Specifications

3-8

Catalyst 6500 Series Switch and Cisco 7600 Series Router Network Analysis Module Installation and Configuration Note

78-16413-01

Chapter 3 Getting Started

Configuring Traffic Sources for Capturing NAM Traffic

If the NetFlow device supports NDE version 8 aggregations, flows from one or more of the version 8

aggregation caches may be exported to the NAM. To export flows from the aggregation caches, perform

these steps:

Step 1 Select an NDE version 8 aggregation.

Router(config)# ip flow-aggregation cache

aggregation-type

The supported aggregation types are as follows:

• Destination-prefix

• Source-prefix

• Protocol-port

• Prefix

Step 2 Enable the aggregation cache.

Router(config-flow-cache)# enable

Step 3 Export the flow entries in the aggregation cache to NAM UDP port 3000.

Router(config-flow-cache)# export destination

NAM-Address

3000

Step 4 Verify NDE.

Router# show ip cache flow-aggregation

aggregation-type

This example shows how to set up an NDE version 8 aggregation configuration:

Router(config)# ip flow-aggregation cache prefix

Router(config-flow-cache)# enable

Router(config-flow-cache)# export destination 172.20.104.74 3000

Router(config-flow-cache)# exit

Router(config)# show ip cache flow-aggregation prefix

Catalyst Operating System Software

You can capture traffic for NAM monitoring from a single VLAN or from multiple VLANs. If you want

to monitor traffic from specific VLANs only, you need to clear the VLANs that you do not want to

monitor from the capture feature.

Using SPAN as a Traffic Source

You can configure Remote SPAN (SPAN) as a traffic source using both the NAM Traffic Analyzer

application and the switch CLI. We recommend that you use NAM Traffic Analyzer.

For more information about SPAN and RSPAN, refer to the “Configuring SPAN and RSPAN” chapter in

the Catalyst 6500 Series Switch Software Configuration Guide.

You can use RSPAN traffic as a SPAN source for the NAM. Verify that the SPAN source is set to the

same VLAN ID that is used for RSPAN. The SPAN destination should be set to nam_module/port.