×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

NAM and NTP

Unanswered Question
Jul 5th, 2006
User Badges:

I have a NAM blade in my 6513. I would like the packet captures to be time stamped with NTP time. I configured the NAM to pull time from the switch which uses NTP. There doesn't seem to be a way to get the packets stamped with the NTP time.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ariela Wed, 07/05/2006 - 14:07
User Badges:
  • Silver, 250 points or more

Hi Bruce,


please post the conf (NTP portion) of your switch, and your 6513.


Regards

Andrea

Richard Burts Wed, 07/05/2006 - 17:16
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

I am not sure whether Bruce's problem is that the NAM blade is not learning NTP or whether the problem is that the NAM blade is learning NTP but the contents of packet captures are not using the NTP time. Perhaps Bruce can clarify.


HTH


Rick

bruce.porter@lm... Thu, 07/06/2006 - 08:31
User Badges:

Thanks for replies. I have set the time for:


Current NAM System Time: Thu 06 Jul 2006, 09:09:35 PDT

Synchronize NAM System Time With: X Switch


The above shows that time is accurate, the switch gets it's time from NTP and the NAM gets it's time from the switch. The problem is that captures are not time stamped with the NTP absolute times.


Times in the capture decodes start with 0.000, as a reference, and count up from there, not absolute times. Is there a way to make them true NTP times?


I also tried setting the NAM's time source to NTP, using the gateway address for the NTP source. That produced the same results.


There appears to be no real NTP time stamping capability, something that the Fluke Optiview Series II Gigabit sniffer won't do either, even from it's XP OS level.


Thanks again. It appears that I may need to find a better method of using relative times or investigate other types of sniffers to run my tests, the sources of which are done in NTP times but not ethernet.

Actions

This Discussion