Using NBAR Classification

Problem

You wish to use the Network Based Application Recognition (NBAR) feature to identify and classify traffic at the application layer.

Solution

The NBAR feature is used to identify traffic within a class-map. You can then use the class-map in a policy-map to define how the router should handle each application data stream:

Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#ip cef
Router1(config)#class-map INTERACTIVE
Router1(config-cmap)#match protocol citrix
Router1(config-cmap)#match protocol telnet
Router1(config-cmap)#exit
Router1(config)#policy-map QoSPolicy
Router1(config-pmap)#class INTERACTIVE
Router1(config-pmap-c)#bandwidth percent 50
Router1(config-pmap-c)#set dscp ef
Router1(config-pmap-c)#exit
Router1(config-pmap)#class class-default
Router1(config-pmap-c)#bandwidth percent 20
Router1(config-pmap-c)#random-detect dscp-based
Router1(config-pmap-c)#exit
Router1(config-pmap)#exit
Router1(config)#interface FastEthernet0/0
Router1(config-fi)#service-policy inbound QoSPolicy
Router1(config-if)#exit
Router1(config)#end
Router1#

Cisco also offers the ability to download specialized Packet Description Language Module (PDLM) files onto the router's flash device, and then activate them for use with NBAR classification:

Router1#show flash

System flash directory:
File Length Name/status
 1 23169076 c2600-ipvoice-mz.124-10.bin
 2 3100 bittorrent.pdlm
[23172304 bytes used, 9857836 available, 33030140 total]
32768K bytes of processor board System flash (Read/Write)

Router1#Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#ip nbar pdlm flash://bittorrent.pdlm
Router1(config)#class-map BITTORRENT
Router1(config-cmap)#match protocol bittorrent
Router1(config-cmap)#exit
Router1(config)#end
Router1#

And you can also use NBAR to automatically profile the protocols on a particular interface:

Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#interface FastEthernet0/0
Router1(config-if)#ip nbar protocol-discovery
Router1(config-if)#exit
Router1(config)#end
Router1#

 

Discussion

Network Based Application Recognition (NBAR) is an extremely useful feature that first became available in IOS Version 12.0(5)XE2, and more generally in 12.1(5)T. Cisco continues to add new protocols to NBAR, allowing you to categorize more and more different traffic streams on your network. The one caveat to using NBAR is that it can introduce a heavy additional load on your router's CPU. We recommend monitoring the CPU utilization after implementing any NBAR-based filtering, at least until you are confident that the router is not straining under the additional load.

The basic syntax is to set up a class-map, and then use the match protocol command with the appropriate keyword:

Router1(config)#class-map INTERACTIVE
Router1(config-cmap)#match protocol citrix
Router1(config-cmap)#match protocol telnet

We used Citrix as an example protocol in this recipe because it is a classic example of the need for the NBAR feature. This is a proprietary protocol that is used in thin-client architectures. The end user's workstation is just a terminal that displays graphical information from the screen of a centrally located computer running a virtual desktop for the user. The protocol transmits graphical information and keystrokes. Because it is an interactive application, it needs to be given high priority through the network. However, it is notoriously difficult to reliably identify from Layer 3 and 4 information:

As the example shows, you can then use this class in a policy-map:

Router1(config)#policy-map QoSPolicy
Router1(config-pmap)#class INTERACTIVE
Router1(config-pmap-c)#bandwidth percent 50
Router1(config-pmap-c)#set dscp ef
Router1(config-pmap-c)#exit

NBAR classifies applications at the application layer, allowing you to differentiate between different streams of traffic that may actually use the same UDP or TCP port numbers, as well as streams of traffic that may use a variety of ports or even arbitrary port numbers.

Here is a list of supported protocols as of IOS Version 12.4(10):

Router1(config-cmap)#match protocol ?
 arp IP ARP
 bgp Border Gateway Protocol
 bridge Bridging
 cdp Cisco Discovery Protocol
 citrix Citrix Systems ICA protocol
 clns ISO CLNS
 clns_es ISO CLNS End System
 clns_is ISO CLNS Intermediate System
 cmns ISO CMNS
 compressedtcp Compressed TCP (VJ)
 cuseeme CU-SeeMe desktop video conference
 dhcp Dynamic Host Configuration
 dns Domain Name Server lookup
 edonkey eDonkey
 egp Exterior Gateway Protocol
 eigrp Enhanced Interior Gateway Routing Protocol
 exchange MS-RPC for Exchange
 fasttrack FastTrack Traffic - KaZaA, Morpheus, Grokster...
 finger Finger
 ftp File Transfer Protocol
 gnutella Gnutella Version2 Traffic - BearShare, Shareeza, Morpheus ...
 gopher Gopher
 gre Generic Routing Encapsulation
 h323 H323 Protocol
 http World Wide Web traffic
 icmp Internet Control Message
 imap Internet Message Access Protocol
 ip IP
 ipinip IP in IP (encapsulation)
 ipsec IP Security Protocol (ESP/AH)
 irc Internet Relay Chat
 kazaa2 Kazaa Version 2
 kerberos Kerberos
 l2tp L2F/L2TP tunnel
 ldap Lightweight Directory Access Protocol
 llc2 llc2
 mgcp Media Gateway Control Protocol
 napster Napster Traffic
 netbios NetBIOS
 netshow Microsoft Netshow
 nfs Network File System
 nntp Network News Transfer Protocol
 notes Lotus Notes(R)
 novadigm Novadigm EDM
 ntp Network Time Protocol
 ospf Open Shortest Path First
 pad PAD links
 pcanywhere Symantec pcANYWHERE
 pop3 Post Office Protocol
 pppoe PPP over Ethernet
 pptp Point-to-Point Tunneling Protocol
 printer print spooler/lpd
 rcmd BSD r-commands (rsh, rlogin, rexec)
 rip Routing Information Protocol
 rsrb Remote Source-Route Bridging
 rsvp Resource Reservation Protocol
 rtcp Real Time Control Protocol
 rtp Real Time Protocol
 rtsp Real Time Streaming Protocol
 secure-ftp FTP over TLS/SSL
 secure-http Secured HTTP
 secure-imap Internet Message Access Protocol over TLS/SSL
 secure-irc Internet Relay Chat over TLS/SSL
 secure-ldap Lightweight Directory Access Protocol over TLS/SSL
 secure-nntp Network News Transfer Protocol over TLS/SSL
 secure-pop3 Post Office Protocol over TLS/SSL
 secure-telnet Telnet over TLS/SSL
 sip Session Initiation Protocol
 skinny Skinny Protocol
 smtp Simple Mail Transfer Protocol
 snapshot Snapshot routing support
 snmp Simple Network Management Protocol
 socks SOCKS
 sqlnet SQL*NET for Oracle
 sqlserver MS SQL Server
 ssh Secured Shell
 streamwork Xing Technology StreamWorks player
 sunrpc Sun RPC
 syslog System Logging Utility
 telnet Telnet
 tftp Trivial File Transfer Protocol
 vdolive VDOLive streaming video
 vofr voice over Frame Relay packets
 winmx WinMx file-sharing application
 xwindows X-Windows remote access

Router1(config-cmap)#

You can obtain and install new PDLM files from Cisco. In the example, we have downloaded a new PDLM file that can identify the BitTorrent protocol. Once we put this file on the router's Flash device, we need to tell NBAR to load the file to make it available:

Router1(config)#ip nbar pdlm flash://bittorrent.pdlm

In the past, Cisco has also made PDLM files available to help network administrators to use NBAR to help to identify hostile applications such as viruses and worms.

We are not aware of PDLM files originating from sources other than Cisco, but we strongly recommend that you use only files that you obtain directly from Cisco. Otherwise, you could potentially open your network to serious security vulnerabilities.

We note in passing that Cisco has also added the option to manually create your own NBAR rules using the ip nbar custom command. This feature should allow you to, for example, define a new protocol by specifying TCP or UDP port numbers, as well as any special rules that look for identifiable content at a particular bit offset in the packet payload. However, the syntax for this feature is confusing, and the parser is apparently unstable in some IOS versions, so we don't currently recommend using it.

The last feature discussed in the Solution section of this recipe is the NBAR Protocol-Discovery feature. This is a useful tool for figuring out what is going through your network, particularly if you are trying to define a QoS strategy. You can use the show ip nbar protocol-discovery command to get detailed statistics on the utilization for every type of protocol that NBAR understands. However, NBAR now supports so many protocols that this complete list is often not very useful for spotting trends. Instead, we suggest using the top-n keyword with a relatively small argument number, such as 5, or at most 10. This will allow you to immediately see statistics for the top protocols for each interface on which you enabled the feature:

Router1#show ip nbar protocol-discovery top-n 5

 FastEthernet0/0 
 Input Output 
 ----- ------ 
 Protocol Packet Count Packet Count 
 Byte Count Byte Count 
 5min Bit Rate (bps) 5min Bit Rate (bps) 
 5min Max Bit Rate (bps) 5min Max Bit Rate (bps) 
 ------------------------ ------------------------ ------------------------
 icmp 220 110 
 25080 12540 
 0 0 
 4000 3000 
 http 55 104 
 3763 60019 
 0 0 
 1000 4000 
 telnet 130 71 
 19212 4269 
 0 0 
 3000 1000 
 eigrp 90 45 
 6660 3330 
 0 0 
 0 0 
 secure-http 4 4 
 248 216 
 0 0 
 0 0 
 unknown 2 2 
 122 112 
 0 0 
 0 0 
 Total 501 336 
 55085 80486 
 0 0 
 8000 8000 
Router1#