Table of Contents

Understanding Types of Domains
Implementing Domains
Understanding Protocol Domains
Understanding Generic Domains

Selecting Filters for Generic Domains

Collecting Statistics for Domains
Editing Predefined Domain Definitions
Configuring Protocol Domains

Creating Port-specific Protocol Domains

Configuring Generic Domains

Defining New Generic Domains

Editing Domains
Deleting Domains

Working with Domains

This chapter describes how you create domains for agents on SwitchProbe devices and the Network Analysis Module. You can do the following tasks while working with domains:

• Use the default domains already loaded in the SwitchProbe devices that match the TrafficDirector default properties file (fw45prop for SwitchProbe devices and NAMprop for the Network Analysis Module).

• Use the Domain Editor to define a new domain, selecting from many additional predefined domain definitions that can serve as a template.

• Create a new custom domain using the Domain Editor.

The following sections contain more information:

• Understanding Types of Domains

• Implementing Domains

• Understanding Protocol Domains

• Understanding Generic Domains

• Collecting Statistics for Domains

• Editing Predefined Domain Definitions

• Configuring Protocol Domains

• Configuring Generic Domains

• Editing Domains

• Deleting Domains

Understanding Types of Domains

After you have installed a domain on an agent, you can direct the agent to collect information for specific domain. The agent collects a new set of statistics only for the traffic that matches the domain definition.

Two categories of domains are supported:

Generic domains are not limited to protocol details about a packet. For example, you can create a generic domain for any portion of a packet that you can further delineate using a filter. The Filter Editor application (see Chapter 8, "Working with Filters") lets you create filters by supplying definable variables automatically when you select the type of packet you are interested in monitoring.

Because generic domains are resource-intensive, you should use them only under the following circumstances:

• You need to view packet size distribution statistics.

• You need short- or long-term history statistics for troubleshooting. (For long-term trend reporting, Cisco Systems recommends that you use a protocol domain and logging).

• The domain definition does not fit into the typical RMON2 structure; for example, a domain for all traffic that originates from a specific server on your network, or if you want to view traffic by IP subnets rather than by IP addresses.

Implementing Domains

After you boot a SwitchProbe device, the device immediately can monitor a wide range of protocols. SwitchProbe devices and Network Analysis Modules boot with many predefined domains based on common protocols (the domains on the Network Analysis Module are different from those on the SwitchProbe device). The TrafficDirector software ships with many more available in the Add Domain list. However, you may need to define additional protocols used on your network. To do this, you use the Domain Editor to create domains so they appear as available domains when you define agent properties files.

Understanding Protocol Domains

Protocol domains track information found at network layers above the data-link layer of the OSI model; they cannot access physical layer statistics. It is for this reason that some TrafficDirector physical layer applications like Segment Zoom cannot start when you select a protocol domain.

Each SwitchProbe device and Network Analysis Module keeps track of all protocol domains installed on the device. In addition to tracking all installed protocol domains, the SwitchProbe or Network Analysis Module's internal architecture also recognizes the base parent protocol, associated children protocols, and the encapsulation type. Each SwitchProbe device supports up to 256 protocol domains.

The Domain Editor also lets you create port-specific protocol domains for well-known UDP and TCP ports. If activity has been discovered on a new UDP or TCP port (possibly from a custom application), you can create a new domain to monitor activity and users. Two additional domain types---TCPAPP and UDPAPP---are provided as dialog box options to speed the configuration process for the most commonly created protocol domains. For more information, see "Creating Port-specific Protocol Domains."

You can also view statistics related to multiple domains simultaneously, using multidomain views in many of the real-time, protocol-level monitoring applications such an TopN Talkers and All Conversations. The multidomain view is a technique for displaying information from multiple domains for viewing in graphs and reports. These pseudo protocol domains---ALLNL and ALLAL---represent filtering on the TopN Matrix group, and they are automatically created.

Understanding Generic Domains

Generic domains provide a different way to display data. For example, if you want to track IP traffic by subnet address rather than individual IP addresses, you would create a generic domain.

You can create a generic domain in subnet mode based on the IP filter and enable the host group. This generic domain could show traffic by IP subnet in such applications as All Talkers and TopNTalkers. You can also enable logging for hosts and conversations to allow for reporting and trend analysis of the IP subnet traffic.

Generic domains also let you monitor a logical data stream formed by packets that match filters specified in the domain definition. A filter is really a logical bit pattern the SwitchProbe device uses to compare every packet it sees on the selected interface. If a packet contains information that matches the filter, it is recognized as traffic for that generic domain.

Selecting Filters for Generic Domains

While the filtering capabilities of a generic domain provides great flexibility, it also restricts the number of generic domains you can install on an agent. The maximum number of filters per agent is 32.

If you wish to have a single filter per domain on an agent, the maximum number of generic domains you can install on the SwitchProbe device is 32. But because you can define up to eight filters per generic domain---you could be limited to only four domains in the device if you choose eight filters for each domain. If you apply filters to a WAN interface, they are also propagated across both DTE and DCE.

This configuration limitation is important to remember when you edit filters that are already installed on SwitchProbe devices, or when you are installing new ones. See "Configuring Generic Domains" for more information about selecting the filters that define the domain.

Collecting Statistics for Domains

Both protocol and generic domains collect one or more sets of statistics. The kind of statistics to be collected are defined when you install the domain on the agent.

Table 5-1 shows the primary statistics supported for both protocol and generic domains, and the RMON1 and RMON2 groups associated with each.

Table 5-1: Types of Statistics Collected for Domain

Statistics Group	Protocol Group	Generic Group
Statistics	RMON2 Protocol Distribution	RMON1 Statistics
Short-Term History		RMON1 History
Long-Term History		RMON1 History
Host	RMON2 Network Layer and Application Layer Host	RMON1 Host
Conversation	RMON2 Network Layer and Application Layer Matrix	RMON1 Matrix
Application Response Time (ART)	ARTMIB

Editing Predefined Domain Definitions

The TrafficDirector application ships with a wide variety of predefined domain definitions; therefore, using the Domain Editor to create completely customized domains is less cumbersome, as you can use the basic definitions to address most needs.

The predefined domain definitions shipped with the TrafficDirector software are listed in Table 5-2:

Table 5-2: Predefined TrafficDirector Protocol Domains

Domain	Members
AppleTalk	AEP, AFP, ARP, ASP, ATP, DSP, LAP, LDDP, NBP, PAP, RTMP, RTREQ, SDDP, ZIP
DEC	CLUST, CTERM, DIAG, DAP, DRP, FOUND, LAT, MOPDL, MOPRC, NICE, NET, NSP, SCP, STP
IP	AOL, ARP, ATIP_AEP, ATIP_NBP, ATP_RTP, ATIP_ZIP, BGP, BGP_TCP, BOOTPC, BOOTPS, CCMAIL, COMPUSRV, CICCOGDP, DBASE, DLSW_RD, DLSW_WR, DNS_TCP, DNS_UDP, DOOM, EGP, FINDER, FTP_DATA, FTP_CRTL, GGP, GOPHER, HTTP, HTTPS, ICMP, IGMP, IGRP, INGRESQL, IPIP, IPIP4, IPV6, IPX1_TCP, IPX1_UDP, IPX2_TCP, IPX2_UDP, IP_LLC, IRC, MOBIPAGT, MOBIPMGR, MS-DNS_T, MS-DNS_U, MS-WINS, MSSNASRV, MSSQLMON, MSSQLSRV, NB_NS_T, NB_DGM_T, NB_SSN_T, NETB_DGM, NETB_NAM, NETB_SSN, NETVIEW, NETV_RCV, NETV_SND, NEW_TCP, NEW_UDDP, NNTP, NOTESTCP, NOTESUDP, NTP, NW-CS_T, NW-CS_U, NW-LU62T, NW-LU62U, ORACLSQL, OSPF, POP3, PORTMAP, RARP, REALAUD, REXEC, RFE_TCP, RFE_UDP, RIP, RLOGIN, RPRINT_T, RPRINT_U, RWHO, SIPP-ESP, SIPP-AH, SMTP, SNMP, SNMPTRAP, SOCKET, SQLNET, SQLNET_N, SQL_SVR, SUN_NFS, SUN_MOUNT, SUNRPC, SUNRPC_T, SUN_YP, TCP, TELNET, TFTP, UDP, VIP, WTCOMSQL, XWINDOW, XWIN_UDP
IPX	IPX_ETH, IPX_LLC, IPX_SNP, NOTESIPX, NCP, NOV_ERRP, NOV_NETB, NOV_NLSP, NOV_PING, NOV_RIP, NOV_SAP, NOV_SNMP, NOV_SPX, NOV_TRAP, NOV_WAN2
NetBEUI	IBM_NETB, NETB, NET
VINES	VINESARP, VINESICP, VINESIP, VINESIPC, VINESMAIL, VINESMM, VINESRTP, VINESSPP, VINESST, VIN_ETH, VIN_LLC, VIN_SNAP
SNA	SNA_FM, SNA_GW, SNA_PS, SNA_RU, SNA_TCP, SNA_TH, SNA_XID
XNS	XNS_ECHO, XNS_ERRP, XNS_IPX, XNS_PEP, XNS_RIP, XNS_SPP, XNS_SPX

You can also add these domains to any properties file so they can be evaluated for statistical compilations through the Add Domain option in the Properties Editor.

• appgrp.cfg---To add domain names or groups to the application layer domains lists.

• protogrp.cfg---To add domain names or groups to the protocol layer domains lists.

• domtree.inf---To add domain names or groups to the file interpreted by the Protocol Zoom application.

• There are no configuration files that you can edit for the traffic mode display; if you create a new generic domain using the Domain Editor, it is automatically displayed in the Domain Name list.

Configuring Protocol Domains

You use the Domain Editor to define new protocol domains to track specific traffic classified by network- and application-layer protocols. Protocol domains have several advantages:

• Because protocol domains require fewer resources from the agents that use them, you can deploy protocol domains in large numbers.

• Protocol domains handle Host and Conversations more efficiently. Instead of every domain creating its own set of host and conversation tables, all protocol domains on a given interface share a common set of network- and application-layer host and conversation tables.

As you define a new domain, you are also identifying the relationship of parent and child protocols as they map to the OSI network-layer model.

• For protocol domains, parent protocols represent the protocols you want to map to the domain at the network layer.

• Child protocols represent the protocols you want to map to the domain at the application layers.

To define a new protocol domain, follow these steps:

Step 1 Start the TrafficDirector application.

Step 2 Click the Admin radio button.

Step 3 Click Domain Editor icon.

The Domain Editor window is displayed (Figure 5-1).

The New Protocol Domain window is displayed (Figure 5-2).

Figure 5-2: New Protocol Domain Window

Step 8 Select the appropriate Datalink layer option.

• Ethernet---The corresponding index number is 0.0.0.1.

• LLC---The corresponding index number is 0.0.0.2.

• SNAP---The corresponding index number is 0.0.0.3.

• Virtual-SNAP---The corresponding index number is 0.0.0.4.

• Assigned-ID---The corresponding index number is 0.0.0.5.

• Anylink---The corresponding index number is 1.0.0.1. (To enable Hosts and Conversations, use this option. Includes all of the preceding data-link layers).

Step 12 Select the protocols you want to include.

Creating Port-specific Protocol Domains

By specifying UDPAPP or TCPAPP in the Domain Type field, you can create new protocol domains to monitor known UDP and TCP ports. For example, the Internet Relay Chat (IRC) protocol uses port 194. HTTP typically uses port 80. Table 5-3 shows examples of predefined protocol domains that are based on port numbers:

Table 5-3: Predefined Protocol Domains

This Protocol Domain...	Monitors
ccmail	Lotus cc:Mail usage
compusrv	Compuserve sessions
AOL	America Online sessions
Doom	Online interactive game, "Doom"
HTTP	HTTP client traffic using port 80

To create new port-specific protocol domains, follow these steps:

Step 1 Select one of the following from the Domain Type pull-down menu:

• UDPAPP---To create protocol domains based on known UDP ports.

• TCPAPP---To create protocol domains based on known TCP ports.

Step 2 Select Tools > New Domain, or click New on the tool bar.

Depending on the domain type you selected, the New UDP Domain or the New TCP Domain window is displayed (Figure 5-3).

Figure 5-3: New UDP Domain and New TCP Domain Windows

Configuring Generic Domains

While generic domains are powerful and flexible, they can quickly deplete agent resources if you use them in large numbers.

One reason that generic domains use more resources than protocol domains is the way they collect and store statistics---primarily Host and Conversations statistics. Because generic domains are based on RMON1, separate Host and Conversation tables are created for each domain installed on each interface.

The number of generic domains you can install on an agent varies, depending on SwitchProbe resources and the definition of each domain. You can install a maximum of 32 domain-related filters on any SwitchProbe device.

For example, this system-level limit means you could install any of the following combinations on a SwitchProbe device:

• Thirty-two generic domains with one filter each.

• Eight generic domains with four filters each.

• Two domains with eight filters each, and four domains with four filters each.

Defining New Generic Domains

To define a new generic domain, follow these steps:

Step 1 Click the Domain Editor icon in the TrafficDirector main window.

The Domain Editor window is displayed (Figure 5-1).

Step 2 Select Generic from the Domain Type pull-down menu.

Step 3 Select Tools > New Domain, or click New Domain on the tool bar.

The New Generic Domain window is displayed (Figure 5-4).

Figure 5-4: New Generic Domain Window

Editing Domains

You can change a domain definition when you want to monitor a different subset of network traffic or port number. You can also edit a previously defined domain whether it is attached to an agent or not. In this case, however, you must reinstall the domain on the agent in a properties file for the changes to take effect.

To change the definition of an existing domain, follow these steps:

Step 1 Highlight the domain from the Domain Editor window.

Step 2 Select Tools > Edit Domain from the menu bar, or click Edit Domain on the tool bar.

Step 3 Change any fields you want to modify.

Step 4 Click OK to modify the domain, or click Cancel to return to the Domain Editor window without saving the changes.

Deleting Domains

You can delete domains to remove unused or outdated domain definitions from the TrafficDirector domain list. Keep in mind this procedure simply removes the domain from the list available for adding to TrafficDirector properties files; it does not delete any domains already installed on an agent.

To deinstall domains from an agent, see Chapter 3, "Using Configuration Manager."

To delete a domain from the domain list, follow these steps:

Step 1 Select the domain you want to delete from the Domain Editor window.

Step 2 Select Tools > Delete Domain from the menu bar, or click Delete Domain on the tool bar.

A cautionary prompt is displayed, asking if you want to continue.

Step 3 Click OK to delete the domain definition.

Posted: Fri Mar 31 08:53:43 PST 2000
Copyright 1989 - 2000©Cisco Systems Inc.