[nsp] NBAR question

[Rubens Kuhl Jr.]

There are many P2P-ware these days... may be it's DC++(most likely) or
SoulSeek.

Rubens

----- Original Message -----
From: "Cisco Geek Rotation" <cisco at peakpeak.com>
To: "Siva Valliappan" <svalliap at cisco.com>
Cc: <cisco-nsp at puck.nether.net>
Sent: Thursday, March 06, 2003 1:09 AM
Subject: Re: [nsp] NBAR question


| At 01:43 PM 3/5/2003 -0800, Siva Valliappan wrote:
| >Hi,
| >
| >   you might want to install the KaZaa 2 pdlm to see if more of your
| >peer 2 peer traffic is classified.  i checked with some of the QoS
| >team on your figures and they suspect you might be having a flood of
| >KaZaa 2 traffic.  the PDLM for KaZaa 2 is at:
| >
| >http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm
| >
| >cheers
| >.siva
|
| Hi Siva:
|
| The version of code I am now using has kazaa2 natively compiled in,
| however, I still see a large percentage of "unknown" traffic.
|
| IOS (tm) 7200 Software (C7200-JK8O3S-M), Version 12.2(16.4)T,  MAINTENANCE
| INTERIM SOFTWARE
|
| #show ip nbar proto int atm2/0.31
|
|   ATM2/0.31
|                              Input                    Output
|     Protocol                 Packet Count             Packet Count
|                              Byte Count               Byte Count
|                              30 second bit rate (bps) 30 second bit rate
(bps)
|     ------------------------ ------------------------ --------------------
----
|     http                     53747452                 28462585
|                              45422167937              6253508836
|                              2848000                  133000
|     kazaa2                   73290926                 34335768
|                              15097238440              11739546309
|                              986000                   806000
|     gnutella                 8697819                  3509837
|                              4307693371               1040095656
|                              868000                   136000
|     fasttrack                6866692                  3356722
|                              6281835790               2703015167
|                              546000                   315000
| <snip>
|     unknown                  55400852                 37217933
|                              25535714756              41656810393
|                              1597000                  1729000
|     Total                    228413920                130605910
|                              116208504466             70216336385
|                              7751000                  3279000
|
|
| So I don't think that PDLM will help.
|
| Chris
|
|
| >On Sun, 2 Mar 2003, Cisco Geek Rotation wrote:
| >
| > > I've been putting ip nbar protocol-discovery on egress interfaces as a
way
| > > of seeing what kinds of traffic are traversing the WAN links.
| > >
| > > What I've noticed even on very late revisions of IOS (a month old) is
that
| > > the "unknown" category always seems to have more traffic than anything
else
| > > (853Kbps here which oeverwhelms the traffic of anything else).  It's
as
| > > though NBAR can't classify a lot of the traffic.  Any ideas how to get
NBAR
| > > to more carefully detail what the traffic is?
| > >
| > > #show ip nbar proto int fastether4/0/0
| > >
| > >   FastEthernet4/0/0
| > >                              Input                    Output
| > >     Protocol                 Packet Count             Packet Count
| > >                              Byte Count               Byte Count
| > >                              30 second bit rate (bps) 30 second bit
| > rate (bps)
| > >     ------------------------ ------------------------
| > ------------------------
| > >     fasttrack                458                      1200
| > >                              27480                    1582200
| > >                              3000                     123000
| > >     http                     1218                     2617
| > >                              543204                   546493
| > >                              50000                    33000
| > >     gnutella                 386                      1120
| > >                              135542                   349589
| > >                              13000                    33000
| > >     icmp                     51                       62
| > >                              9026                     6752
| > >                              2000                     1000
| > >     smtp                     26                       69
| > >                              6167                     7032
| > >                              3000                     0
| > >
| > >
| > > <snip>
| > >
| > >     unknown                  2052                     11682
| > >                              758973                   7760912
| > >                              88000                    853000
| > >     Total                    4529                     17380
| > >                              1546650                  10359269
| > >                              165000                   1045000
| > >
| > >
| > > _______________________________________________
| > > cisco-nsp mailing list  cisco-nsp at puck.nether.net
| > > http://puck.nether.net/mailman/listinfo/cisco-nsp
| > > archive at http://puck.nether.net/pipermail/cisco-nsp/
| > >
|
|
| _______________________________________________
| cisco-nsp mailing list  cisco-nsp at puck.nether.net
| http://puck.nether.net/mailman/listinfo/cisco-nsp
| archive at http://puck.nether.net/pipermail/cisco-nsp/