NBAR2 Standard Protocol Pack 1.0 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 © 2013 Cisco Systems, Inc. All rights reserved. CONTENTS CHAPTER 1 Release Notes for NBAR2 Standard Protocol Pack 1.0 1 CHAPTER 2 BGP 3 BITTORRENT 6 CITRIX 7 DHCP 8 DIRECTCONNECT 9 DNS 10 EDONKEY 11 EGP 12 EIGRP 13 EXCHANGE 14 FASTTRACK 15 FINGER 16 FTP 17 GNUTELLA 18 GOPHER 19 GRE 20 H323 21 HTTP 22 ICMP 23 IMAP 24 IPINIP 25 IPV6-ICMP 26 IRC 27 KAZAA2 28 KERBEROS 29 L2TP 30 NBAR2 Standard Protocol Pack 1.0 iii Contents LDAP 31 MGCP 32 NETBIOS 33 NETSHOW 34 NFS 35 NNTP 36 NOTES 37 NTP 38 OSPF 39 POP3 40 PPTP 41 PRINTER 42 RIP 43 RTCP 44 RTP 45 RTSP 46 SAP 47 SECURE-FTP 48 SECURE-HTTP 49 SECURE-IMAP 50 SECURE-IRC 51 SECURE-LDAP 52 SECURE-NNTP 53 SECURE-POP3 54 SECURE-TELNET 55 SIP 56 SKINNY 57 SKYPE 58 SMTP 59 SNMP 60 SOCKS 61 SQLNET 62 SQLSERVER 63 SSH 64 STREAMWORK 65 NBAR2 Standard Protocol Pack 1.0 iv Contents SUNRPC 66 SYSLOG 67 TELNET 68 TFTP 69 VDOLIVE 70 WINMX 71 NBAR2 Standard Protocol Pack 1.0 v Contents NBAR2 Standard Protocol Pack 1.0 vi CHAPTER 1 Release Notes for NBAR2 Standard Protocol Pack 1.0 NBAR2 Standard Protocol Pack Overview The Network Based Application Recognition (NBAR2) Standard Protocol Pack 1.0 is provided as the base protocol pack with an unlicensed Cisco image on a device. The NBAR2 Standard Protocol Pack has limited features and functionality. Supported Platform The NBAR2 Standard Protocol Pack 1.0 is supported on Cisco ASR 1000 Series Aggregation Services Routers. Additional References Related Topic Document Title Application Visibility and Control Application Visibility and Control Configuration Guide Classifying Network Traffic Using NBAR Classifying Network Traffic Using NBAR module NBAR Protocol Pack NBAR Protocol Pack module QoS: NBAR Configuration Guide QoS: NBAR Configuration Guide NBAR2 Standard Protocol Pack 1.0 1 Release Notes for NBAR2 Standard Protocol Pack 1.0 NBAR2 Standard Protocol Pack 1.0 2 CHAPTER 2 BGP Name/CLI Keyword bgp Full Name Border Gateway Protocol Description Border Gateway Protocol (BGP) is a protocol designed to share network information (for example network reachability) between autonomous systems (AS). According to the information, the BGP routers build/modify their routing tables. The protocol was designed to replace the Exterior Gateway Protocol (EGP). Usually the protocol uses TCP/UDP ports 179 as default. Reference http://tools.ietf.org/html/rfc4274 Global ID L4:179 ID 11 Known Mappings UDP Port 179 TCP Port 179 IP Protocol - IP Version IPv4 Support Yes IPv6 Support Yes Application Group - Category - Sub Category - NBAR2 Standard Protocol Pack 1.0 3 BGP P2P Technology No Encrypted No Tunnel No Underlying Protocols - • BITTORRENT, page 6 • CITRIX, page 7 • DHCP, page 8 • DIRECTCONNECT, page 9 • DNS, page 10 • EDONKEY, page 11 • EGP, page 12 • EIGRP, page 13 • EXCHANGE, page 14 • FASTTRACK, page 15 • FINGER, page 16 • FTP, page 17 • GNUTELLA, page 18 • GOPHER, page 19 • GRE, page 20 • H323, page 21 • HTTP, page 22 • ICMP, page 23 • IMAP, page 24 • IPINIP, page 25 • IPV6-ICMP, page 26 • IRC, page 27 • KAZAA2, page 28 • KERBEROS, page 29 • L2TP, page 30 • LDAP, page 31 • MGCP, page 32 NBAR2 Standard Protocol Pack 1.0 4 BGP • NETBIOS, page 33 • NETSHOW, page 34 • NFS, page 35 • NNTP, page 36 • NOTES, page 37 • NTP, page 38 • OSPF, page 39 • POP3, page 40 • PPTP, page 41 • PRINTER, page 42 • RIP, page 43 • RTCP, page 44 • RTP, page 45 • RTSP, page 46 • SAP, page 47 • SECURE-FTP, page 48 • SECURE-HTTP, page 49 • SECURE-IMAP, page 50 • SECURE-IRC, page 51 • SECURE-LDAP, page 52 • SECURE-NNTP, page 53 • SECURE-POP3, page 54 • SECURE-TELNET, page 55 • SIP, page 56 • SKINNY, page 57 • SKYPE, page 58 • SMTP, page 59 • SNMP, page 60 • SOCKS, page 61 • SQLNET, page 62 • SQLSERVER, page 63 • SSH, page 64 • STREAMWORK, page 65 NBAR2 Standard Protocol Pack 1.0 5 BGP BITTORRENT • SUNRPC, page 66 • SYSLOG, page 67 • TELNET, page 68 • TFTP, page 69 • VDOLIVE, page 70 • WINMX, page 71 BITTORRENT Name/CLI Keyword bittorrent Full Name BitTorrent Description BitTorrent is a p2p file sharing protocol used for distributing files over the internet. It identifies content by URL and is designed to integrate seamlessly with the web. The BitTorrent protocol is based on a BitTorrent tracker (server) that initializes the connections between the clients (peers). Reference http://jonas.nitro.dk/bittorrent/bittorrent-rfc.html Global ID L7:69 ID 69 Known Mappings UDP Port - TCP Port - IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - P2P Technology No NBAR2 Standard Protocol Pack 1.0 6 BGP CITRIX Encrypted No Tunnel No Underlying Protocols socks CITRIX Name/CLI Keyword citrix Full Name Citrix Description Citrix is an application that mediates users remotely to their corporate applications. ICA: Independed Computing Architecture is a designated protocol for application server system; it is used for transferring data between clients and servers.CGP: CGP is a tunneling protocol, the latest addition to the family of Citrix protocol.As of today it encapsulates ICA protocol but will be extended to other Citrix protocol such as RDP, HTTP/HTTPS.IMA: used for server-server communication. Server-Browser: Used mainly a control connection which has Published Application Name and triggers an ICA connection Reference http://www.citrix.com/site/resources/dynamic/additional/ICA_Acceleration_ 0709a.pdf Global ID L7:56 ID 56 Known Mappings UDP Port 1604 TCP Port 1494,2512,2513,2598 IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - NBAR2 Standard Protocol Pack 1.0 7 BGP DHCP P2P Technology No Encrypted No Tunnel No Underlying Protocols - DHCP Name/CLI Keyword dhcp Full Name Dynamic Host Configuration Protocol Description The Dynamic Host Configuration Protocol (DHCP) provides a framework for passing configuration information to hosts on a TCP/IP network. The information given by designated DHCP servers include: IP address, subnet mask and default gateway. A DHCP server usually listens on UDP port 67 and DHCP client usually listens on UDP 68. Reference http://www.ietf.org/rfc/rfc2131.txt Global ID L7:13 ID 13 Known Mappings UDP Port 67,68 TCP Port - IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - P2P Technology No NBAR2 Standard Protocol Pack 1.0 8 BGP DIRECTCONNECT Encrypted No Tunnel No Underlying Protocols - DIRECTCONNECT Name/CLI Keyword directconnect Full Name Direct Connect Description Direct connect is a peer-to-peer file sharing protocol. Clients connect to a main hub that mediates them to other clients in order to download files. The hubs hold a database of clients and files and mediate the clients. Once clients are connected in a P2P manner, they can download files and chat with one another. Reference http://www.metroactive.com/papers/metro/07.12.01/work-0128.html Global ID L7:70 ID 70 Known Mappings UDP Port - TCP Port - IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - P2P Technology No Encrypted No NBAR2 Standard Protocol Pack 1.0 9 BGP DNS Tunnel No Underlying Protocols - DNS Name/CLI Keyword dns Full Name Domain Name System Description Domain Name Server is a server that translates URLs into IP addresses based on client queries. It is based on client-server architecture. Reference https://www1.ietf.org/rfc/rfc1035.txt Global ID L4:53 ID 72 Known Mappings UDP Port 53 TCP Port 53 IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - P2P Technology No Encrypted No Tunnel No Underlying Protocols - NBAR2 Standard Protocol Pack 1.0 10 BGP EDONKEY EDONKEY Name/CLI Keyword edonkey Full Name eDonkey Description eDonkey is a peer-to-peer file sharing addopted to share large files. The network is based on multiple decentralized servers ,each client must be connected to a server to enter the network. edonkey-static and eMule are also required to fully detect or prevent this application traffic. Reference http://web.archive.org/web/20010213200827/www.edonkey2000.com/ overview.html Global ID L7:67 ID 67 Known Mappings UDP Port - TCP Port - IP Protocol - IP Version IPv4 Support No IPv6 Support No Application Group - Category - Sub Category - P2P Technology No Encrypted No Tunnel No Underlying Protocols - NBAR2 Standard Protocol Pack 1.0 11 BGP EGP EGP Name/CLI Keyword egp Full Name Exterior Gateway Protocol Description Exterior Gateway Protocol (EGP) is a protocol used to convey network information between neighboring gateways, or Autonomic systems. This way the gateways acquire neighbors, monitor neighbor reachability and exchange net-reachability information in the form of Update messages. EGP is IP protocol number 8. Reference http://tools.ietf.org/html/rfc904 Global ID L3:8 ID 4 Known Mappings UDP Port - TCP Port - IP Protocol 8 IP Version IPv4 Support Yes IPv6 Support Yes Application Group - Category - Sub Category - P2P Technology No Encrypted No Tunnel No Underlying Protocols - NBAR2 Standard Protocol Pack 1.0 12 BGP EIGRP EIGRP Name/CLI Keyword eigrp Full Name Interior Gateway Routing Protocol Description Enhanced Interior Gateway Routing Protocol (EIGRP) is an interior gateway protocol. It is an advanced distance-vector routing protocol, with optimizations to minimize both the routing instability incurred after topology changes, as well as the use of bandwidth and processing power in the router. The protocol is usually known as IP protocol 88 as default.