Table of Contents

Serial Line Internet Protocol Support

SLIP Address Selection
SLIP Configuration Overview
SLIP Configuration Tutorial

Modem Support

Modem Configuration Commands
Modem Control Strings
Control String Definitions
Modem Log
Modem Configuration Tutorial

Security Options

Data Capture
Console Logout
Access List Security

Access Levels
Address Groups
Configuring Access List Security
Disabling Access List Security
Access List Examples

Static Routes
Private Routes
SLIP Routing

SLIP Routing Configuration

Creating IP Filters for Expert Data Reduction

Downloading IP Filter Information Using dvftp
Setting IP-DATAFILTER from Command-Line Mode

Configuring SNMP Trap Ports and Destinations

Specifying Trap Ports

Cisco Discovery Protocol
FASTMIB Feature—Fast Ethernet and FDDI
Locally Administered Address—Token Ring
Roving for Full RMON Analysis

Making the Roving Connection

Advanced Features

SwitchProbe devices are equipped with a variety of advanced features that are described briefly in the following list. Detailed descriptions of each features are included later in this chapter.

• Serial Line Internet Protocol (SLIP) Support—Provides out-of-band communication between the agent and the management software through the Remote serial port.
  
  
• Modem Support—Allows the agent to dial and communicate through a modem attached to the remote serial port.
  
  
• Security Options—Provide a significantly improved level of security for access and control of the agent.
  
  
• Static Routes—Enable establishment of semipermanent static routes between the agent and management stations.
  
  
• Private Routes—Enable establishment of permanent private routes between the agent and management stations.
  
  
• SLIP Routing—Enables the SwitchProbe device to route IP traffic between the SLIP interface and the primary LAN interface.
  
  
• Expert Data Reduction—Allows you to create IP filters that determine whether to include or exclude packets for statistics collection.
  
  
• SNMP Traps—Allows you to configure the SwitchProbe device to send SNMP traps to specific ports and destination addresses.
  
  
• Cisco Discovery Protocol (CDP)—Allows network management applications to automatically discover and learn certain configuration information about network devices that support CDP protocol. The CDP function is supported on Ethernet SwitchProbe devices.
  
  
• FASTMIB Feature for Fast Ethernet and FDDI SwitchProbe Devices—Improves the tracking of RMON1 statistics at the first indication of dropped packets.
  
  
• Locally Administered Address—Allows you to define the agent MAC address in a Token Ring environment.
  
  
• Roving—Directs full RMON analysis on specific switch ports and other network device ports on demand.
  
  

Serial Line Internet Protocol Support

All SwitchProbe models support out-of-band communications through the serial port labeled Remote using Serial Line Internet Protocol (SLIP). You can use the SLIP connection as a secondary connection through which you can access all network statistics. Normally, the SLIP link is used as a backup link when the network is not operational or the agent is not accessible.

• Provides SNMP communication over a serial link.
  
  
• Forwards trap packets from a LAN to the SLIP port. When you use a modem, you can configure the agent to dial the remote node to forward the trap packet. To configure a modem, see "Modem Configuration Tutorial."
  
  
• Routes IP packets between the SLIP port and the primary LAN interface.
  
  

The serial connection can be direct through EIA/TIA-232, or over telephone lines using dial-up modems. Communications over the serial line are the same as over the LAN, except the serial line packets are encapsulated using the SLIP protocol, as specified in RFC 1055.

SLIP Address Selection

The SwitchProbe agent uses a standard IP routing algorithm to route packets to different interfaces. You should configure the agent using an IP address that is not on the same subnet as the LAN IP address. The IP addresses that appear on the SLIP interface should be in a different subnet than the LAN interface; otherwise, the agent will not be able to route the packets correctly.

SLIP Configuration Overview

To configure the SLIP interface, you must use the console or the TrafficDirector Remote Login application.

SLIP Configuration Tutorial

This tutorial shows the steps you must follow to configure the agent to use the SLIP port. To configure the TrafficDirector application to access the agent through the SLIP port, see the Using the Campus TrafficDirector Application publication. Consult your TCP/IP software documentation for information about configuring your IP stack for SLIP.

Step 1   Connect to the agent using the Console or the TrafficDirector Remote Login application.

After connecting to the agent, the following configuration menu is displayed:

Step 2   Change the selected interface.

You must select the serial interface before you can configure it. The selected interface is shown across from menu item 8. In this example, the selected interface is Ethernet.

Change the selected interface by entering 8 and pressing Enter.

Step 3   Select the item that corresponds to the serial interface.

In this example, enter 2 and press Enter to select the serial interface. The configuration menu reflects the serial interface settings.

Step 4   Change the IP address of the agent by entering 1 and pressing Enter.

Step 5   You are prompted to enter the new address.

Enter the address and press Enter.

The following example illustrates changing the IP address to 78.20.1.1:

---

Note The change to the IP address does not take effect until after you reset or power-cycle the device. This is necessary to continue communication with the agent with its initial address. When a new session is initiated, the device is accessed using the new address.

---

---

Note A subnet mask is automatically inserted by the program, depending on the IP address entered. You can change the subnet mask in the next step.

---

Step 6   Change the agent's subnet mask by entering 2 and pressing Enter.

Step 8   Change the default gateway address of the agent by entering 3 and pressing Enter.

Step 10   Set the speed of the serial interface by entering 6 and pressing Enter.

For more information about resetting the SwitchProbe agent, see "Resetting a SwitchProbe Device Agent" in "Configuration."

Modem Support

Before the SwitchProbe agent can use a modem through the Remote serial port, SLIP must be configured correctly. The agent supports Hayes-compatible modems connected to the Remote serial port for SLIP connections with remote management stations.

Modem Configuration Commands

You configure the modem through the agent console using command-line mode. For more information about command-line mode, see ""Command-Line Mode."

To access command-line mode, follow these steps:

Step 1   Connect to the agent through the console or through the TrafficDirector Remote Login application.

Step 2   Enter 11 to access the command-line mode and press Enter.

The object name for modem options is modem. To get help on modem options, use the
help modem command, as shown in the following example:

To display all modem parameters, use the get modem command, as shown in the following example:

Modem Control Strings

Modem control strings are ASCII strings used to initialize and communicate with the modem.

You can use the # character as a delimiter for strings.

Control String Definitions

Modem control strings are defined in the following section. For an example of the modem control string, see "Modem Configuration Tutorial." The modem control strings are described briefly in the following list:

• init_string—An initialization string used for the modem; sent when the modem is first initialized and controls the general operation of the modem.
  
  
• hangup_string—This string is sent to the modem if a connection is made and the agent must disconnect.
  
  
• connect_string—Used by the agent to compare text received from the modem. A match indicates a connection was made.
  
  
• noconnect_string—Used by the agent to compare text received from the modem. A match indicates a connection was not made.
  
  
• phone_number1—Sent to the modem to instruct the modem to dial out to make a connection. This string should include the dial command and the telephone number. This is the primary telephone number.
  
  
• phone_number2—A secondary dialing string used by the agent if the primary telephone connection (phone_number1) fails. The primary telephone number is retried for a number of times specified by the connect_retry string before this string is used.
  
  
• connect_protocol—Used by the agent to connect to the network after the modem has established a connection. This string handles the login name and password.
  
  
• connect_time—After the agent dials a number, it waits for connect_time (in seconds) for a connection before it retries the number. The default value is 30.
  
  
• connect_retry—The agent retries the primary telephone number (phone_number1) for this many times before it switches to the secondary telephone number (phone_number2). The default value is 10.
  
  
• disconnect_time—The agent, after making a connection, disconnects if no data is sent by the agent for the number of seconds equal to disconnect_time. The default value is 30.
  
  

Modem Log

To aid in debugging, all messages to and from the modem can be logged to the event log. This can be enabled and disabled through the agent_options object.

The following example shows how to turn off the modem log:

Modem Configuration Tutorial

This tutorial illustrates the modem configuration process. Any entries you make for modem configuration take effect immediately without rebooting the agent.

While the modem commands in this example are intended to work on almost any Hayes-compatible modem, each modem is different. Consult your modem documentation for the correct commands. The initialization string is especially dependent on the specific modem type.

To configure the modem through the agent console using the command-line mode, see "Command-Line Mode."

Step 1   Access command-line mode by connecting to the agent through the console or through the TrafficDirector Remote Login application.

Step 2   Enter 11 to access command-line mode and press Enter:

Step 3   Use the get modem command to review the existing configuration:

Step 4   Enter the modem initialization string "AT S0=1^M".

---

Note Enter the command exactly as shown. You must use quotes if there are spaces between the characters in the string. Note the two extra ^M characters at the end of the string. This is the carriage-return to the modem that indicates the end of the string. This is very important. If you forget to use this string, the command is not processed. This string is automatically sent to the modem when the agent is booted.

---

Step 5   Set the modem hangup string to "^2+++^2ATH0^M".

Step 7   Set the modem noconnect string to match the message your modem sends when it fails to make a connection.

Step 12   Set the modem secondary phone number to dial 1-555-123-1111.

After the connection is made by the agent, if data is not sent for more than disconnect_time, then the agent disconnects the connection.

Security Options

When you select Security Options from the Agent Configuration Utility main menu, four options appear in a sub-menu. These options allow you to configure security-related functions in the SwitchProbe device:

• Change admin_password—All SwitchProbe devices are shipped with no admin password. By default, you do not need to enter a password to access the Agent Configuration Utility on a local console to view the utility's settings and enter new values in the utility's settings.
  
  

  This option allows you to establish or modify a password required to access the Agent Configuration Utility on a local console or using the TrafficDirector Remote Login application to view the utility's settings and enter new values.

• Change user_password—All SwitchProbe devices are shipped with no user password. By default, you do not need to enter a password to access the Agent Configuration Utility on a local console to view the utility's settings.
  
  

• Change capture slice size—All SwitchProbe devices are shipped with a default capture slice size of 4096.
  
  

• Toggle data capture—All SwitchProbe devices are shipped with this option turned on. By default, each SwitchProbe device can capture each packet that the device sees on any attached segment.
  
  

  Because some packet data might be sensitive in nature, this option allows you to disable the data capture ability.

  This option can be toggled off (disable data capture) using the TrafficDirector Remote application or from a local console. As an added security feature, after this option is toggled to off, it can only be toggled on from the local console.

Data Capture

Data Capture enables a SwitchProbe device to collect selected packets for later decoding and analysis. You can use the TrafficDirector Protocol Decode application to upload them to the client software for seven-layer protocol analysis.

Console Logout

This function is a security feature designed to secure an unattended password-protected SwitchProbe device.

If a user or admin password has been assigned to the SwitchProbe device, the Console Logout function will immediately end your Agent Configuration Utility session and display a prompt to enter a user or admin password. This function is useful for authorized users (using a password) of a SwitchProbe device to temporarily log out of the SwitchProbe device without exposing the SwitchProbe device to unauthorized use.

Access List Security

All SwitchProbe models support the SNMP community mechanism for security. Stations attempting to access the SwitchProbe device must know the read community name to have read access, and must know the write community name to have write access.

All SwitchProbe models also support an access list that controls which IP address groups are allowed access, and what level of access they have. The access list allows four different groups of access; you can assign each group a different access level.

Access Levels

The access levels are shown in Table 10-1. When an address matches more than one group in the access list and qualifies for rights at more than one level, the access level with the highest priority number is granted.

Address Groups

You can define a maximum of four different groups and access each group with a different access group. An address group can be an individual IP address or a group of addresses, defined by the network address and network mask:

• Network address—IP or network or subnet address of all nodes allowed to access the agent.
  
  
• Network mask—Mask for the network address, network, or subnet address. The mask field is used to distinguish what type of address is specified in the IP network address field. For a single IP address, the mask is 255.255.255.255.
  
  

When an SNMP request is received from a node, its source IP address is logically ANDed with the mask. The result of the logical AND is compared with the network address field.

If the comparison is successful, that group's access level is granted to that node. However, the node can match multiple entries in the access list. When a node matches multiple access levels, the access level with the highest priority is used.

Use the following guidelines for specifying masks:

Configuring Access List Security

To configure Access List Security, follow these steps:

Step 3   To display instructions for displaying and changing the SNMP access list, use the help access_list command and press Enter:

Step 4   Use the get command to view the current access list.

Step 5   Use the set command to change the access list.

---

Note When setting an entry in the access_list, the first entry should always be with read/write (rw) access. When deleting an entry from the list, you should leave at least one entry with rw access.

---

---

Note Any changes to the access_list are effective immediately. Use care when changing the access level using the TrafficDirector Remote Login feature. If you change the access level of the node used for Remote Login, the communication might be terminated as soon as you enter the command.

---

Disabling Access List Security

Your SwitchProbe device is shipped with the Access List Security feature disabled by default. All entries in the table have no access and the SNMP security feature is disabled.

To clear the access list, use the following command:

You can also create an entry in the table with an IP network address of 0.0.0.0, a mask of 0.0.0.0, and the level as rw, allowing all nodes to read/write to the agent:

Access List Examples

Access list examples are shown in Table 10-2 and Table 10-3.

Static Routes

SwitchProbe devices support the addition of static routes through the local or remote console. A static route is volatile and is deleted when the device is power-cycled.

Static routes are configured through the agent console using the command-line mode. For more information on command-line mode, see "Command-Line Mode." You can access command-line mode by first connecting to the agent through the console or through the TrafficDirector Remote Login application.

Enter 11 and press Enter.

In command-line mode, enter the help route command and press Enter to display a complete set of the routing commands:

The following command deletes the previous static route:

Private Routes

You can configure SwitchProbe devices to have private routes that are stored in NVRAM and configured in the agent route table at boot time. NVRAM can hold four private routes, each containing three fields—IP/Subnet address, mask for the IP/Subnet address, and gateway for the route.

You configure private routes through the agent console using command-line mode. For more information about command-line mode, see "Command-Line Mode."

You access command-line mode by connecting to the agent through the console or through the TrafficDirector Remote Login application.

Enter 11 and press Enter.

Use the help proute command to display a complete set of the private route commands:

Use the set proute command with the entry number, network address, mask, and gateway to change the private route table. In the following example, all packets destined for IP subnet 45.20.0.0 are sent to 192.10.10.20:

To invalidate a private route entry, use the set proute command followed by the entry number and the parameter no. The following example invalidates private route entry 1:

To clear all private route entries, use the clear proute command:

SLIP Routing

A SLIP mini-routing feature is supported in all SwitchProbe devices. This feature allows trap messages from the network to be forwarded to remote management locations through the SLIP interface. It allows access to the network through the SLIP port for telnet and other IP-based activities. This feature be useful if the network segment is otherwise inaccessible.

The primary interface (for example, interface 1) has a secondary IP address used to make the agent act as a pseudo-IP router and for routing. If the mini-routing option is enabled, the agent routes all IP packets from the SLIP port to the LAN, and vice versa.

The pseudo-routing function works only on IP packets; all other packets are not affected. When the IP packet reaches the SwitchProbe device, the firmware forwards it to the IP task. The IP task checks if the packet is intended for itself. If it is not intended for itself, and if the SLIP route option has been enabled, the IP packet is transmitted on the LAN interface after substituting the source IP address with the secondary IP address.

SLIP Routing Configuration

You enable and disable SLIP routing using the agent console in command line mode. For more information about command-line mode, see "Command-Line Mode."

You can access command-line mode by connecting to the agent through the console or through the TrafficDirector Remote Login application. Enter 11 and press Enter:

SLIP routing is controlled by the slip_ip option in the agent_options object. To view the current setting, use the following command:

To enable SLIP routing, use the following command:

Creating IP Filters for Expert Data Reduction

You can create and download IP filters to SwitchProbe devices that determine whether to include or exclude packets from particular IP addresses. You can configure your SwitchProbe device to collect only packets from those hosts you want to monitor, eliminating unwanted hosts and conversations. To do so, you must provide the SwitchProbe device with the network address and mask of the hosts you want to include or exclude. There are two ways to provide the SwitchProbe device with this IP filter information:

• Download the information using the TrafficDirector dvftp utility.
  
  
• Pass the information directly to IP-DATAFILTER using the set command.
  
  

Downloading IP Filter Information Using dvftp

You download the required IP filter information by specifying the information in a text file, then passing the file as a parameter to the dvftp utility. This text file consists of lines in the following format:

For example:

In this example, the SwitchProbe device includes (I) for collecting all packets from host 204.240.x.x, and excludes (E) all packets from host 10.20.10.x.

Use the following command to run the dvftp utility:

dvftp agentname filename IP-DATAFILTER

agentname—The name defined for the agent when adding it to the client software. The dvftp utility downloads the DLCI information to the interface number you specified when you added the agent to the TrafficDirector application.

filename—The text file containing the IP filter information. If you do not specify a path, dvftp searches for the file in the $NSHOME/usr directory.

Setting IP-DATAFILTER from Command-Line Mode

As an alternative to using the dvftp utility for IP filter configuration, you can directly set the contents of the IP-DATAFILTER object from the command line. To do so, follow these steps:

Step 1   Access the Agent Configuration Utility.

Step 2   Enter 11 to access command-line mode and press Enter.

Step 3   Enter the following command:

For example, the following command configures interface 3 to exclude for collection all packets from host 10.20.10.x. You use the get command to check the IP-DATAFILTER information:

Configuring SNMP Trap Ports and Destinations

SwitchProbe devices generate SNMP traps as a result of alarm thresholds being crossed or changes in PVC status. You configure both the port(s) and destination addresses you need for SNMP traps.

Specify the port you want the agent to send traps to using the command-line object trap_port.

Specify the hosts to which you want the agent to send traps by maintaining the trap destination table using the TrafficDirector dvadmin utility.

Specifying Trap Ports

By default, all SNMP traps that the SwitchProbe device generates are sent to the TrafficDirector application at port 395. You can also configure the device to send traps to port 162, or to both ports.

The trap_port object contains the number of the port to which the SwitchProbe device sends SNMP traps. This object can contain the following values:

• 395 (default)
  
  
• 162
  
  
• Both 395 and 162
  
  

To specify the ports to which you want the SwitchProbe device to send all SNMP traps, follow these steps:

Step 1   Access the Agent Configuration Utility.

Step 2   Enter 11 to access command-line mode and press Enter.

Step 3   Do one of the following:

• To direct all traps to port 162, use the following command:
  
  

  set trap_port 162

• To direct all traps to port 395, use the following command:
  
  

  set trap_port 395

• To direct all traps to both port 395 and port 162, use the following command:
  
  

---

Note Use the TrafficDirector dvadmin utility to maintain the agent's trap destination table and specify IP addresses to which you want the SwitchProbe device to send SNMP traps. For more information about the dvadmin utility, see the Using the Campus TrafficDirector Application publication.

---

Cisco Discovery Protocol

The Cisco Discovery Protocol (CDP) function is supported on Ethernet, ATM, Multiport Fast Ethernet, Fast EtherChannel, and Multiport T1/E1 WAN SwitchProbe devices.

FASTMIB Feature—Fast Ethernet and FDDI

All Fast Ethernet and FDDI agents include a FASTMIB feature that allows you to configure the device to improve the tracking of RMON1 statistics at the first indication of dropped packets.

• When you enable the FASTMIB feature and the device starts dropping packets, it indicates that greater emphasis is placed on tracking RMON1 statistics than RMON2 statistics. As a result, the device can continue tracking MAC-layer statistics during periods of extremely heavy use.
  
  
• When you disable the FASTMIB feature and the device starts dropping packets, it indicates that less emphasis is placed on tracking RMON1 statistics. The FASTMIB feature is enabled by default.
  
  

To change the FASTMIB feature, follow these steps:

Step 4   Enable or disable this feature as follows:

Locally Administered Address—Token Ring

The setting of a locally administered address is a feature available on a Token Ring interface only. To identify the location of the SwitchProbe device, you can assign a locally administered address (LAA) that changes the MAC address of the Token Ring interface. You configure the LAA using command-line mode on the agent console.

To configure the LAA, follow these steps:

Step 1   Access the Agent Configuration Utility main menu.

Step 2   Enter 11 to access command-line mode and press Enter.

Step 3   Enter the following command:

set mac_addr <local area address>

The Agent Configuration Utility main menu is displayed again. The new values will not take effect until you reset the SwitchProbe's agent. To reset the SwitchProbe's agent, see "Resetting a SwitchProbe Device Agent" in "Configuration."

---

Note After a locally administered MAC address becomes effective, and you want to use the interface's original MAC address (as assigned by Cisco Systems), you must set the local MAC address to 00-00-00-00-00-00.

---

Roving for Full RMON Analysis

You can set up the SwitchProbe device as a roving agent to achieve full RMON analysis on a specific switch port or other network device port on demand.

Roving is used in conjunction with mini-RMON. For example, you can set up an external proxy agent to provide continuous mini-RMON support for all ports, then use the same agent as a roving agent to achieve full RMON analysis on a particular port on demand.

Although you can use a single SwitchProbe model as a proxy RMON agent and a roving agent, they are two separate features—both are dependent on the device being monitored. For example, a network device might support proxy RMON but not roving.

• There is an analyzer port, or a port that is not transmitting network traffic that you can designate as an analyzer port.
  
  
• The device supports mirroring, which is the ability to direct a copy of traffic from a monitor port to an analyzer port where the roving SwitchProbe device can view that traffic.
  
  

Making the Roving Connection

Roving RMON involves a physical connection between the SwitchProbe device and the switch. Typical roving RMON configuration for a switch includes using one or more switch ports as a monitor port and one switch port as an analyzer port. The monitor port is the port on which you want to examine traffic; the analyzer port is the port where an external SwitchProbe device connected to the switch views that traffic.

You can use any dual-port SwitchProbe device as a roving agent. The agent ports must be of the same media type and configured as shown in Table 10-4.

Posted: Wed Oct 2 08:29:40 PDT 2002
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.