[nsp] NBAR question
Mark Persiko
mark.persiko at bvsd.k12.co.us
Tue Mar 4 15:17:20 EST 2003
PacketShaper is resold by a company called "Stratacache" in Dayton, OH.
Their phone number is 800-244-8915. I'm sure there are other
resellers...
Mark
- Mark C. Persiko, Network Engineer
- IT Division, Boulder Valley School District
- mark.persiko at bvsd.k12.co.us
-----Original Message-----
From: Cisco Geek Rotation [mailto:cisco at peakpeak.com]
Sent: Monday, March 03, 2003 10:56 AM
To: Voll, Scott; cisco-nsp at puck.nether.net
Subject: RE: [nsp] NBAR question
I've yet to be able to get the Packetshaper people to respond with a
quote
on an update of a unit I've been looking at buying. Do you have a
contact
you can share.
Chris
At 09:28 AM 3/3/2003 -0800, Voll, Scott wrote:
>I agree with Mark. If you want great control, the PacketShaper is a
>great product. Might be a little spendy. We were lucky enough to get
>an old PacketShaper (in an Intel box) and buy the support from
Packeteer
>and get a fully up to date OS. Great Way to keep garbage out of your
>network or police your bandwidth. It's great for keeping File sharing
>programs out and streaming within limits.
>
>
>
>Scott Voll
>Network Analyst, CCNA
>Willamette ESD
>scott.voll at wesd.org
>
>
>
>
>
>-----Original Message-----
>From: Mark Persiko [mailto:mark.persiko at bvsd.k12.co.us]
>Sent: Monday, March 03, 2003 8:03 AM
>To: cisco-nsp at puck.nether.net
>Subject: RE: [nsp] NBAR question
>
>
>Another product you can use is Packeteer PacketShaper, which
>shows egress/ingress protocols and lets you set bandwidth
>allocations or blocks for types of traffic. This might be
>more efficient than the CPU cost of NBAR in software, depending on the
>router you use.
>
>Thanks,
> Mark
>
>- Mark C. Persiko, Network Engineer
>- IT Division, Boulder Valley School District
>- mark.persiko at bvsd.k12.co.us
>
>
>
>-----Original Message-----
>From: Scott Morris [mailto:swm at emanon.com]
>Sent: Monday, March 03, 2003 5:38 AM
>To: 'Cisco Geek Rotation'; cisco-nsp at puck.nether.net
>Subject: RE: [nsp] NBAR question
>
>
>It could be as simple as parts of protocols that aren't caught by the
>signature. Such as passive FTP or something utilizing a high port.
>*shrug*
>
>If you really want to be sure of things, plug a sniffer into your line
>and take a look at it "manually"!
>
>Scott
>
>
>-----Original Message-----
>From: Cisco Geek Rotation [mailto:cisco at peakpeak.com]
>Sent: Sunday, March 02, 2003 9:27 PM
>To: swm at emanon.com; cisco-nsp at puck.nether.net
>Subject: RE: [nsp] NBAR question
>
>
>At 08:35 PM 3/2/2003 -0500, Scott Morris wrote:
> >Wait for more signatures to get programmed into the IOS, or by adding
a
>
> >PDLM in your config!
> >
> >The more signatures to compare against, the more work you want your
> >router to do!
> >
> >Scott
>
>
>Sure, but looking at what all is in the list of protocols already when
I
>do
>a show ip nbar proto interface <x> that list looks pretty
>comprehensive. What other protocols are likely to be happening that
are
>
>missing from that list?
>
>Chris
>
>
> >-----Original Message-----
> >From: cisco-nsp-bounces at puck.nether.net
> >[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Cisco Geek
> >Rotation
> >Sent: Sunday, March 02, 2003 12:22 PM
> >To: cisco-nsp at puck.nether.net
> >Subject: [nsp] NBAR question
> >
> >
> >I've been putting ip nbar protocol-discovery on egress interfaces as
a
> >way of seeing what kinds of traffic are traversing the WAN links.
> >
> >What I've noticed even on very late revisions of IOS (a month old) is
> >that the "unknown" category always seems to have more traffic than
> >anything else
> >(853Kbps here which oeverwhelms the traffic of anything else). It's
as
> >though NBAR can't classify a lot of the traffic. Any ideas how to
get
> >NBAR
> >to more carefully detail what the traffic is?
> >
> >#show ip nbar proto int fastether4/0/0
> >
> > FastEthernet4/0/0
> > Input Output
> > Protocol Packet Count Packet Count
> > Byte Count Byte Count
> > 30 second bit rate (bps) 30 second bit
> >rate
> >(bps)
> > ------------------------ ------------------------
> >------------------------
> > fasttrack 458 1200
> > 27480 1582200
> > 3000 123000
> > http 1218 2617
> > 543204 546493
> > 50000 33000
> > gnutella 386 1120
> > 135542 349589
> > 13000 33000
> > icmp 51 62
> > 9026 6752
> > 2000 1000
> > smtp 26 69
> > 6167 7032
> > 3000 0
> >
> >
> ><snip>
> >
> > unknown 2052 11682
> > 758973 7760912
> > 88000 853000
> > Total 4529 17380
> > 1546650 10359269
> > 165000 1045000
> >
> >
> >_______________________________________________
> >cisco-nsp mailing list cisco-nsp at puck.nether.net
> >http://puck.nether.net/mailman/listinfo/cisco-nsp
> >archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>_______________________________________________
>cisco-nsp mailing list cisco-nsp at puck.nether.net
>http://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>_______________________________________________
>cisco-nsp mailing list cisco-nsp at puck.nether.net
>http://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>_______________________________________________
>cisco-nsp mailing list cisco-nsp at puck.nether.net
>http://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list cisco-nsp at puck.nether.net
http://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
More information about the cisco-nsp
mailing list