Upload
trannhi
View
217
Download
0
Embed Size (px)
Citation preview
Release Notes for NBAR2 Protocol Pack 6.3.0
• Supported Platforms, page 1
• New Features, page 2
• New Protocols in NBAR2 Protocol Pack 6.3.0, page 2
• Updated Protocols in NBAR2 Protocol Pack 6.3.0, page 4
• Deprecated Protocols in NBAR2 Protocol Pack 6.3.0, page 5
• Caveats in NBAR2 Protocol Pack 6.3.0, page 5
• Restrictions and Limitations in NBAR2 Protocol Pack 6.3.0, page 6
• Recommended Configurations, page 7
Supported PlatformsNetwork-Based Application Recognition (NBAR2) Protocol Pack support is provided for Cisco WirelessLAN Controller platforms, starting with the 7.5 release.
Though the NBAR2 protocol library and the protocol signatures support IPv6 traffic classification, CiscoWireless LAN Controller platforms currently support only IPv4 traffic classification.
Note
NBAR2 Protocol Pack 6.3.0 is supported on the following Cisco Wireless LAN Controller platforms:
• Cisco 5508 Wireless Controller
• Cisco Flex 7500 Series Wireless Controllers
• Cisco 8510 Wireless Controller
• Cisco Wireless Services Module 2 (WiSM2)
The Cisco 2504 Wireless Controller supports Application Visibility and Control, but does not supportprotocol packs.
Note
NBAR2 Protocol Pack 6.3.0 OL-30862-01 1
New FeaturesThe newly added features in this protocol pack are:
• Microsoft Lync Audio/Video separation
• Non-encrypted Cisco-Jabber support
New Protocols in NBAR2 Protocol Pack 6.3.0The following table displays the newly added protocols in NBAR2 Protocol Pack 6.3.0, after NBAR2 ProtocolPack 4.1.1:
DescriptionSyntax NameCommon Name
AirPlay (previously called AirTunes) is a proprietaryprotocol stack/suite developed by Apple Inc. that allowswireless streaming of audio, video, and photos, alongwith related metadata between devices.
airplayAirplay
Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the audio calls part ofCisco Jabber.
cisco-jabber-audioCisco Jabber Audio
Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the control andsignaling part of Cisco Jabber.
cisco-jabber-controlCisco Jabber Control
Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the text messaging partof Cisco Jabber.
cisco-jabber-imCisco Jabber IM
Cisco Jabber is a unified communications clientapplication that provides presence, instant messaging(IM), voice, and video calling capabilities on manyplatforms. This protocol classifies the video calls part ofCisco Jabber.
cisco-jabber-videoCisco Jabber Video
NBAR2 Protocol Pack 6.3.02 OL-30862-01
Release Notes for NBAR2 Protocol Pack 6.3.0New Features
DescriptionSyntax NameCommon Name
Dropbox is a file hosting service operated by DropboxInc., that offers cloud storage, file synchronization, andclient software. Dropbox allows users to create a specialfolder on each of their computers, which Dropbox thensynchronizes so that it appears to be the same folder (withthe same contents) regardless of which computer is usedto view it. Files placed in this folder also are accessiblethrough a website and mobile phone applications.
dropboxDropbox
ESPN is a global television network focused onsports-related programs. espn-browsing is the protocolused for accessing and browsing the websites and mobileapplications of the network for iPhone, iPad, Android,and WinRT.
espn-browsingESPN Browsing
ESPN is a global television network focused onsports-related programs. espn-video is the protocol usedfor watching video streams using browser or mobileapplications for iPhone, iPad, Android, and WinRT.espn-video is used for video streaming services of thenetwork.
espn-videoESPN Video
Microsoft Lync Audio is the audio calls support in MSLync. This protocol classifies the voice part of video calls.The classification is based on STUN and RTP.
ms-lync-audioMicrosoft Lync Audio
Microsoft Lync video is the video calls support in MSLync. This protocol classifies the visual part of the videocall. The voice in the video call is classified asMS-Lync-Audio. The classification is based on STUNand RTP.
ms-lync-videoMicrosoft Lync Video
Outlook Web Service is a protocol that covers a group ofMicrosoft's web email services. It includes Outlook emailservice part of Microsoft Office 365 Business Plan.
outlook-web-serviceOutlook Web Service
QQ general account login and common traffic. The QQAccounts protocol classifies QQ web login traffic overHTTP and is used by QQ applications that require a loginto the QQ accounts via the web browsers such as QQLive.
qq-accountsQQ Accounts
WhatsApp Messenger is a proprietary, cross-platforminstant messaging application for smartphones. In additionto text messaging, users can send images, location,contacts, and video and audio media messages.
whatsappWhatsApp
NBAR2 Protocol Pack 6.3.0 OL-30862-01 3
Release Notes for NBAR2 Protocol Pack 6.3.0New Protocols in NBAR2 Protocol Pack 6.3.0
Updated Protocols in NBAR2 Protocol Pack 6.3.0The following table displays the protocols that have been updated in NBAR2 Protocol Pack 6.3.0, after NBAR2Protocol Pack 4.1.1:
UpdatesProtocol
Updated signatures to allow blocking of the application.bittorrent
Updated signatures.blizwow
Updated signatures to support eMule 0.51aedonkey
Updated signatures to support eMule 0.51aencrypted-emule
Updated signatures.espn-browsing
Updated signatures.espn-video
Updated signatures.gtalk-ft
Updated signatures.hotmail
Updated signatures.imap
Updated signatures.itunes
Updated signatures to support rtp trafficms-lync
Updated signatures to support netflix apps when the client is behind http proxynetflix
Updated signatures.pcoip
Updated signatures.qqlive
Updated signatures to support dynamic payload types.rtp
Updated signatures.sip
The following clients are now supported:
• Skype 6.5.0.158 for Windows
• Skype 6.5.0.443 for Mac
• Skype 6.6.0.467 for Mac
skype
Updated signatures to support sub classification of unique-name.ssl
Updated signatures.telnet
NBAR2 Protocol Pack 6.3.04 OL-30862-01
Release Notes for NBAR2 Protocol Pack 6.3.0Updated Protocols in NBAR2 Protocol Pack 6.3.0
UpdatesProtocol
Updated signatures.tor
Deprecated Protocols in NBAR2 Protocol Pack 6.3.0The following table displays the protocols that are deprecated in NBAR2 Protocol Pack 6.3.0:
ReasonProtocol
Service is no longer available.ghostsurf
Service is no longer available.guruguru
Has been replaced with outlook-web-service.hotmail
Has been replaced with ms-lync.livemeeting
Service is no longer available.megavideo
Have been replaced with ms-lync-audio and ms-lync-video.ms-lync-media
Caveats in NBAR2 Protocol Pack 6.3.0
If you have an account on Cisco.com, you can also use the Bug Search Tool to find select caveats of anyseverity. To reach the Bug Search Tool, log in to Cisco.com and go tohttps://tools.cisco.com/bugsearch/search . (If the defect that you have requested cannot be displayed, thismay be due to one or more of the following reasons: the defect number does not exist, the defect does nothave a customer-visible description yet, or the defect has been marked Cisco Confidential.)
Note
Resolved Caveats in NBAR2 Protocol Pack 6.3.0
The following table lists the resolved caveats in NBAR2 Protocol Pack 6.3.0, after NBAR2 Protocol Pack4.1.1:
DescriptionResolved Caveat
Some Xunlei-KanKan traffic may be misclassified as Xunlei.CSCue08462
Video traffic generated by some ESPN websites might be misclassified asunknown.
CSCuh63870
Web traffic generated by some ESPNwebsites might bemisclassified as unknown.CSCuh63889
NBAR2 Protocol Pack 6.3.0 OL-30862-01 5
Release Notes for NBAR2 Protocol Pack 6.3.0Deprecated Protocols in NBAR2 Protocol Pack 6.3.0
DescriptionResolved Caveat
Traffic generated by qqlive might be misclassified as http.CSCue69212
Bittorrent-networking is not applied to any attributes.CSCug53325
BitTorrent's traffic is changed when being blocked.CSCud62120
Known Caveats in NBAR2 Protocol Pack 6.3.0
The following table lists the known caveats in NBAR2 Protocol Pack 6.3.0:
DescriptionKnown Caveat
Traffic generated by pcAnywhere for mac and pcAnywhere mobile app might bemisclassified as unknown
CSCtx65481
gtalk-video might be misclassified as rtpCSCub62860
gbridge pc client might not be blockedCSCub89835
Traffic generated by AIM Pro might be misclassified as unknown andwebex-meeting
CSCuc43505
Some qqlive traffic may bemisclassified as qq-accountswhen qqlive is configuredunder a class-map
CSCuh95182
When using Microsoft Lync in Office-365, the traffic might be misclassified asrtp or SSL
CSCui50424
SIP related protocols classification and RTP sub-classification may fail whencompact headers are used
CSCui58918
Encrypted Cisco Jabber is not supportedCSCui70613
Cisco-jabber-video and cisco-phone might be misclassified when configuredunder a class-map
CSCui85573
Microsoft Lync might be misclassified in certain scenariosCSCuj07892
Restrictions and Limitations in NBAR2 Protocol Pack 6.3.0The following table lists the limitations and restrictions in NBAR2 Protocol Pack 6.3.0:
Limitation/RestrictionProtocol
http traffic generated by the bitcomet bittorrent client might be classified as httpbittorrent
NBAR2 Protocol Pack 6.3.06 OL-30862-01
Release Notes for NBAR2 Protocol Pack 6.3.0Restrictions and Limitations in NBAR2 Protocol Pack 6.3.0
Limitation/RestrictionProtocol
Encrypted video streaming generated by hulumight be classified as its underlyingprotocol rtmpe
hulu
Traffic generated by the logmein android app might be misclassified as ssllogmein
Login and chat traffic generated by the ms-lync client might be misclassified asssl
ms-lync
Traffic generated by the mobile or mac app is not supported. ms-lync 2013 trafficif any, might be misclassified.
ms-lync 2013
Login to QQ applications which is not via webmay not be classified as qq-accountsqq-accounts
Voice traffic generated by secondlife might be misclassified as sslsecondlife
Recommended ConfigurationsThe following configurations are tested and recommended for blocking the respective traffic.
Caveat for referenceRecommended Configuration
CSCud40143To block Picasa traffic, you need to block Googleservices and the Picasa application, because Googleapplications share signatures.
CSCud43226To block Gmail traffic, you need to block Googleservices and the Gmail application, because Googleapplications share signatures.
NBAR2 Protocol Pack 6.3.0 OL-30862-01 7
Release Notes for NBAR2 Protocol Pack 6.3.0Recommended Configurations
NBAR2 Protocol Pack 6.3.08 OL-30862-01
Release Notes for NBAR2 Protocol Pack 6.3.0Recommended Configurations