Cisco NAM vs. regular NetFlow monitoring?

[GeneralDzur]

I've been reading some Case Studies on the Cisco web site - and they mention NAM's (Network Analysis Modules) a lot, that you plug into a router to analyze traffic.

I was wondering if anyone's used them - and what the benefit is over the regular combination of ACL's, syslogging, and NetFlow analyzing?

- stephan

 

[BuckWeet]

NAMs are just for 6500's... They're an actual blade that you install into the switch.. They can do netflow but can also do more. They're not a centralized solution either, keep that in mind. They can also do packet sniffing..


BuckWeet

 

[webnetwiz]

NAMs are not only for Cisco 6500s! Do a search on part number NM-NAM, and you'll see that you can put a NAM into almost any router that takes them.

 

[vipergg]

We used NAMS and they were garbage . Way overpriced for what they do . The packet capture was worthless , took linke 20 minutes to come back with the decode when you did a capture . Use netflow or better yet a sniffer or observer 10 probe.

 

[BuckWeet]

ahh i stand corrected...

i guess you can get them for low end devices now..

we only deploy them in 6500's.. which is the ws-svc-nam2 module..

We only really use them for packet sniffing.. On our mainframes that have tons of ports coming into the box, its hard to get a off the box sniffer to monitor the amount of vlans/interfaces that we have on the box.. SPAN can only do so much.


BuckWeet

 

[GeneralDzur]

So it's basically a hardware-based sniffer?

I use NetFlow for bandwidth monitoring, and Kiwi Syslog Daemon for ACL violations, so what you're saying is a NAM would be overkill/pointless?

- stephan

 

[webnetwiz]

Are you looking to put the NAM into a modular router platform, or on the switches?

 

[GeneralDzur]

a router - 2621XM. I wanted to know if there would be any tangible or significant benefit to using one over NetFlow/Syslogging

- stephan

 

[BuckWeet]

For something that small, I would invest in a software based package that would sit on a server.. I'm sure you have other routers/switches that you would like to monitor as well...


BuckWeet

 

[GeneralDzur]

But are software-based packages (Such as AdventNet's ManageEngine for Netflow) as accurate as a NAM?

It's basically a stub setup.

ISP-->Cisco 2621-->Cisco Gb switch-->subordinate (D-link/linksys) switches

- stephan

 

[BuckWeet]

Yes they are.. if not better than the NAM.. netflow is a reporting agent that runs IOS and exports data.. It will give you the same info if its destined to a NAM or some external app..


BuckWeet