Delete

Delete a selected session. Not available if capture session is running.

Start

Start capturing to a selected session. The number in the Packets column for that session will start to rise.

Stop

Stop capturing to the selected session (no packets will go through). Capture data remains in the capture memory buffer, but no new data is stored. Click Start to resume the capture.

Clear

Clear captured data from memory.

Decode

Display details of the capture session.

Save to File

Save a session to a file on the NAM hard disk. See Working with Capture Files.

Capture Setting Fields

describes the Capture Settings fields.

Table C-49 Capture Settings Fields

Field

Description

Usage Notes

Packet Slice Size (bytes)

The slice size in bytes; used to limit the size of the captured packets.

Enter a value between 64 and 9000. Enter zero (0) to not perform slicing.

If you have a small session but want to capture as many packets as possible, use a small slice size.

If the packet size is larger than the specified slice size, the packet is sliced before it is saved in the capture session. For example, if the packet is 1000 bytes and slice size is 200 bytes, only the first 200 bytes of the packet is stored in the capture session.

Capture Source

Data-Ports or ERSPAN

Choose the capture source (check one or more check boxes):

Data-ports: This accepts SPAN, RSPAN, and VACL capture. For NAM on ISR G2 SM-SRE, internal, external, or both.2 On NAM-NX1, you can select only one data-port at a time.

ERSPAN: Locally terminated is recommended.

Note On some platforms, you may be limited to selecting only one of the dataports at a time. Most platforms allow you to select both dataports at once.

Storage Type: Memory

Check to store captures in memory

for this capture. Enter a number from 1 up to your platform maximum. If system memory is low, the actual session size allocated might be less than the number specified here.

, the capture will end when the amount of data reaches size of session.

Storage Type: File(s)

File Size (MB)

(file size can be from 1 MB to 500/2000 MB depending on your platform). If disk space is not available, you are not able to start new capture-to-disk sessions.

Number of Files

Enter a value for Number Of Files to use for capture. The maximum is determined on the size of the file, numbers of files stored, and the amount of disk space available at the location where these files are stored.

Rotate Files

Use this feature if you plan to capture sets of small files that allow you to perform instantaneous downloads, decodes, and analysis. Rotating files allows you to automatically maintain your storage space.

Check the Rotate Files check box to rotate files. Available only for remote storage or NAM appliances. For information about configuring remote storage, see About Capturing to Data Storage.

. To determine the most recent capture, check each file’s time stamp.

File Location

If file data storage is available, choose one of the storage targets in the drop-down list. The drop-down list displays only those targets in the Ready state.

Local disk is the default, or choose a previously configured remote storage location if available. Each option shows the amount of disk space available for capture packet storage.

page (see Utilizing Capture Data Storage).

2.The Nexus virtual blade (VB) does not have dataports, so this option is not supported.

2.The Nexus virtual blade (VB) does not have dataports, so this option is not supported.

Custom Decode Filter Dialog Box

describes the critical fields on the custom decide filter window.

Table C-50 Custom Decode Filter Dialog Box

Field

Description

Usage Notes

Protocol

The protocol to match with the packet.

to match all packets regardless of protocol.)

Address
(MAC or IP)

Indicates whether to filter by MAC or IP address.

Choose MAC to filter using the source/destination MAC address of the packets.

Choose IP to filter using the source/destination addresses of the packets.

Both Directions

Indicates whether the filter is applied to traffic in both directions.

If the source is host A and the destination is host B, enabling both directions filters packets from A to B and B to A.

If the source is host A and the destination is not specified, enabling both directions filters packets both to and from host A.

Offset

The offset (in bytes) from the Base where packet data-matching begins.

Enter a decimal number.

Base

The base from which the offset is calculated.

If you select absolute, the offset is calculated from the absolute beginning of the packet (for example, the beginning of the Ethernet frame).

If you select protocol, the offset is calculated from the beginning of the protocol portion of the packet. If the packet does not contain the protocol, the packet fails this match.

or a protocol.

Data Pattern

The data to be matched with the packet.

are hexadecimal numbers from 0-9 or a-f. Leave blank if not applicable.

Filter Expression

An advanced feature to set up complex filter conditions.

.

See Tips for Creating Custom Decode Filter Expressions.

Custom Decode Subexpressions Fields

describes the custom decode fields and provides filter and format details.

Table C-51 Custom Decode Field Subexpressions

Field

Filter By

Format

eth.dst

MAC address

, where h is a hexadecimal number from 0 to 9 or a to f.

ip.dst

IP address

, where n is a number from 0 to 255 and s is a 0-32 hostname that does not contain a hyphen.

tcp.dstport

TCP port number

A decimal number from 0 to 65535.

udp.dstport

UDP port number

A decimal number from 0 to 65535.

Protocol

Click the Protocol list in the Custom Decode Filter dialog box to see the list of protocols on which you can filter.

Protocol data pattern

is a hexadecimal number fro 0 to 9 or a to f.

are decimal numbers.

portion of the packet.

frame.pkt_len

Packet length

A decimal number that represents the packet length, not the truncated capture packet length.

Error Scan Window

describes the Error Scan window fields.

Table C-52 Error Scan Window Descriptions

Field

Description

Severity

: Warning; for example, an application returned an unusual error code

: A serious problem, such as malformed packets

Group

: A checksum was invalid

: Protocol sequence is problematic

: Problem with the application response code

: An application request

: Dissector incomplete or data can’t be decoded

: Problems while reassembling

: Malformed packet or dissector has a bug; dissection of this packet aborted

Hardware Filter Dialog Box

describes the Create Hardware Filter dialog box.

Table C-53 Create Hardware Filter Dialog

Attribute

Options

Range

Data Ports

Both Ports, Data Port 1, Data Port 2

—

Frame Length

Equal To, Not Equal To, Greater Than, Less Than

Min. 64, Max 65535

VLAN IDs

Equal To, Not Equal To, Greater Than, Less Than

Min. 1, Max 4095

MPLS Label

Equal To, Not Equal To

Min. 0, Max 1048575

Source Address / Mask

Equal To, Not Equal To

IPv4 address

Destination Address / Mask

Equal To, Not Equal To

IPv4 address

L4 Protocol

Equal To, Not Equal To

ICMP, IGMP, IP in IP, GRE, L2Tp, TCP, UDP, Integer

With Custom, you can enter a custom value that is not in the list of common protocols. Enter min. 1, max 255.

L4 Source Port

Equal To, Not Equal To

Min. 1, Max 65535

L4 Destination Port

Equal To, Not Equal To

Min. 1, Max 65535

Pattern Match

Filters packets based on 4-byte hexadecimal patterns anywhere in the first 256 bytes.

Equal To, Not Equal To

NAM Packet Analyzer Decode Window

describes the critical fields on the NAM Packet Analyzer window.

Table C-54 Packet Browser

Field

Description

No.

Packet numbers, listed numerically in capture sequence. If the decode (display) filter is active, the packet numbers might not be consecutive.

Time

Time the packet was captured relative to the first packet displayed (not the first packet in the session). To see the absolute time, see the Detail window.

Source

Packet source, which might be displayed as hostname, IP, IPX, or MAC address. To turn hostname resolution on and off for IP addresses, choose the Setup tab and change this setting under Preferences.

Destination

Packet destination, which might be displayed as hostname, IP, IPX, or MAC address.

Protocol

Top-level protocol of the packet.

Length

Size of the packet, in bytes.

Info

Brief text information about the packet contents.

Software Filter Dialog Box

describes key Software Filter dialog box fields.

Table C-55 Software Filter Dialog Box

Field

Description

Usage Notes

Source Address /
Mask

Source address of the packets.

For IP, IPIP4, GRE.IP, or GTP.IPv4 addresses, enter a valid IPv4 address in dotted-quad format n.n.n.n, where n is 0 to 255. The default (if blank) is 255.255.255.255.

For IPv6 or GTP.IPv6 addresses, enter a valid IPv6 address in any allowed IPv6 address format. For example:

– 1080::8:800:200C:417A

– ::FFF:129.144.52.38

Note See RFC 5952 for valid text representations.

is a hexadecimal number from 0 to 9 or a to f. The default is ff ff ff ff ff ff.

The mask applied to the source address.

If a bit in the Source Mask is set to 1, the corresponding bit in the address is relevant.

If a bit in the Source Mask is set to 0, the corresponding bit in the address is ignored.

Destination Address / Mask

Destination address of the packets.

For IP, IPIP4, GRE.IP, or GTP.IPv4 addresses, enter a valid IPv4 address in dotted-quad format n.n.n.n, where n is 0 to 255. The default (if blank) is 255.255.255.255.

For IPv6 or GTP.IPv6 addresses, enter a valid IPv6 address in any allowed IPv6 address format. For example:

– 1080::8:800:200C:417A

Note See RFC 5952 for valid text representations.

ff ff ff ff ff ff.

The mask applied to the destination address.

If a bit in the Dest. Mask is set to 1, the corresponding bit in the address is relevant.

If a bit in the Dest. Mask is set to 0, the corresponding bit in the address is ignored.

Network Encapsulation

The protocol to match with the packet.

Both Directions (check box)

This check box indicates whether the filter is applied to traffic in both directions.

If the source is host A and the destination is host B, enabling both directions filters packets from A to B and B to A.

If the source is host A and the destination is not specified, enabling both directions filters packets both to and from host A.

The “both directions” check box also affects the ports and not only the addresses (the same logic applies).

VLAN Identifier(s)

The 12-bit field specifying the VLAN to which the packet belongs.

Choose a VLAN Range or enter an individual VLAN IDs.

Prime NAM filters the first VLAN only. If you include a range, note this limitation.

The VLAN ID can range from 1-4095.

Application 3

drop list to filter by application.

Select one protocol to capture from the Application drop-down list.

Source Port(s)

radio button to filter by port.

Enter one or more ports separated by commas.

Destination Port(s)

Enter one or more ports separated by commas.

IP Protocol

Choose TCP, UDP, or SCTP. No selection (default) means that any will be allowed.

3.The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or TCP), you will need to use the “IP Protocol” selector. Selecting, for example, TCP in the “IP Protocol” selector will filter on all packets using TCP.

3.The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or TCP), you will need to use the “IP Protocol” selector. Selecting, for example, TCP in the “IP Protocol” selector will filter on all packets using TCP.

Administration User Interface Windows

This section includes the following sections:

System Overview

SNMP Agent

Preferences

New User Dialog Box

User Privileges

Current User Sessions

System Overview

9

Table C-56 System Overview

Field

Description

Inputs Tab

Cumulative Input Statistics

Health and usage information on all the traffic received by the NAM. It shows the number of packets received (Rx Packets), number of packets lost or dropped (Rx Packets Lost), and number of bytes received (Rx Bytes). The Cumulative column shows cumulative counts since the start of the NAM, and the Rate column one shows the same counters for the last ten seconds.

Input Traffic

Usage information in bytes and packets based on the input you select. You can toggle between a chart or table format. Data is updated every 30 seconds and contains data from the past hour. The table time interval cannot be changed. The input table rate is calculated every 10 seconds. A table legend provides data for standard statistics provided by the software for data collected over a period of time.

at the bottom of Input Traffic chart.

Resources Tab

Date

Current date and time synchronized with the switch, router, or NTP server.

IPv4 Address
IPv6 Address

Based on your configuration, IPv4 address and/or IPv6 address displays.

System Uptime

Length of time the host has been running uninterrupted.

Disk Usage

Config, data, and root partitions with their total and free space. Also shows the amount of disk space used by the performance data base files (DB) and the packet capture to disk (capture files).

Use this information to ensure you have enough disk space and perform the needed maintenance as necessary.

Utilization

Percentage of memory resources being consumed by the NAM as well as the total memory available.

CPU Usage

Percentage of CPU resources being consumed by the NAM. Each individual CPU in a multi-CPU platform is listed separately.

SNMP Agent

Table C-57 System SNMP Agent Dialog Box

Field

Description

Location

(Optional) The physical location of the switch or router in which the NAM is installed.

Community String

Add permission and community string information.

E-Mail Setting

Table C-58 Mail Configuration Options

Field

Description

Enable Mail

Enables e-mail of reports and notification of alarms

External Mail Server

IP address or hostnameof external mail server

Send Test Mail to

Optional. List e-mail addresses for up to three e-mail recipients.Use this as a verification of your mail setup.

Mail Alarm to

This recipient will receive alarm notifications and scheduled exports. Enter multiple addresses using space or comma delimiters.

Advanced Settings

Enables you to designate an e-mail access server port, as well as select a encryption protocol.

Mail Server Port

Optional. Designate an e-mail port for the NAM.If your mail server is configured with a non-default server port number, use this field to ensure it works with Prime NAM.

Mail Server Encryption

Optional. Select Secure Sockets Layer (SSL) or Transport Layer Security (TLS) encryption for e-mail messaging. Use these encryption protocols to authenticate servers and clients and  encrypt messages between you and Prime NAM.

Preferences

describes the critical fields of the Preferences window.

Table C-59 System View and Logging Preferences

Field

Description

Refresh Interval (60-3600 sec)

Amount of time between refresh of information on dashboards. Default is 300.

Top N Entries (1-10)

Number of entries on the Top N charts. Default is 5. To view up to 100 entries, use the Table view versus the chart view.

Perform IP Host Name Resolution

Display hostnames instead of IP Addresses. This option performs translation using DNS lookup. Ensure you set your DNS nameserver parameters. See Setting Network Parameters.

Traffic Display Unit

Data displayed in graph and tables; Bits (default) or Bytes.

Response Time Display Unit

Default is automatic. Options include: microseconds, milliseconds, and seconds.

International Notation

Display options for numbering. May affect report accuracy; see the Cisco Bug Search tool for details.

Audit Trail

.

IP TOS Flow Key

Include type of service (TOS) data in the NAM network flow. Select only if you are measuring Differentiated Services Code Point (DSCP) for monitored traffic. If you require ART and other flow-based analysis and expect that the TOS information in your network may change in an on-going flow, do not select TOS information to be part of flow configuration.

Note If TOS byte changes in an on-going flow this results in a new flow being created. If this option is not selected, the entire flow transaction is treated as one flow regardless of a TOS change in this flow.

See Using NAM to Monitor QoS/DiffServ (DSCP).

New User Dialog Box

describes the critical fields in the New User dialog box.

Table C-60 New User Dialog Box

Field

Description

Usage Notes

Password
Verify Password

The account password

Enter a password that adheres to your site security policies.

Privileges

Privileges associated with this account

Select each privilege to grant to the user.

User Privileges

describes the critical fields in the User Privileges window.

Table C-61 User Privileges

Privilege

Access Level

AccountMgmt

Enables a user to create, delete, and edit user accounts.

SystemConfig

Enables a user to edit basic NAM system parameters such as IP address, gateway, HTTP port, and so on.

Capture

Enables a user to perform packet captures and manage capture sessions and use the NAM packet analyzer to decode packet data.

AlarmConfig

Enables a user to create, delete, and edit alarms on the switch/router and NAM.

MonitorConfig

Enables a user to create, delete, and edit the following:

Collections and reports

Protocol directory entries

Protocol groups

URL-based applications

MonitorView

Enables a user to view monitoring data and reports (granted to all users).

TACACs+ Authentication and Authorization

Table C-62 TACACS+ Authentication and Authorization Dialog Box

Field

Usage Notes

Enable TACACS+ Authentication and Authorization

Determines whether TACACS+ authentication and authorization is enabled.

To enable, check the check box.

To disable, uncheck the check box.

Primary TACACS+ Server

Enter the IP address of the primary server.

Backup TACACS+ Server

Enter the IP address of the backup server (optional).

Note If the primary server does not respond after 30 seconds, the backup server will be contacted.

Secret Key

Enter the TACACS+ secret key.

Verify Secret Key

Reenter the TACACS+ secret key.

Current User Sessions

describes the critical fields in the Current User Sessions window.

Table C-63 Current User Sessions

Field

Description

From

The name of the machine the user logged in from.

Last Activity

The time stamp of the last user activity.

Report Descriptions

lists the MIB objects supported by the NAM.

Table C-64 NAM RMON Support

Description

Source

MIB-II: All groups except Exterior Gateway Protocol (EGP) and transmission.

RFC 1213

RMON-MIB: Alarm and Event groups only

RFC 2819

RMON2: trapDestTable only

RFC 2021

CDP-MIB: Cisco Discovery Protocol

EntityMIB

RFC 2737

Troubleshooting Network and NAM Issues

This appendix addresses some common issues you might encounter while using Cisco Prime Network Analysis Module as well as how to use NAM to troubleshoot NAM network connection issues.

This appendix contains the following topics:

Resolving Typical NAM Issues

Troubleshooting Login Issues

Understanding Typical Error Messages

Troubleshooting WAAS Data Issues

Using the CLI to Troubleshoot Issues

Resolving Typical NAM Issues

on my dashboard reports. What should I do?

You may have created a filter that needs to be changed in order to see data. Use the Interactive Report Filter to do any or all of the following actions until your data displays:

– Change the site filters

– Change the application filter

– Incrementally expand the time range from the default to a greater time range

Review the following question for additional details if this does not resolve your issue.

Q. I am sending traffic to the NAM but nothing comes up on the default monitoring page. What could be wrong?

There are two typical issues that are seen when first setting up traffic to the NAM:

– Wait for at least five minutes after traffic is sent to the NAM. Prime NAM collects and displays information at intervals and traffic may not display in charts immediately.

– Ensure the client time is synchronized with the NAM time. Typically this means setting your NTP server to synchronize your NAM time. For details, see Synchronizing Your System Time.

Q. What information should I collect and what else should I do when the NAM is not responding?

Determine the answers to the following questions and gather the following information:

Does session from the switch/router CLI work?

Does ping over EOBC (127 subnet) work?

Does ping to the management IP address work?

Collect output of show tech-support command from both the NAM and the switch or router.

Collect core files.

Check if NAM hardware is seated correctly in chassis

Perform the following tasks to troubleshoot your issue:

Reset NAM

Reset into maintenance image or helper

Clear the configuration

Reinstall the application image (using the -- reformat option)

Q. What can I do to increase my Prime vNAM performance level?

on Cisco.com.

Q. How can I view NAM log files and send them to TAC for review?

. Save the files to your local disk. You can analyze the files locally or, if requested forward on to your technical support team for review.

Troubleshooting Login Issues

Log into the NAM by using the username and password that the NAM administrator provided you, and click the Login button. If you are having problems logging in:

Make sure you are using a browser that is currently supported for use with NAM:
English Firefox 3.6+ or Microsoft Internet Explorer 8+ (Microsoft Internet Explorer 7 is not supported)

Make sure you are using a platform that is currently supported for use with NAM:
Microsoft Windows XP or Microsoft Windows 7. The Macintosh platform is not supported on this release.

Make sure you have JavaScript enabled.

Clear the browser cache and restart the browser (not necessary if installing NAM for the first time).

Make sure cookies are enabled in your browser.

If you see the following message: “Initializing database. Please wait until initialization process finishes,” you must wait until the process finishes.

Make sure your username and password does not use any special characters.

If your platform requires licensing, make sure you accepted the license agreement and that the license has not expired.

If the Prime vNAM permanent license is installed and you log in for the first time and accept the EULA, you may be logged out so the permanent license can take effect. We recommend you wait several minutes before you attempt another logon.

To view the full documentation set (including the User Guide and Release Notes) for the Cisco Prime NAM software, go to the NAM software Technical Documentation area on Cisco.com:

http://www.cisco.com/en/US/products/sw/cscowork/ps5401/
tsd_products_support_series_home.html

Understanding Typical Error Messages

Q. I’m waiting for the graphical data to populate on a dashboard. What does this red error “Request Error -- Please Try Again” mean?

This means an internal error has occurred, or the login session may have timed out.

Q. I’m waiting for the graphical data to populate on a dashboard. What does this red error “Query resulted in no data” mean?

button to check the filter settings and data sources to make sure the NAM is getting data. You can also check the Overview page to ensure the traffic is reaching the NAM. If no traffic appears, check your data sources and SPAN session configuration.

Q. What does the message “Client or NAM time is incorrect” mean?

The browser or client time and the NAM time must be synchronized to avoid this error. See Synchronizing Your System Time.

Frequently Asked Questions about Prime NAM Behavior

Q. How does NAM calculate network latency?

To calculate network latency, the software looks at each packet and associates it to a transaction. For example, NAM looks at SYN and SYN-ACK and timestamps these packets to perform these calculations.

Q. How can Prime NAM be restricted to one tenant’s traffic when using SPAN or ERSPAN on a Nexus 1000V?

Prime NAM can be deployed per tenant so they each NAM has their own portal. NAM processes VxLAN, LISP, FabricPath, and OTV for multiple tenants.

Q. Why is the browser behaving strangely? It is displaying data for no apparent reason or is not displaying expected data.

).

Q. Why is the NAM performance lower than expected?

Disk capture will reduce the NAM performance considerably. It is due to the disk input/output speed. You will see a warning in the top right corner of the window.

Q. Why won’t the system change the storage option for my capture session from disk to memory and then back to disk?

state. You cannot delete the capture session to release the disk for capture. The workaround is to reboot the NAM. This has been fixed in the latest patch (patch 5) on the Cisco software download web page.

Q. What MIBs do the Prime NAM support?

lists the MIB objects supported by Prime NAM.

Table D-1 Supported MIBs

Description

Source

MIB-II: All groups except Exterior Gateway Protocol (EGP) and transmission.

RFC 1213

RMON2: trapDestTable only

RFC 2021

CDP-MIB: Cisco Discovery Protocol1

EntityMIB

RFC 2737

1.CDP is received on NAM management ports only. NAM does not transmit CDP packets.

1.CDP is received on NAM management ports only. NAM does not transmit CDP packets.

interface data?

NAM-NX1 gets this data by exchanging messaging with the Supervisor Engine on EOBC channel.  There is no MIB involved

Q. Which platforms require MIBs?

All NAM platforms except NAM-NX1 and NAM appliance platform require the Entity-mib, mib-2, if-mib, and… (don't remember) to get and configure SPAN sessions.  NAM-NX1 uses EOBC and proprietary messaging with SUP on EOBC to get and configure SPAN session.  Appliance NAM platforms have two options:  For the SNMP option, the requirements are the same as other NAM platforms.  With a NetConf interface, there is not any MIB involved.

Troubleshooting WAAS Data Issues

Q. Why does Prime NAM display the status of WAAS devices as pending?

Prime NAM is unable to monitor WAAS traffic until you set up WAAS monitored servers. To change the pending status, you must set up WAAS monitored servers. See your product documentation for more details.

Q. Why is no WAAS data seen in the Monitor windows?

Perform the following steps:

Use the NAM GUI to verify that the Monitored Servers list is configured with the correct server IP addresses.

Use the NAM GUI to verify that WAAS data sources have data collection enabled for applicable segments.

Use the WAAS CLI show statistics flow filters to verify that the servers have active traffic flows that are optimized and monitored.

Use the WAAS CLI show statistics flow mon tcpstat to verify that WAAS Flow Agent exports flow data to the correct NAM IP address.

Q. The WAAS is not sending data to the NAM, and the reports are not showing any values.

, and check the “Filter Response Time for all Data Sources by Monitored Servers” check box.

Using the CLI to Troubleshoot Issues

Locating Packet Drops

Handling an Unresponsive NAM

Using the CLI to Troubleshoot Performance Agent (PA)

Locating Packet Drops

Q. How can I find out using the CLI if packets are being dropped?

The following CLI command shows packet drops at different layers of the NAM system at 5 minute intervals and up to the last 24 hours:

root@NAM1x-18.cisco.com# show pkt-drop-counters Hour-0

Start time of the hour: 2010-11-05 13:00 PDT

Time hardware pkts dropped FM pkts dropped ART pkts dropped

13:05 3548 0 0

13:10 3354 0 0

13:15 2843 0 0

13:20 2629 0 0

13:25 3592 0 0

13:30 3298 0 0

13:35 1823 0 0

13:40 2549 0 0

00:00 0 0 0

00:00 0 0 0

00:00 0 0 0

00:00 0 0 0

Handling an Unresponsive NAM

Q. Why is my NAM Blade not responding?

Do the following:

Check the NAM IP configuration (using the CLI command show ip )

Check VLAN configuration of management port on Sup:

analysis module <slot> management-port access-vlan <#>

Does the session from the switch/router work?

Does a ping to NAM mgmt IP address work?

What is the module status on Sup/router?

show modules CLI

Using the CLI to Troubleshoot Performance Agent (PA)

Q. Why is the NAM not receiving data from PA?

Prime NAM no longer uses Performance Agent as a remote data source. Use Prime Infrastructure or Prime Assurance to collect PA data.

Cisco Prime Network Analysis Module User Guide

Release 6.1
July 2014

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco Prime Network Analysis Module User Guide
© 2005-2010 Cisco Systems, Inc. All rights reserved.