Cisco NBAR Protocol Discovery Question

Hi All

i have a  router that is runing NBAR Protocol Discovery and it is showing that there is a large amount of edonkey traffic going through the router is there anyway i can find out what ip the edonkey traffic is coming from?

many thanks
JAMESBALLAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
that1guy15Connect With a Mentor Commented:
Netflow will provide everything NBAR does plus tons more. compaired to NBAR netflow is a bit more complicated to get going though.

here is a good link from Cisco on NetFlow
http://www.ciscosystems.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1031653

0
 
zwart072Commented:
if you are using also nat, you can use the command "show ip nat translations" you can see all the connections on which ports are made on source and also destination ip adresses/ port numbers
0
 
JAMESBALLAuthor Commented:
i have tryed this but i think the nbar is picking the data up by looking at the application data so i not sure which port it is using i am guessing it maybe tunneling through port 80
0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
zwart072Commented:
If you can't see which port it is using, you can use nbar to block the edonkey traffic.
See also http://www.cisco.com/go/nbar
0
 
JAMESBALLAuthor Commented:
aye i was tempted to try it and see if any one moaned would like to see if can track down the miss guided user.....
0
 
that1guy15Commented:
NBAR is only going to classify this traffic and allow you to do with it how you like. If you want more details of the traffic then you would need to setup and monitor NetFlow.

But i agree, the simplest way would be to just block the traffic and wait for the person to complain.
0
 
JAMESBALLAuthor Commented:
do you know if netflow will show protocols like nbar does? i never used netflow before
0
 
JAMESBALLAuthor Commented:
thats great thanks for your help
0
 
JAMESBALLAuthor Commented:
I found the traffic but is saying it is kazaa traffic on port 1214 between a workstation and the exchange server anyone seen that before??
0
 
that1guy15Commented:
Hmmm this traffic should be showing up going out your edge router.

Check your exchange server to see if it is actually making a connection with the workstation.
0
All Courses

From novice to tech pro — start learning today.