[nsp] NBAR question
Cisco Geek Rotation
cisco at peakpeak.com
Sun Mar 2 10:21:43 EST 2003
I've been putting ip nbar protocol-discovery on egress interfaces as a way
of seeing what kinds of traffic are traversing the WAN links.
What I've noticed even on very late revisions of IOS (a month old) is that
the "unknown" category always seems to have more traffic than anything else
(853Kbps here which oeverwhelms the traffic of anything else). It's as
though NBAR can't classify a lot of the traffic. Any ideas how to get NBAR
to more carefully detail what the traffic is?
#show ip nbar proto int fastether4/0/0
FastEthernet4/0/0
Input Output
Protocol Packet Count Packet Count
Byte Count Byte Count
30 second bit rate (bps) 30 second bit rate (bps)
------------------------ ------------------------ ------------------------
fasttrack 458 1200
27480 1582200
3000 123000
http 1218 2617
543204 546493
50000 33000
gnutella 386 1120
135542 349589
13000 33000
icmp 51 62
9026 6752
2000 1000
smtp 26 69
6167 7032
3000 0
<snip>
unknown 2052 11682
758973 7760912
88000 853000
Total 4529 17380
1546650 10359269
165000 1045000
More information about the cisco-nsp
mailing list