Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-12
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-12
NAM / Traffic Analyzer v3.5 Tutorial
NAM-1/2 Data Sources
Mini-RMON / SPAN / RSPAN
NAM-1/2 Data Sources
Mini-RMON / SPAN / RSPAN
RSPANned
port
C
i
s
c
o
C
a
t
a
l
y
s
t
S
w
i
t
c
h
Uplink
Supervisor Engine
Line Card
NAM
Line Card
Supervisor Engine
Cisco Catalyst 6500 Chassis
Data Bus
Spanned
Traffic
Spanned
Traffic
Mini_RMON traffic
collected by internal
NAM interface
Mini_RMON traffic
collected by internal
NAM interface
Use SPAN to copy
port, VLAN, or Ether
Channel traffic to the
NAM
Use SPAN to copy
port, VLAN, or Ether
Channel traffic to the
NAM
Traffic passes over
production links when
using RSPAN to
monitor traffic on a
remote switch.
Traffic passes over
production links when
using RSPAN to
monitor traffic on a
remote switch.
Note: The NAM-2, has two
monitor/destination ports
to support two
simultaneous
SPAN/RSPAN sessions
Note: The NAM-2, has two
monitor/destination ports
to support two
simultaneous
SPAN/RSPAN sessions
Spanned traffic sent to
NAM Data Port
Spanned traffic sent to
NAM Data Port
Mini RMON
E
O
B
C
NAM-1/2 Data Sources – Mini-RMON / SPAN / RSPAN
How is data sent to the NAM for collection and analysis? Well, as mentioned in the previous slide, the NAM
receives data from three internal interfaces. The first is an interface used to gather mini-RMON statistics from
each of the enabled ports on the host device. This allows the user to view basic layer two statistics for each
port and is used to decide if further analysis is necessary for any of the ports. If further analysis is deemed
necessary, the NAM analyzes actual traffic passed to it using the SPAN or VACL mechanism of the Catalyst
switch.
Spanning is the term used to define the configuration required to copy traffic from source port(s), VLANs, or
Cisco Ether Channel
®
tunnel to a destination switch port (SPAN port) for analysis. A SPAN session is an
association of a destination monitor port with one or more sources of traffic. Sources can be physical ports,
VLANs, or a Cisco Ether Channel tunnel. When the NAM is installed, the host switch recognizes it as a SPAN
destination. The user selects one or more ports, VLANs, or Ether Channels and the switch copies the traffic
from the selected sources to the NAM for analysis and reporting.
Note: the NAM-2 hardware includes two destinations to allow increased flexibility for network monitoring.
The ability to SPAN VLANs allows the user to achieve additional monitoring flexibility. Remote switches can
be configured to “export” data on a special user defined VLAN. The NAM can then span this “remote” VLAN,
effectively spanning data from a remote switch. This capability is known as RSPAN (Remote SPAN).
Note: RSPAN data traverses production links, this additional traffic may have an adverse performance impact
on your network. Please consider these implications before implementing remote monitoring using RSPAN.
Note: RSPAN and SPAN are mutually exclusive; if using RSPAN then you will lose the ability to SPAN data
to that port. Consider using a NAM-2 with its second data port to allow the NAM to do both SPAN and RSPAN
together.
For further information, refer to Chapter 5 for links to additional information on SPAN and RSPAN.