Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-77
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-77
NAM / Traffic Analyzer v3.5 Tutorial
Basic NM-NAM Configuration
Overview of Steps
Basic NM-NAM Configuration
Overview of Steps
Step 1
• Configure CEF using Router CLI to forward
interface packets to the NM-NAM internal
interface
• Connect NM-NAM external interface to a Fast-
Ethernet source
Internal
Internal
CEF Se0/0, Se0/1
External
External
Internal
Internal
External
External
FE Data Segment
All traffic seen by Se0/0 and
Se0/1
All traffic seen by connected
FE segment
Router (config)# ip cef
Router (config)# interface type slot|wic-slot|port
Router (config-if)# analysis-module monitoring
Step 2
• Turn on types of monitoring (Application,
host, conversation, …) for data streams
- Internal
- External
- ALL NDE Traffic from device
- Subset of NDE traffic from a device
Repeat steps 2 and 3 for each interface to monitor
No subsets of traffic other than NDE
No subsets of traffic other than NDE
See earlier slides for
NetFlow setup
See earlier slides for
NetFlow setup
Basic NM-NAM Configuration Process
Like the NAM-1/2, the configuration of monitoring for the NM-NAM is also a two step process. First data must be
sent to the NM-NAM for analysis, and secondly, various monitoring options must be enabled for each monitoring
interface on the NM-NAM for analysis. Unlike the NAM-1/2, the NM-NAM does not break down the received
traffic into subsets. Each NM-NAM interface simply analyzes the stream on it regardless of what it represents.
The exception to this is the NDE traffic will actually be reported on as a separate data stream.
Data can be sent to the NM-NAM by:
• Using CEF to copy packets from a router interface to the internal NM-NAM interface
• Connecting the External NM-NAM interface to a FE source (HUB or SPAN port)
At this point the data is being sent to the NAM but not yet being analyzed. The second step is to turn on various
monitoring options for the Internal and External interfaces, as well as the NDE default data stream – Monitors all
NetFlow traffic sent by a single NetFlow device, and any NDE Custom data stream – Monitors a subset of
NetFlow traffic from a single device.
Note: NDE traffic is sent to the NM-NAM interface configured as the Management port.
Earlier we discussed using NetFlow as a data source. NetFlow is also an applicable data source on the NM-
NAM.