Cisco NBAR Protocol Discovery Question

Hi All

i have a  router that is runing NBAR Protocol Discovery and it is showing that there is a large amount of edonkey traffic going through the router is there anyway i can find out what ip the edonkey traffic is coming from?

many thanks
JAMESBALLAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

zwart072Commented:
if you are using also nat, you can use the command "show ip nat translations" you can see all the connections on which ports are made on source and also destination ip adresses/ port numbers
0
JAMESBALLAuthor Commented:
i have tryed this but i think the nbar is picking the data up by looking at the application data so i not sure which port it is using i am guessing it maybe tunneling through port 80
0
zwart072Commented:
If you can't see which port it is using, you can use nbar to block the edonkey traffic.
See also http://www.cisco.com/go/nbar
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

JAMESBALLAuthor Commented:
aye i was tempted to try it and see if any one moaned would like to see if can track down the miss guided user.....
0
that1guy15Commented:
NBAR is only going to classify this traffic and allow you to do with it how you like. If you want more details of the traffic then you would need to setup and monitor NetFlow.

But i agree, the simplest way would be to just block the traffic and wait for the person to complain.
0
JAMESBALLAuthor Commented:
do you know if netflow will show protocols like nbar does? i never used netflow before
0
that1guy15Commented:
Netflow will provide everything NBAR does plus tons more. compaired to NBAR netflow is a bit more complicated to get going though.

here is a good link from Cisco on NetFlow
http://www.ciscosystems.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1031653

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JAMESBALLAuthor Commented:
thats great thanks for your help
0
JAMESBALLAuthor Commented:
I found the traffic but is saying it is kazaa traffic on port 1214 between a workstation and the exchange server anyone seen that before??
0
that1guy15Commented:
Hmmm this traffic should be showing up going out your edge router.

Check your exchange server to see if it is actually making a connection with the workstation.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.