Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-157
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-157
NAM / Traffic Analyzer v3.5 Tutorial
Packet Capture and Decode
Capture Settings
Packet Capture and Decode
Capture Settings
Define how the NAM handles
new packets when the buffer is
full.
Define how the NAM handles
new packets when the buffer is
full.
Define how much NAM
memory will be allocated to
packet capture, or which disk
(local or remote) to store data
Define how much NAM
memory will be allocated to
packet capture, or which disk
(local or remote) to store data
Capture filtering options enable
you to filter out any unwanted
traffic by address and/or
protocol before it is stored in
NAM memory for analysis.
Capture filtering options enable
you to filter out any unwanted
traffic by address and/or
protocol before it is stored in
NAM memory for analysis.
Capture controls, capture must
be stopped to change settings.
Capture controls, capture must
be stopped to change settings.
Status of capture
Status of capture
Select data source
Select data source
Setup & use of remote
storage discussed later
Setup & use of remote
storage discussed later
Capture Settings
The first and most important configuration option for capturing data is your data source, which you do from
the Capture Packets from field in the Capture > Settings dialog.
Capture to Buffer- As with all protocol analyzers, there is an absolute limit to the number of packets that the
NAM can capture and store in memory, but it also has features to optimize the use of NAM resources while
maximizing the number of packets stored. Those features include:
Wrap when Full —This option enables you to define what action the NAM should take when the buffer
(RAM allocated for packet capture) is full: Should it lock the packet capture so that no packets get
overwritten? Or should it overwrite (wrap) the oldest packets when the buffer becomes full?
Buffer Size—Here you have the option to define how much of the NAM memory you want to allocate
to packet capture. Obviously, the more you choose here, the less you have for other NAM features and
other Capture Buffers. Maximum buffer sizes: NAM-1 125MB, NAM-2 300MB, and NM-NAM 70MB.
Capture to Disk -Use to capture packets to disk instead of memory. You can select either the local NAM
hard disk or any configured remote storage options. (Setup of the remote storage is discussed later in this
section.) You can also select the file size, the number of files, and whether or not to rotate the files if all of
them fill during capture or simply to end the capture.
Capture Filter—With this option, you can configure the NAM to ignore traffic before it is stored in memory.
This is a very useful option if you have already narrowed the search for the source of the problem and you
want to hone in on a specific subset of traffic. You can filter by protocol and/or by MAC or IP address for both
source and destination addresses and add a mask to define which part of the address to include and which
part to ignore. You can also define how you want the NAM to apply the filter—to include all packets that
match the filter (inclusive) or exclude all packets that match the filter (exclusive).
Note(s):
• To change the capture settings you must first clear the capture buffer.
• You can use address and protocol filters together, but not port and custom filters.