Cisco Systems 5 Users Manual Nam50_ug

2015-01-05

• Cisco Network Analysis Module (NAM) Traffic Analyzer User Guide, 5.0
• Contents
  • About This Guide
  • Chapter Overview
  • Audience
  • Conventions
  • Notices
  • Obtaining Documentation and Submitting a Service Request
• Overview
  • Introducing NAM Traffic Analyzer 5.0
    • Dashboards
    • Logical Site
    • New Application Classification Architecture
    • Standards-Based NBI
    • NetFlow v9 Data Export
    • Historical Analysis
    • SNMP v3 Support -- NAM to Router/Switch Support
  • Overview of the NAM Platforms
  • Logging In
  • Navigating the User Interface
    • Common Navigation and Control Elements
      • Menu Bar
      • Detailed Views
      • Context Menus
      • Quick Capture
      • Interactive Report
      • Chart View / Grid View
      • Mouse-Over for Details
      • Zoom/Pan Charts
      • Sort Grid
      • Bytes / Packets
      • Statistics
      • Context-Sensitive Online Help
  • Understanding How the NAM Works
    • Understanding How the NAM Uses SPAN
    • Understanding How the NAM Uses VACLs
    • Understanding How the NAM Uses NDE
    • Understanding How the NAM Uses WAAS
  • Configuration Overview
    • Configuring and Viewing Data
    • Cisco WAAS NAM Virtual Service Blade
• Setting Up The NAM Traffic Analyzer
  • Default Functions
    • Traffic Analysis
    • Application Response Time Metrics
    • Voice Signaling/RTP Stream Monitoring
    • Traffic Usage Statistics
  • Traffic
    • SPAN
      • About SPAN Sessions
      • Creating a SPAN Session
      • Editing a SPAN Session
      • Deleting a SPAN Session
    • Data Sources
      • SPAN
      • ERSPAN
        • Enabling Auto-Creation of ERSPAN Data Sources Using the Web GUI
        • Enabling Auto-Creation of ERSPAN Data Sources Using the CLI
        • Disabling Auto-Creation of ERSPAN Data Sources Using the Web GUI
        • Disabling Auto-Creation of ERSPAN Data Sources Using the CLI
        • Creating ERSPAN Data Sources Using the Web GUI
        • Creating ERSPAN Data Sources Using the CLI
        • Deleting ERSPAN Data Sources Using the Web GUI
        • Deleting ERSPAN Data Sources Using the CLI
        • Configuring ERSPAN on Devices
      • VACL
        • Configuring VACL on a WAN Interface
        • Configuring VACL on a LAN VLAN
      • NetFlow
        • Understanding NetFlow Interfaces
        • Understanding NetFlow Flow Records
        • Managing NetFlow Data Sources
        • Configuring NetFlow on Devices
        • Enabling Auto-Creation of NetFlow Data Sources Using the Web GUI
        • Enabling Auto-Creation of NetFlow Data Sources Using the CLI
        • Disabling Auto-Creation of NetFlow Data Sources Using the Web GUI
        • Disabling Auto-Creation of NetFlow Data Sources Using the CLI
        • Creating NetFlow Data Sources Using the Web GUI
        • Creating NetFlow Data Sources Using the CLI
        • Deleting NetFlow Data Sources Using the Web GUI
        • Deleting NetFlow Data Sources Using the CLI
        • Testing NetFlow Devices
    • WAAS
      • Understanding WAAS
      • Response Time Monitoring from WAAS Data Sources
        • Monitoring Client Data Sources
        • Monitoring WAN Data Sources
        • Monitoring Server Data Sources
        • Deployment Scenarios
      • Managing WAAS Devices
      • Adding Data Sources for New WAAS Device
      • Editing WAAS Data Sources
      • Deleting a WAAS Data Source
      • Auto Create of New WAAS Devices
    • Hardware Deduplication
  • Alarms
    • Alarm Actions
      • Alarm Action Configuration
      • Editing Alarm Actions
      • Deleting Alarm Actions
    • Thresholds
      • Setting Host Thresholds
      • Setting Conversation Thresholds
      • Setting Application Thresholds
      • Setting Response Time Thresholds
      • Setting DSCP Thresholds
      • Setting RTP Stream Thresholds
      • Setting Voice Signaling Thresholds
      • Setting NDE Interface Thresholds
      • Editing an Alarm Threshold
      • Deleting a NAM Threshold
    • User Scenario
  • Data Export
    • NetFlow
      • Viewing Configured NetFlow Exports
      • Configuring NetFlow Data Export
      • Editing NetFlow Data Export
    • Scheduled Exports
      • Editing a Scheduled Export
      • Deleting a Scheduled Export
    • Custom Export
  • Managed Device
    • Device Information
    • NBAR Protocol Discovery
  • Network
    • Sites
      • Definition Rules
        • Specifying a Site Using Subnets
        • Specifying a Site Using WAE devices (WAAS Data Sources)
        • Specifying a Site Using Multiple Rules
        • Resolving Ambiguity (Overlapping Site Definitions)
      • Viewing Defined Sites
      • Defining a Site
        • Subnet Detection
      • Editing a Site
    • NDE Interface Capacity
      • Creating an NDE Interface
    • DSCP Groups
      • Creating a DSCP Group
      • Editing a DSCP Group
      • Deleting a DSCP Group
  • Classification
    • Applications
      • Creating a New Application
      • Editing an Application
      • Deleting a Protocol
    • Application Groups
      • Creating an Application Group
      • Editing an Application Group
      • Deleting an Application Group
    • URL-based Applications
      • Example
      • Editing a URL-Based Application
      • Deleting a URL-based Application
    • Encapsulations
  • Monitoring
    • Aggregation Intervals
    • Response Time
    • Voice
    • RTP Filter
    • URL
      • Enabling a URL Collection
      • Changing a URL Collection
      • Disabling a URL Collection
    • WAAS Monitored Servers
      • Adding a WAAS Monitored Server
      • Deleting a WAAS Monitored Server
• Monitoring and Analysis
  • Navigation
    • Context Menus
    • Interactive Report
      • Saving Filter Parameters
  • Traffic Summary
  • Response Time Summary
  • Site Summary
  • Alarm Summary
  • Analyzing Traffic
    • Application
      • Hosts Detail
    • Host
      • Applications Detail
    • NDE Interface Traffic Analysis
      • Viewing Interface Details
      • DSCP Detail
    • DSCP
      • Application Groups Detail
    • URL Hits
      • Viewing Collected URLs
      • Filtering a URL Collection List
    • Host Conversations
    • Network Conversation
    • Top Application Traffic
    • Application Traffic By Host
  • WAN Optimization
    • Top Talkers Detail
    • Application Performance Analysis
      • Transaction Time (Client Experience)
      • Traffic Volume and Compression Ratio
      • Average Concurrent Connections (Optimized vs. Passthru)
      • Multi-Segment Network Time (Client LAN - WAN - Server LAN)
    • Conversation Multi-Segments
  • Response Time
    • Application Response Time
    • Network Response Time
    • Server Response Time
    • Client Response Time
    • Client-Server Response Time
    • Server Application Responses
    • Server Application Transactions
    • Server Network Responses
    • Client-Server Application Responses
    • Client-Server Application Transactions
    • Client-Server Network Responses
  • Managed Device
    • Interface
      • Interfaces Stats Table
      • Interface Statistics Over Time
    • Health
      • Switch Health
        • Chassis Health
        • Chassis Information
        • Crossbar Switching Fabric
        • Ternary Content Addressable Memory Information
      • Router Health
        • Router Health
        • Router Information
    • NBAR
  • Media
    • RTP Streams
      • Purpose
      • Monitoring RTP Streams
    • Voice Call Statistics
    • Calls Table
    • RTP Conversation
      • 4
        • Capturing and Decoding Packet Data
      • Quick Capture
        • Figure 4-1 Quick Capture
    • Sessions
      • Figure 4-2 NAM Capture Sessions
      • Viewing Capture Sessions
        • Table 4-1 Capture Session Fields (continued)
        • Table 4-2 Buttons in the Capture Session Operations Window
      • Configuring Capture Sessions
        • Step 1 Choose Capture > Packet/Capture Decode > Sessions.
        • Step 2 Click the Create button to set up a new capture. The NAM Traffic Analyzer displays the Configure Capture Session window (...
        • Figure 4-3 Configure Capture Session Window
          • Step 3 Enter information in the Capture Settings Fields (Table 4-3) as appropriate.
            • Table 4-3 Capture Settings Fields (continued)
              • Table 4-4 Maximum Capture Session Sizes for NAM Platforms (continued)
          • Step 4 Click the Submit button to finish configuration for this session, or configure Software Filters for this session (see the next section, Software Filters, page 4-7).
      • Software Filters
        • Creating a Software Filter
          • Step 1 Choose Capture > Packet Capture/Decode > Sessions.
          • Step 2 The bottom half of the screen displays any configured Software Filters. Click the Create button at the bottom of the Software Filters area to create a new software filter.
            • Figure 4-4 Software Filter Dialog
          • Step 3 Enter information in each of the fields as appropriate. See Table 4-5 for descriptions of the fields.
            • Table 4-5 Software Filter Dialog Box (continued)
          • Step 4 Click the Submit button to create the filter, or click Cancel to close the dialog box without creating a software filter.
        • Editing a Software Capture Filter
          • Step 1 Choose Capture > Packet Capture/Decode > Sessions.
          • Step 2 Choose the filter to edit, then click Edit.
          • Step 3 Enter information in each of the fields as appropriate.
          • Step 4 Do one of the following:
      • Hardware Assisted Filters
        • Configuring a Hardware Filter
          • Step 1 Choose Capture > Packet Capture/Decode > Sessions.
          • Step 2 At the bottom of the screen, in the Hardware Filters section, click the Create button.
          • Step 3 Enter a name in the Name field.
          • Step 4 Choose one of the following types of filters from the Type drop-down list:
            • Figure 4-5 Hardware Filter Type
          • Step 5 Data fields will then appear that correspond with the type of hardware filter you selected. Fill in the desired fields. See the following sections for more specific information.
          • Step 6 Click Submit to complete the configuration of the capture session. Otherwise, click Reset to revert to the previous settings, or click Cancel to abort.
          • VLAN
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose VLAN.
            • Step 3 Choose either the Range or Individuals radio button. For Range, enter a range of VLANs. For Individuals, enter up to four individual VLANs.
            • Step 4 Click the Submit button.
          • VLAN and IP
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose VLAN and IP.
            • Step 3 Enter the ID of the desired VLAN. The VLAN ID can range from 1-4095.
            • Step 4 Enter a Source Address / Mask (optional).
            • Step 5 Enter a Destination Address / Mask (optional).
            • Step 6 Choose a Layer 4 Protocol (optional).
            • Step 7 Click Submit.
          • IP
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose IP.
            • Step 3 Enter a Source Address / Mask (optional).
            • Step 4 Enter a Destination Address / Mask (optional).
            • Step 5 Choose a Layer 4 IP Protocol (optional)
            • Step 6 Click Submit.
          • IP and TCP/UDP
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose IP and TCP/UDP
            • Step 3 Enter a Source Address / Mask (optional).
            • Step 4 Enter a Destination Address / Mask (optional).
            • Step 5 Choose an IP Protocol, either TCP or UDP.
            • Step 6 Enter a TCP/UDP Source Port (optional).
            • Step 7 Enter a TCP/UDP Destination Port (optional).
            • Step 8 Click Submit.
          • IP and Payload Data
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose IP and Payload Data.
            • Step 3 Enter a Source Address / Mask (optional).
            • Step 4 Enter a Destination Address / Mask (optional).
            • Step 5 Choose an IP Protocol, either TCP or UDP.
            • Step 6 Enter the values for Payload Data:
            • Step 7 Repeat Step 6 for up to four payload data segments.
            • Step 8 Click Submit.
          • Payload Data
            • Step 1 Enter a Filter Name.
            • Step 2 From the Type drop-down menu, choose Payload Data.
            • Step 3 Choose an IP Protocol, either TCP or UDP.
            • Step 4 Enter the values for Payload Data:
            • Step 5 Repeat Step 4 for up to four payload data segments.
            • Step 6 Click Submit.
    • Files
      • Table 4-6 Buttons in the Capture Files Operations Window
      • Analyzing Capture Files
        • Table 4-7 Capture Analysis Window Fields
        • Error Scan
          • Figure 4-6 Error Scan Screen
            • Table 4-8 Error Scan Screen Descriptions
      • Downloading Capture Files
        • Step 1 Choose Capture > Packet Capture/Decode > Files.
        • Step 2 Choose a capture file from the list of captures.
        • Step 3 Click Download.
          • Figure 4-7 Download Capture File Dialog Box
        • Step 4 Click Save.
      • Deleting a Capture File
        • Step 1 Choose Capture > Packet Capture/Decode > Files.
        • Step 2 Choose a capture file from the list of captures.
        • Step 3 Click Delete.
        • Step 4 Click OK to delete the file or Cancel to allow the file to remain.
      • Deleting Multiple Files
        • Step 1 Choose Capture > Packet Capture/Decode > Files.
        • Step 2 Highlight a row in the list of captures, and then hold down the Shift key and select another row. All rows inbetween will also be selected.
        • Step 3 Click the Delete button.
        • Step 4 Click OK to delete all the files or Cancel to allow them to remain.
    • Viewing Packet Decode Information
      • Step 1 Choose Capture > Packet Capture/Decode > Sessions, or Capture > Packet Capture/Decode > Files (depending on which type you would like to decode).
      • Step 2 Choose a capture session or file, and then click the Decode button. The Packet Decoder window displays.
        • Table 4-9 Packet Decoder Operations
        • Table 4-10 Packet Browser
      • Browsing Packets in the Packet Decoder
      • Filtering Packets Displayed in the Packet Decoder
        • Step 1 From the Packet Decoder window, click the Display Filter button. The Packet Decoder - Display Filter Window displays.
        • Step 2 Do the following:
        • Step 3 Click OK to apply the filter and close the window.
      • Viewing Detailed Protocol Decode Information
        • Step 1 Highlight the packet number about which you want more information.
        • Step 2 To review the information, use the scrolling bar in the lower panes.
      • Using Alarm-Triggered Captures
        • Step 1 Create an alarm event from the Setup > Alarms > Alarm Events window.
        • Step 2 Set a threshold for the event from the Setup > Alarms > Alarm Thresholds window.
        • Step 3 Set up a capture session from the Capture > Packet Capture/Decode > Sessions window. Click Create.
      • Custom Display Filters
        • Creating Custom Display Filters
          • Step 1 Choose Capture > Packet Capture/Decode > Sessions.
          • Step 2 Click Create.
          • Step 3 Enter information in each of the fields as appropriate.
            • Table 4-11 Custom Decode Filter Dialog Box (continued)
          • Step 4 Do one of the following:
          • Tips for Creating Custom Decode Filter Expressions
            • Table 4-12 Logical and Comparison Operators
            • Examples of Custom Decode Filter Expressions
        • Editing Custom Display Filters
          • Step 1 Choose Capture > Packet Capture/Decode > Display Filters.
          • Step 2 Choose the filter to edit, then click Edit.
          • Step 3 Change the information in each of the fields as appropriate.
          • Step 4 Do one of the following:
        • Deleting Custom Display Filters
          • Step 1 Choose Capture > Packet Capture/Decode > Display Filters.
          • Step 2 Choose the filter to delete, then click Delete.
          • Step 3 In the confirmation dialog box, do one of the following:
• User and System Administration
  • System Administration
    • Resources
    • Network Parameters
    • SNMP Agent
    • Working with NAM Community Strings
      • Creating NAM Community Strings
      • Deleting NAM Community Strings
      • Testing the Router Community Strings
    • System Time
    • Synchronizing the NAM System Time with the Switch or Router
    • Synchronizing the NAM System Time Locally
    • Configuring the NAM System Time with an NTP Server
    • E-Mail Setting
    • Web Data Publication
    • Capture Data Storage
    • Creating NFS Storage Locations
      • Configuring the NFS Server
      • Configuring the NFS Storage Location on the NAM
    • Editing NFS Storage Locations
    • Creating iSCSI Storage Locations
    • Editing iSCSI Storage Locations
    • Syslog Setting
    • SNMP Trap Setting
    • Creating a NAM Trap Destination
    • Editing a NAM Trap Destination
    • Deleting a NAM Trap Destination
    • Preferences
  • Diagnostics
    • System Alerts
    • Audit Trail
    • Tech Support
  • User Administration
    • Local Database
    • Recovering Passwords
    • Changing Predefined NAM User Accounts on the Switch or Router
    • Creating a New User
    • Editing a User
    • Deleting a User
    • Establishing TACACS+ Authentication and Authorization
    • Configuring a TACACS+ Server to Support NAM Authentication and Authorization
    • Configuring a Cisco ACS TACACS+ Server
      • Adding a NAM User or User Group
      • Configuring a Generic TACACS+ Server
    • Current User Sessions
• NAM Traffic Analyzer 5.0 Usage Scenarios
  • Deployment
    • Deploying NAMs in the Branch
    • Deploying NAMs for Voice/Video applications
    • Deploying NAMs for WAN Optimization
    • Deploying Multi-NAM Consolidation
    • Autodiscovery Capabilities of NAM
    • Creating Custom Applications
    • Utilizing Sites to Create a Geographically Familiar Deployment
    • Integrating NAM with Third Party Reporting Tools
    • Integrating NAM with LMS
  • Monitoring
    • Understanding Traffic Patterns at the Network Layer
    • Understanding Traffic patterns for DiffServ-Enabled Networks
    • Using NAM to Evaluate Application-Level Performance Monitoring for TCP-Interactive Applications
    • Using NAM to Evaluate Application-Level Performance Monitoring for UDP Realtime Applications
    • Using NAM to Evaluate Potential Impact of WAN Optimization Prior to Deployment
  • Troubleshooting
    • Using NAM for Problem Isolation
    • Using NAM for SmartGrid Visibility
• Troubleshooting
  • General NAM Issues
  • Error Messages
  • Packet Drops
  • NAM Not Responding
  • NAM Behavior
  • WAAS Troubleshooting
• Supported MIB Objects
  • Supported MIBs
• Index