Release Notes for Cisco Network Data Analyzer Release 3.0(3)

These release notes contain platform and system requirements and instructions for installing and setting up Release 3.0(3) of the Cisco Network Data Analyzer.

These release notes contain the following sections:

Platforms Supported

The Cisco Network Data Analyzer (referred to here as the Analyzer) is supported on the following platforms:

Solaris Version 2.5.1 and Version 2.6
HPUX Version 11.0

The Analyzer Display module also runs on Windows NT Version 4.0.

Workstation Requirements

Hardware Requirements

The Analyzer requires the following hardware:

DisplayServer host machine (Solaris or HPUX):
- 256 MB of physical memory (RAM)
- 400 MB of free logical memory
Solaris:
- 70 MB of free disk space for tar and uncompressed installation files (which you can delete after installation)
- 50 MB of free disk space for the installed Analyzer executables
HPUX:
- 120 MB of free disk space for tar and uncompressed installation files (which you can delete after installation)
- 75 MB of free disk space for the installed Analyzer executables
Analyzer Display module executables running on a PC:
- 25 MB of free disk space
- Pentium class 166-MHz CPU with 64 MB or more of physical memory (RAM)

Software Requirements

The Analyzer requires the following software:

The Bourne sh shell (/bin/sh) must be available for execution.
The following standard utility programs must be in /usr/bin or /bin, or must be set in each user's $PATH environment variable:
- awk
- cat
- cd
- chmod
- echo
- expr
- kill
- ls
- mkdir
- nohup
- ps
- pwd
- rm
- sed
- touch
- unalias
- wc
- whoami

Installing and Starting the Analyzer for the First Time

To install and start the Analyzer, perform the following steps:

Step 1 Log in to the workstation as root.

$ su root

password: <password>

Step 2 Untar the tar file.

Solaris: # tar -xvf NDA3_0.SOL.tar

 
HPUX: # tar -xvf NDA3_0.HP_11.tar

Step 3 Run the installation script and answer all questions.

Note The installation process prompts you to start the Analyzer user interface. Before you start the installation script, enable remote X connections to your workstation by an xhost + command.

Solaris: # ./NDA3_0.setup.sh ./NDA3_0.SOL.Z 

 
HPUX: # ./NDA3_0.setup.sh ./NDA3_0.HP_11.Z

To install the Analyzer Display module on Windows NT, perform the following steps:

Step 1 Set protections on the NFADisplay directory and all of its subdirectories by entering the following command at the root level:

# chmod -R 777 /opt/CSCOnfa/NFADisplay

Step 2 Copy the /opt/CSCOnfa/NFADisplay directory and all of its subdirectories and files to the target directory on your PC. If desired, you can use the Tar command and WINZIP for this process.

Note Do not use FTP for the copy because recursiveness of the copy and all subdirectories is not guaranteed.

Stopping and Restarting the Analyzer Servers

To stop or restart the Analyzer servers (UtilityServer and DisplayServer), perform the following steps:

Step 1 Log in as root.

$ su root
password: <password>

Step 2 Stop or restart the servers.

a. To stop the Analyzer servers, run the stop.All shell script:

# /opt/CSCOnfa/stop.All

b. To restart the Analyzer servers, run the start.All shell script:

# /opt/CSCOnfa/start.All

Starting the Analyzer Display Module

To start the user interface, enter the appropriate command:

Solaris: # /opt/CSCOnfa/NFADisplay/bin/start.Display

 
HPUX: # /opt/CSCOnfa/NFADisplay/bin/start.Display

 
Windows NT: c:\NFADisplay\bin>startPC_Display

New Features for Release 3.0

This section describes new features for Release 3.0 of the Analyzer.

NetFlow FlowCollector Control—You can use the Analyzer to create, modify, and delete collections on remote machines running Release 3.0 of the FlowCollector.

Note The Analyzer works best if you run the FlowCollector in Release 3.0 mode. The FlowCollector's default mode is set to NFC20_COMPATIBLE_MODE yes. To run the FlowCollector in Release 3.0 mode, stop the FlowCollector, change the setting in the nf.resources file to NFC20_COMPATIBLE_MODE no, and restart the FlowCollector.

Note To avoid having to log on to a FlowCollector each time you want to modify a NetFlow configuration, run the FlowCollector gateway program (NFCGW) with the PROGRAMFLAGS switch set to -i (dash, lowercase i).

Traffic matrix statistics (TMS) control—You can use the Analyzer to create and delete TMS data collections on UtilityServers. This capability requires that routers be running IOS Release 12.0(6)T or 12.0(5)S.
Router configuration for data export—You can use the Analyzer to set up collection parameters for exporting NetFlow or TMS data from routers.
On-router aggregation schemes—You can use the Analyzer to set up routers to collect and display data for five new on-router aggregation schemes. These on-router aggregation schemes require that routers have DNS names and be running IOS Release 12.0(3)T or Release 12.0(6)S.
Online help system—You can use Netscape Version 4.5 or Internet Explorer Version 5 as the Web browser for viewing the Analyzer help system.

New Features for Release 3.0(2)

Release 3.0(2) of the Analyzer has these new features:

Support—The Analyzer is supported on HPUX Version 11.0.
Compressed data files—The Analyzer can read compressed files that the FlowCollector created. NetFlow collection control can also set or unset compression.
Traffic Matrix Statistics (TMS) histogram charts—Histogram charts can be generated for traffic matrix statistics data.

New Features for Release 3.0(3)

Release 3.0(3) of the Analyzer has these new features:

Additional aggregation schemes—The Analyzer now supports DetailCallRecord, ASHostMatrix, HostMatrixInterface, and ASPort.
Search feature—In the Analyzer's Search window you can now search by IP address, AS numbers, or port identifiers. Previously, you could search only by IP address.
Export data in HTML format—You can export the contents of the displayed aggregation scheme in HTML format to a file that can be viewed in table format in a Web browser. Previously, you could export data only in CSV format.
Export data is available from the Search window—The results of the Search operation can now be exported to a file in CSV or HTML format.

Operating Suggestions

Here are some suggestions for using the Analyzer:

To run the Display module from a Windows NT platform, use this procedure:

Note Do not use FTP for the copy because recursiveness of the copy and all subdirectories is not guaranteed.

c. Change directory (cd) to NFADisplay/bin

d. Enter startPC_Display.bat.

Make sure one UtilityServer at a time is collecting TMS data from a given router.
If you are working in the AS Drill Down window and the Search window, you must use the DetailASMatrix aggregation scheme.
Use the Router Configuration option on the Tools menu to configure TMS data collection, and then use the TMS Collection Control window to start a collection on the UtilityServer.
The router configuration process recognizes only those routers that have DNS entries. A workaround for this is to edit the copy of the router configuration file that you make available to the Analyzer so that the file includes the router's IP address for the host name.

: Example:

hostname 172.23.249.99

If the UtilityServer is stopped and then restarted, TMS collections are not resumed.
To enable the router configuration process to reread the router configuration files, restart the Display module.
To navigate in the router-based aggregations table in the RouterConfig window, do the following:
- To advance to the next cell, press Tab.
- To advance to the next row, press Return.
To display the Contents, Index, and Search functions of online Help, enable Java and Javascript in your browser. In Netscape, use the Advanced option under Edit > Preferences.

Known Bugs and Restrictions for Release 3.0

This section describes known bugs and restrictions for Release 3.0 of the Analyzer.

The UtilityServer might fail to start. When this happens, wait 3 to 4 minutes and try to restart the UtilityServer by executing the start.UtilityServer script.
If you cannot invoke the Analyzer Help system while running under Windows NT, do the following:
If a window is blank or all blue/grey, resize the window or minimize the window and then restore it.
If the Display module runs out of memory, an Out of Memory message appears on the terminal window from which the Analyzer was invoked. If that happens, edit the start_Display file and place the -mx option before the Java call, as shown below:

/opt/CSCOnfa/NFADisplay/RunTimeJava/bin/java -mx128 -cp ...

RouterConfig cannot configure routers that prompt for a user name or contain an "enable secret" password.
TMS collections are not resumed if the UtilityServer is stopped and then restarted.
If you cannot change the TMS internal/external setting for the router interfaces, the IOS software on the selected router does not support that functionality.
If you delete a TMS collection, you must wait approximately 15 seconds before starting a new collection on that router. Otherwise, a router in use error message is displayed.
Although the Display module can run on a UNIX platform and can send output to an X server running on a PC using an X windows emulator, this configuration is not supported.
The Display module does not run under OpenWindows unless OpenWindows is installed with the motif libraries.
During the installation of NDA on HPUX, after you answer y to Do you want to start the servers?, ignore the syntax error message regarding the following:

/opt/CSCOnfa/NFAUtility/bin/start.UtilityServer [90]:
Syntax error

: The Analyzer servers were successfully started.

Corrected Release 3.0 Bugs and Restrictions

The following bugs and restrictions from Release 3.0 are corrected in Release 3.0(3) of the Analyzer:

A request for topN = 10000 caused the Analyzer to try to retrieve all data. That could cause an "Out of Memory" exception to occur.
If a data set contained an extremely large Total Flow Count (that is, greater than 2147483647), a NumberFormatException error occurred.

Obtaining Documentation

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM is updated monthly. Therefore, it is probably more current than printed documentation. The CD-ROM package is available as a single unit or as an annual subscription.

Ordering Documentation

Registered CCO users can order the Documentation CD-ROM and other Cisco Product documentation through our online Subscription Services at http://www.cisco.com/cgi-bin/subcat/kaojump.cgi.

Nonregistered CCO users can order documentation through a local account representative by calling Cisco's corporate headquarters (California, USA) at 408 526-4000 or, in North America, call 800 553-NETS (6387).

Obtaining Technical Assistance

Cisco provides Cisco Connection Online (CCO) as a starting point for all technical assistance. Warranty or maintenance contract customers can use the Technical Assistance Center. All customers can submit technical feedback on Cisco documentation using the web, e-mail, a self-addressed stamped response card included in many printed docs, or by sending mail to Cisco.

Cisco Connection Online

Cisco continues to revolutionize how business is done on the Internet. Cisco Connection Online is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.

CCO's broad range of features and services helps customers and partners to streamline business processes and improve productivity. Through CCO, you will find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online support services, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.

Customers and partners can self-register on CCO to obtain additional personalized information and services. Registered users may order products, check on the status of an order and view benefits specific to their relationships with Cisco.

You can access CCO in the following ways:

WWW: www.cisco.com
Telnet: cco.cisco.com
Modem using standard connection rates and the following terminal settings: VT100 emulation; 8 data bits; no parity; and 1 stop bit.
- From North America, call 408 526-8070
- From Europe, call 33 1 64 46 40 82

You can e-mail questions about using CCO to cco-team@cisco.com.

Technical Assistance Center

The Cisco Technical Assistance Center (TAC) is available to warranty or maintenance contract customers who need technical assistance with a Cisco product that is under warranty or covered by a maintenance contract.

To display the TAC web site that includes links to technical support information and software upgrades and for requesting TAC support, use www.cisco.com/techsupport.

To contact by e-mail, use one of the following:

Language	E-mail Address
English	tac@cisco.com
Hanzi (Chinese)	chinese-tac@cisco.com
Kanji (Japanese)	japan-tac@cisco.com
Hangul (Korean)	korea-tac@cisco.com
Spanish	tac@cisco.com
Thai	thai-tac@cisco.com

In North America, TAC can be reached at 800 553-2447 or 408 526-7209. For other telephone numbers and TAC e-mail addresses worldwide, consult the following web site: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml.

Documentation Feedback

If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco.

You can e-mail your comments to bug-doc@cisco.com.

To submit your comments by mail, for your convenience many documents contain a response card behind the front cover. Otherwise, you can mail your comments to the following address:

Cisco Systems, Inc.
Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate and value your comments.

Access Registrar, AccessPath, Any to Any, Are You Ready, AtmDirector, Browse with Me, CCDA, CCDE, CCDP, CCIE, CCNA, CCNP, CCSI, CD-PAC, the Cisco logo, Cisco Certified Internetwork Expert logo, CiscoLink, the Cisco Management Connection logo, the Cisco NetWorks logo, the Cisco Powered Network logo, Cisco Systems Capital, the Cisco Systems Capital logo, Cisco Systems Networking Academy, the Cisco Systems Networking Academy logo, the Cisco Technologies logo, Fast Step, FireRunner, Follow Me Browsing, FormShare, GigaStack, IGX, Intelligence in the Optical Core, Internet Quotient, IP/VC, IQ Breakthrough, IQ Expertise, IQ FastTrack, IQ Readiness Scorecard, The IQ Logo, Kernel Proxy, MGX, Natural Network Viewer, NetSonar, Network Registrar, the Networkers logo, Packet, PIX, Point and Click Internetworking, Policy Builder, Precept, RateMUX, ReyMaster, ReyView, ScriptShare, Secure Script, Shop with Me, SlideCast, SMARTnet, SVX, The Cell, TrafficDirector, TransPath, VlanDirector, Voice LAN, Wavelength Router, Workgroup Director, and Workgroup Stack are trademarks; Changing the Way We Work, Live, Play, and Learn, Empowering the Internet Generation, The Internet Economy, and The New Internet Economy are service marks; and Aironet, ASIST, BPX, Catalyst, Cisco, Cisco IOS, the Cisco IOS logo, Cisco Systems, the Cisco Systems logo, the Cisco Systems Cisco Press logo, CollisionFree, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastLink, FastPAD, FastSwitch, GeoTel, IOS, IP/TV, IPX, LightStream, LightSwitch, MICA, NetRanger, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0005R)

Table of Contents

Release Notes for Cisco Network Data Analyzer Release 3.0(3)