Content

| 9.3 |  | Network Analysis Modules and Switch Fabric Modules |
| 9.3.3 |  | Using the NAM |

The NAM can be used for Network Analysis for a variety of functions including, but not limited to TACACS, SNMP and capture of SPAN information. In the remainder of this section, the use of NAMs in relation to SPAN sessions will be discussed.

The NAM Traffic Analyzer is a Web-based monitoring application embedded in the NAM software. The application provides comprehensive traffic monitoring and analysis capabilities on board the NAM, in addition to its traffic statistics collection functionality. This combines the roles of the monitoring agent and analysis application in the same device.

The NAM Traffic Analyzer runs on a Web server on the NAM itself, and is accessible through a Web browser (Microsoft Internet Explorer 5.0 and above, Netscape 4.7 and above). The NAM Traffic Analyzer enables troubleshooting and monitoring of applications, such as IP telephony and quality of service (QoS).

The NAM automatically learns VLANs from the switch, but does not automatically SPAN them. The Active SPAN Sources window must be used to SPAN them.

Key features of the NAM Traffic Analyzer include:

- Monitoring capabilities – Supports full RMON and RMON2 monitoring to analyze network traffic up to the application layer for hosts, conversations, applications. Supports extended monitoring using SMON, DSMON and HCRMON.
- Voice and QoS monitoring – Offers DSMON and IP telephony monitoring capabilities including protocol utilization and call and phone attributes, and violations of QoS policies.
- Troubleshooting capabilities – Capable of capturing and decoding data and voice packets in real time to troubleshoot network problems, including alarm capabilities and drill-down views of traffic to identify potential problems before they occur.
- Web access – Provides instant access to traffic statistics.
- Secure Web access – Users can enable the HTTPS server on the NAM and use up to 168-bit encryption for data exchange.
- Role-based user administration – Provides local and remote (TACACS+) authentication and authorization capabilities to assign different levels of roles and privileges to users.

The NAM has no network interfaces. Monitored packets are forwarded to the line module using SPAN or RSPAN functionality that mirrors any switch port or VLAN on the NAM. The NAM supports simultaneous monitoring of multiple ports or VLANs and maintains independent group statistics for each data source. Any data source, such as physical ports, VLANs, EtherChannel, and NetFLow data export frames, that can be directed to the NAM using the SPAN or RSPAN function is supported for RMON data collection.

With the help of SPAN configuration on the Supervisor, the NAM can also monitor EtherChannel. On the Supervisor, each physical port in the bundle is mirrored into the NAM.

| Interactive Media Activity Checkbox: Network Analysis Module (NAM) After completing this activity, the students will be able to understand NAM.