Types of Traffic Analyzers

Like protocol decoders, traffic analyzers are available in various forms. Some are hardware-based devices designed expressly for capturing and analyzing traffic. Such devices are often built using standard PC hardware and network cards that meet stringent performance criteria. Other solutions are software based. While software-based solutions are not suitable for high throughput networks, this type of solution provides improved flexibility by enabling administrators to install the traffic analyzer on an existing PC or laptop. In both cases, the traffic analyzer is connected to a switch using a signal splitter or the SPAN/RSPAN features on switches produced by Cisco Systems. Traffic analyzers are generally not connected in-line.

Cisco Systems offers three additional options for traffic analysis. The MDS9000 family supports in-line analysis of FC and SCSI traffic via the Storage Services Module (SSM). The SSM can analyze only the traffic that passes through the SSM, so the hosts or storage arrays to be analyzed must be connected to the SSM. The SSM has traffic analysis capabilities built into the Application Specific Integrated Circuits (ASICs) that process and forward FC frames. This type of in-line solution supports the highest performance of any traffic analysis solution. Another option for the MDS9000 family is to use the SPAN/RSPAN features. By spanning traffic to a PAA, all traffic passing through the FC fabric can be analyzed. The PC to which the PAA is attached must have the Cisco Traffic Analyzer installed. The Cisco Traffic Analyzer is a software-based tool. The third option is to copy traffic to a NAM installed in a Catalyst switch using the SPAN/RSPAN features. Conceptually, the NAM is similar to the hardware-based traffic analyzers described in the previous paragraph. However, the NAM supports much higher performance because it is directly connected to the crossbar in the switch. The NAM also supports basic traffic analysis using a suite of RMON-based MIBs.