Would I use NBAR to search on DSCP values, or something else?

[jkeeffe]

A service policy on a fastethernet interface, with fair-queue in class-default, shows lots of packets in the class 0 and in the class 5, as shown here:

Class-map: class-default (match-any)

1069285238 packets, 1161214848048 bytes

30 second offered rate 33560000 bps, drop rate 0 bps

Match: any

Queueing

Flow Based Fair Queueing

Maximum Number of Hashed Queues 256

(total queued/total drops/no-buffer drops) 0/73/0

exponential weight: 9

class Transmitted Random drop Tail drop Minimum Maximum Mark

pkts/bytes pkts/bytes pkts/bytes thresh thresh prob

0 1067073173/1161070545754 7/10598 66/99924 20 40 1/10

1 0/0 0/0 0/0 22 40 1/10

2 0/0 0/0 0/0 24 40 1/10

3 0/0 0/0 0/0 26 40 1/10

4 0/0 0/0 0/0 28 40 1/10

5 1840665/117810962 0/0 0/0 30 40 1/10

6 372176/26817087 0/0 0/0 32 40 1/10 <<--------- ***

7 102/132812 0/0 0/0 34 40 1/10

rsvp 0/0 0/0 0/0 36 40 1/10

I need to find out what traffic is marked COS 5. Would using NBAR give me that info even if I need to have it search in the IP header's TOS field?

If NBAR will not do that, is there another way, using IOS commands, that I can determine the source of the traffic that is sending packets with the Class-of-service field of 5?

[smahbub]

check out the following link, hope this helps :

http://www.ciscopress.com/articles/article.asp?p=101170&seqNum=3&rl=1

[paul driver]

Hello

Posible match on the COS values of DSCP, however thinking about it, it wont give you the scr/dst addrressing

Another way could be to SPAN a specifc port and use wireshark to capture the traffic you desire
 

sh mls qos maps

   Dscp-cos map:
       dscp:   0  8 10 16 18 24 26 32 34 40 46 48 56
     -----------------------------------------------
        cos:   0  1  1  2  2  3  3  4  4  5  5  6  7

   Cos-dscp map:
        cos:   0  1  2  3  4  5  6  7
     --------------------------------
       dscp:   0  8 16 26 32 46 48 56

class-map match-any COS5_cm
 match ip dscp cs5

policy-map COS5_pm
 class COS5_cm

int x/x
service-policy input COS5_pm

res

Paul