Initial Configuration of the NNM iSPI Performance for Traffic

The NNM iSPI Performance for Traffic Configuration form enables you to configure the different elements required for creating the network traffic monitoring environment. You can configure the Leaf Collector and Master Collector to receive the traffic data from different devices. You can create filters to filter out the unnecessary information and retain only the data that you are interested in. This topic includes the following sections:

• Configure Leaf Collector Systems
• Configure Leaf Collector Instances
• Configure Leaf Collector Sampling
• Configure Master Collectors
• Configure Flow Forwarders
• Configure Sites
• Configure Filters
• Define Filter Groups
• View Application Mapping
• View Application Mapping Groups
• Create Filter Groups and Application Mapping Rules from the Command Line
• Configure Classes of Service
• Add Top N Application Inclusion List

To use the Configuration form, you must log on to the NNMi console as an administrator.

To log on to the NNM iSPI Performance for Traffic Configuration form:

1. Log on to the NNMi console with the administrator privileges.
2. Go to the Configuration workspace.
3. Double-click NNM iSPI Performance for Traffic Configuration. The NNM iSPI Performance for Traffic form opens.
4. Log on to the NNM iSPI Performance for Traffic form with the system user account created during the installation of the Master Collector.

The following table lists the configuration tasks:

Configure the NNM iSPI Performance for Traffic

What You Can Configure	Description
Leaf Collectors	Using the Leaf Collector Systems view, you can add the details of Leaf Collector systems.
Master Collectors	Using the Master Collector Systems view, you can add the details of Master Collector systems.
Flow Forwarders	Using the Flow Forwarder view, you can add the details of Flow Forwarders associated with Leaf Collectors.
Filters	Using the Filters view, you can create filters to filter out unwanted data and retain only the information that is relevant to you.
Application Mapping	Using the Application Mapping view, you can associate different flow attributes with different applications running on your network.
Sites	Using the Sites view, you can define sites in your environment. With this configuration, you can generate traffic reports with the data obtained from specific sites.
Type of Service Groups	Using the Type of Service Groups view, you can group flow packets based on the Type of Service (ToS) values.

Configure Leaf Collector Systems

The NNM iSPI Performance for Traffic Configuration form enables you to configure multiple Leaf Collector instances to deploy on the network. You can start and configure multiple Leaf Collector instances on a single system. But before configuring individual Leaf Collector instances, it is important to add the Leaf Collector systems first in the NNM iSPI Performance for Traffic Configuration form.

The Leaf Collector Systems view displays all the configured Leaf Collector systems on the network (systems where you installed the Leaf Collector). You can open an existing Leaf Collector system to view the details of the configuration. You can modify the properties of the Leaf Collector system using this view.

To view the Leaf Collector Systems view, go to the NNM iSPI Performance for Traffic Configuration form, and then click Leaf Configuration >Leaf Collector Systems. The Leaf Collector Systems view opens.

The following table lists the tasks you can perform using this view:

Tasks performed using Leaf Collector Systems View

Task	Description
Add a new Leaf Collector system	Open a new form to add a new Leaf Collector system by clicking Add.
View the details of existing Leaf Collector systems	The view presents the details of all the Leaf Collector systems that are already added.
Edit the properties of existing Leaf Collector systems	Open a new form by clicking Open to edit the properties (such as host name, password, or port) of an existing system.
Delete a Leaf Collector system that was configured with the monitoring solution	Open a new form to delete an existing Leaf Collector from the list of configured Leaf Collector systems by clicking Open.

The following table lists the basic attributes of the Leaf Collector System view:

Attribute	Description
Collector System Hostname	The fully qualified domain name of the Leaf Collector system.
Use Encryption	If disabled, the Master Collector uses HyperText Transfer Protocol (HTTP) and plain sockets to access the Leaf Collector system. This is the default option. If enabled, the Master Collector uses secure sockets layer encryption (HTTPS/SSL) to access the Leaf Collector system. You must import certificates from the Leaf Collector to the Master Collector to use encryption to access the Leaf Collector. For more information, see the Enabling Secure Communication between the Master Collector and the Leaf Collector section in the Network Node Manager iSPI Performance for Traffic Software Deployment Reference.
HTTP(S) Port	The port number for HTTP or HTTPS access to the server on the Leaf Collector system. The default port numbers are as follows: HTTP: 11080 HTTPS: 11043. You must type this value in the HTTP(S) Port field if you select the Use Encryption option.
JNDI Port	The JNDI port number of the Leaf Collector system.
Leaf Count	Number of Leaf Collector instances running on the system.

You can add, edit, or delete Leaf Collector systems.

Add or edit Leaf Collector systems

You must configure the NNM iSPI Performance for Traffic by adding Leaf Collector instances in the Leaf Collector view. You cannot use the data provided by Leaf Collectors unless you add the Leaf Collector instances and Leaf Collector systems to the NNM iSPI Performance for Traffic views.

To add a Leaf Collector system:

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collector Systems.
2. Click Add. A new form opens.
3. In the form, specify the necessary details in the following fields:
   • Collector System Hostname: Type the fully-qualified domain name of the Leaf Collector system.
   • Leaf Password: Type the password of the system account on the Leaf Collector system (this is the password that you specified during the installation of the Leaf Collector).
   • JNDI Port: Type the JNDI port number for the Leaf Collector system. 11099 is the default JNDI port number.
   • Use Encryption: Enable this option if you want the Master Collector to use secure sockets layer encryption (HTTPS/SSL) to access the Leaf Collector system.
   • HTTP(S) Port: Type the port number of the Leaf Collector system.
     • Type the HTTP port number if you do not select the Use Encryption option. 11080 is the default HTTP port number of the Leaf Collector system.
     • Type the HTTPS port number if you select the Use Encryption option. 11043 is the default HTTPS port number of the Leaf Collector system.

   To modify the properties of a Leaf Collector system:

   1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collector Systems.
   2. Select the Leaf Collector system that you want to edit.
   3. Click Open. A new form opens. The form presents two sections:
      • Collector System Details: This section enables you to modify the properties of the system.
      • Leaf Collectors on this System: This section shows the details of all the Leaf Collectors that are running on the system.
   4. In the Collector System Details section, modify the values in the following fields:
      • Leaf Password
      • JNDI Port
      • Use Encryption
      • HTTP(S) Port
   5. Click Save & Close.

To delete Leaf Collector systems

Before you remove a specific Leaf Collector System from the environment, you must use the Leaf Collector view to delete the Leaf Collector instances configured for that system.

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collector Systems.
2. Select the Leaf Collector system that you want to delete.
3. Click Delete.

Configure Leaf Collector Instances

The NNM iSPI Performance for Traffic Configuration form enables you to configure individual Leaf Collector instances that you want to deploy on the network. You can create and configure multiple Leaf Collector instances on a single system.

Before configuring multiple Leaf Collector instances to run on a single system, make sure you have sufficient resources on the system.

The Leaf Collectors view provides you with an interface to add and modify collector instances to the view. You can delete an existing collector instance from the Leaf Collectors view. The view also displays all the configured Leaf Collector instances on the network and helps you start or stop the collector instances of your choice.

To display the Leaf Collectors view, go to the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collectors. The Leaf Collectors view opens.

recommends that you do not configure multiple Leaf Collector instances on a single Leaf Collector system.

The following table lists the tasks you can perform using this view:

Tasks performed using Leaf Collectors View

Task	Description
Add a new Leaf Collector instance	Open a new form to add a new Leaf Collector instance by clicking Add.
View the details of existing Leaf Collector instances	The view presents the details of all the Leaf Collector instances that are already added.
Edit the properties of existing Leaf Collector instances	Open a new form by clicking Open to edit the properties of a collector instance that was already added.
Delete a Leaf Collector instance that was configured with the monitoring solution	Open a new form to delete an existing Leaf Collector instance from the list of configured Leaf Collector instances by clicking Open.

The following table lists the basic attributes of the Leaf Collectors view:

Leaf Collector Attributes

Attribute	Description
Collector Name	The name of the Leaf Collector instance.
Status	The status of the Leaf Collector system.
IP	The IP address of the Leaf Collector system. The default value is 0.0.0.0.
Collector Type	The type of Leaf Collector instance running on the system. Possible values are: Netflow Sflow JFlow IPFIX
Container Hostname	The Fully qualified domain name of the system that hosts the collector instance.
Listen Port	The Port where the collector instance listens for incoming traffic packets.

You can add, edit, or delete Leaf Collector instances by using this form.

To add Leaf Collector instances:

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collectors.
2. Click Add. A new form opens. The form shows the following two different sections:
   • Leaf Collector Details: You must specify the necessary details of the collector here.
   • The other section shows multiple tabs to display additional properties associated with the collector.
3. In the Leaf Collector Details section, specify the values in the following fields:
   • Collector Type: Select one of the following collector types:
     • netflow: Select this option, if you want the new Leaf Collector to process NetFlow traffic.
     • ipfix: Select this option, if you want the new Leaf Collector to process IPFIX traffic.
     • sflow:  Select this option, if you want the new Leaf Collector to process sFlow traffic.
   • Listen Port: Specify the port where the collector listens for incoming flow packets (must be in the range of 1024-65535).
   • IP: Type the IP address of the Leaf Collector system. The default value is 0.0.0.0.

   • Store Flow in File: Select true if you want to store the incoming flow packets in a file on the Leaf Collector system.

     Use this feature only for troubleshooting. This option has a significant impact on the performance of the Leaf Collector.

     If you select true, the flow packet files are created in the following directory on the Leaf Collector system:
     On Windows:
     <Data_Dir>\nmsas\traffic-leaf\data\<Leaf_Collector_Instance>\<IP_Address_of_Source>
     On Linux:
     /var/opt/OV/nmsas/traffic-leaf/data/<Leaf_Collector_Instance>/<IP_Address_of_Source>

     In this instance:
     <Data_Dir>: Data directory that you chose during the installation of the Leaf Collector.
     <Leaf_Collector_Instance>: Name of the Leaf Collector instance.
     <IP_Address_of_Source>: IP address of the device where the flow packet originated.

   • Source IP DNS Lookup: Set this to true if you want to enable DNS lookup of the source of the flow packet.
   • Destination IP DNS Lookup: Set this to true if you want to enable DNS lookup of the destination of the flow packet.
4. Optional. Add secondary properties of the collector in the other section:
   • In the Filter Groups tab, associate a filter group with the Leaf Collector.
   • In the All TOS Groups, tab, associate a TOS group with the Leaf Collector.
5. In the All Application Mapping Groups tab, associate an application mapping group with the Leaf Collector. If you have not created any application mapping groups, you must select the DefaultAppMapGroup to be able to sort and rank metrics by applications on reports.
6. In the All Leaf Collector Systems tab, select the host name of the system where you installed the Leaf Collector.
7. Click Save & Close.

To edit a Leaf Collector instance

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collectors.
2. Select the Leaf Collector instance you want to edit.
3. Click Open. A new form opens. The form shows the following two different sections:
   • Leaf Collector Details: Lists the details of the collector.
   • The other section presents multiple tabs to display additional properties associated with the collector.
4. The Leaf Collector Details section shows the following primary properties of the collector.
   
   • Collector Type: Select one of the following collector types:
   • netflow: Select this option, if you want the new Leaf Collector to process NetFlow traffic.
   • ipfix: Select this option, if you want the new Leaf Collector to process IPFIX traffic.
   • sflow: Select this option, if you want the new Leaf Collector to process sFlow traffic.
   • Listen Port: Specify the port where the collector listens for incoming flow packets (must be in the range of 1024-65535).
   • IP: Displays the IP address of the Leaf Collector system. You cannot modify the value in this field.
   • Store Flow in File: Select true if you want to store the incoming flow packets in a file on the Leaf Collector system. Use this feature only for troubleshooting. This option has a significant impact on the performance of the Leaf Collector.

   If you select true, the flow packet files are created in the following directory on the Leaf Collector system:
   On Windows:
   <Data_Dir>\nmsas\traffic-leaf\data\<Leaf_Collector_Instance>\<IP_Address_of_Source>
   On Linux:
   /var/opt/OV/nmsas/traffic-leaf/data/<Leaf_Collector_Instance>/<IP_Address_of_Source>

   • Source IP DNS Lookup: Set this to true if you want to enable DNS lookup of the source of the flow packet.
   • Destination IP DNS Lookup: Set this to true if you want to enable DNS lookup of the destination of the flow packet.
5. Modify the secondary properties of the collector. The other pane on this form enables you to view and modify the association of the collector with existing filters, applications, and ToS groups.
   • Applied Filter groups: In the Filter Groups tab, select a filter group you want to apply on the collector or deselect a filter group that you want to dissociate from the collector.
   • Applied Application Mapping groups: In the Applied Application Mapping Groups tab, select the application group you want to apply on the collector or deselect an application group that you want to dissociate from the collector.
   • ToS groups: In the TOS Groups tab, select a ToS group you want to apply on the collector or deselect a ToS group that you want to dissociate from the collector.
   • Flow Forwarding Destinations: In the Flow Forwarding Destinations tab, select a Flow Forwarder you want to associate with the collector or deselect a Flow Forwarder you want to dissociate from the collector.
   • Flow Exporters: In the Flow Exporters tab, select a Flow Exporter you want to associate with the collector or deselect a Flow Exporter you want to dissociate from the collector.
   • Collector Statistics History: Displays the last 11 flush entries that the Leaf Collector has processed and flushed to the Master Collector.
   • Collector Health: Displays the health of the Leaf Collector. This tab lists the following details:
     • All the problems that the selected Leaf Collector encountered during its operation. The Start Time and End Time columns display the time when the problem started and got resolved.
     • Suggestions to resolve the problems
     • Status of the problems
6. Click Save & Close.

To delete Leaf Collector instances:

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collectors.
2. Select the Leaf Collector instance you want to delete.
3. Click Delete.

To start or stop a Leaf Collector instance, select the instance of your choice, and then click Start or Stop.

Configure Leaf Collector Sampling

When Leaf Collector receives a large number of flow records, you can sample the flow records to improve the performance. You can enable the NNM iSPI Performance for Traffic to sample the flow records received at the Leaf Collector based on the sampling rate and mode of sampling. When you enable sampling, the NNM iSPI Performance for Traffic processes one out of N flow records, where N is the sampling rate configured in the NNM iSPI Performance for Traffic. For more information on sampling in the NNM iSPI Performance for Traffic, see the Technical White paper Sampling Support in the NNM iSPI Performance for Traffic.

To enable Leaf Collector sampling:

1. In the NNM iSPI Performance for Traffic Configuration form, click Leaf Configuration >Leaf Collector Sampling.
2. In the Leaf Collector Sampling form, click Edit to update any of the following fields:
   

   Attribute	Description
   Sampling	Indicates whether the Leaf Collector sampling is enabled or not. Possible values are: true false Set this to true if you want to sample the flow records received at the Leaf Collector. The default value is false.
   Sampling Mode	Indicates the mode based on which the flow records are sampled when the Leaf Collector sampling is enabled. Possible values are: Random: Select this option if you want the records to be sampled randomly. Random mode enables you to sample one record out of every N records randomly. Top Flow Record: Select this option if you want the records to be sampled based on the top value of the byte counter. Top Flow Record mode enables you to sample one record (with maximum value of byte counter) out of every N records. The default value is Random.
   Sampling Rate	Indicates the rate at which the records are sampled when the Leaf Collector sampling is enabled. For example, if the value of sampling rate is five, the NNM iSPI Performance for Traffic samples one record in every five records received at the Leaf Collector.  recommends you to select a whole number from 2 through 10 as the sampling rate for better accuracy. However, the acceptable range is from 2 through 100. The default value is 3.

3. Click Save.

Configure Master Collectors

After adding all the details of Leaf Collectors in the NNM iSPI Performance for Traffic Configuration form, you must set up the Master Collector in your environment, which includes adding details such as the host name of the Master Collector system and the flush record limit of the collector in the NNM iSPI Performance for Traffic Configuration form.

You must set up only one Master Collector in your environment. However, in a GNM setup, you can add a Master Collector belonging to a different regional manager to your region.

To configure the Master Collector:

1. In the NNM iSPI Performance for Traffic Configuration form, click Master Configuration >Master Collector.

2. In the Master Collector form, click Edit to update any of the following fields:

   Attribute	Description
   Master Hostname	Indicates the hostname of the Master Collector. Type the FQDN of the Master Collector system.
   Source IP DNS Lookup	Indicates whether the NNM iSPI Performance for Traffic must perform IP DNS lookup at the source or not. Possible values are : true false Set this to true if you want to enable DNS lookup of the source of a flow packet. Do not set this field to true if you have already configured DNS lookup for sources for NNM iSPI Performance for Traffic. The default value is false.
   Destination IP DNS Lookup	Indicates whether the NNM iSPI Performance for Traffic must perform IP DNS lookup at the destination or not. Possible values are: true false Set this to true if you want to enable DNS lookup of the destination of a flow packet. Do not set this field to true if you already configured DNS lookup for destinations for the NNM iSPI Performance for Traffic. The default value is false.
   Flush Record Limit	Indicates the record limit for the NNM iSPI Performance for Traffic to flush the IP flow data records to the NPS database. After the number of records in the NNM iSPI Performance for Traffic reaches the limit specified in this field, the NNM iSPI Performance for Traffic flushes the records to NPS.
   DNS Lookup Type	Indicates whether the NNM iSPI Performance for Traffic must retrieve the IP address of the specified domain name in case sensitive manner or not. Possible values are: As-Is: The NNM iSPI Performance for Traffic retrieves the IP address for the specified domain name without converting the case of the domain name. This is the default value. Uppercase: The NNM iSPI Performance for Traffic retrieves the IP address for the specified domain name after converting the domain name to uppercase. Lowercase: The NNM iSPI Performance for Traffic retrieves the IP address of the specified domain name after converting the domain name to lowercase.
   Interface Traffic Data Flush	Indicates whether the NNM iSPI Performance for Traffic must flush the Interface Traffic data. Possible values are: Enable Flush: If you select this value, the Leaf Collector flushes Interface Traffic data to the Master Collector and the Master Collector generates the data for the extension pack Interface_Traffic. Disable Flush: If you select this value, the Leaf Collector does not flush Interface Traffic data to the Master Collector and the Master Collector stops generating the data for the extension pack Interface_Traffic. This is the default value.
   Long Term Flush Period	Indicates the period (in minutes) after which the Leaf Collector flushes the aggregated data for long term reports to the Master Collector. By default, the Leaf Collector flushes the aggregated data to the Master Collector every 5 minutes. You can modify this flush period and provide value in the range of 5 through 15.
   Short Term Reporting	Indicates whether the Interface Traffic_1_min reports are enabled or not. These reports are disabled by default. Possible values are: Enable: If you select this value, the Leaf Collector flushes the 1-minute Interface Traffic data that is aggregated every minute to the Master Collector and the Master Collector generates the data for the extension pack Interface_Traffic_1_min. Disable: If you select this value, the Leaf Collector does not flush 1-minute Interface Traffic data that is aggregated every minute to the Master Collector and the Master Collector stops generating the data for the extension pack Interface_Traffic_1_min. This is the default value. After you enable the Short Term Reporting, the Leaf Collector immediately starts flushing the 1-minute Interface Traffic data that is aggregated every minute to the Master Collector. However, the Interface Traffic_1_min reports are available only after the Interface_Traffic_1_min extension pack installation is complete.
   Noise Reduction	Indicates whether the NNM iSPI Performance for Traffic is enabled to drop the flow records that are considered as noise. Flow Records are considered as noise when the value of byte counter is less than the configured threshold value. It is assumed that such records do not affect the calculation of top contributors. Possible values are: Enable: If you select this value, flow records with value of byte counter less than the Noise Threshold value are dropped. Disable: If you select this value, no flow records are dropped. This is the default value.
   Noise Threshold	Indicates the threshold value with which the byte counter of flow records is compared when Noise Reduction is enabled. The NNM iSPI Performance for Traffic considers the flow records with value of byte counter less than this threshold value as noise and drops these records. The Noise Threshold value is in Bytes.
   Traffic Master Collector Flow Record Queue	Indicates the maximum number of flow records that the Master Collector can queue while accepting the input from the Leaf Collectors.

3. Click Save.

Configure Flow Forwarders

Flow Forwarders are configured on a Leaf Collector. This configuration enables forwarding of IP flow records to a specified location. The destination where the flow data needs to be sent is identified with the IP address and port number combination. You can configure multiple flow forwarding destinations for each Leaf Collector instance.

To configure a Flow Forwarder:

1. In the NNM iSPI Performance for Traffic Configuration form, click Flow Forwarder and Flow Producer > Flow Forwarders.
2. In the Flow Forwarders view, click Add. A new form opens with the following sections:
   • Flow Forwarder Details: In this section, you must specify the primary details of the Flow Forwarder you want to add.
   • The other section lists the available Leaf Collectors in the environment. You can use the check boxes () to associate Leaf Collectors to the Flow Forwarder.
3. In the Flow Forwarder Details section, specify the following details:
   • Flow Forwarder Name: Type the name of the Flow Forwarder.
   • Forwarding IP: Type the IP address of the Flow Forwarding system.
   • Forwarding Port:Type the port number of the Flow Forwarding system.
4. In the other section, select the check boxes () to associate Leaf Collectors to the Flow Forwarder. You can link multiple Leaf Collectors with a Flow Forwarder.
5. Click Save.

Modify Flow Forwarders

The Flow Forwarders view in the NNM iSPI Performance for Traffic Configuration form lists the configured Flow Forwarders. You can edit the properties of the existing Flow Forwarders from this view.

To modify a Flow Forwarder:

1. In the NNM iSPI Performance for Traffic Configuration form, click Flow Forwarder and Flow Producer > Flow Forwarders.
2. In the Flow Forwarders view, select a Flow Forwarder you want to edit.
3. Click Open. A new form opens with the following sections:
   • Flow Forwarder Details: In this section, you can modify the primary details of the Flow Forwarder.
   • The other section lists the available Leaf Collectors in the environment. You can use the check boxes () to modify the relationship of a Flow Forwarder with Leaf Collectors.
4. In the Flow Forwarder Details section, you can modify the following details:
   • Flow Forwarder Name:The name of the Flow Forwarder.
   • Forwarding IP: The IP address of the Flow Forwarding system.
   • Forwarding Port: The port number of the Flow Forwarding system.
5. In the other section, select the check boxes () to associate Leaf Collectors to the Flow Forwarder or clear the check boxes () to dissociate Leaf Collectors from the Flow Forwarder. You can link multiple Leaf Collectors with a Flow Forwarder.
6. Click Save.

Start and Stop Flow Forwarders

After adding a new Flow Forwarder or modifying an existing Flow Forwarder, you must start it.

To start a Flow Forwarder:

1. In the NNM iSPI Performance for Traffic Configuration form, click Flow Forwarder and Flow Producer > Flow Forwarders.
2. In the Flow Forwarders view, select a Flow Forwarder you want to start.
3. Click Start.

To stop a Flow Forwarder:

1. In the NNM iSPI Performance for Traffic Configuration form, click Flow Forwarder and Flow Producer > Flow Forwarders.
2. In the Flow Forwarders view, select a Flow Forwarder you want to stop.
3. Click Stop.

Delete Flow Forwarders

You can delete Flow Forwarders from the Flow Forwarders view in the NNM iSPI Performance for Traffic Configuration form.

To delete a Flow Forwarder:

1. In the NNM iSPI Performance for Traffic Configuration form, click Flow Forwarder and Flow Producer > Flow Forwarders.
2. In the Flow Forwarders view, select a Flow Forwarder you want to delete.
3. Click Delete.

Configure Sites

The NNM iSPI Performance for Traffic Configuration form enables you to define sites in your networking environment. You can view traffic reports for specific sites to identify site-specific performance bottlenecks in your organization's network infrastructure.

When a flow collector sends a flow packet to the Leaf Collector, the source and destination sites of the flow packet are computed by the Leaf Collector based on the sites you configure using the NNM iSPI Performance for Traffic Configuration form.

Guideline to Defining Sites

You can define a site by a specific IP address or a range of IP addresses. The NNM iSPI Performance for Traffic associates the flow with a site if the origin or destination of the flow is a system whose IP address that defines the site. You can also use the wildcard character (*) in the IP address while defining a site.

Follow these guidelines when you define sites in the NNM iSPI Performance for Traffic Configuration form:

• You can use an IP address, an IP address range, or an IP address with the wildcard character (*) to define a site.

• You can use the wildcard character in one or more (or all) octets of the IP address to define a site.

  When you use wildcard characters for all the four octets, the NNM iSPI Performance for Traffic associates the site to all flow packets collected from the network. If the IP address pattern matches the SrcIP of the flow, NNM iSPI Performance for Traffic maps it to a Source Site Name field.

• You can use an IP address range instead of a single IP address for defining a site. You can use ranges in one or more (or all) octets of the IP address. For example, 179.16.2-20.1-100.

The NNM iSPI Performance for Traffic Configuration form enables you to define, modify, or delete sites.

To define a new site:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Sites.
2. In the Sites view, click Add. A new form opens with the following sections:
   • Site Details: In this section, you must specify the primary details of the site you want to add.
   • The other section displays the list of similar sites that exist in the environment.
3. In the Site Details section, specify the following details:
   • Site Name: Type the name of the Site. Do not use any special characters other than the hyphen (-) and underscore (_).

   • Tenant: Select a NNMi tenant from the list of tenants created in NNMi.

     NNMi provides a tenant named Default Tenant and assigns each newly discovered node to the Default Tenant and the Security Group attribute value configured for the Default Tenant. As an NNMi administrator, you can create new tenants and security groups.

     You can select the following options based on the selected tenant:

     • Sites with higher, lower, or equal priority
     • Sites in the same IP range
   • Optional. Site Description: Type a description of the site.

   • Optional. Site Priority: Type the priority of the site (an integer between 0 and 65535). The NNM iSPI Performance for Traffic considers value 0 as high priority and the value 65535 as low priority.

     To view the sites with higher priority, click Show Higher Priority Sites. The Higher Priority Sites tab shows all the existing sites that have a higher priority assigned to them.

     To view the sites with lower priority, click Show Lower Priority Sites. The Lower Priority Sites tab shows all the existing sites that have a lower priority assigned to them.

     To view the sites with same priority, click Show Same Priority Sites. The Same Priority Sites tab displays all the existing sites that have the same priority assigned to them.

     NNM iSPI Performance for Traffic shows the sites with higher, lower, or same priority for the selected tenant.

   • Site IP Configuration: In this section, type the following:

     New IP/Range: Type the IP address or range of IP addresses to define the site. You can use the wildcard character (*) when specifying the IP address.
     If the SrcIP or DstIP attribute (or both) of a packet matches the IP address (or the IP address range) specified in this field, the NNM iSPI Performance for Traffic associates the packet to the site.
     For example, if you specify 172.16.*.*, flow packets with 172.16.2.1 as the SrcIP or DstIP attribute are associated to the site.

     After typing the value, click Add.

     To include more IP addresses (or IP address ranges) in the site definition, type the address or range in the New/IP Range box, and then click Add.
     
     If you specify an IP address range, click Show Sites in the Same IP Range to view the sites that are in the same IP range. The Sites in the Same IP Range tab shows sites that are in the same IP range.

     NNM iSPI Performance for Traffic shows the sites within the same IP range for the selected tenant.

4. Click Save & New to save and create another site, or click Save & Close to save and close the form.

To modify an existing site:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Sites.
2. In the Sites view, select a site, and then click Open. A new form opens with the following sections:
   • Site Details: In this section, you can modify the primary details of the site you selected.
   • The other section lists similar sites that exist in the environment.
3. In the Site Details section, you can modify the following details:
   • Site Name: The name of the Site. Do not use any special characters other than the hyphen (-) and underscore (_).

   • Tenant: Select a NNMi tenant from the list of tenants created in NNMi.

     NNMi provides a tenant named Default Tenant and assigns each newly discovered node to the Default Tenant and the Security Group attribute value configured for the Default Tenant. As an NNMi administrator, you can create new tenants and security groups.

   • Site Description: The description of the site.

   • Site Priority: The priority of the site (an integer between 0 and 65535). The NNM iSPI Performance for Traffic considers value 0 as high priority and the value 65535 as low priority.

     To view the sites with higher priority, click Show Higher Priority Sites. The Higher Priority Sites tab shows all the existing sites that have a higher priority assigned to them.

     To view the sites of lower priority, click Show Lower Priority Sites. The Lower Priority Sites tab shows all the existing sites that have a lower priority assigned to them.

     To view the sites with the same priority value, click Show Same Priority Sites. The Same Priority Sites tab shows all the existing sites that have the same priority assigned to them.

   • Site IP Configuration: In this section, you can modify the following:

   New IP/Range: The IP address or range of IP addresses to define the site. You can use the wildcard character (*) while specifying the IP address.
   If the SrcIP or DstIP attribute (or both) of a packet matches the IP address (or the IP address range) specified in this field, the NNM iSPI Performance for Traffic associates the packet to the site.
   For example, if you specify 172.16.*.*, flow packets with 172.16.2.1 as the SrcIP or DstIP attribute are associated to the site.

   After typing the value, click Add.

   To include more IP address (or IP address ranges) in the site definition, type the address or range in the New/IP Range box, and then click Add.
   

   If you specify an IP address range, click Show Sites in the Same IP Range to view the sites that are in the same IP range. The Sites in the Same IP Range tab shows the sites that are in the same IP range.

   When editing a site, the tabs in the right pane continue to show the site with its old properties. For example, if you change the priority of a site from 2 to 3, and then if you click Higher Priority Sites tab, the same site is displayed there with the priority 2. Changes take effect only after you click Save &Close.

4. Click Save & Close.

To delete a site:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Sites.
2. In the Sites view, select the site you want to delete and click Delete.
3. In the confirmation dialog box, click Delete.

Site Priority

By defining the site priority, you can configure the Leaf Collector to process site information of received flow packets in a specific order. The Leaf Collector prioritizes processing of flow packets associated with high priority sites.

Configure Filters

Filters enable to filter out flow packets that are not of your interest. The NNM iSPI Performance for Traffic Configuration form enables you to define filters to utilize only the relevant flow packets for traffic flow monitoring. The filtering mechanism of the NNM iSPI Performance for Traffic enables you to either drop or keep flow packets based on the filter definitions you create.

You can create filtering conditions using the following attributes of a flow packet:

• ProducerIP: IP address of the system where the flow collector is located.
• SrcIP: IP address of the system where the traffic flow originated.
• DstIP: IP address of the system where the traffic flow terminated.
• IPProtocol: Protocol used by the traffic flow.
• NFSNMPInputIndex: SNMP index of the egress interface
• NFSNMPOutputIndex: SNMP index of the ingress interface
• DstPort: Ingress port
• TCPFlags: TCP flag of the traffic flow
• IPToS: Type of Service property of the traffic flow

The NNM iSPI Performance for Traffic enables you to define a filter with multiple conditions by using the AND operator.

Add Filters

The NNM iSPI Performance for Traffic Configuration form enables you to add filter conditions to filter out unnecessary flow packets. Although optional, creating filters simplifies the process of analyzing the traffic flow packets by discarding irrelevant and unnecessary flow packets.

To add a new filter:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filters.
2. In the Filters view, click Add. A new form opens with the following sections:
   • Filter Details: In this section, you must specify the primary details of the filter you want to add.
   • The other section lists related details.
3. In the Filter Details section, select the filter operation.
   If you select keep, the NNM iSPI Performance for Traffic retains only the packets that satisfy the condition of the filter and discards all other packets.
   If you select drop, the NNM iSPI Performance for Traffic discards only the packets that satisfy the condition of the filter and retains all other packets.
4. You can create new conditions and delete or modify the existing conditions.
   To create a new condition:
   1. Select an attribute.
   2. Select an operator. For the ProducerIP, SrcIP, and DstIP attributes, you can choose the like, equals, or not-equals operator. For the other attributes, you can choose the =, !=, <=, or >= operator.
      The Filter Text Configuration tab in the right pane shows the condition that you define in the Filter Details section. The All Filter Groups tab shows the list of all defined filter groups.
      
   3. Specify the value to be compared.
   4. Click Add. Another row of attributes and operators appears.
   5. To add another condition, repeat the above steps. If you define multiple conditions, the NNM iSPI Performance for Traffic assigns the AND operator on them when performing the filtering action.
   6. Optional. If filter groups are already defined, you can associate the filter with a filter group from the All Filter Groups tab. By default, the NNM iSPI Performance for Traffic places the new filter in DefaultFilterGroup.
5. Click Save &Close.

Modify Filters

You can use the NNM iSPI Performance for Traffic Configuration form to edit the existing filters.

To modify a filter:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filters.
2. In the Filters view, select the filter you want to modify, and click Open. A new form opens with the following sections:
   • Filter Details: In this section, you can modify the primary details of the filter you want to add.
   • The other section lists related details.
3. In the Filter Details section, select the filter operation.
   If you select keep, the NNM iSPI Performance for Traffic retains only the packets that satisfy the condition of the filter and discards all other packets.
   If you select drop, the NNM iSPI Performance for Traffic discards only the packets that satisfy the condition of the filter and retains all other packets.
   
4. You can create new conditions and delete or modify the existing conditions.
   To create a new condition:
   1. Select an attribute.
   2. Select an operator. For the ProducerIP, SrcIP, and DstIP attributes, you can choose the like, equals, or not-equals operator. For the other attributes, you can choose the =, !=, <=, or >= operator.
      The Filter Text Configuration tab in the right pane shows the condition that you define in the Filter Details section. The All Filter Groups tab shows the list of all defined filter groups.
      
   3. Specify the value to be compared.
   4. Click Add. Another row of attributes and operators appears.
   5. To add another condition, repeat the above steps. If you define multiple conditions, the NNM iSPI Performance for Traffic assigns the AND operator on them while performing the filtering action.
5. To modify an existing condition, modify the operator or the value to be compared from an existing condition.
6. To delete a condition, click Remove next to the condition.

7. You can change the group membership of the filter from the Group Membership of this Filter tab.

   If you remove the group membership of the filter from every filter group, the NNM iSPI Performance for Traffic automatically places the filter in DefaultFilterGroup.

8. Click Save & Close.

Delete Filters

You can use the NNM iSPI Performance for Traffic Configuration form to delete the existing filters.

To delete a filter:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filters.
2. In the Filters view, select the filter you want to delete and click Delete.

Define Filter Groups

You can define filter groups to group a set of defined filters. By default, the NNM iSPI Performance for Traffic provides you with DefaultFilterGroup.

You can use the Filter Mapping Groups view in the NNM iSPI Performance for Traffic Configuration form to define new filter groups, associate filters with existing filter groups, view and modify the existing filter groups, and delete filter groups.

To view the Filter Groups view, click Filter Configuration > Filter Groups in the NNM iSPI Performance for Traffic Configuration form.

The basic attributes of the Filter Groups view are:

Attributes	Description
Filter Group Name	The name of the group.
Number of Filters	The number of filters associated with the group.

Add Filter Group

By default, the NNM iSPI Performance for Traffic provides you with a filter group—DefaultFilterGroup. You can also define new filter groups by using the NNM iSPI Performance for Traffic Configuration form.

To add a new filter group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filter Groups.
2. In the Filter Groups view, click Add. A new form opens.
3. In the Filter Group Details section, specify the name of the filter group. You can use alphanumeric characters, hyphens (-), and underscores (_).
4. The All Filters tab shows the list of all filters and their association with the filter groups. To associate a filter with the new filter group, select the select check box () next to the filter.
5.  Click Save & Close.

Modify Filter Group

You can edit a filter group's association with filters by using the NNM iSPI Performance for Traffic Configuration form. You cannot change the name of a filter group.

To modify a filter group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filter Groups.
2. In the Filter Groups view, click Open. A new form opens. The Group Members of This Filter tab shows all the existing filters and their association with all the groups.

3. To associate a filter with the group, select the select check box () next to the filter. To dissociate a filter from the group, clear the select check box () next to the filter.

   Before removing the group membership of a filter from the group, make sure the filter is associated with at least one filter group. A filter cannot exist without a membership to a group and gets automatically deleted if you dissociate it from all the existing groups.

4.  Click Save & Close.

Delete Filter Group

You can delete a filter group by using the NNM iSPI Performance for Traffic Configuration form.

To delete a filter group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Filter Configuration > Filter Groups.
2. In the Filter Groups view, select the filter group you want to delete, and click Delete.

View Application Mapping

The application mapping feature enables you to associate flow packets with specific applications in your organization. This helps you correlate the flow packets with applications. The NNM iSPI Performance for Traffic provides you with a set of default application mapping definitions and a default application mapping group—DefaultAppMapGroup.

You can use the Application Mappings view in the NNM iSPI Performance for Traffic Configuration form to define new applications, map flow packets to existing applications, view and modify the current application mapping setting, and delete application definitions.

To view the Application Mappings view, click Application Mapping Configuration > Application Mappings in the NNM iSPI Performance for Traffic Configuration form.

The following table lists the basic attributes of the Application Mappings view:

Attributes	Description
Application Name	The name of the application.
Condition Configuration	The expression that defines association of flow packets with an application.
Application Groups	Application mapping groups where the application belongs. An application can belong to multiple application groups.

Define New Application Mapping

The NNM iSPI Performance for Traffic provides you with a set of default application mapping definitions and a default application mapping group—DefaultAppMapGroup. You can also define new applications by using the NNM iSPI Performance for Traffic Configuration form. By default, 302 application mapping definitions are provided.

An application mapping cannot have more than 10 individual conditions.

To define a new application mapping:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mappings.
2. In the Application Mappings view, click Add. A new form opens with the following sections:
   • Application Mapping Details: In this section, you must specify the primary details of the application you want to add.
   • The other section lists related details.
3. In the Application Mapping Details section, specify the following details:
   1. Application Name: Type the name of the application. You can use alphanumeric characters, hyphens (-), and underscores (_).
   2. Define the condition expression: The NNM iSPI Performance for Traffic enables you to map a flow packet to an application with the help of conditions created with different attributes of the flow packet. You can define the condition expression with a single condition or combine multiple conditions using Boolean Operators, AND and OR. To define the condition expression, you must first add the Boolean operators and then add conditions to these operators.

      To add the Boolean operator (s): Use the Application Mapping buttons to insert, append, and replace Boolean Operators based on the rule that you want to create.

      Application Mapping Buttons

      Button	Description
      AND	Inserts the AND Boolean Operator at the selected cursor location. View the condition expression displayed under Filter String to see the logic of the expression as it is created.
      OR	Inserts the OR Boolean Operator at the current cursor location. View the condition expression displayed under Filter String to see the logic of the expression as it is created.
      Delete	Deletes the selected Boolean Operator. If the Boolean Operator is selected, all the conditions associated with the Boolean Operator are deleted.

      Click here for more information about using the Boolean Operators.

      • Add your highest level Boolean operator first.
      • The AND and OR Boolean Operators must contain at least two conditions.
      • Add each additional Boolean Operator before adding the condition to which it applies.
      • Place the cursor on the Boolean Operator that you want to append to or replace.

      To add a condition: Use the Mapping Rule components to insert, append, and replace a condition.

      Mapping Rule Components

      Component	Description
      Flow Attribute	The attribute on which you want NNM iSPI Performance for Traffic to search. See Flow Attributes for a description of available Flow Attributes.
      Operator	The operator that establishes the relationship between the Attribute and Operand. For the ProducerIP, SrcIP, and DstIP attributes, you can choose the like, in, equals, or not-equals operator. For other attributes, you can choose the =, !=, <=, or >= operator.
      Operand	The operand that completes the criteria required to define the condition.

      1. Select an attribute from the Flow Attribute field.
      2. Select an operator from the Operation field.

      3. Specify the value to be compared in the Operand field.

         If you select DstPort as the flow attribute, the NNM iSPI Performance for Traffic reports all the traffic that is reaching and originating from the defined destination port. If you want to

      4. Click Insert,Append, or Replace.
      5. To add another condition, repeat the above steps.

4. Click Save & Close.

Click here for examples to define condition expressions.

Example 1

IPProtocol = 4000

To add the above condition, after you are in the Application Mapping Details section, follow these steps:

1. Type the name of the application in the Application Name field.
2. Select IPProtocol in the Flow Attribute field.
3. In the Operator field, select =.
4. In the Operand field, enter 4000.
5. Click Insert.
6. Click Save and Close.

Example 2

IPProtocol = 4000 OR DstPort = 1000

To add the condition expression above, after you are in the Application Mapping Details section, follow these steps:

1. Type the name of the application in the Application Name field.
2. Click OR.
3. Select the OR you just added to the condition expression.
4. Follow these steps to add the condition, IPProtocol = 4000:
   1. Select IPProtocol in the Flow Attribute field.
   2. In the Operator field, select =.
   3. In the Operand field, enter 4000.
5. Click Insert.
6. Follow these steps to add the condition, DstPort = 1000:
   1. Select DstPort in the Flow Attribute field.
   2. In the Operator field, select =.
   3. In the Operand field, enter 1000.
7. Click Save and Close.

Example 3

((DstPort = 10000 OR DstPort = 20000) AND (DstIP equals 192.168.0.0 OR DstIP equals 192.168.0.10))

To add the condition expression above, after you are in the Application Mapping Details section, follow these steps:

1. In the Application Name field, type the name of the application.
2. Click AND.
3. Follow these steps to add the condition expression, DstPort = 10000 OR DstPort = 20000:
   1. Click OR.
   2. Select the OR you just added to the condition expression.
   3. Follow these steps to add the condition, DstPort = 10000:
      1. In the Flow Attribute field, select DstPort.
      2. In the Operator field, select =.
      3. In the Operand field, enter 10000.
   4. Click Insert.
   5. Follow these steps to add the condition, DstPort = 20000:
      1. In the Flow Attribute field, select DstPort.
      2. In the Operator field, select =
      3. In the Operand field, enter 20000.
   6. Click Append.
4. Select the AND that you added previously to the condition expression.
5. Follow these steps to add the condition expression, DstIP equals 192.168.0.0 OR DstIP equals 192.168.0.10:
   1. Click OR.
   2. Select the OR you just added to the condition expression.
   3. Follow these steps to add the condition, DstIP = 192.168.0.0:
      1. In the Flow Attribute field, select DstIP.
      2. In the Operator field, select equals.
      3. In the Operand field, enter 192.168.0.0.
   4. Click Insert.
   5. Follow these steps to add the condition, DstIP = 192.168.0.10:
      1. In the Flow Attribute field, select DstIP.
      2. In the Operator field, select equals.
      3. In the Operand field, enter 192.168.0.10.
   6. Click Append.
6. Click Save and Close.

Flow Attributes

Flow Attributes	Attribute Description
ProducerIP	IP address of the system where the flow collector is located
SrcIP	IP address of the system where the traffic flow originated
DstIP	IP address of the system where the traffic flow terminated
IPProtocol	Protocol used by the traffic flow
NFSNMPInputIndex	SNMP index of the egress interface
NFSNMPOutputIndex	SNMP index of the ingress interface
Port	Source or destination port of the traffic flow
TCPFlags	TCP flag of the traffic flow
IPToS	Type of Service property of the traffic flow

Modify Application Mapping Definition

You can use the NNM iSPI Performance for Traffic Configuration form to edit an existing application mapping definition.

To modify an application mapping definition:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mappings.
2. In the Application Mappings view, select an application and then click the Open icon. A new form opens with the following sections:
   • Application Mapping Details: In this section, you can modify the primary details of the application you selected.
   • The other section lists related details.
3. In the Application Mapping Details section, you can modify the following details:
   • Application Name: You can modify the name of the application. You can use alphanumeric characters, hyphens (-), and underscores (_).
   • Modify the condition expression: You can modify the Boolean Operators and conditions in the condition expression for an existing application mapping. You can view the modifications displayed under the Filter String and in the Application Mapping Text Configuration tab.
4. Click Save & Close.

Delete an Application

You can use the NNM iSPI Performance for Traffic Configuration form to delete an application mapping definition.

To delete an application:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mappings.
2. In the Application Mappings view, select the application you want to delete.
3. Click Delete.

View Application Mapping Groups

You can define application mapping groups to group a set of defined applications. The NNM iSPI Performance for Traffic provides you with a default application mapping group—DefaultAppMapGroup.

You can use the Application Mapping Groups view in the NNM iSPI Performance for Traffic Configuration form to define new application mapping groups, associate applications with existing application mapping groups, view and modify the current application mapping groups, and delete application mapping groups.

To view the Application Mapping Groups view, click Application Mapping Configuration > Application Mapping Groups in the NNM iSPI Performance for Traffic Configuration form.

The basic attributes of the Application Mapping Groups view are the following:

Attributes	Description
Application Group	The name of the group.
Number of Application Mappings	The number of applications associated with the group.

Define New Application Mapping Group

The NNM iSPI Performance for Traffic provides you with adefault application mapping group—DefaultAppMapGroup. You can also define new application mapping groups by using the NNM iSPI Performance for Traffic Configuration form.

To define a new application mapping group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mapping Groups.
2. In the Application Mapping Groups view, click Add. A new form opens.

3. In the Application Mapping Groups Details section, specify the name of the application mapping group. Follow the rules given below when naming an Application Mapping Group:

   • Names of Application Mapping Groups must start with an alphabet.
   • Do not use numeric characters at the beginning of an Application Mapping Group name. 

   • You can use alphanumeric characters, hyphens (-), and underscores (_) in the Application Mapping Group names. Do not use spaces or any other special characters.

     For example, you can create an Application Mapping Group called AppMap1Grp, but not 1AppMapGrp.

4. The All Application Mappings tab shows the list of all applications and their association with the application mapping groups. To associate an application with the new application mapping group, select the application.
5.  Click Save & Close.

Modify Application Mapping Group

You can modify an application mapping group's association with applications by using the NNM iSPI Performance for Traffic Configuration form. You cannot change the name of an application mapping group.

To modify an application mapping group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mapping Groups.
2. In the Application Mapping Groups view, click Open. A new form opens. The Application Mapping Group Members tab shows all the existing applications and their association with all the groups.

3. To associate an application with the group, select the application. To dissociate an application from the group, clear the select check box () next to the application.

   Before removing the group membership of an application from the group, make sure the application is associated with at least one application mapping group. An application cannot exist without a membership to a group and gets automatically deleted if you dissociate it from all the existing groups.

   You cannot remove an application from the application mapping group if the application belongs to the Top N inclusion list. If you try to remove the application from the application mapping group by clearing the check box () next to the application, the following message appears: No changes done in application mapping group:<group_name> mapping group modified, but some of the application mappings that belong to the Inclusion List have not been removed. You must first remove the application from the Top N Application Inclusion List before removing the application from the group.

4.  Click Save & Close.

Delete Application Mapping Group

You can delete an application mapping group by using the NNM iSPI Performance for Traffic Configuration form.

To delete an application mapping group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Application Mapping Configuration > Application Mapping Groups.
2. In the Application Mapping Groups view, select the application mapping group you want to delete, and click Delete.

Create Filter Groups and Application Mapping Rules from the Command Line

Using the nmstrafficfiltappmaptool.ovpl command, you can create filter groups and application mapping from the command line. The nmstrafficfiltappmaptool.ovpl command accepts inputs from a text file (where the definition for filter groups and application mapping exists) and creates filter groups and application mapping rules in the NNM iSPI Performance for Traffic configuration console.

To create filter groups:

1. Log on to the Master Collector system with the administrative or root privileges.
2. With the help of a text editor, create a new text file.
3. In the text file, add the following entry:
   <Condition_definition>, Action = <keep/drop> [, FilterGroups = <Filter_Group_Name>]
   In this instance:
   <Condition_definition> is the condition defined on the flows.
   <Filter_Group_Name> is the name of the filter group that you want to create.
   Specify keep to retain the match.
   Specify drop to discard the match.
   You can specify multiple condition definitions separated by commas and multiple filter group names separated by spaces.
4. Save the file.
5. Go to the following directory:
   <TrafficMasterInstallDir>/bin
6. Run the following command:
   nmstrafficfiltappmaptool.ovpl [--userName=<user name>][--password=<password>]--import <file name>
   In this instance,
   <user name> is the user name to log on to the NNM iSPI Performance for Traffic configuration console. [userName] is an optional parameter.
   <password> is the password for the above user. [password] is an optional parameter.
   <file name> is the name of the text file that you created (specify the file name with the complete location).
   The NNM iSPI Performance for Traffic creates the filter groups based on the definition provided in the text files and new groups appear in the configuration console.

To create application mapping rules:

1. Log on to the Master Collector system with the administrative or root privileges.
2. With the help of a text editor, create a new text file.
3. In the text file, add the following rule:
   <Condition definition>, App =<Application Name> [, AppGroups = <Application Group Name>]
   In this instance:
   <Condition_definition> is the condition defined on the flows.
   <Application Name> is the name of the application that you want to map to the expression.
   Optional. <Application Group Name> is the group name for the application.
   You can combine multiple conditions using the Boolean Operators, AND and OR, to create a condition expression. For example, condition expression (Port = 22000 AND (DstIP equals 192.168.0.0 OR DstIP equals 192.168.0.1)) is created using AND and OR to combine three conditions. To see a list of all attributes with which you can create a condition, click here.
   
4. Save the file.
5. Go to the following directory:
   <TrafficMasterInstallDir>/bin
6. Run the following command:
   nmstrafficfiltappmaptool.ovpl [--userName=<user name>][--password=<password>]--import <file name>
   In this instance,
   <user name> is the user name to log on to the NNM iSPI Performance for Traffic configuration console. [userName] is an optional parameter.
   <password> is the password for the above user. [password] is an optional parameter.
   <file name> is the name of the text file that you created (specify the file name with the complete location).
   The NNM iSPI Performance for Traffic creates the application mapping groups based on the definition provided in the text files and new groups appear in the configuration console.

Configure Classes of Service

The NNM iSPI Performance for Traffic enables you to enrich every traffic flow by adding the Class of Service attribute to the flow. You can define this attribute by using the NNM iSPI Performance for Traffic Configuration form. If defined, you can sort or group different values of traffic metrics on reports by this attribute.

Define Class of Service

To use the Class of Service property to rank traffic metric values, you must define Class of Service first by using the NNM iSPI Performance for Traffic Configuration form.

To define a class of service:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Type Of Service Groups.
2. In the Type Of Service Groups view, click Add. A new form opens.
3. In the new form, follow these steps:
   1. In the TOS Group Name box, type a name. While configuring a Leaf Collector instance, you can associate this TOS group name with the Leaf Collector.
   2. In the Type Of Service Group Details section, select a Type of Service (ToS) value, select an operation (= or between), and then select a ToS value (select two values if you choose the between operation).
   3. In the Operand box, type the name of the class of service. This class of service name appears in the 'Grouping By' metric list on reports if you associate the TOS group with a Leaf Collector instance.
   4. If you want to add another class of service, click Add, and then repeat step c.
4. Click Save & Close. The newly defined TOS group appears in the Type Of Service Groups view.

Modify Class of Service Definitions

You can modify the existing Class of Service definitions by using the NNM iSPI Performance for Traffic Configuration form.

To modify a class of service:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Type Of Service Groups.
2. In the Type Of Service Groups view, select a TOS group, and then click Open. A new form opens.
3. In the new form, follow these steps:
   1. In the Type Of Service Group Details section, modify existing class of service definitions by changing the Type of Service (ToS) value or operation (= or between).
   2. In the Operand box, you can change the name of the class of service.
   3. If you want to add another class of service, click Add. If you want to remove an existing class of service, click Remove.
4. Click Save & Close.

Delete TOS Groups

By using the NNM iSPI Performance for Traffic Configuration form, you can delete TOS groups that you have created.

To delete a TOS group:

1. In the NNM iSPI Performance for Traffic Configuration form, click Site, ToS and Threshold Configuration > Type Of Service Groups.
2. In the Type Of Service Groups view, select the TOS group you want to delete, and click Delete.

Add Top N Application Inclusion List

The Top N Application Inclusion List view enables you to configure the NNM iSPI Performance for Traffic to always include select applications on the Top N reports in Interface_Traffic_Aggregated reports folder. In Leaf Collector only top contributors to traffic are retained for a time interval and the rest are grouped into a single 'Anonymous' bucket. In the case of applications, you can configure a set of applications such that traffic data for them are always retained irrespective of their contribution to the traffic volume.

To open the Top N Application Inclusion List view, open the NNM iSPI Performance for Traffic Configuration form, and click Application Mapping Configuration > Top N Application Inclusion List.

To add an application to the list of applications that always appear on Top N reports:

1. Select an application mapping group.
2. From the left pane, select the applications that you want to add to the list.
3. Click Add. The selected applications appear on every Top N report.

To remove an application from the list, select the application from the right pane, and then click Remove.

If you define multiple applications with the same name, the NNM iSPI Performance for Traffic Configuration form lets you add only one application from among the applications with the same name.