Filter
Top Products
1-13
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 1 Overview
Understanding How the NAM Works
• Advanced Troubleshooting. The NAM provides robust capture and decode capabilities for packet
traces that can be triggered or terminated based on user-defined thresholds.
• Open instrumentation. The NAM is a mediation and instrumentation product offering, and hence
provides a robust API that can be used by partner products as well as customers that have home
grown applications. See the Cisco NAM 5.0 API Programmer’s Guide.
The NAM delivers the above functionality by analyzing a wide variety of data sources that include:
• Port mirroring technology like SPAN and RSPAN/ERSPAN. The NAM can analyze Ethernet VLAN
traffic from the following sources: Ethernet, Fast Ethernet, Gigabit Ethernet, trunk port, or Fast
EtherChannel SPAN, RSPAN, or ERSPAN source port
• VAC L
• NetFlow Data Export (NDE). The NAM can analyze NetFlow Data Export (NDE) from Managed
Devices (Routers/Switches)
• WAAS
• SNMP
• Network Tap Device. Applies to Cisco NAM 2200 Series appliances only.
The NAM Traffic Analyzer 5.0 retains the ability to use SNMP as a southbound interface for
configuration and data retrieval from switches and routers. NAM 5.0 moves away from RMON and
toward web services and Netflow Data Export as the northbound interface for data objects. NAM 5.0 will
continue to support baseline manageability features of SNMP such as MIB-2 and IF-TABLE, and the
health status and interface statistics that can be used by external products like Fault and Configuration
Management offerings (for example, CiscoWorks LMS).
For more information about SPAN, RSPAN, and ERSPAN, see the "Configuring Local SPAN, RSPAN,
and ERSPAN" chapter in the Catalyst 6500 Series Switch Software Configuration Guide.
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/
configuration/guide/span.html
For more general information about NDE, see this section in the Cisco 7600 Series Cisco IOS Software
Configuration Guide, 12.2SX.
http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SXF/
configuration/guide/nde.html
Table 1-1 summarizes the traffic sources that are used for NAM monitoring.
The next sections describe how the NAM uses the supported data sources:
• Understanding How the NAM Uses SPAN, page 1-14
• Understanding How the NAM Uses VACLs, page 1-14
Ta ble 1-1 Summary of Traffic Sources for NAM Monitoring
Traffic Source LAN WAN
Ports VLANs Ports VLANs
VACL capture Yes Yes Yes N/A
NetFlow Data Export NDE (local) Yes Yes Yes Yes
NetFlow Data Export NDE (remote) Yes Yes Yes Yes
SPAN Yes Yes No No
ERSPAN Yes Yes No No