Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Would I use NBAR to search on DSCP values, or something else?

A service policy on a fastethernet interface, with fair-queue in class-default, shows lots of packets in the class 0 and in the class 5, as shown here:

Class-map: class-default (match-any)

1069285238 packets, 1161214848048 bytes

30 second offered rate 33560000 bps, drop rate 0 bps

Match: any

Queueing

Flow Based Fair Queueing

Maximum Number of Hashed Queues 256

(total queued/total drops/no-buffer drops) 0/73/0

exponential weight: 9

class Transmitted Random drop Tail drop Minimum Maximum Mark

pkts/bytes pkts/bytes pkts/bytes thresh thresh prob

0 1067073173/1161070545754 7/10598 66/99924 20 40 1/10

1 0/0 0/0 0/0 22 40 1/10

2 0/0 0/0 0/0 24 40 1/10

3 0/0 0/0 0/0 26 40 1/10

4 0/0 0/0 0/0 28 40 1/10

5 1840665/117810962 0/0 0/0 30 40 1/10

6 372176/26817087 0/0 0/0 32 40 1/10 <<--------- ***

7 102/132812 0/0 0/0 34 40 1/10

rsvp 0/0 0/0 0/0 36 40 1/10

I need to find out what traffic is marked COS 5. Would using NBAR give me that info even if I need to have it search in the IP header's TOS field?

If NBAR will not do that, is there another way, using IOS commands, that I can determine the source of the traffic that is sending packets with the Class-of-service field of 5?

2 REPLIES
Silver

Re: Would I use NBAR to search on DSCP values, or something else

check out the following link, hope this helps :

http://www.ciscopress.com/articles/article.asp?p=101170&seqNum=3&rl=1

HelloPosible match on the COS

Hello


Posible match on the COS values of DSCP, however thinking about it, it wont give you the scr/dst addrressing

Another way could be to SPAN a specifc port and use wireshark to capture the traffic you desire
 

sh mls qos maps

   Dscp-cos map:
       dscp:   0  8 10 16 18 24 26 32 34 40 46 48 56
     -----------------------------------------------
        cos:   0  1  1  2  2  3  3  4  4  5  5  6  7


   Cos-dscp map:
        cos:   0  1  2  3  4  5  6  7
     --------------------------------
       dscp:   0  8 16 26 32 46 48 56

 

 

class-map match-any COS5_cm
 match ip dscp cs5

policy-map COS5_pm
 class COS5_cm

 

int x/x
service-policy input COS5_pm

 

 

res

Paul

 

Please don't forget to rate any posts that have been helpful. Thanks.
540
Views
0
Helpful
2
Replies
CreatePlease login to create content