[cisco-voip] Nbar missing some RTP traffic

[Jeffrey Ollie]

On Thu, Apr 17, 2008 at 8:42 AM, Ellington, Chris
<Chris.Ellington at inin.com> wrote:
> Why not just pick the exact traffic you are looking to match and match
>  it?  Don't worry about nbar messing it up - just grab the ports you're
>  seeking and mark as such?

Because RTP traffic doesn't use a single UDP port.  The phone (or
CallManager, the router, or whatever) picks a UDP port number at
random and sends that information to the other side via the signalling
protocol (SIP, H.323, SCCP, etc.).

Jeff