Summary of the content on the page No. 1
Cisco Network Analysis Module
(NAM) Traffic Analyzer User Guide, 5.0
January 2011
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
Text Part Number: OL-22617-01
Summary of the content on the page No. 2
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE IN
Summary of the content on the page No. 3
CONTENTS About This Guide xi CHAPTER 1 Overview 1-1 Introducing NAM Traffic Analyzer 5.0 1-1 Dashboards 1-2 Logical Site 1-2 New Application Classification Architecture 1-3 Standards-Based NBI 1-3 NetFlow v9 Data Export 1-4 Historical Analysis 1-4 SNMP v3 Support -- NAM to Router/Switch Support 1-5 Overview of the NAM Platforms 1-5 Logging In 1-6 Navigating the User Interface 1-6 Common Navigation and Control Elements 1-6 Menu Bar 1-6 D
Summary of the content on the page No. 4
Contents Cisco WAAS NAM Virtual Service Blade 1-20 CHAPTER 2 Setting Up The NAM Traffic Analyzer 2-1 Default Functions 2-1 Traffic Analysis 2-1 Application Response Time Metrics 2-2 Voice Signaling/RTP Stream Monitoring 2-2 Traffic Usage Statistics 2-3 Traffic 2-3 SPAN 2-3 About SPAN Sessions 2-3 Creating a SPAN Session 2-6 Editing a SPAN Session 2-8 Deleting a SPAN Session 2-9 Data Sources 2-9 SPAN 2-10 ERSPAN 2-10 VACL 2-17 Ne
Summary of the content on the page No. 5
Contents Setting RTP Stream Thresholds 2-45 Setting Voice Signaling Thresholds 2-46 Setting NDE Interface Thresholds 2-47 Editing an Alarm Threshold 2-48 Deleting a NAM Threshold 2-48 User Scenario 2-49 Data Export 2-49 NetFlow 2-49 Viewing Configured NetFlow Exports 2-50 Configuring NetFlow Data Export 2-51 Editing NetFlow Data Export 2-53 Scheduled Exports 2-53 Editing a Scheduled Export 2-54 Deleting a Scheduled Export 2-54 Custom Expor
Summary of the content on the page No. 6
Contents URL-based Applications 2-71 Example 2-72 Editing a URL-Based Application 2-73 Deleting a URL-based Application 2-73 Encapsulations 2-73 Monitoring 2-74 Aggregation Intervals 2-74 Response Time 2-76 Voice 2-76 RTP Filter 2-78 URL 2-78 Enabling a URL Collection 2-78 Changing a URL Collection 2-80 Disabling a URL Collection 2-80 WAAS Monitored Servers 2-80 Adding a WAAS Monitored Server 2-81 Deleting a WAAS Monitored Server
Summary of the content on the page No. 7
Contents Filtering a URL Collection List 3-14 Host Conversations 3-15 Network Conversation 3-15 Top Application Traffic 3-15 Application Traffic By Host 3-17 WAN Optimization 3-17 Top Talkers Detail 3-17 Application Performance Analysis 3-18 Transaction Time (Client Experience) 3-18 Traffic Volume and Compression Ratio 3-18 Average Concurrent Connections (Optimized vs. Passthru) 3-18 Multi-Segment Network Time (Client LAN - WAN - Server LAN) 3-18 C
Summary of the content on the page No. 8
Contents RTP Conversation 3-42 CHAPTER 4 Capturing and Decoding Packet Data 4-1 Sessions 4-2 Viewing Capture Sessions 4-3 Configuring Capture Sessions 4-4 Software Filters 4-7 Creating a Software Filter 4-8 Editing a Software Capture Filter 4-11 Hardware Assisted Filters 4-12 Configuring a Hardware Filter 4-12 Files 4-15 Analyzing Capture Files 4-17 Error Scan 4-17 Downloading Capture Files 4-18 Deleting a Capture File 4-19 Deleting Mul
Summary of the content on the page No. 9
Contents Capture Data Storage 5-8 Creating NFS Storage Locations 5-9 Editing NFS Storage Locations 5-10 Creating iSCSI Storage Locations 5-11 Editing iSCSI Storage Locations 5-11 Syslog Setting 5-12 SNMP Trap Setting 5-12 Creating a NAM Trap Destination 5-12 Editing a NAM Trap Destination 5-13 Deleting a NAM Trap Destination 5-13 Preferences 5-13 Diagnostics 5-14 System Alerts 5-14 Audit Trail 5-14 Tech Support 5-15 User Administration
Summary of the content on the page No. 10
Contents Understanding Traffic Patterns at the Network Layer 6-4 Understanding Traffic patterns for DiffServ-Enabled Networks 6-4 Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications 6-4 Using NAM to Evaluate Application-Level Performance Monitoring for UDP Realtime Applications 6-5 Using NAM to Evaluate Potential Impact of WAN Optimization Prior to Deployment 6-5 Troubleshooting 6-5 Using NAM for Problem Isolation 6-5 Usin
Summary of the content on the page No. 11
About This Guide This guide describes how to use Cisco Network Analysis Module Traffic Analyzer 5.0 (NAM 5.0) software. This preface has the following sections: • Chapter Overview, page xi � Audience, page xii � Conventions, page xii � Notices, page xii � Obtaining Documentation and Submitting a Service Request, page xiii For a list of the platforms that Cisco NAM 5.0 supports, see Overview of the NAM Platforms, page 1-5. Chapter Overview This guide contains the following chapters: � Ch
Summary of the content on the page No. 12
About This Guide Audience This guide is designed for network administrators who are responsible for setting up and configuring Network Analysis Modules (NAMs) to monitor traffic and diagnose emerging problems on network segments. As a network administrator, you should be familiar with: � Basic concepts and terminology used in internetworking. � Network topology and protocols. � Basic UNIX commands or basic Windows operations. Conventions This document uses the following conventions: Item Co
Summary of the content on the page No. 13
About This Guide Obtaining Documentation and Submitting a Service Request For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content
Summary of the content on the page No. 14
About This Guide User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0 xiv OL-22617-01
Summary of the content on the page No. 15
CH A P T E R 1 Overview This chapter provides information about the Cisco Network Analysis Module Traffic Analyzer, Release 5.0 and describes the new features and how to navigate the interface. This chapter contains the following sections: � Introducing NAM Traffic Analyzer 5.0, page 1-1 – Dashboards, page 1-2 – Logical Site, page 1-2 – New Application Classification Architecture, page 1-3 – Standards-Based NBI, page 1-3 – NetFlow v9 Data Export, page 1-4 – Historical Analysis, page 1-
Summary of the content on the page No. 16
Chapter 1 Overview Introducing NAM Traffic Analyzer 5.0 Cisco NAM includes an embedded, web-based Traffic Analyzer GUI that provides quick access to the configuration menus and presents easy-to-read performance monitoring and analysis on web, voice, and video traffic. Dashboards The Cisco NAM Traffic Analyzer, Release 5.0 introduces a redesigned interface and user experience, with more intuitive workflows and interactive reporting capabilities. The dashboard-style layouts show multip
Summary of the content on the page No. 17
Chapter 1 Overview Introducing NAM Traffic Analyzer 5.0 a set of subnets specified by an address prefix and mask, or using other criteria such as a remote device data source (for example, remote WAE device and segment information). If you want to limit the view of your network analysis data to a specific city, a specific building, or even a specific floor of a building, you can use the sites function. You can also include multiple types of data sources in the site definition, and you c
Summary of the content on the page No. 18
Chapter 1 Overview Introducing NAM Traffic Analyzer 5.0 With NAM 5.0, the NBI is expanded to include a Representational State Transfer (REST) web service for configuration, and retrieval of data pertaining to sites. Also introduced is the capability to export high-volume performance data in the form of Netflow v9 (see the next section, “NetFlow v9 Data Export”). Note REST does not support retrieval of performance data for sites. REST is a set of guidelines for doing web services over
Summary of the content on the page No. 19
Chapter 1 Overview Overview of the NAM Platforms SNMP v3 Support -- NAM to Router/Switch Support Simple Network Management Protocol Version 3 (SNMPv3) is an interoperable standards-based protocol for network management. The security features provided in SNMPv3 are: � Message integrity—Ensuring that a packet has not been tampered with in-transit. � Authentication—Determining the message is from a valid source. � Encryption—Scrambling the contents of a packet prevent it from being se
Summary of the content on the page No. 20
Chapter 1 Overview Logging In Logging In Log into the NAM by using the username and password that the NAM installer provided you, and click the Login button. If you are having problems logging in: � Make sure you are using a browser that is currently supported for use with NAM 5.0: English Firefox 3.6+ or Microsoft Internet Explorer 8+ (Microsoft Internet Explorer 7 is not supported) � Make sure you are using a platform that is currently supported for use with NAM 5.0: Microsoft W
