Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-15
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-15
NAM / Traffic Analyzer v3.5 Tutorial
NAM-1/2 Data Sources
NetFlow
NAM-1/2 Data Sources
NetFlow
RSPANned
port
N
e
t
F
l
o
w
E
n
a
b
l
e
d
D
e
v
i
c
e
Supervisor Engine
Line Card
NAM
NDE traffic from
local host device
can be copied to
the NAM
NDE traffic from
local host device
can be copied to
the NAM
NDE traffic for enabled
interfaces on remote
NetFlow enabled
devices passes over
production links to the
NAM on UDP port
3000.
NDE traffic for enabled
interfaces on remote
NetFlow enabled
devices passes over
production links to the
NAM on UDP port
3000.
Cisco Catalyst 6500 Chassis
NDE
NDE
Packets
NDE
Packets
NetFlow Data Export
(NDE) traffic collected
by a single internal
NAM interface
NetFlow Data Export
(NDE) traffic collected
by a single internal
NAM interface
E
O
B
C
NetFlow supports monitoring
of Applications, Hosts,
Conversations, and DiffServ
NetFlow supports monitoring
of Applications, Hosts,
Conversations, and DiffServ
NAM Data Sources – NetFlow
Besides the NAM’s internal interfaces for SPAN/VACL and mini-RMON, there is also one for NetFlow Data
Export (NDE) packets arriving to the NAM via UDP port 3000 (management port –shared by NDE, ERSPAN,
and management traffic). NDE packets contain information on one or more packet flows for one or more
interfaces on a local or remote router that can be parsed and added to the RMON MIB and reported on by
the NAM Traffic Analysis software. NetFlow allows for the monitoring of applications, hosts, conversations,
and DiffServ (remote). Detailed monitoring for voice, VLAN, ART, DiffServ (local) and packet captures and
decodes are not available on NetFlow (NDE) data sources.
The flows are configured on the remote device, possibly by interface, and exported to the NAM via UDP port
3000. The flows represent data coming in one interface on the remote device and exiting out another. If NDE
is enabled on the host switch, all traffic that is layer 3 switched on the PFC and all traffic that is NetFlow
switched on the MSFC are automatically forwarded to the NAM for potential monitoring.
For further information on NetFlow and it’s configuration, refer to the NAM User Guide and chapter 5 for links
to references on NetFlow.
In general, it is extremely important to manage the data sources supplying data to the NAM. The user must
understand how the NAM and it’s data sources are configured in order to help interpret the various NAM
reports. Later in this chapter we will look at how to select and configure these data sources for monitoring by
the NAM.