1. Advanced Troubleshooting with Cisco Prime NAM-3: Use Case

2. Objective
Using the simplified workflow of the Cisco Prime™ Network Analysis Module (NAM) on the Cisco Catalyst® Series NAM, the user can:
View alarms triggered and look more deeply into the application for further analysis.
With the advanced troubleshooting features of the Cisco Prime NAM-3, the user can:
Customize high-speed packet capture using advanced hardware filters.
Offload packet capture to external storage.
Analyze packet anomalies using the Error Scan feature.

3. Use Case Flow Context Demonstration
Users have complained of intermittent Microsoft SharePoint access delays in the past 2 weeks.
Network administrator baselines Microsoft SharePoint response time as 1000 ms.
Network administrator creates alarm for Microsoft SharePoint that, when triggered, sends an and starts packet capture.
Network administrator receives an alert that an alarm for Microsoft SharePoint has been triggered.
Network administrator logs into Cisco Prime™ NAM.
Demonstration
View alarm summary and analyze alarm details on the Microsoft SharePoint application.
Analyze Microsoft SharePoint response time during the time interval of the alarm trigger.
View the details of the Microsoft SharePoint server with the highest server response time.
Analyze the server and notice that during this time period, several clients were downloading an OS patch from this server using Microsoft CIFS. This operation affected the server performance of Microsoft SharePoint, a business- critical application.

4. Use Case Flow Demonstration
Before analyzing the triggered packet capture, showcase various Cisco Prime NAM troubleshooting capabilities.
View the hardware filter setup for high speed-packet capture.
View the packet-capture session created for the alarm trigger and configure storage for packet capture pointing to external storage.
Analyze the packet capture file from the alarm trigger to identify packet anomalies.

5. Outline

6. Advanced Troubleshooting with Cisco Prime NAM-3: Adobe Flash Demonstration Outline (1 of 2)
Identify Application with response-time degradation
Choose Monitor > Alarm Summary
Select SharePoint in Top N Applications by Alarm Count; right-click Alarm Details.
Review Baseline and determine which clients and servers are affected by poor Microsoft SharePoint performance
Analyze Response Time > Application.
Move left bar and zoom into 12:51; move right bar and zoom into 13:11.
Pan to 12:05-12:29; move left bar to 11:41 and right bar to 13:35.
Scroll down and click in Top Servers by Avg Server Response Time; select Analyze Host Traffic.
Analyze affected Microsoft SharePoint server
Pan to 12:05-12:29; scroll down and view Top N Applications.
Pan to 12: :11; view Top N Applications.
Click Host Conversations. A new window opens. Close the window

7. Advanced Troubleshooting with Cisco Prime NAM-3: Adobe Flash Demonstration Outline (2 of 2)
Troubleshoot using built-in packet capture and filters
Choose capture > Sessions.
Click the Hardware Filter Settings button. The Hardware Filter Settings window opens. Close the window.
Select OR for Combination Logic; then click Apply.
Select TCP_Campus_DC and then click Edit. The Hardware Filter dialog window opens. Close the window.
Select or hover over the radio button beside TCP_DC_Campus. The Hardware Details window opens. Close the window.
Under Capture Sessions, select Sharepoint_Resp_Time; then click Edit.
Select Select File Location [SAS] MyDotHill. Under Software Filters, select Share_Resp_Time; then click Edit. The Software Filter dialog window opens. Click Apply.
Choose Capture > Data Storage.> Data Storage.
Choose Capture > Files.
Select SharePoint_Resp_Time.pcap and click Error Scan. The Capture Errors and Warning Information window opens. Select Packet ID and then click Decode Packets button. The NAM Traffic Analyzer – Packet Decoder window opens. Close the window.

8. Appendix

9. Application Performance Troubleshooting Intuitive Workflow Accelerates Problem Resolution
1. Identify the application with high response time
2. Analyze application performance over time
3. Zoom to investigate specific performance issues
Time-based Filter
4. Identify the Top N clients affected by the degradation
5. Isolate the servers with high response time
6. View detailed information to analyze server activity

10. Capture Use Case: Triggered Alarm Threshold Proactive Troubleshooting
Features:
Associate packet capture with alarm action
Start and stop captures based on rising and falling threshold
Benefits:
Proactive troubleshooting when problem occurs
Contextual capture for targeted analysis
Optimize storage resources

11. Introduction to Packet Filtering in Cisco Prime NAM-3
Maximum of 4 Hardware Filters Applied to All Capture Sessions
Maximum of 6 Software Filters Applied per Capture Session
Raw Network Packets
Hardware Filter 1
Hardware Filter 1
Hardware Filter 1
Capture Session A
Capture Session B
Capture Session C
Software Filter X
Software Filter Y
External File
Memory
Local File
External File

12. Hardware Filter Example Capture TCP Packets Between Los Angeles Branch Office and Data Center

13. Extensible Capture Storage SAS and Fibre Channel over Ethernet External Storage Options
Features:
Mini-SAS port for connecting to external SAS Array
10GE SPF+ FCoE port for connecting to Fibre Channel and FCoE array
Ability to format, label and group LUNs into volumes from the GUI
Benefits:
Centralized capture storage for analysis
High-speed storage expansion options
Investment protection

14. Capture Use Case: Error Scan Highlights Observed Protocol- and Packet level Anomalies
Features:
Packet trace analysis highlighting observed protocol- and packet level anomalies
Ability to select anomalous packet for targeted decode analysis
Benefits:
Error Scan feature locates root cause much more quickly than does manually analyzing or scanning the packet traces