NDANCY INFO: Module 9 FT info: Active: Manual bulk sync completed Network Analysis Modules. Cisco's NAM is essentially a remote monitoring (RMON) probe and packet-capture device that allows you to monitor any port, VLAN, or combination of the two as if you were using an external packet-capture device. The NAM is controlled through a web browser, which can be tedious when you're looking at large capture files. The benefit of the web-based implementation is that no extra software is required. The NAM may also be used from anywhere that the net- work design allows. The interface of the packet-capture screen should be familiar to anyone who has used products such as Ethereal. Each packet is broken down as far as possible, and there is an additional window showing the ASCII contents of the packets. Architecture One of the limitations of the packet capture is the lack of smart alarm indications such as those found in high-end packet-capture utilities. Many other features are available on the NAM, as it operates as an RMON probe. The NAM is an excellent troubleshooting tool, and because it's always there, it can be invaluable during a crisis. (Chances are someone won't borrow the blade out your production 6509, though stranger things have happened.) The additional fea- ture of being able to capture more than one session at a time makes the NAM blade an excellent addition to your arsenal of tools. With the ability to capture from RSPAN sources (see Chapter 18), the NAM blade can be used to analyze traffic on any switch on your network. A sample screen from the NAM interface is shown in Figure 17-7. http://10.10.10.6 localhost - Packet Decoder - NAM Traffic Analyzer ⑉ Mozilla Firefox Cisco SYSTEMS NAM Traffic Analyzer Packet Decoder Capture1 Packets: 1-10 of 37 Go to Display Filter Time (s) Source Destination Protocol 0.000 70 192.168.100.2 224.0.0.2 Hello (state Active) 2.917 192.168.100.2 224.0.0.2 Hello (state Active) 5.882 192.168.100.2 224.0.0.2 Hello (state Active) 8.778 192.168.100.2 224.0.0.2 Hello (state Active) 