Planning NAM Probe deployment and configuration

Traffic volume directly affects NAM Probe CPU utilization. Before you deploy NAM, estimate the volume of the traffic to be analyzed via the traffic profile you intend to analyze.

Note: This is part of the Capacity planning guide

Basic planning of NAM Probe sizing

Compare your expected analysis requirements with the capacity and sizing limits. Based on that comparison, decide the number of NAM Probes required.

If the expected volume or complexity of traffic exceeds the performance estimates, either provide more NAM Probes or re-evaluate your requirements based on the type of analysis that NAM is to provide.

Adjust your deployment strategy based on the complexity of the traffic.

Traffic complexity is directly related to NAM Probe memory consumption. If you anticipate that the traffic to be analyzed contains large numbers of users and sessions, pay attention to the memory size available in the NAM Probes that you are going to deploy. For a high-end NAM system, always choose 64-bit NAM Probes. A 64-bit architecture can use more memory per process and it also uses multithreading more effectively.

Applies to DC RUM 2017

Re-adjust your estimates for those NAM Probes that supply data to an ADS.

NAM Probes that supply data to ADS report servers require additional CPU resources to prepare the data. These NAM Probes will have slightly lower capacity limits – even for data analysis that is not reported to the ADS.

Consider using NAM Probes in a load-sharing configuration by duplicating the data feed or using intelligent switching.

You can configure two or more NAM Probes to receive the same traffic, with each NAM Probe analyzing only a fraction of it. For more information, see NAM Probe Load Sharing.

Bandwidth between remote NAM Probe and report servers

The bandwidth required between a NAM Probe and report servers depends on the expected amount of measurement data between the devices.

Based on NAM Probe and report server performance limits, NAM Probes may generate approximately the following amounts of measurement data:

NAM Server

Up to 130 MB of raw data can be expected every five minutes, compressed to not more than 20 MB every five minutes (600 kbps) before transmission from the NAM Probe to the report server.

This calculation depends on the license used. With more decodes, there are more samples, which in turn means additional files are created and additional data is exchanged.

ADS

Applies to DC RUM 2017

Up to 300 MB of raw data can be expected every five minutes, compressed to not more than 50 MB every five minutes (1.5 Mbps) before transmission from the NAM Probe to the report server.

These are maximum numbers. Typically, one monitoring device that monitors 500 Mbps of steady traffic produces a 200 kbps stream of data that is consumed by the report server. Full-detail monitoring of every single HTTP hit for a site of the same size may increase this bandwidth to 1.5 Mbps.

NAM Probe planning examples

The following examples refer to planning NAM Probe deployments at single attachment points within the monitored network topology. They do not attempt to estimate the required number of devices to monitor an entire network at all possible attachment points.

Example: small SAP environment

Assume the traffic level of approximately 200 K operations per day and approximately 350 users, peak traffic rates of 300 Kbps.

  • After comparing the expected traffic levels with the capacity limits for SAP GUI traffic, you will see that the capacity of a single NAM Probe exceeds many times the minimum required capacity. Note that for NAM Probe sizing it is preferable to use the bytes per second figure rather than the number of operations figure.
  • No load-sharing is required.

This example is illustrated in the context of a specific network in NAM Deployment Example: Small Website and Enterprise Network.

Example: large internet-facing website

Assume that the website serves hundreds of thousands or millions of users grouped into the top 250 ISPs, accessing hundreds of URLs on dozens of web servers. The website users load nearly 20 million pages daily. The traffic levels are of the order of 2 Gbps, with 25% SSL component, 3 million operations per day, and with approximately 175 K users per day and nearly 1 million sessions.

  • After comparing the expected traffic levels (of 2 GBps) with the capacity limits for HTTP/HTTPS traffic, you will see that you will need two NAM Probes. For high-end deployments, always choose 64-bit NAM Probes.
  • You can split the traffic between the two NAM Probes using a Gigamon switch with load sharing functionality or use the NAM Probe load-sharing feature. For more information, see NAM Probe capacity considerations.

This example is illustrated in the context of a specific network in NAM Deployment Example: Large Website and Supporting Multi-Tier Infrastructure.