nbar input only showing telnet/rip/snmpc... on atm0/dialer interface

kevward74 · ‎09-18-2009

Hi,

we are only seeing the protocols above being reported with nbar on an 877 dialer interface and atm0. Can't figure out why this is happening.

#sh ip nbar prot

Dialer1

Input Output

----- ------

Protocol Packet Count Packet Count

Byte Count Byte Count

30sec Bit Rate (bps) 30sec Bit Rate (bps)

30sec Max Bit Rate (bps) 30sec Max Bit Rate (bps)

------------------------ ------------------------ ------------------------

notes 0 26495

0 11073768

0 0

0 195000

rtp 0 252146

0 16641636

0 0

0 52000

http 0 6586

0 2479777

0 0

0 49000

sqlnet 0 275

0 61560

0 0

0 9000

telnet 8375 208

402490 18717

0 0

4000 3000

netbios 0 1045

0 147430

0 0

0 7000

exchange 0 1601

0 269894

0 0

0 5000

Thanks for any input

Kev

rohitrattan · ‎09-18-2009

Hello,

The reason that you are able to see only some protocols with NBAR is because NBAR is not able to recognize other protocols you may be running and that's because you do not have PDLM's or Packet Description language Modules installed for other Protocols that you should be seeing. These PDLM's help NBAR recognize/classify packets.

HTH

Rohit

kevward74 · ‎09-18-2009

Hi Rohit,

Thanks for replying. The protocols are being recognized outbound ok and its specifically the rtp packets we're interested in to know why they aren't showing inbound to the device.

Kev

rohitrattan · ‎09-18-2009

Kev,

This essentially means that the NBAR is not able to

1)either recognize packets coming in

2)or see packets coming in

But why would'nt it recognize, it should do so, unless there's some bug, which is very unlikely, so moving to the next cause

Do you see packets arriving on the interface, i.e. are those packets actually hitting the interface because i guess some other redundant interface could be receiving packets. Sub-Optimal routing or essentially Asymmetric routing could cause such behavior. So, if you have a redundant path be sure to check it.

HTH

Rohit

Lucien Avramov · ‎09-18-2009

What version of IOS are you running?

azzu-supportservices · ‎09-21-2009

Morning Lavramov,

We're running c870-advipservicesk9-mz.124-15.T8.bin on the devices we see the lack of inbound nbar information on.

Kev

Lucien Avramov · ‎09-21-2009

There seems to be some errors on this code.

I tried on c870-advipservicesk9-mz.124-24.T1.bin and it seems to work.

can you try this code?