Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

How capture traffic in NAM 2220

Hello everyone.

Thanks for read me again. I'm in a big big problem here last week I openned a Disccussion about how configure my NAM 2220. Right now I have network connectivity but I don't know what comes next. I never "touch" before a NAM or any analyzer so I kind of loss. If someone can help me with this would be great.

Thanks you so much.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

How capture traffic in NAM 2220

Hi Daniel,

1. yes these  2 are your destination ports where you can capture the traffic

2. ASAIK , it is not nessacary to have 10 GE ethernet port on neighbor port

3.Yes ,SPAN configuration need to be done on the switch , which can done from GUI of the NAM too as well.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_software/5-1/user/guide/nam51_ug/setup.html#wp1087884

https://supportforums.cisco.com/docs/DOC-32763

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****
Cisco Employee

How capture traffic in NAM 2220

that does not matter, while configuring SPAN you can give any interfcae or interfaces as source but you destination port should be ONE of the NAM Monitoring port.

****the destination port has to be configured as a monitor port and not as an access port.

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****
17 REPLIES
Cisco Employee

Re: How capture traffic in NAM 2220

Hi Daniel,

After the Intial setup of NAM ,  you need to configure :

SPAN / RSPAN /VACL-based captures, NetFlow (versions 1, 5, 6, 7, 8, and 9) to capture the traffic.

How to create SPAN:

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/5-0/2220/instcfg2220/config.html#wp1079309

after configuring the above , you can monitor the traffic via GUI , check the below link for that :

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_software/5-1_2/user/guide/NAM_UG512/monitr_analysis.html

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

How capture traffic in NAM 2220

Dear AFROJ

Thank so much for your replay but I have some question I guess easy for you, but very difficult for me.

1.- My NAM 2220 has 2 ports 10 GE XFP, only in this ports can I capture the traffic?

2.- My neighbor Switch need to has 10 GE Ethernet too?

3.- For create a SPAN can I do this in my Switch? Or I need to configure this in my NAM.

I really appreciate your help, because my job depends of this.

I hope don't bother you If I we continue in "touch"

Cisco Employee

How capture traffic in NAM 2220

Hi Daniel,

1. yes these  2 are your destination ports where you can capture the traffic

2. ASAIK , it is not nessacary to have 10 GE ethernet port on neighbor port

3.Yes ,SPAN configuration need to be done on the switch , which can done from GUI of the NAM too as well.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_software/5-1/user/guide/nam51_ug/setup.html#wp1087884

https://supportforums.cisco.com/docs/DOC-32763

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

How capture traffic in NAM 2220

Dear AFROJ,

But I have this question if my monitoring port are 2 XPF 10 GE, my Switch port need to have an SFP port too?

Cisco Employee

How capture traffic in NAM 2220

that does not matter, while configuring SPAN you can give any interfcae or interfaces as source but you destination port should be ONE of the NAM Monitoring port.

****the destination port has to be configured as a monitor port and not as an access port.

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

How capture traffic in NAM 2220

Ok let me see if I get this right.

The NAM 2220 has two monitoring Port this ports are two 10 GE and they use fibers. My neighbor Switch (In this case a Nexus 7000) can use an SFP 1 Ge. But the medium need to be fibers right? Or I'm missing something?

What happens if my Switch doesn't have Fibers Ports? Still can I monitoring?

Cisco Employee

Re: How capture traffic in NAM 2220

I found this link , looks like we need the correct SFP:

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/2220/installation/guide/instcfg/cables.html#wp1017093

I'll check ,if I found any other relevant information . I will share it with you.

Thanks-
Afroz
[Do rate the useful post]

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

How capture traffic in NAM 2220

Dear AFROJ

Thanks for the link. Maybe my english is not good enough, but I want to discover this.

The phisycal connection beetwen my Switch CORE or (NEXUS) & NAM 2220 must be by fibers... right?

I'm not sure if I clear, if doesn't I apologyze, but I want to know if I want to capture traffic I need this connetion.

I can't capture traffic by the management port, isn`t?

Ah for last.... I need to configure this in my switch, right?

Destination port configuration

switch7000-1#configure terminal

switch7000-1(config)#interface ethernet 3/48

!--- Configures the switchport parameters for a port.

switch7000-1(config-if)#switchport

!--- Configures the switchport interface as a SPAN destination.

switch7000-1(config-if)#switchport monitor

switch7000-1(config-if)#no shut

switch7000-1(config-if)#exit

SPAN session configuration

switch7000-1(config)#monitor session 1
!---Configure the source port with traffic direction.
switch7000-1(config-monitor)#source interface ethernet 3/11 both
!--- Configure the destination port.
switch7000-1(config-monitor)#destination interface ethernet 3/48
!--- To enable the SPAN session, by default session in shutdown state.
switch7000-1(config-monitor)#no shut
switch7000-1(config-monitor)#exit
!--- To save the configurations in the device.
switch7000-1(config)#copy running-config startup-config

The destination port should be the port that is connect to my NAM?

And the source port (ports) should be the ports that is connect to my LAN?

Cisco Employee

How capture traffic in NAM 2220

Hi Daniel,

The phisycal connection beetwen my Switch CORE or (NEXUS) & NAM 2220 must be by fibers . Yes

I can't capture traffic by the management port, isn`t ? >> it can only be by the Monitoring port.

Switch configuration looks fine.

The destination port should be the port that is connect to my NAM? correct

And the source port (ports) should be the ports that is connect to my LAN? cource port can be any port on the switch , the interface you want to monitor.

****** If someone has a differnt view on this ,please share with us **********

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

How capture traffic in NAM 2220

Dear AFROJ

I connected my Switch with GLC-SX-MMD to my NAM and I try with other 6500. But I don't see any activity on my monitor ports. The led are off. Do you know If I'm using the correct sfp for my Switches?

How capture traffic in NAM 2220

An another question.

If just plug in the fibers I have to see activity on my monitoring port? Or before I need to configure the SPAN Port & ans SPAN session?

Cisco Employee

How capture traffic in NAM 2220

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/2220/installation/guide/instcfg/cables.html#wp1017093

chekc ,if you are using the supported SFP.

activity should be after configuring SPAN.

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

Re: How capture traffic in NAM 2220

Maybe that is my mistake.

Because I'm connected to the nam by Management port in my PC. No network conectivity for now, and when connected my monitor to my switch nothing happens and I didn't configure the span session in my Switch.

Just another question; Can I just configure the SPAN session and ports on the Switch? Or OI need to configure in both devices?.

Cisco Employee

How capture traffic in NAM 2220

You need to do the configuration on the Switch Only.

Thanks-
Afroz

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****

Re: How capture traffic in NAM 2220

Dear Friend.

I have the the correct XFP's in my NAM Actually I have a JDSU PLRXXL-SC-S43-C1.

In my swtich I configured a new vlan and new SVI. My computer and the NAM are on the same VLAN. I can ping from my swtich to the NAM. I configured my SPAN session on my Switch.  But I don't see anything to analize in my NAM. The fibers just don`t come up.

I make I guess and Silly test I connect the fibers between my 2 analize ports and and blue light comes.

Re: How capture traffic in NAM 2220

Hello AFROJ.

Well our new lab is working so I tried with a Nexus 5000 this is my configuration:

NEXUS_5548(config)# interface ethernet 1/31

NEXUS_5548(config-if)# switchport

NEXUS_5548(config-if)# switchport mode trunk

NEXUS_5548(config-if)# switchport monitor

NEXUS_5548(config-if)# speed 10000

NEXUS_5548(config-if)# no shut

NEXUS_5548(config)# no monitor session 3

ERROR: Invalid session

NEXUS_5548(config)# monitor session 3

NEXUS_5548(config-monitor)# source interface ethernet 1/32

NEXUS_5548(config-monitor)# source vlan 160 - 162

NEXUS_5548(config-monitor)# destination interface EThernet 1/31

NEXUS_5548(config-monitor)# no shut

NEXUS_5548(config-monitor)# mtu 500

And this is output from show monitor session:

EXUS_5548(config-monitor)# do show monitor session 3

   session 3

---------------

type              : local

state             : down (No operational src/dst)

mtu              : 500

source intf       :

    rx            : Eth1/32

    tx            : Eth1/32

    both          : Eth1/32

source VLANs      :

    rx            : 160-191

source VSANs      :

    rx            :

destination ports : Eth1/31

Legend: f = forwarding enabled, l = learning enabled

NEXUS_5548(config-monitor)# no shut

My XFP are:  PLRXXL-SCS43-C1

My SFP in Nexus are:  GLC-SX-MMD

Not activity on monitor ports.

BTW just as a comment when I connect my fibers between my two XFP's a blue light appers

Re: How capture traffic in NAM 2220

Dejar AFROJ.

Thinks you so much for the info. I really sorr

Sent from Cisco Technical Support iPad App

344
Views
0
Helpful
17
Replies
CreatePlease login to create content