[nsp] NBAR question

[Cisco Geek Rotation]

At 01:43 PM 3/5/2003 -0800, Siva Valliappan wrote:
>Hi,
>
>   you might want to install the KaZaa 2 pdlm to see if more of your
>peer 2 peer traffic is classified.  i checked with some of the QoS
>team on your figures and they suspect you might be having a flood of
>KaZaa 2 traffic.  the PDLM for KaZaa 2 is at:
>
>http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm
>
>cheers
>.siva

Hi Siva:

The version of code I am now using has kazaa2 natively compiled in, 
however, I still see a large percentage of "unknown" traffic.

IOS (tm) 7200 Software (C7200-JK8O3S-M), Version 12.2(16.4)T,  MAINTENANCE 
INTERIM SOFTWARE

#show ip nbar proto int atm2/0.31

  ATM2/0.31
                             Input                    Output
    Protocol                 Packet Count             Packet Count
                             Byte Count               Byte Count
                             30 second bit rate (bps) 30 second bit rate (bps)
    ------------------------ ------------------------ ------------------------
    http                     53747452                 28462585
                             45422167937              6253508836
                             2848000                  133000
    kazaa2                   73290926                 34335768
                             15097238440              11739546309
                             986000                   806000
    gnutella                 8697819                  3509837
                             4307693371               1040095656
                             868000                   136000
    fasttrack                6866692                  3356722
                             6281835790               2703015167
                             546000                   315000
<snip>
    unknown                  55400852                 37217933
                             25535714756              41656810393
                             1597000                  1729000
    Total                    228413920                130605910
                             116208504466             70216336385
                             7751000                  3279000


So I don't think that PDLM will help.

Chris


>On Sun, 2 Mar 2003, Cisco Geek Rotation wrote:
>
> > I've been putting ip nbar protocol-discovery on egress interfaces as a way
> > of seeing what kinds of traffic are traversing the WAN links.
> >
> > What I've noticed even on very late revisions of IOS (a month old) is that
> > the "unknown" category always seems to have more traffic than anything else
> > (853Kbps here which oeverwhelms the traffic of anything else).  It's as
> > though NBAR can't classify a lot of the traffic.  Any ideas how to get NBAR
> > to more carefully detail what the traffic is?
> >
> > #show ip nbar proto int fastether4/0/0
> >
> >   FastEthernet4/0/0
> >                              Input                    Output
> >     Protocol                 Packet Count             Packet Count
> >                              Byte Count               Byte Count
> >                              30 second bit rate (bps) 30 second bit 
> rate (bps)
> >     ------------------------ ------------------------ 
> ------------------------
> >     fasttrack                458                      1200
> >                              27480                    1582200
> >                              3000                     123000
> >     http                     1218                     2617
> >                              543204                   546493
> >                              50000                    33000
> >     gnutella                 386                      1120
> >                              135542                   349589
> >                              13000                    33000
> >     icmp                     51                       62
> >                              9026                     6752
> >                              2000                     1000
> >     smtp                     26                       69
> >                              6167                     7032
> >                              3000                     0
> >
> >
> > <snip>
> >
> >     unknown                  2052                     11682
> >                              758973                   7760912
> >                              88000                    853000
> >     Total                    4529                     17380
> >                              1546650                  10359269
> >                              165000                   1045000
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > http://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >