[nsp] NBAR question

[Siva Valliappan]

Hi,

  you might want to install the KaZaa 2 pdlm to see if more of your
peer 2 peer traffic is classified.  i checked with some of the QoS
team on your figures and they suspect you might be having a flood of
KaZaa 2 traffic.  the PDLM for KaZaa 2 is at:

http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm

cheers
.siva

On Sun, 2 Mar 2003, Cisco Geek Rotation wrote:

> I've been putting ip nbar protocol-discovery on egress interfaces as a way
> of seeing what kinds of traffic are traversing the WAN links.
>
> What I've noticed even on very late revisions of IOS (a month old) is that
> the "unknown" category always seems to have more traffic than anything else
> (853Kbps here which oeverwhelms the traffic of anything else).  It's as
> though NBAR can't classify a lot of the traffic.  Any ideas how to get NBAR
> to more carefully detail what the traffic is?
>
> #show ip nbar proto int fastether4/0/0
>
>   FastEthernet4/0/0
>                              Input                    Output
>     Protocol                 Packet Count             Packet Count
>                              Byte Count               Byte Count
>                              30 second bit rate (bps) 30 second bit rate (bps)
>     ------------------------ ------------------------ ------------------------
>     fasttrack                458                      1200
>                              27480                    1582200
>                              3000                     123000
>     http                     1218                     2617
>                              543204                   546493
>                              50000                    33000
>     gnutella                 386                      1120
>                              135542                   349589
>                              13000                    33000
>     icmp                     51                       62
>                              9026                     6752
>                              2000                     1000
>     smtp                     26                       69
>                              6167                     7032
>                              3000                     0
>
>
> <snip>
>
>     unknown                  2052                     11682
>                              758973                   7760912
>                              88000                    853000
>     Total                    4529                     17380
>                              1546650                  10359269
>                              165000                   1045000
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>