NBAR
NBAR – Network-Based Application Recognition
- Used to classify packets
- Performs Deep Packet Inspection to classify packet
- Not based on TCP/UDP port numbers
- Works independently from QoS
- Uses Protocol packs to update application signatures
- Can create custom protocols
- Can download and add Application Recognition Modules to recognise additional protocols on network
- Also known as Packet Description Language Modules (PDLMs)
- Requires protocol discovery to be enabled on the interface
- Supported on L2 and L3 EtherChannels
- Command:
- (config-if)#ip nbar protocol-discovery
- Used with Modular QoS Command (MQC)
- Commands:
- (config)#class-map <class-map name> match-any
- (config-cmap)#match protocol <protocol>
Troubleshooting Commands
- #show ip nbar protocol-pack active [detail] - displays detailed information about the current active protocol pack
- #show ip nbar protocol-discovery interface <IF> - Displays NBAR statistics for interface
[_/su_spoiler]
TCP Optimization
TCP Optimization
Nagle Service
- Congestion control algorithm for small packets
- Improves performance of Telnet sessions
- Normal use is sending one packet for each keystroke typed
- Larger networks will have many small packets and cause congestion
- Using nagle it waits for acknowledgement of the first keystroke
- Can then send larger packet including more than one typed character
- Waits for acknowledgement
- Command:
[_/su_spoiler]
Explicit Congestion Notification (ECN)
Explit Congestion Notification (ECN)
- Notifies end hosts of network congestion
- Provides enhanced support for TCP applications sensitive to delay or packet loss including
- Telnet
- Web browsing
- Transfer of audio and video data
- Reduces delay and packet loss in data transmissions
- Command:
[_/su_spoiler]
Selective Acknowledgements
Selective Acknowledgements
- Receiving TCP host returns selective acknowledgement packets to sender
- Informs sender what packets have been received
- Can acknowledge packets received out of order
- Sender then only resends the missing packets, instead of everything from the first lost packet
- Only used when multiple packets are lost within one TCP window
- Command:
- (config)#ip tcp selective-ack
[_/su_spoiler]
Path MTU Discovery
- Disabled by default
- Helps avoid fragmentation with TCP streams
- Maximises use of available bandwidth between endpoints in a TCP connection
- Discovers the maximum end-to-end MTU size
- Process:
- On receiving a MTU packet that is too big, the device sends a Fragmentation needed and DF bit set ICMP message back to the host
- Host then lowers MTU value
- Command:
- (config)#ip tcp path-mtu-discovery
[_/su_spoiler]
Window Scaling / Sizing
- Used to control how often a TCP acknowledgement is needed when sending multiple packets to host
- Larger window size recommended for higher TCP performance
- Network paths with a large bandwidth-delay product called Long Fat Networks (LFNs)
- Expands Window definition to 32 bits from 16 bits
- Uses a scale factor to carry this 32 bit value in a 16 bit field
- Can scale to a factor of 14
- Command:
- (config)#ip tcp window-size <0 - 1,073,741,823 bytes>
[_/su_spoiler]
TCP SYN Wait Time
- Can specify the amount of time to wait before timing out a TCP connection
- Only affects traffic originating from device and not going through device
- Default is 30 seconds
- Command:
- (config)#ip tcp synwait-time <5 - 300(seconds)>
[_/su_spoiler]
TCP Outgoing Queue
- Can limit the number of packets queued in the outgoing TCP queue
- Default is 5 if the connection has a TTY associated with it e.g. Telnet
- Default queue size is 20
- Command:
- (config)#ip tcp queuemax <5 - 50>
[_/su_spoiler]
Device Services
Device Services
IOS Small Services
- Services or daemons that run on a router that originally used for diagnostic information
- TCP Small servers are:
- Echos
- Echos back whatever you type in telnet session
- Command to test:
- Chargen
- Generates a stream of ASCII data in a telnet session
- Command to test:
- #telnet <x.x.x.x> chargen
- Discard
- Throws away whatever you type in a telnet session
- Command to test:
- #telnet <x.x.x.x> discard
- Daytime
- Returns the system date and time
- Command to test:
- #telnet <x.x.x.x> daytime
- TCP Small servers are enabled by default
- Command:
- (config)#service tcp-small-servers
- UDP Small servers are:
- Echo
- Echos back whatever you type in telnet session
- Command to test:
-
- Discard
- Throws away whatever you type in a telnet session
- Command to test:
- #telnet <x.x.x.x> discard
- Chargen
- Generates a stream of ASCII data in a telnet session
- Command to test:
- #telnet <x.x.x.x> chargen
- UDP Small servers are enabled by default
- Command:
- (config)#service udp-small-servers
[_/su_spoiler]
Finger
- Service that allows you to see remotely who is logged on to a router
- Command:
- (config)#service finger
- (config)#ip finger
- Command to test:
[_/su_spoiler]
Directed Broadcast and Broadcast Address
Directed Broadcast and Broadcast Address
- A packet whose destination matches the local subnet broadcast address
- Feature disabled by default
- Allows Smurf and Fraggle DoS attacks
- The router changes the destination address from the directed broadcast address to the all subnet broadcast address (255.255.255.255)
- This can be over-ridden with the broadcast address command set on the interface
- Command:
- (config-if)#ip broadcast-address <x.x.x.x>
- Example:
- An interface with the address 10.0.0.0/24 would have a broadcast address of 10.0.0.255
- A directed broadcast would have its destination set to 10.0.0.255
- The router changes that destination and sends it to the all subnet broadcast address of 255.255.255.255
- If the broadcast address command is configured on the outgoing interface then it will only send it to the configured broadcast address
[_/su_spoiler]
UDP Forwarding
- Forward specific UDP broadcasts to unicast addresses
- Can be configued on a per port / service basis
- Will forward UDP by default for only the following protocols:
- TACAS, TFTP, BOOTP, Time, NetBIOS Name Server, NetBIOS Datagram Services and DNS
- Configured with the helper address and udp forwarding feature
- Command:
- (config)#ip forward-protocol udp <udp port>
- (config-if)#ip helper-address <unicast address>
[_/su_spoiler]
Director Response Protocol (DRP)
Director Response Protocol (DRP)
- Cisco proprietary UDP service to provide a very simple load balancing method between servers
- Sends user service requests to the closest and most responsive server
- It queries routers for BGP and IGP RIB metrics between distributed servers and clients
- DistributedDirector is separate standalone software and will answer DNS queries or respond with HTTP 302 redirect message
- DRP Server Agents are border routers within the estate
- Can use authentication between devices and limit the scope of valid DRP queries using ACLs
- Configuration to enable DRP Server Agent on router:
- (config)#ip drp server
- (config)#ip drp access-group <acl>
- ip drp authentication key-chain <key-chain>
- Displaying information command:
- #show ip drp
[_/su_spoiler]
