In order to limit p2p for the customer who owns a residential network
we have placed Cisco 1812 at the edge and deployed nbar. This is a
test installation. I am very pleased with the router performance but
am getting strange protocol pattern. H323 is always at the first
place. There is only 1 known ATA in the network the rest are PCs. Has
anybody seen something like this? Is Cisco wrongly detecting the
protocol or some application is masking under h323?
IOS 12.4(4)T
test#sh ip nbar pro top 5
FastEthernet0
Input Output
----- ------
Protocol Packet Count Packet Count
Byte Count Byte Count
30sec Bit Rate (bps) 30sec Bit Rate (bps)
30sec Max Bit Rate (bps) 30sec Max Bit Rate (bps)
------------------------ ------------------------ ------------------------
h323 430318174 484580202
295530378354 510582379098
88000 1573000
63716000 43937000
directconnect 504961074 542682313
143155578719 440140011862
743000 3554000
21928000 41361000
bittorrent 180345117 157134261
159151376414 113440218306
10108000 595000
38642000 21540000
ftp 80687341 132973054
12278545780 182223219346
0 0
9632000 38304000
http 116564629 107386015
72277177873 68179685509
1832000 1320000
28170000 8680000
unknown 440807349 545371541
233174948525 397103904825
5399000 8274000
39084000 39050000
Total 1837535964 2054257711
943457543062 1756935108799
18426000 16318000
257742000 231020000
Aivars