Network Based Application Recognition (NBAR) - Revision history

User at 22:25, 2 December 2022

2022-12-02T22:25:25Z

User at 19:54, 8 July 2021

2021-07-08T19:54:33Z

User at 19:41, 8 July 2021

2021-07-08T19:41:46Z

User at 19:30, 8 July 2021

2021-07-08T19:30:15Z

User at 16:46, 8 July 2021

2021-07-08T16:46:29Z

User at 16:36, 8 July 2021

2021-07-08T16:36:05Z

User at 16:31, 8 July 2021

2021-07-08T16:31:04Z

User: Created page with "'''Content Coming Soon'''"

2019-01-06T06:40:47Z

Created page with "'''Content Coming Soon'''"

New page

'''Content Coming Soon'''

@@ Line 1: / Line 1: @@
 '''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality|quality]] of [[Service|service]] and [[Network Security|network security]] purposes.<ref>Definition - What Does Network Based Application Recognition (NBAR) Mean? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>
-[[Application|Applications]] in today's enterprise networks require different levels of service based upon [[Business Requirements|business requirements]]. These requirements can be translated into network policies. The resources provided here assist you in configuring your network to provide the appropriate level of service to these applications. Mission critical applications including [[Enterprise Resource Planning (ERP)|ERP]] and [[Workforce Optimization (WFO)|workforce optimization]] applications can be intelligently identified and classified using Network Based Application Recognition (NBAR). Once these mission critical applications are classified they can be guaranteed a minimum amount of bandwidth, policy routed, and marked for preferential treatment. Non-critical applications including [[Internet]] gaming applications and MP3 file sharing applications can also be classified using NBAR and marked for best effort service, policed, or blocked as required.<ref>What is Network Based Application Recognition (NBAR)? [https://www.cisco.com/c/en/us/products/ios-nx-os-software/network-based-application-recognition-nbar/index.html Cisco]</ref>
+[[Application|Applications]] in today's enterprise networks require different levels of service based upon [[Business Requirements|business requirements]]. These requirements can be translated into network policies. The resources provided here assist you in configuring your network to provide the appropriate level of service to these applications. Mission critical applications including [[Enterprise Resource Planning (ERP)|ERP]] and workforce optimization applications can be intelligently identified and classified using Network Based Application Recognition (NBAR). Once these mission critical applications are classified they can be guaranteed a minimum amount of bandwidth, policy routed, and marked for preferential treatment. Non-critical applications including [[Internet]] gaming applications and MP3 file sharing applications can also be classified using NBAR and marked for best effort service, policed, or blocked as required.<ref>What is Network Based Application Recognition (NBAR)? [https://www.cisco.com/c/en/us/products/ios-nx-os-software/network-based-application-recognition-nbar/index.html Cisco]</ref>
 Next Generation NBAR or NBAR2 is a backward compatible re-architecture of NBAR, designed with several new advantages that give greater granular control over network traffic while addressing new technologies and emerging security threats. Features include advanced classification techniques to identify new IP protocols, evasive applications (for example, Tor), cloud applications, and mobile applications. Further improvements include traffic accuracy techniques, custom protocols, common protocol library, and a new signature delivery using protocol packs that allow distribution of protocol updates outside of the Cisco operating release train enabling rapid response to market trends.

@@ Line 83: / Line 83: @@
 [[Network Architecture]]<br />
 [[Network Control Program (NCP)]]<br />
 [[Network Diagram]]<br />
 [[Network Effect]]<br />

@@ Line 45: / Line 45: @@
-The following steps occur, with reference to the numbering in the figure above:
+The following steps occur, with reference to the numbering in the figure above:<br />
 . In this example, an external user generates an HTTP query to a web server located on the internal network.<br />
 . The router receives this traffic on its external interface. If an inbound ACL is applied on the external interface, the router processes the ACL.<br />
@@ Line 55: / Line 55: @@
 *For NBAR to process traffic, the traffic must be seen by two interfaces on your router: The ingress interface classifies and marks the traffic, and the egress interface enforces policies concerning the markings.
 *You can apply NBAR classification, marking, and policing in more than one direction of the router. For example, in Figure 10-4, you could set up two different policies: one for traffic entering the network (from E1 to E0) and one for traffic leaving the network (E0 to E1), giving you a lot of flexibility in enforcing security policies.

← Older revision		Revision as of 19:30, 8 July 2021
Line 25:		Line 25:
	*Trivial File Transfer Protocol (TFTP)		*Trivial File Transfer Protocol (TFTP)
	NBAR2 provides support for an even greater number of protocol types, including non-TCP and non-UDP IP protocols, statically assigned TCP and UDP port numbers, dynamically assigned TCP and UDP port numbers, and subport classification or classification based on deep packet inspection. Network administrators can obtain new protocol support by downloading protocol packs from Cisco Connection Online.		NBAR2 provides support for an even greater number of protocol types, including non-TCP and non-UDP IP protocols, statically assigned TCP and UDP port numbers, dynamically assigned TCP and UDP port numbers, and subport classification or classification based on deep packet inspection. Network administrators can obtain new protocol support by downloading protocol packs from Cisco Connection Online.
		+
		+
		+	'''NBAR and Classification<ref>NBAR and Classification [http://etutorials.org/Networking/Router+firewall+security/Part+IV+Stateful+and+Advanced+Filtering+Technologies/Chapter+10.+Filtering+Web+and+Application+Traffic/Network-Based+Application+Recognition/ eTutorials.Org]</ref>'''<br />
		+	Classification is the first step in implementing QoS. NBAR can be used to implement classification. NBAR is a Cisco IOS classification engine that inspects packets and classifies them based on their application type. This can be something as simple as examining the TCP or UDP port numbers in the transport header of a segment, or it can as complex as examining information in HTML headers or web content. Basically, NBAR can inspect traffic from Layers 3 through 7. This inspection can look for the following types of information:
		+	*TCP and UDP port numbers in the transport-layer segment header
		+	*Dynamic TCP and UDP port numbers assigned for additional connections for an application, such as FTP (similar to the inspection process that CBAC uses when examining applications that open additional connections)
		+	*Subport information, which is information contained in the application layer data, such as application commands or data types
		+	*Layer 3 IP protocols (other than TCP and UDP)
		+	Classification of traffic with NBAR can be done dynamically or manually. NBAR supports the Protocol Discovery feature, which allows NBAR to discover automatically application protocols that enter or leave an interface. This feature also maintains per-protocol statistics, such as the number of input and output packets and bytes, bit rates, and other statistical information. With manual classification, you define the traffic types that NBAR should examine. After NBAR has identified an application, the appropriate classification can take place, marking the packet header with the corresponding IP Precedence or DSCP value.
		+
		+	<u>''Classification Process''</u> <br />
		+	NBAR enables you to classify traffic from information found in Layers 3 through 7 of the OSI reference model. The first step in setting up NBAR is to create classes for traffic that you want NBAR to inspect. You can have NBAR examine many things, such as the application type, specific addresses for connections, data in a connection, and the length of a packet. Based on your matching criteria, NBAR places matching traffic into your specified class (or grouping).
		+
		+	When you have created your classification rules, you create a policy that marks the traffic. For IP traffic, you use IP Precedence to group (classify) the traffic. The IP Precedence standard (and DSCP) uses the bits in the ToS field in an IP packet to classify the traffic. Both of these functions are performed on the ingress interface (as traffic enters your router). Then you define what action(s) will occur for marked traffic when it leaves a specific egress interface(s) on your router. Normally, with QoS, this affects how the packet is queued up before it is transmitted out the interface. However, you can define other policies for this traffic, such as limiting its bandwidth or even dropping the traffic, based on the classification, of course. The figure below illustrates this process.
		+
		+
		+	[[File:NBAR Classification Example.png\|400px\|NBAR Classification Example]]<br />
		+	source: eTutorials.Org
		+
		+
		+	The following steps occur, with reference to the numbering in the figure above:
		+	1. In this example, an external user generates an HTTP query to a web server located on the internal network.<br />
		+	2. The router receives this traffic on its external interface. If an inbound ACL is applied on the external interface, the router processes the ACL.<br />
		+	3. Assuming that the ACL permits the packet, the router uses NBAR to classify and mark the packet. This classification is done in the ingress direction of the external interface. In this case, you need an NBAR classification for HTTP traffic. For QoS purposes, you could classify all HTTP traffic into one grouping; however, if this was for security purposes, you might be looking for specific commands, filenames, or other data in the HTML query request to mark it, such as with a worm, a virus, or a Trojan horse attack. When used for security purposes, you would configure NBAR to drop unwanted or dangerous traffic. If the traffic does not match any of the classification rules, it is not marked (it is not dangerous).<br />
		+	4. After NBAR processes the traffic, it is routed to the egress interface. In this example, this is E0. The router then processes any QoS actions on the packet. I use the term QoS loosely here because the Cisco IOS can take many actions when dealing with the packet, such as queuing it up with an appropriate queuing mechanism, shaping it, policing it, and even dropping it. For security purposes, you want to drop the marked traffic and, possibly log the transaction. If the traffic is not marked, it is treated normally. Finally, if there is an egress ACL on the router's interface, this affects what traffic can exit it.<br />
		+
		+	A few important things must be pointed out about NBAR and classification:
		+	*When the Cisco IOS marks the packets' ToS field with the IP Precedence or DSCP value, this remains in the packet as long as the packet is being routed to the destination (unless another router modifies the ToS value).
		+	*For NBAR to process traffic, the traffic must be seen by two interfaces on your router: The ingress interface classifies and marks the traffic, and the egress interface enforces policies concerning the markings.
		+	*You can apply NBAR classification, marking, and policing in more than one direction of the router. For example, in Figure 10-4, you could set up two different policies: one for traffic entering the network (from E1 to E0) and one for traffic leaving the network (E0 to E1), giving you a lot of flexibility in enforcing security policies.

← Older revision		Revision as of 16:46, 8 July 2021
Line 1:		Line 1:
−	'''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)\|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)\|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality\|quality]] of [[Service\|service]] and [[Network Security\|network security]] purposes.<ref>What is Network Based Application Recognition (NBAR)? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>	+	'''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)\|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)\|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality\|quality]] of [[Service\|service]] and [[Network Security\|network security]] purposes.<ref>Definition - What Does Network Based Application Recognition (NBAR) Mean? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>

−	[[Application\|Applications]] in today's enterprise networks require different levels of service based upon [[Business Requirements\|business requirements]]. These requirements can be translated into network policies. The resources provided here assist you in configuring your network to provide the appropriate level of service to these applications. Mission critical applications including [[Enterprise Resource Planning (ERP)\|ERP]] and [[Workforce Optimization (WFO)\|workforce optimization]] applications can be intelligently identified and classified using Network Based Application Recognition (NBAR). Once these mission critical applications are classified they can be guaranteed a minimum amount of bandwidth, policy routed, and marked for preferential treatment. Non-critical applications including [[Internet]] gaming applications and MP3 file sharing applications can also be classified using NBAR and marked for best effort service, policed, or blocked as required.	+	[[Application\|Applications]] in today's enterprise networks require different levels of service based upon [[Business Requirements\|business requirements]]. These requirements can be translated into network policies. The resources provided here assist you in configuring your network to provide the appropriate level of service to these applications. Mission critical applications including [[Enterprise Resource Planning (ERP)\|ERP]] and [[Workforce Optimization (WFO)\|workforce optimization]] applications can be intelligently identified and classified using Network Based Application Recognition (NBAR). Once these mission critical applications are classified they can be guaranteed a minimum amount of bandwidth, policy routed, and marked for preferential treatment. Non-critical applications including [[Internet]] gaming applications and MP3 file sharing applications can also be classified using NBAR and marked for best effort service, policed, or blocked as required.<ref>What is Network Based Application Recognition (NBAR)? [https://www.cisco.com/c/en/us/products/ios-nx-os-software/network-based-application-recognition-nbar/index.html Cisco]</ref>
		+
		+	Next Generation NBAR or NBAR2 is a backward compatible re-architecture of NBAR, designed with several new advantages that give greater granular control over network traffic while addressing new technologies and emerging security threats. Features include advanced classification techniques to identify new IP protocols, evasive applications (for example, Tor), cloud applications, and mobile applications. Further improvements include traffic accuracy techniques, custom protocols, common protocol library, and a new signature delivery using protocol packs that allow distribution of protocol updates outside of the Cisco operating release train enabling rapid response to market trends.
		+
		+
		+	'''How NBAR Works'''<ref>How Does NBAR Work? [https://www.liveaction.com/resources/blog/nbar-network-based-application-recognition/ Live Action]</ref><br />
		+	NBAR provides intelligent network classification for [[Network Infrastructure\|network infrastructure]]. It has the ability to recognize a wide variety of applications, including those that dynamically assign [[Transmission Control Protocol (TCP)]] or [[User Datagram Protocol (UDP)]] port numbers. Upon recognition of the application, the network assigns it specific services. Using quality-of-service (QoS) features, NBAR helps ensure network bandwidth is being used to meet enterprise objectives. This means:
		+	*guaranteed bandwidth for critical applications;
		+	*limited bandwidth for non-critical applications;
		+	*avoiding congestion by dropping specific packets; and
		+	*marking specific packets to enable end-to-end QoS from.
		+	While many network administrators are using monitoring tools to oversee network link usage, these tools only provide a partial view – the volume of traffic, but not type of traffic. NBAR examines traffic on a designated router interface, identifying it by the application. This is done by mapping traffic ports to standard and non-standard protocols – much more manageable than access control lists (ACLs) that require precise matching of protocols and ports. NBAR supports a wide range of network protocols, including some of these stateful protocols that were difficult to classify before NBAR:
		+	*HTTP classification by URL, host, and Multipurpose Internet Mail Extensions (MIME) type
		+	Oracle SQLNet
		+	*Sun RPC
		+	*Microsoft Exchange
		+	*UNIX r commands
		+	*VDOLive
		+	*RealAudio
		+	*Microsoft Netshow
		+	*FTP
		+	*StreamWorks
		+	*Trivial File Transfer Protocol (TFTP)
		+	NBAR2 provides support for an even greater number of protocol types, including non-TCP and non-UDP IP protocols, statically assigned TCP and UDP port numbers, dynamically assigned TCP and UDP port numbers, and subport classification or classification based on deep packet inspection. Network administrators can obtain new protocol support by downloading protocol packs from Cisco Connection Online.

← Older revision		Revision as of 16:36, 8 July 2021
Line 1:		Line 1:
	'''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)\|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)\|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality\|quality]] of [[Service\|service]] and [[Network Security\|network security]] purposes.<ref>What is Network Based Application Recognition (NBAR)? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>		'''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)\|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)\|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality\|quality]] of [[Service\|service]] and [[Network Security\|network security]] purposes.<ref>What is Network Based Application Recognition (NBAR)? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>
		+
		+	[[Application\|Applications]] in today's enterprise networks require different levels of service based upon [[Business Requirements\|business requirements]]. These requirements can be translated into network policies. The resources provided here assist you in configuring your network to provide the appropriate level of service to these applications. Mission critical applications including [[Enterprise Resource Planning (ERP)\|ERP]] and [[Workforce Optimization (WFO)\|workforce optimization]] applications can be intelligently identified and classified using Network Based Application Recognition (NBAR). Once these mission critical applications are classified they can be guaranteed a minimum amount of bandwidth, policy routed, and marked for preferential treatment. Non-critical applications including [[Internet]] gaming applications and MP3 file sharing applications can also be classified using NBAR and marked for best effort service, policed, or blocked as required.
		+

	== See Also ==		== See Also ==

← Older revision		Revision as of 16:31, 8 July 2021
Line 1:		Line 1:
−	'''~~Content Coming Soon~~'''	+	'''Network Based Application Recognition (NBAR)''' is the mechanism used by some Cisco routers and switches to recognize a dataflow by inspecting some packets sent. The networking equipment which uses NBAR does a deep packet inspection on some of the packets in a dataflow, to determine which traffic category the flow belongs to. Used in conjunction with other features, it may then program the internal [[Application Specific Integrated Circuit (ASIC)\|application-specific integrated circuits (ASICs)]] to handle this flow appropriately. The categorization may be done with [[Open Systems Interconnection Model (OSI Model)\|Open Systems Interconnection (OSI)]] layer 4 info, packet content, signaling, and so on but some new applications have made it difficult on purpose to cling to this kind of tagging. The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports. That's why NBAR is also known as OSI layer 7 categorization. On Cisco routers, NBAR is mainly used for [[Quality\|quality]] of [[Service\|service]] and [[Network Security\|network security]] purposes.<ref>What is Network Based Application Recognition (NBAR)? [https://en.wikipedia.org/wiki/Network_Based_Application_Recognition Wikipedia]</ref>
		+
		+	== See Also ==
		+	<div style="column-count:2;-moz-column-count:4;-webkit-column-count:4">
		+	[[Network]]<br />
		+	[[Network Address Translation (NAT)]]<br />
		+	[[Network Architecture]]<br />
		+	[[Network Control Program (NCP)]]<br />
		+	[[Network Data Representation (NDR)]]<br />
		+	[[Network Diagram]]<br />
		+	[[Network Effect]]<br />
		+	[[Network Infrastructure]]<br />
		+	[[Network Management]]<br />
		+	[[Network Map]]<br />
		+	[[Network Mapping]]<br />
		+	[[Network Monitoring]]<br />
		+	[[Network Motif]]<br />
		+	[[Network News Transfer Protocol (NNTP)]]<br />
		+	[[Network Operations Center (NOC)]]<br />
		+	[[Network Organization]]<br />
		+	[[Network Performance Management (NPM)]]<br />
		+	[[Network Protocol]]<br />
		+	[[Network Security]]<br />
		+	[[Network Structure]]<br />
		+	[[Network Topology]]<br />
		+	</div>
		+
		+
		+	== References ==
		+	<references/>