nbar eDonkey classification - correct?

[ace-cco]

Hi everybody -

we are classifying traffic on a serial interface with the nbar feature as edonkey traffic. Is it possible that Cisco's nbar mistakes the backup application traffic with edonkey packets?

Our netflow an ip accounting data is not that well syncronized since we enabled the features during different times of the day. So as of now we can't align the different data properly ..

Anybody an idea of how reliable a classification as edonkey might be?

regards

Robert

[dgahm · Accepted solution]

Robert,

The NBAR PDLM uses the well known TCP port 4662 to identify eDonkey. If your backup app uses the same port then it would look just like eDonkey to NBAR.

If the backups and eDonkey are always different IP addresses then you should be able to define your traffic classes to protect your backups.

You can post your config if you would like suggestions.

Please rate helpful posts.

Dave

[ace-cco]

Thanks Dave,

I thought NBAR would look somehow deeper into the application layers ...