Cisco IOS Cookbook, 2nd Edition

Using NBAR Classification

Problem

You wish to use the Network Based Application Recognition (NBAR) feature to identify and classify traffic at the application layer.

Solution

The NBAR feature is used to identify traffic within a class-map. You can then use the class-map in a policy-map to define how the router should handle each application data stream:

Router1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#ip cef
Router1(config)#class-map INTERACTIVE
Router1(config-cmap)#match protocol citrix
Router1(config-cmap)#match protocol telnet
Router1(config-cmap)#exit
Router1(config)#policy-map QoSPolicy
Router1(config-pmap)#class INTERACTIVE
Router1(config-pmap-c)#bandwidth percent 50
Router1(config-pmap-c)#set dscp ef
Router1(config-pmap-c)#exit
Router1(config-pmap)#class class-default
Router1(config-pmap-c)#bandwidth percent 20
Router1(config-pmap-c)#random-detect dscp-based
Router1(config-pmap-c)#exit
Router1(config-pmap)#exit
Router1(config)#interface FastEthernet0/0
Router1(config-fi)#service-policy inbound QoSPolicy
Router1(config-if)#exit
Router1(config)#end
Router1#

Cisco also offers the ability to download specialized Packet Description Language Module (PDLM) files onto the router’s flash device, and then activate them for use with NBAR classification:

Router1#show flash

System flash directory:
File  Length   Name/status
  1   23169076  c2600-ipvoice-mz.124-10.bin
  2   3100     bittorrent.pdlm [23172304 bytes used, 9857836 available, 33030140 total] ...