[nsp] NBAR question

Cisco Geek Rotation cisco at peakpeak.com
Sun Mar 2 10:21:43 EST 2003


I've been putting ip nbar protocol-discovery on egress interfaces as a way 
of seeing what kinds of traffic are traversing the WAN links.

What I've noticed even on very late revisions of IOS (a month old) is that 
the "unknown" category always seems to have more traffic than anything else 
(853Kbps here which oeverwhelms the traffic of anything else).  It's as 
though NBAR can't classify a lot of the traffic.  Any ideas how to get NBAR 
to more carefully detail what the traffic is?

#show ip nbar proto int fastether4/0/0

  FastEthernet4/0/0
                             Input                    Output
    Protocol                 Packet Count             Packet Count
                             Byte Count               Byte Count
                             30 second bit rate (bps) 30 second bit rate (bps)
    ------------------------ ------------------------ ------------------------
    fasttrack                458                      1200
                             27480                    1582200
                             3000                     123000
    http                     1218                     2617
                             543204                   546493
                             50000                    33000
    gnutella                 386                      1120
                             135542                   349589
                             13000                    33000
    icmp                     51                       62
                             9026                     6752
                             2000                     1000
    smtp                     26                       69
                             6167                     7032
                             3000                     0            
 

<snip>

    unknown                  2052                     11682
                             758973                   7760912
                             88000                    853000
    Total                    4529                     17380
                             1546650                  10359269
                             165000                   1045000        




More information about the cisco-nsp mailing list