NBAR Protocol Discovery

Introduction to NBAR Protocol Discovery

The NBAR Protocol Discovery feature provides an easy way of discovering the application protocols passing through an interface. Network Based Application Recognition (NBAR) determines which protocols and applications are currently running on the network. With Protocol Discovery, you can discover any protocol traffic that is supported by NBAR and obtain statistics that are associated with that protocol.

NBAR provides several classification features that identify applications and protocols from Layer 4 through Layer 7. NBAR is also used in Cisco Application Visibility and Control (AVC). With AVC, NBAR provides better application performance through better QoS and policing, and provides finer visibility about the network that is being used.


Note

NBAR is not able to classify traffic accurately when SaaS applications use end-to-end encryption, QUIC, or DoH due to the encryption's impact on classification. In such a case, the encrypted traffic, including DoH and QUIC without SNI, limits the NBAR's ability to send the correct Protocol ID, causing issues with traffic classification.

Configuring NBAR Protocol Discovery

Follow the procedure given below to enable protocol discovery:

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy nbar-proto-policy

Configures a WLAN policy profile and enters wireless policy configuration mode.

Step 3

central switching

Example:

Device(config-wireless-policy)# central switching

Configures the wireless policy profile for central switching.

Note

 

NBAR Protocol Discovery is supported in local mode (central switching) and in FlexConnect (central switching) mode.

Step 4

ip nbar protocol-discovery

Example:

Device(config-wireless-policy)# ip nbar protocol-discovery

Enables application recognition on the wireless policy profile by activating the NBAR2 engine.

Verifying Protocol Discovery Statistics

To view protocol discovery statistics, use the following command: 

Device# show ip nbar protocol-discovery wlan wlan-profile-name 

wlan_profile_name (iif_id 0xF0400002)

Last clearing of "show ip nbar protocol-discovery" counters 00:07:12


                            Input                    Output
                            -----                    ------
   Protocol                 Packet Count             Packet Count
                            Byte Count               Byte Count
                            5min Bit Rate (bps)      5min Bit Rate (bps)
                            5min Max Bit Rate (bps)  5min Max Bit Rate (bps)
   ------------------------ ------------------------ ------------------------
   unknown                  22                       0
                            4173                     0
                            0                        0
                            2000                     0
   dhcp                     3                        2
                            1166                     724
                            0                        0
                            0                        0
   ping                     2                        2
                            204                      236
                            0                        0
                            0                        0
   Total                    27                       4
                            5543                     960
                            0                        0
                            2000                     0

To clear protocol discovery statistics, use the following command:

Device# clear ip nbar protocol-discovery wlan wlan-profile-name