Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-13
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-13
NAM / Traffic Analyzer v3.5 Tutorial
NAM-1/2 Data Sources
ERSPAN
NAM-1/2 Data Sources
ERSPAN
RSPANned
port
Supervisor Engine
Line Card
NAM
Cisco Catalyst 6500 Chassis
NDE
ERSPAN
Packets
ERSPAN
Packets
ERSPAN traffic
collected by NAM
Management port
ERSPAN traffic
collected by NAM
Management port
ERSPAN’d packets are
encapsulated in GRE header
and directed to
IP address of ERSPAN
destination
ERSPAN’d packets are
encapsulated in GRE header
and directed to
IP address of ERSPAN
destination
Use ERSPAN to
troubleshoot problems at
remote sites without
having to send personnel
to the site or hauling
around a portable analyzer
Use ERSPAN to
troubleshoot problems at
remote sites without
having to send personnel
to the site or hauling
around a portable analyzer
NAM Data Sources – ERSPAN
As discussed earlier, a user often has a need to analyze traffic flows captured by SPAN on a box different
from where they are captured. Switches that support Remote SPAN (RSPAN) allow the user to capture the
monitored traffic and transmit it to a remote switch that has an embedded NAM, using a RSPAN VLAN.
However, RSPAN analyzes traffic only on the same L2 domain from where it is sourced. Also, the L2 domain
is confined to Cisco switches due to special properties of the RSPAN VLAN that are supported by Cisco
switches only.
ERSPAN (encapsulated SPAN) provides a solution to the limitations just described. The ERSPAN feature
allows the user to capture traffic and encapsulate it in a GRE/IP packet. This encapsulated packet can then
be sent through any L3 network as a GRE tunneled packet.
ERSPAN increases the NAM's deployment flexibility, enabling it to monitor traffic from remote parts of the
network. The NAM can receive ERSPAN traffic through the internal management port (same used by
NetFlow traffic). Alternatively, the ERSPAN traffic can be directed to the switch, and then the receiving port
can be SPANned to the NAM for analysis.
ERSPAN traffic sent directly to the NAM is treated as a separate data source independent of the SPANned
traffic. ERSPAN is supported on Sup720 with IOS 12.2(18)SXE or later and PFC3B.
Note:
• Sending excessive ERSPAN traffic directly to NAM will slow GUI response time.