Release Notes for Cisco Network Data Analyzer Release 3.6(1)

These release notes contain platform and system requirements and instructions for installing and setting up Release 3.6(1) of the Cisco Network Data Analyzer.

July 20, 2001

These release notes contain the following sections:

Platforms Supported

The Cisco Network Data Analyzer (referred to here as the Analyzer) is supported on the following platforms:

Solaris Version 2.5.1, Version 2.6, and Version 2.7
HPUX Version 11.0

The Analyzer Display module also runs on Windows NT Version 4.0.

System Requirements

Hardware Requirements

The Analyzer requires the following hardware:

DisplayServer host machine (Solaris or HPUX):
- 256 MB of physical memory (RAM)
- 400 MB of free logical memory
Solaris:
- 70 MB of free disk space for tar and uncompressed installation files (which you can delete after installation)
- 50 MB of free disk space for the installed Analyzer executables
HPUX:
- 120 MB of free disk space for tar and uncompressed installation files (which you can delete after installation)
- 75 MB of free disk space for the installed Analyzer executables
Analyzer Display module executables running on a PC:
- 25 MB of free disk space
- Pentium class 166-MHz CPU with 64 MB or more of physical memory (RAM)

Software Requirements

The Analyzer requires the following software:

The Bourne sh shell (/bin/sh) must be available for execution.
The following standard utility programs must be in /usr/bin or /bin, or must be set in each user's $PATH environment variable:
- awk
- cat
- cd
- chmod
- echo
- expr
- kill
- ls
- mkdir
- nohup
- ps
- pwd
- rm
- sed
- touch
- unalias
- wc
- whoami

Installing and Starting the Analyzer for the First Time

To install and start the Analyzer, perform the following steps:

Step 1 Log in to the workstation as root.

$ su root

password: <password>

Step 2 Untar the tar file.

Solaris: # tar -xvf NDA3_6.SOL.tar

 
HPUX: # tar -xvf NDA3_6.HP_11.tar

Step 3 Run the installation script and answer all questions.

Note The installation process prompts you to start the Analyzer user interface. Before you start the installation script, enable remote X connections to your workstation by an xhost + command.

Solaris: # ./NDA3_6.setup.sh ./NDA3_6.SOL.Z 

 
HPUX: # ./NDA3_6.setup.sh ./NDA3_6.HP_11.Z

To install the Analyzer Display module on Windows NT, perform the following steps:

Step 1 Set protections on the NFADisplay directory and all of its subdirectories by entering the following command at the root level:

# chmod -R 777 /opt/CSCOnfa/NFADisplay

Step 2 Copy the /opt/CSCOnfa/NFADisplay directory and all of its subdirectories and files to the target directory on your PC. If desired, you can use the Tar command and WINZIP for this process.

Note Do not use FTP for the copy because recursiveness of the copy and all subdirectories is not guaranteed.

Stopping and Restarting the Analyzer Servers

To stop or restart the Analyzer servers (UtilityServer and DisplayServer), perform the following steps:

Step 1 Log in as root.

$ su root

password: <password>

Step 2 Stop or restart the servers.

a. To stop the Analyzer servers, run the stop.All shell script:

# /opt/CSCOnfa/stop.All

b. To restart the Analyzer servers, run the start.All shell script:

# /opt/CSCOnfa/start.All

Starting the Analyzer Display Module

To start the Analyzer user interface, enter the appropriate command:

Solaris: # /opt/CSCOnfa/NFADisplay/bin/start.Display

 
HPUX: # /opt/CSCOnfa/NFADisplay/bin/start.Display

 
Windows NT: c:\NFADisplay\bin>startPC_Display

New Features for Release 3.0

This section describes new features for Release 3.0 of the Analyzer.

NetFlow FlowCollector Control—You can use the Analyzer to create, modify, and delete collections on remote machines running Release 3.0 of the FlowCollector.

Note The Analyzer works best if you run the FlowCollector in Release 3.0 mode. The FlowCollector's default mode is set to NFC20_COMPATIBLE_MODE yes. To run the FlowCollector in Release 3.0 mode, stop the FlowCollector, change the setting in the nf.resources file to NFC20_COMPATIBLE_MODE no, and restart the FlowCollector.

Note To avoid having to log on to a FlowCollector each time you want to modify a NetFlow configuration, run the FlowCollector gateway program (NFCGW) with the PROGRAMFLAGS switch set to -i (dash, lowercase i).

Traffic matrix statistics (TMS) control—You can use the Analyzer to create and delete TMS data collections on UtilityServers. This capability requires that routers be running IOS Release 12.0(6)T or Release 12.0(5)S.
Router configuration for data export—You can use the Analyzer to set up collection parameters for exporting NetFlow or TMS data from routers.
On-router aggregation schemes—You can use the Analyzer to set up routers to collect and display data for five new on-router aggregation schemes. These on-router aggregation schemes require that routers have DNS names and be running IOS Release 12.0(3)T or Release 12.0(6)S.
Online help system—You can use Netscape Version 4.5 or Internet Explorer Version 5 as the Web browser for viewing the Analyzer help system.

New Features for Release 3.0(2)

Release 3.0(2) of the Analyzer has these new features:

Support—The Analyzer is supported on HPUX Version 11.0.
Compressed data files—The Analyzer can read compressed files that the FlowCollector created. NetFlow collection control can also set or unset compression.
Traffic Matrix Statistics (TMS) histogram charts—Histogram charts can be generated for traffic matrix statistics data.

New Features for Release 3.0(3)

Release 3.0(3) of the Analyzer has these new features:

Additional aggregation schemes—The Analyzer now supports DetailCallRecord, ASHostMatrix, HostMatrixInterface, and ASPort.
Search feature—In the Analyzer's Search window you can now search by IP address, AS numbers, or port identifiers. Previously, you could search only by IP address.
Export data in HTML format—You can export the contents of the displayed aggregation scheme in HTML format to a file that can be viewed in table format in a Web browser. Previously, you could export data only in CSV format.
Export data is available from the Search window—The results of the Search operation can now be exported to a file in CSV or HTML format.

New Features for Release 3.5(1)

Release 3.5(1) of the Analyzer has these new features:

New aggregation schemes—The Analyzer now supports RouterDestOnly, RouterFullFlow, RouterPrePortProtocol, RouterSrcDst, RouterTosAS, RouterToSDstPrefix, RouterTosPrefix, RouterTosProtoPort, and RouterTosSrcPrefix.
Router configuration has the following new router-based aggregation schemes that include type of service (TOS): as-tos, destination-prefix-tos, prefix-port, prefix-tos, protocol-port-tos, and source-prefix-tos.
Router configuration supports Catalyst 6000 routers, including a flow mask for setting the following new router-based aggregation schemes: Destination Only, Destination-Source, and Full Flow.
Minimum mask setting for router-based aggregations on the router configuration window
Ability to specify multiple collectors in the Router Configuration window for redundant data streams
Solaris Version 2.7 support
Router security
Disable tool tips

New Features for Release 3.6(1)

Release 3.6(1) of the Analyzer has these new features:

You can print charts that the Network Data Analyzer creates.
Bar charts are displayed horizontally instead of vertically so that labels are easier to read.
In Bar Charts, range labels are scrollable.
In Histograms, large gaps between two data values are indicated by the label "no data."

Operating Suggestions

Here are some suggestions for using the Analyzer:

To run the Display module from a Windows NT platform, use this procedure:
Make sure one UtilityServer at a time is collecting TMS data from a given router.
If you are working in the AS Drill Down window and the Search window, you must use the DetailASMatrix aggregation scheme.
Use the Router Configuration option on the Tools menu to configure TMS data collection, and then use the TMS Collection Control window to start a collection on the UtilityServer.
The router configuration process recognizes only those routers that have DNS entries. A workaround for this is to edit the copy of the router configuration file that you make available to the Analyzer so that the file includes the router's IP address for the host name.

: Example:

hostname 172.23.249.99

If the UtilityServer is stopped and then restarted, TMS collections are not resumed.
To enable the router configuration process to reread the router configuration files, restart the Display module.
To navigate in the router-based aggregations table in the RouterConfig window, do the following:
- To advance to the next cell, press Tab.
- To advance to the next row, press Return.
To display the Contents, Index, and Search functions of online Help, enable Java and Javascript in your browser. In Netscape, use the Advanced option under Edit > Preferences.

Known Bugs and Restrictions for Release 3.6(1)

This section describes known bugs and restrictions for Release 3.0 of the Analyzer.

The UtilityServer might fail to start. When this happens, wait 3 to 4 minutes and try to restart the UtilityServer by executing the start.UtilityServer script.
If you cannot invoke the Analyzer Help system while running under Windows NT, do the following:
If a window is blank or all blue/grey, resize the window or minimize the window and then restore it.
If the Display module runs out of memory, an Out of Memory message appears on the terminal window from which the Analyzer was invoked. If that happens, edit the start_Display file and place the -mx option before the Java call, as shown below:

/opt/CSCOnfa/NFADisplay/RunTimeJava/bin/java -mx128 -cp ...

RouterConfig cannot configure routers that prompt for a user name or contain an "enable secret" password.
TMS collections are not resumed if the UtilityServer is stopped and then restarted.
If you cannot change the TMS internal/external setting for the router interfaces, the IOS software on the selected router does not support that functionality.
If you delete a TMS collection, you must wait approximately 15 seconds before starting a new collection on that router. Otherwise, a router in use error message is displayed.
Although the Display module can run on a UNIX platform and can send output to an X server running on a PC using an X windows emulator, this configuration is not supported.
The Display module does not run under OpenWindows unless OpenWindows is installed with the motif libraries.
During the installation of NDA on HPUX, after you answer y to Do you want to start the servers?, ignore the syntax error message regarding the following:

/opt/CSCOnfa/NFAUtility/bin/start.UtilityServer [90]:

Syntax error

: The Analyzer servers were successfully started.

The number of charts that can be opened simultaneously depends on the amount of memory available.

Corrected Release 3.6(1) Bugs and Restrictions

The following bugs and restrictions from Release 3.0 are corrected in Release 3.6(1) of the Analyzer:

A request for topN = 10000 caused the Analyzer to try to retrieve all data. That could cause an "Out of Memory" exception to occur.
If a data set contained an extremely large Total Flow Count (that is, greater than 2147483647), a NumberFormatException error occurred.

Obtaining Documentation

The following sections provide sources for obtaining documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at the following sites:

http://www.cisco.com
http://www-china.cisco.com
http://www-europe.cisco.com

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or as an annual subscription.

Ordering Documentation

Cisco documentation is available in the following ways:

Registered Cisco Direct Customers can order Cisco Product documentation from the Networking Products MarketPlace:

: http://www.cisco.com/cgi-bin/order/order_root.pl

Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription Store:

: http://www.cisco.com/go/subscription

Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco corporate headquarters (California, USA) at 408 526-7208 or, in North America, by calling 800 553-NETS(6387).

Documentation Feedback

If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco.

You can e-mail your comments to bug-doc@cisco.com.

To submit your comments by mail, use the response card behind the front cover of your document, or write to the following address:

Attn Document Resource Connection
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools. For Cisco.com registered users, additional troubleshooting tools are available from the TAC website.

Cisco.com

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.

Cisco.com provides a broad range of features and services to help customers and partners streamline business processes and improve productivity. Through Cisco.com, you can find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online technical support, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.

Customers and partners can self-register on Cisco.com to obtain additional personalized information and services. Registered users can order products, check on the status of an order, access technical support, and view benefits specific to their relationships with Cisco.

To access Cisco.com, go to the following website:

http://www.cisco.com

Technical Assistance Center

The Cisco TAC website is available to all customers who need technical assistance with a Cisco product or technology that is under warranty or covered by a maintenance contract.

Contacting TAC by Using the Cisco TAC Website

If you have a priority level 3 (P3) or priority level 4 (P4) problem, contact TAC by going to the TAC website:

http://www.cisco.com/tac

P3 and P4 level problems are defined as follows:

P3—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.
P4—You need information or assistance on Cisco product capabilities, product installation, or basic product configuration.

In each of the above cases, use the Cisco TAC website to quickly find answers to your questions.

To register for Cisco.com, go to the following website:

http://www.cisco.com/register/

If you cannot resolve your technical issue by using the TAC online resources, Cisco.com registered users can open a case online by using the TAC Case Open tool at the following website:

http://www.cisco.com/tac/caseopen

Contacting TAC by Telephone

If you have a priority level 1 (P1) or priority level 2 (P2) problem, contact TAC by telephone and immediately open a case. To obtain a directory of toll-free numbers for your country, go to the following website:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtm l

P1 and P2 level problems are defined as follows:

P1—Your production network is down, causing a critical impact to business operations if service is not restored quickly. No workaround is available.
P2—Your production network is severely degraded, affecting significant aspects of your business operations. No workaround is available.

This document is to be used in conjunction with the documents listed in the "Related Documentation" section.

AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco Systems Networking Academy, the Cisco Systems Networking Academy logo, Fast Step, Follow Me Browsing, FormShare, FrameShare, GigaStack, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, Packet, RateMUX, ScriptBuilder, ScriptShare, SlideCast, SMARTnet, TransPath, Unity, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That's Possible, and Empowering the Internet Generation, are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, IOS, IP/TV, LightStream, MICA, Network Registrar, PIX, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0106R)

Table of Contents

Release Notes for Cisco Network Data Analyzer Release 3.6(1)

Release Notes for Cisco Network Data Analyzer Release 3.6(1)