release notes for nbar2 protocol pack 7.0 - cisco notes for nbar2 protocol pack 7.0.0 overview...

Release Notes for NBAR2 Protocol Pack 7.0.0

• Release Notes for NBAR2 Protocol Pack 7.0.0, page 2

NBAR2 Protocol Pack 7.0.0 1

Release Notes for NBAR2 Protocol Pack 7.0.0Overview

NBAR2 Protocol Pack 7.0.0 contains the EnhancedWeb Classification feature that supports multi-transactionsexport of URLs. For more information on this feature, see Classifying Network Traffic Using NBAR.

The other features added in this protocol pack are as follows:

• SSL sub-classification

• RTP dynamic payload type sub-classification

• Microsoft Lync Audio/Video separation

• Non-encrypted Cisco-Jabber support

• Enhanced industrial protocol support (Modbus, DNP3)

• Enhanced support for Microsoft cloud applications

Supported Platforms

Network Based Application Recognition (NBAR) Protocol Pack 7.0.0 is supported on Cisco ASR 1000 SeriesAggregation Services Routers.

New Protocols in NBAR2 Protocol Pack 7.0.0

The following protocols are added to NBAR2 Protocol Pack 7.0.0:

DescriptionSyntax NameCommon Name

Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the audio calls part ofCisco Jabber.

cisco-jabber-audioCisco Jabber Audio

Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the control andsignaling part of Cisco Jabber.

cisco-jabber-controlCisco Jabber Control

Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the text messaging partof Cisco Jabber.

cisco-jabber-imCisco Jabber IM

NBAR2 Protocol Pack 7.0.02

Release Notes for NBAR2 Protocol Pack 7.0.0Release Notes for NBAR2 Protocol Pack 7.0.0

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/clsfy-traffic-nbar.html

DescriptionSyntax NameCommon Name

Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the video calls part ofCisco Jabber.

cisco-jabber-videoCisco Jabber Video

Microsoft Lync Audio is the audio calls support in MSLync. This protocol classifies the voice part of video calls.The classification is based on STUN and RTP.

ms-lync-audioMicrosoft Lync Audio

Microsoft Lync video is the video calls support in MSLync. This protocol classifies the visual part of the videocall. The voice in the video call is classified asMS-Lync-Audio. The classification is based on STUNand RTP.

ms-lync-videoMicrosoft Lync Video

Microsoft Office Web Apps is the web-based version ofthe Microsoft Office productivity suite. It includes theweb-based versions ofMicrosoftWord, Microsoft Excel,Microsoft PowerPoint, andMicrosoft OneNote. The webapplications allow users to access their documents withina web browser and collaborate with other users online.

ms-office-web-appsMicrosoft Office WebApplications

Microsoft SkyDrive is a file hosting service that allowsusers to upload and sync files to a cloud storage andfurther access them from a web browser or a mobileapplication.

skydriveMicrosoft SkyDrive

Modbus is a standard communication protocol forconnecting industrial electronic devices. Modbus TCP/IPuses theModbus instruction set and wraps TCP/IP aroundit.

modbusModbus TCP/IP

New Features in NBAR2 Protocol Pack 7.0.0

SSL Unique-name Sub-classificationIn this protocol pack, a new sub-classification parameter called 'unique-name' is introduced for SSL. Theunique-name parameter can be used to match SSL sessions of servers that are not known globally, or are notyet supported by NBAR. The unique-name will match the server name indication (SNI) field in the clientrequest if the SNI field exists, or it will match the common name (CN) field in the first certificate of theserver's response.

The feature also supports cases of SSL sessions that use session-id than the SSL sessions that use handshake.

The following example shows how an SSL based service with the server name as 'finance.cisco.com' is matchedusing unique-name:

class-map match-any cisco-finance

match protocol ssl unique-name finance.cisco.com



The SSL sub-classification parameters have priority over the built in signatures. Therefore, when a'unique-name' defined by a user matches a known application such as Facebook, it will not match the builtin protocol but will match SSL with the configured sub-classification.

Note

Similar to the other sub-classification features, the classification result (for example, as seen inprotocol-discovery), does not change and will remain as SSL. However, the flowsmatching the class maps(as shown in the leading example) will receive the services such as QoS and Performancemonitor configuredfor them. To view the detailed matching statistics, refer to the policy map counters.

Note

Reference: http://tools.ietf.org/html/rfc6101

RTP Dynamic Payload Type Sub-classificationIn this protocol pack, the existing sub-classification parameters for 'RTP audio' and 'RTP video' are enhancedto detect RTP flows that use dynamic payload types (PT). Dynamic PTs are PTs in the dynamic range from96 to 127 as defined in RTP RFC, and are selected online through the signaling protocols such as SIP andRTSP, for each session. In this protocol pack, only RTP sessions initiated using SIP will match by dynamicpayload type.

There is no change in usability of the feature.

The following example shows how to detect RTP audio flows that include both static and dynamic PT:

class-map match-any generic-rtp-audio

match protocol rtp audio

The RTP audio/video sub-classification parameters are generic in nature and will match only on genericRTP traffic. More specific classification such as ms-lync-audio, cisco-jabber-audio, facetime, andcisco-phone will not match as RTP, and therefore will not match the audio/video sub-classification.

Note

Reference: http://tools.ietf.org/html/rfc3551

Modbus Function Code SubclassificationIn this protocol pack, new sub-classification parameters are introduced for Modbus. The varioussub-classification parameters can be used to match different function codes such as READ and WRITEoperations of the Modbus protocol.

The parameters available for modbus protocol are as follows:

Modbus Function CodeModbus Function NameParameter Name

0x01Read Coilsread-coils

0x02Read Discrete Inputsread-discrete-input

0x03Read Holding Registersread-holding-registers

0x04Read Input Registerread-input-register

0x05Write Single Coilwrite-single-coil



http://tools.ietf.org/html/rfc6101

http://tools.ietf.org/html/rfc3551

Modbus Function CodeModbus Function NameParameter Name

0x06Write Single Registerwrite-single-register

0x07Read Exception Statusread-exception-status

0x0FWrite Multiple Coilswrite-multiple-coils

0x10Write Multiple Registerswrite-multiple-registers

0x14Read File Recordread-file-record

0x15Write File Recordwrite-file-record

0x16Mask Write Registermask-write-register

0x17Read/Write Multiple Registersread-or-write-registers

0x18Read FIFO Queueread-FIFO-Queue

0x2BEncapsulated transportencapsulated-transport

The following example shows how to match a modbus function code:

class-map match-any modbus-read-coils

match protocol modbus read-coils

Reference: http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf

Updated Protocols in NBAR2 Protocol Pack 7.0.0

The following protocols are updated in NBAR2 Protocol Pack 7.0.0:

UpdatesProtocol

Updated signatures.blizwow

Updated signatures to support DNP 3.0.dnp

Updated signatures.espn-browsing

Updated signatures.espn-video

Updated signatures.imap

Updated signatures.ms-office-365

Updated signatures to support outlook.com email service.outlook-web-service

Updated signatures to support dynamic payload types.rtp



http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf

UpdatesProtocol

Updated signatures.sip

Updated signatures to support sub classification of unique-namessl

Updated signatures.telnet

Deprecated Protocols in NBAR2 Protocol Pack 7.0.0

The following protocols are deprecated in NBAR2 Protocol Pack 7.0.0:

• ghostsurf—service no longer available

• guruguru—service no longer available

• hotmail—replaced with outlook-web-service

• livemeeting—replaced with ms-lync

• megavideo—service no longer available

• ms-lync-media—replaced with ms-lync-audio and ms-lync-video

Caveats in NBAR2 Protocol Pack 7.0.0

If you have an account on Cisco.com, you can also use the Bug Toolkit to find select caveats of anyseverity. To reach the Bug Toolkit, log in to Cisco.com and go to http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl. (If the defect that you have requested cannot be displayed, this may be dueto one or more of the following reasons: the defect number does not exist, the defect does not have acustomer-visible description yet, or the defect has been marked Cisco Confidential.)

Note

Resolved Caveats in NBAR2 Protocol Pack 7.0.0

The following table lists the resolved caveats in NBAR2 Protocol Pack 7.0.0:

DescriptionResolved Caveat

Some Xunlei-KanKan traffic may be misclassified as Xunlei.CSCue08462

Video traffic generated by some ESPN websites might be misclassified asunknown.

CSCuh63870

Web traffic generated by some ESPNwebsites might bemisclassified as unknown.CSCuh63889

Known Caveats in NBAR2 Protocol Pack 7.0.0

The following table lists the known caveats in NBAR2 Protocol Pack 7.0.0:



http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl

http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl

DescriptionKnown Caveat

Traffic generated by pcAnywhere for mac and pcAnywhere mobile app might bemisclassified as unknown

CSCtx65481

gtalk-video might be misclassified as rtpCSCub62860

gbridge pc client might not be blockedCSCub89835

Traffic generated by AIM Pro might be misclassified as unknown andwebex-meeting

CSCuc43505

Under heavy SSL traffic, the following error message my appear: ":%STILE_CLIENT-4-MAX_LINK_TOUCH_WARN:F0: cpp_cp:NBARnumberof flow-slinks threshold is reached, can't allocate more memory for flow-slinks"

CSCug12174

PCoIP session-priority configuration limitationCSCuh49380

Segmented packets are not classified when using NBAR sub classificationCSCuh53623

Some qqlive traffic may bemisclassified as qq-accountswhen qqlive is configuredunder a class-map

CSCuh95182

When using Microsoft Lync in Office-365, the traffic might be misclassified asrtp or SSL

CSCui50424

SSL sub classification will not be matched if a built-in protocol was matched inthe SSL client-hello message

CSCui53625

SIP related protocols classification and RTP sub-classification may fail whencompact headers are used

CSCui58918

SIP related protocols classification and RTP sub-classification may fail whenfield extraction is activated and the 'contact' or 'from' fields do not contain '@'.

CSCui58922

Encrypted Cisco Jabber is not supportedCSCui70613

Matching under ms-office-web-apps attributes might be misclassifiedCSCui72228

The drop policy may not work for ms-office-web-apps protocolCSCui76906

The drop policy may not work for sky-drive protocolCSCui84201

Cisco-jabber-video and cisco-phone might be misclassified when configuredunder a class-map

CSCui85573

Cisco-jabber-video for windows may not be classified correctlyCSCui85652

Microsoft Lync might be misclassified in certain scenariosCSCuj07892



Restrictions and Limitations in NBAR2 Protocol Pack 7.0.0

The following table lists the limitations and restrictions in NBAR2 Protocol Pack 7.0.0:Limitation/RestrictionProtocol

http traffic generated by the bitcomet bittorrent client might be classified as httpbittorrent

For capwap-data to be classified correctly, capwap-control must also be enabledcapwap-data

During configuring QoS class-map with ftp-data, the ftp protocol must be selected.As an alternative, the ftp application group can be selected.

ftp

Encrypted video streaming generated by hulumight be classified as its underlyingprotocol rtmpe

hulu

Traffic generated by the logmein android app might be misclassified as ssllogmein

Login and chat traffic generated by the ms-lync client might be misclassified asssl

ms-lync

Traffic generated by the mobile or mac app is not supported. ms-lync 2013 trafficif any, might be misclassified.

ms-lync 2013

Login to QQ applications which is not via webmay not be classified as qq-accountsqq-accounts

Voice traffic generated by secondlife might be misclassified as sslsecondlife

Downloading NBAR2 Protocol Packs

NBAR2 Protocol Packs are available for download as Software Type 'NBAR2 Protocol Pack' on cisco.comsoftware download page (http://www.cisco.com/cisco/software/navigator.html).

Additional References

Related Documents

Document TitleRelated Topic

Application Visibility and Control Configuration GuideApplication Visibility and Control

Classifying Network Traffic Using NBAR moduleClassifying Network Traffic Using NBAR

NBAR Protocol Pack moduleNBAR Protocol Pack

QoS: NBAR Configuration GuideQoS: NBAR Configuration Guide

Quality of Service Solutions Command ReferenceQoS Command Reference



http://www.cisco.com/cisco/software/navigator.html

http://www.cisco.com/en/US/docs/ios-xml/ios/avc/configuration/xe-3s/avc-xe-3s-book.html

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/clsfy-traffic-nbar.html

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/NBAR_Protocol_Pack.html

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/qos-nbar-xe-3s-book.html