Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Scenarios 3-11
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Scenarios 3-11
NAM / Traffic Analyzer v3.5 Tutorial
Scenario 1
Configure Core Monitoring (ALLSPAN)
Scenario 1
Configure Core Monitoring (ALLSPAN)
PHY Port
(ALLSPAN)
PHY Port
(ALLSPAN)
SPAN source (1/2)
is a trunk port.
VLAN X
VLAN X
VLAN Y
VLAN Y
VLAN Z
VLAN Z
First the packet is counted here ...
…then the packet is counted again on the proper VLAN
data source for all enabled monitoring categories.
Enable
Collections
Enable
Collections
Setup > Monitor > Core Monitoring
Configure Core Monitoring
The Traffic Analyzer collects and reports data for two types of data sources. The first is an aggregated data
source which includes the ALLSPAN data source (and DATAPORT1/2 data source if using a NAM-2). The
ALLSPAN aggregation includes a counting of all packets mirrored to the data ports of the NAM by either
SPAN or VACL. The second data source type includes the individual VLANs, where every mirrored packet is
assigned to and counted in the VLAN that it participates in. In the case of a trunk port, ALLSPAN provides
statistics for all traffic traversing the port, regardless of its membership in a VLAN. It is important to
understand this because ALLSPAN can report confusing statistics when the NAM is configured for more than
one SPAN source. However, monitoring for either or both of these two data sources (ALLSPAN or VLAN)
must be configured before the NAM will collect or report data for these data sources. Note too that changing
a SPAN source does not change the data source that the NAM is configured to collect for. NetFlow Data
Export (NDE) data sources must also be enabled for collection to occur.
To begin monitoring activities, Dean chooses to enable monitoring on the ALLSPAN entity. This gives Dean
an overall view of VLAN traffic to see if he needs to drill down into any particular VLAN.
Step 1. Click Setup > Monitor > Core Monitoring. The Core Monitoring Functions dialog is displayed.
Step 2. The pull-down Data Sources list displays all VLANs known to this switch, as well as, an
ALLSPAN entry. Just because a VLAN is listed here does not mean that it has been observed
in the SPAN source. Turning on VLAN traffic statistics for ALLSPAN and then viewing VLAN
statistic will show which VLANs have been observed in the SPAN sources. If fact, that is what
Dean is about to do. Select ALLSPAN from the Data Sources pull-down menu.
Step 3. Enable desired monitoring functions (application, network host, network conversations, VLAN
statistics) and click Apply.
The NAM now begins collecting these statistics for all traffic on port Gi1/2 (SPAN source).
Note: Because Dean did not enable a specific VLAN for collection, the NAM is not yet collecting data based
on individual VLANs.