Table 1 shows the user-settable tables. Included is the default size in rows/variable entries, bytes used by a single entry, total bytes used at the default setting, and the number of bytes used when you set the table to the maximum size of 200,000 entries.

Table 1: User-Settable Tables

Parameter/Table		Default Table Size Setting	Bytes Per Table Entry	Memory Used by Default Setting	Memory Used for 200K Table Size
NL hosts		4000	100	400,000	20,000,000
AL hosts		8000	50	400,000	10,000,000
NL conversations		6000	80	480,000	16,000,000
AL conversations		12000	30	360,000	6,000,000
	Total per interface memory (non-WAN)			1,640,000	52,000,000
DLCI NL conversations		6000	30	180,000	6,000,000
DLCI AL conversations		12000	30	360,000	6,000,000

New Features in SwitchProbe Release 4.7

The following sections contain brief descriptions of the new features in SwitchProbe Release 4.7.

ART MIB Enhancements

There are several improvements to the ART MIB software option, including:

Tracking of half-closed TCP connections—all data is counted by ART MIB despite the state of the connection.
Monitoring of NFS-over-UDP requests.
Tracking TCP acknowledgments that do not have new client data.
Tracking server-to-client data transfers, including acknowledgments in the closing packets.
Handling of duplicate requests.
Tracking X Windows server response time maps (X Server/X Client to
TCP Server/TCP Client requests).
Users of Fast Ethernet and Multiport Fast Ethernet SwitchProbe devices can support ART capabilities on interface 49 or individual Fast Ethernet interfaces for aggregating requests.
Using an ART filter, the ART MIB can now exclude certain hosts from ART evaluation to support a finer degree of analysis. You can now specify a maximum of 20 hosts to exclude using the art_filter command.

Application Recognition

You can track additional protocols with the enhanced logic of the proxyapport command. You can also exclude certain data from traffic analysis.

With the proxyapport command, a SwitchProbe device can aggregate data from a range of port numbers rather than only one port, and redirect the data to one proxy port. This feature is designed for those applications (such as SAP) that use multiple ports.

To track the additional protocols, you specify the address of the server running the protocol.

You can also include or exclude certain ports from the range of ports you specify for a particular application. You can specify a maximum of 20 ports for a specific agent.

Caution Any proxy ports you defined using previous firmware releases are lost when you upgrade to Release 4.7.

ATM Enhancements

The following ATM enhancements are included in this release:

VPI/VCI extended capabilities—You can now monitor permanent virtual circuits (PVCs) on OC-3 ATM SwitchProbe devices that require more than 10 bits for VPI:VCI analysis if they include all unique VPIs or VCIs in their configuration.
PVC ifSpeed enhancement—You can now specify the speed on a VPI:VCI pair on OC-3 ATM and DS-3 ATM SwitchProbe devices. You can view utilization of PVCs
as a percentage of the base interface speed.

WAN Decompression Support

This new licensed software option lets Multiport T1/E1 WAN SwitchProbe devices monitor a WAN link that contains compressed data.This is a hardware-based compression—the device internally decompresses the WAN traffic being monitored.

SwitchProbe Release 4.7 supports only these compression types:

Van Jacobsen Header compression for TCP/IP (RFC 1144)—Compresses TCP/IP traffic consisting of small packets with only a few bytes of data (such as Telnet).
Per-packet compression using STAC/Hi-Fn compression (RFC 1974)—Compresses each packet and is used on links with poor integrity. The dictionaries are initialized for each compression/decompression sequence.

Per-packet compression—After the option is enabled, it synchronizes at the next cycle.
Link compression—After the option is enabled, the entire link must be shut down and brought back up while the SwitchProbe device is running so the option can synchronize. The synchronization process is performed by first analyzing the packets passing over the link so it can correctly set up compression and decode the packets.

Note Predictor compression is not supported in this release.

Note Because of the additional processing associated with decompressing a Multiport T1/E1 WAN SwitchProbe device, this option can aggregate a maximum of two T1/E1 links. This mechanism provides flexibility in monitoring mixed configurations of links with compressed and uncompressed data.

Note To monitor compressed WAN links, the maximum transmission unit (MTU) packet size (in bytes) cannot exceed 1500 bytes on the router interfaces carrying the compressed WAN data.

Improved Security Access

You can now define a maximum of eight different address group entries for agent access lists (the previous limit was four). You can define address group entries as one IP address or a group of addresses.

New Software Option Licensing Scheme

Software option licenses for ART MIB, Resource Monitor, NetFlow, VLAN Monitor, Fast EtherChannel, and the new WAN Decompression option are no longer linked to the hardware MAC address.

Note If you recently purchased the software options, you must be running firmware Release 4.7 to enable the options on your SwitchProbe device.

Selective Aging of Host Data

The aging algorithm has been enhanced so you can age out (remove) transient data more quickly than the critical host and conversation data you wish to track.

For example, tracking common network maintenance activities (such as ping or ARP requests) can unnecessarily consume SwitchProbe resources. The new aging logic runs every nn minutes (where nn is user-defined). The request controls the contents of the host aging tables to free up space for monitoring only critical conditions.

If you have installed SwitchProbe devices on large backbones (more than 100,000 hosts) and you require large aging intervals for billing/logging (for example, minimum aging periods greater than three hours), the new aging option improves the quality and retention time for significant host data.

Two new RMON2 menu options support this capability:

age_check_interval—The frequency at which the host tables should be purged (typically a short duration such as five minutes)
noise_threshold—The number of bytes that a host should see in every age_check_interval to avoid data being purged after the min_aging time.
Use this value to filter out regularly occurring but insignificant bytes of data.

Note In older firmware releases, min_aging was called host_aging_frequency and matrix_aging_frequency.

The standard host and matrix table entries has been doubled from 100,000 to 200,000.

New SwitchProbe Device Offered with Release 4.7

Cisco Systems introduces the E-3 ATM SwitchProbe device with this release.

For more information about this new device, see the Cisco E-3 ATM SwitchProbe Configuration Note.

Flash Memory Support in Release 4.7

Firmware Release 4.7 supports only those SwitchProbe devices with 512K flash memory. The following SwitchProbe models (manufactured prior to August, 1998) might have either 256K or 512K flash memory:

PB6 single-port Token Ring and WAN SwitchProbe devices
All PB7 SwitchProbe devices

If your device is running Release 4.5.4 or later, you can determine the flash size by entering the command %get agent from the SwitchProbe console.

Note If the flash size is 256K, you must upgrade your device to 512K flash before you can run Release 4.7.

To upgrade PB7 SwitchProbe devices, you can purchase a flash memory upgrade kit, or trade in your device through Cisco Systems' Technology Migration Program. For more information about this program, contact your sales representative.

Caution When purchasing a PB7 flash memory upgrade kit, all configuration settings are automatically lost and are reset to factory defaults. Therefore, before you remove the existing PCC module, Cisco Systems strongly urges you to record the current device configuration settings on the worksheets provided in the Cisco SwitchProbe Flash Memory Upgrade Installation Instructions.

Note The PB6 single- and dual-port Ethernet SwitchProbe devices do not require an upgrade to the 512K flash image.

Random-Access Memory Upgrades

Some SwitchProbe devices, configured with 64 MB (or higher) of random-access memory (RAM), cannot be upgraded with the Cisco Systems memory upgrade kits because of the incompatibility of memory types (SIMMs versus DIMMs).

The RAM upgrade kits are intended only for SwitchProbe devices currently configured with 4, 8, 16, or 32 MB of RAM. For more information, see the SwitchProbe page on
Cisco Connection Online (CCO).

New Feature Limitations in Release 4.7

The following limitations are known in Release 4.7:

For packets larger than 2000 bytes on half- and full-duplex Fast Ethernet SwitchProbe devices, the wrong byte count may be received, especially when using TR-ISL.
The FDDI Ring-Map application does not work in MAC-Passive mode.
Token packets are counted incorrectly if the history interval is set to less than
30 seconds.
The network-layer-to-MAC-layer address map is not supported in the OC-3 ATM SwitchProbe device.
For each monitoring interface on ART-enabled devices, you must have a minimum of 16 MB of memory. For example, on a device with four interfaces, you must have 64 MB of memory.
On multiport devices, a data capture from one interface might show packets from other interfaces. Before generating a new data capture, you should always clear the buffer (using the Clear Buffer button in the TrafficDirector Data Capture application).
All WAN SwitchProbe devices with a large number of interfaces configured in Frame Relay mode might not respond to requests when you run any history-based application within 30 seconds after the device reboots.
Cisco WAN SwitchProbe devices only recognize CDP packets in Cisco HDLC, PPP, and Frame Relay encapsulations.

Open Caveats—Release 4.7

Table 2 lists the caveats known to exist in this release.

Table 2: Release 4.7 Caveats

DDTS Number	Description
CSCdk47293	The broadcast packets directed to LLC (0xC000FFFFFFFF) are counted as multicast packets in the TokenRingPStats table.
CSCdk47294	The TokenRingMLStatsSoftErrorReports variable does not capture line errors.
CSCdm54245	When resetting counters and reinstalling properties from the TrafficDirector application, the DCE and DTE counters are not reset. This problem affects all device families, but most particularly the ATM SwitchProbe device.
CSCdp06083	During a data capture, if the slice size is set to 0, the entire packet should be captured. Instead, only the first 1500 bytes are captured.
CSCdp73914	On Multiport Fast Ethernet devices, the etherStatsHighCapacityPkts and etherStatsHighCapacityOctets variables do not reset to 0 after rebooting the device, but maintain a high value because the 64-bit counters are not reset.
CSCdp79563	RMON2 data shows incorrect entries when the encapsulation setting on T1/E1 WAN SwitchProbe devices is different than the WAN encapsulation established on the WAN link in compression mode. The data shows SNA entries when IP packets are sent through the WAN compression link.

Documentation Updates

Note the following updates to the Cisco SwitchProbe Installation and Configuration Guide.

The Multiport Fractional WAN SwitchProbe device is no longer documented in the Cisco SwitchProbe Installation and Configuration Guide, but is still available from Cisco Systems.
The following information was inadvertently omitted from the following locations in the Cisco SwitchProbe Installation and Configuration Guide:

Chapter 7, page 7-44, "Configuring Special Interface Options—Fast Ethernet"
Chapter 7, page 7-46, "Configuring Special Interface Options—Gigabit Ethernet"
Chapter 8, Table 8-1, "Command-Line Objects"

: When enabled (the default), the toggle vlan_mode option directs the selected Fast Ethernet or Gigabit Ethernet interface to read the protocol headers of the interface and determine the VLAN ID number of each packet that passes through the interface.
: The vlan_mode option can collect RMON1 traffic (hosts and conversations segregated by VLAN ID) of the entire monitored segment (supporting Ethernet, Fast Ethernet, Gigabit Ethernet, Token Ring, and FDDI).

Note

full

only

Cisco SwitchProbe Installation and Configuration Guide

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

WWW: http://www.cisco.com
WWW: http://www-europe.cisco.com
WWW: http://www-china.cisco.com
Telnet: cco.cisco.com
Modem: From North America, 408 526-8070; from Europe, 33 1 64 46 40 82. Use the following terminal settings: VT100 emulation; databits: 8; parity: none; stop bits: 1; and connection rates up to 28.8 kbps.

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.

If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.

Table of Contents

Release Notes forSwitchProbe Release 4.7

Release Notes for
SwitchProbe Release 4.7