Advanced Troubleshooting with Cisco Prime NAM-3: Use Case

Objective Using the simplified workflow of the Cisco Prime™ Network Analysis Module (NAM) on the Cisco Catalyst® 6500 Series NAM, the user can: View alarms triggered and look more deeply into the application for further analysis. With the advanced troubleshooting features of the Cisco Prime NAM-3, the user can: Customize high-speed packet capture using advanced hardware filters. Offload packet capture to external storage. Analyze packet anomalies using the Error Scan feature.

Use Case Flow Context Demonstration Users have complained of intermittent Microsoft SharePoint access delays in the past 2 weeks. Network administrator baselines Microsoft SharePoint response time as 1000 ms. Network administrator creates alarm for Microsoft SharePoint that, when triggered, sends an email and starts packet capture. Network administrator receives an email alert that an alarm for Microsoft SharePoint has been triggered. Network administrator logs into Cisco Prime™ NAM. Demonstration View alarm summary and analyze alarm details on the Microsoft SharePoint application. Analyze Microsoft SharePoint response time during the time interval of the alarm trigger. View the details of the Microsoft SharePoint server with the highest server response time. Analyze the server and notice that during this time period, several clients were downloading an OS patch from this server using Microsoft CIFS. This operation affected the server performance of Microsoft SharePoint, a business- critical application.

Use Case Flow Demonstration Before analyzing the triggered packet capture, showcase various Cisco Prime NAM troubleshooting capabilities. View the hardware filter setup for high speed-packet capture. View the packet-capture session created for the alarm trigger and configure storage for packet capture pointing to external storage. Analyze the packet capture file from the alarm trigger to identify packet anomalies.

Outline

Advanced Troubleshooting with Cisco Prime NAM-3: Adobe Flash Demonstration Outline (1 of 2) Identify Application with response-time degradation Choose Monitor > Alarm Summary Select SharePoint in Top N Applications by Alarm Count; right-click Alarm Details. Review Baseline and determine which clients and servers are affected by poor Microsoft SharePoint performance Analyze Response Time > Application. Move left bar and zoom into 12:51; move right bar and zoom into 13:11. Pan to 12:05-12:29; move left bar to 11:41 and right bar to 13:35. Scroll down and click 10.0.250.12 in Top Servers by Avg Server Response Time; select Analyze Host Traffic. Analyze affected Microsoft SharePoint server Pan to 12:05-12:29; scroll down and view Top N Applications. Pan to 12:51 - 13:11; view Top N Applications. Click Host Conversations. A new window opens. Close the window

Advanced Troubleshooting with Cisco Prime NAM-3: Adobe Flash Demonstration Outline (2 of 2) Troubleshoot using built-in packet capture and filters Choose capture > Sessions. Click the Hardware Filter Settings button. The Hardware Filter Settings window opens. Close the window. Select OR for Combination Logic; then click Apply. Select TCP_Campus_DC and then click Edit. The Hardware Filter dialog window opens. Close the window. Select or hover over the radio button beside TCP_DC_Campus. The Hardware Details window opens. Close the window. Under Capture Sessions, select Sharepoint_Resp_Time; then click Edit. Select Select File Location [SAS] MyDotHill. Under Software Filters, select Share_Resp_Time; then click Edit. The Software Filter dialog window opens. Click Apply. Choose Capture > Data Storage.> Data Storage. Choose Capture > Files. Select SharePoint_Resp_Time.pcap and click Error Scan. The Capture Errors and Warning Information window opens. Select Packet ID 17105 and then click Decode Packets button. The NAM Traffic Analyzer – Packet Decoder window opens. Close the window.

Appendix

Application Performance Troubleshooting Intuitive Workflow Accelerates Problem Resolution 1. Identify the application with high response time 2. Analyze application performance over time 3. Zoom to investigate specific performance issues Time-based Filter 4. Identify the Top N clients affected by the degradation 5. Isolate the servers with high response time 6. View detailed information to analyze server activity

Capture Use Case: Triggered Alarm Threshold Proactive Troubleshooting Features: Associate packet capture with alarm action Start and stop captures based on rising and falling threshold Benefits: Proactive troubleshooting when problem occurs Contextual capture for targeted analysis Optimize storage resources

Introduction to Packet Filtering in Cisco Prime NAM-3 Maximum of 4 Hardware Filters Applied to All Capture Sessions Maximum of 6 Software Filters Applied per Capture Session Raw Network Packets Hardware Filter 1 Hardware Filter 1 Hardware Filter 1 Capture Session A Capture Session B Capture Session C Software Filter X Software Filter Y External File Memory Local File External File

Hardware Filter Example Capture TCP Packets Between Los Angeles Branch Office and Data Center

Extensible Capture Storage SAS and Fibre Channel over Ethernet External Storage Options Features: Mini-SAS port for connecting to external SAS Array 10GE SPF+ FCoE port for connecting to Fibre Channel and FCoE array Ability to format, label and group LUNs into volumes from the GUI Benefits: Centralized capture storage for analysis High-speed storage expansion options Investment protection

Capture Use Case: Error Scan Highlights Observed Protocol- and Packet level Anomalies Features: Packet trace analysis highlighting observed protocol- and packet level anomalies Ability to select anomalous packet for targeted decode analysis Benefits: Error Scan feature locates root cause much more quickly than does manually analyzing or scanning the packet traces