Cisco Network Analysis Module

It pays to subscribe to trade magazines like Network Computing. Today I read Sean Doherty's Cisco Integrated Services Routers: When Routes Converge. Although his article was a useful introduction to two of Cisco's new products, he mentioned the Cisco Network Analysis Module. I had never heard of such a product. I should have, since Greg Shipley wrote about it in his 2002 article Cisco's Network Analysis Module Fills Monitoring Gap for Switched Networks. Greg's article, as well as Cisco's documents, are fascinating to those of us responsible for monitoring networks.

The device pictured above is the Cisco Catalyst 6500 Series NAM (NAM-1 and NAM-2), a blade for your Catalyst switch. Pictured at right is the Cisco Branch Routers Series Network Analysis Module (NM-NAM), a module for your Cisco router. The blade and module are embedded PCs that collect and present traffic and statistics on network operation. The picture shows the 20 GB HDD present in the module.

You can collect and analyze a wide variety of information via the embedded Web browser offered in the NAM. For example, the screen at left shows real-time packet capture of traffic through a Catalyst switch. I think this is absolutely incredible. As Greg reports, "using the NAM, administrators can select ports, Etherchannels or VLANs on the switch to monitor, and send data directly to the NAM blade for inspection. The NAM is unique because the monitored traffic moves directly onto the blade from the Catalyst backplane, is analyzed, and can then be viewed simply by using the embedded Web interface."

If anyone at Cisco is reading this, I would love to install a NM-NAM in my 2651XM router to test its functionality. This is just the sort of device that would make a great addition to my next book. If anyone uses these devices, please feel free to comment on them below.

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more