Creating a Custom Protocol

NBAR supports the use of custom protocols to identify custom applications. Custom protocols support static port-based protocols and applications that NBAR does not currently support.

Note	For a list of NBAR-supported protocols, see the "Classifying Network Traffic Using NBAR" module.

With NBAR supporting the use of custom protocols, NBAR can map static TCP and UDP port numbers to the custom protocols.

Initially, NBAR included the following features related to custom protocols and applications:

• Custom protocols had to be named custom-xx, with xx being a number.
• Ten custom applications can be assigned using NBAR, and each custom application can have up to 16 TCP and 16 UDP ports each mapped to the individual custom protocol. The real-time statistics of each custom protocol can be monitored using Protocol Discovery.

In Cisco IOS Release 12.3(4)T, the following enhancements to custom protocols were introduced:

• The ability to inspect the payload for certain matching string patterns at a specific offset.
• The ability to allow users to define the names of their custom protocol applications. The user-named protocol can then be used by Protocol Discovery, the Protocol Discovery MIB, and the match protocol command as an NBAR-supported protocol.
• The ability for NBAR to inspect custom protocols specified by traffic direction (that is, traffic heading toward a source or destination rather than traffic in both directions) if desired by the user.
• CLI support that allows a user who is configuring a custom application to specify a range of ports rather specifying each port individually.

In Cisco IOS Release 12.4(1)T, the following enhancements to custom protocols were introduced:

• The variable keyword, the field-name argument,and the field-length argument were added to the ip nbar custom command.

This additional keyword and two additional arguments allow for creation of more than one custom protocol based on the same port numbers.

• After creating a variable when creating a custom protocol, you can use the match protocol commandto classify traffic on the basis of a specific value in the custom protocol.

Note	For more information about these quality of service (QoS) commands, see the Cisco IOS Quality of Service Solutions Command Reference.

NBAR recognizes and classifies network traffic by protocol or application. You can extend the set of protocols and applications that NBAR recognizes by creating a custom protocol. Custom protocols extend the capability of NBAR Protocol Discovery to classify and monitor additional static port applications and allow NBAR to classify nonsupported static port traffic. You define a custom protocol by using the keywords and arguments of the ip nbar custom command. However, after you define the custom protocol, you must create a traffic class and configure a traffic policy (policy map) to use the custom protocol when NBAR classifies traffic. To create traffic classes and configure traffic polices, use the functionality of the Modular Quality of Service (QoS) Command-Line Interface (CLI) (MQC). The MQC is a command-line interface that allows you to define traffic classes, create and configure traffic policies (policy maps), and then attach these traffic policies to interfaces. For more information about NBAR and the functionality of the MQC, see the "Configuring NBAR Using the MQC" module.

1.    enable

2.    configure terminal

3.    ip nbar custom name [offset [format value]] [variable field-name field-length] [source | destination] [tcp | udp] [range start end | port-number]

4.    end

• Examples
  

Traffic classes can be used to organize packets into groups on the basis of a user-specified criterion. For example, traffic classes can be configured to match packets on the basis of the protocol type or application recognized by NBAR. In this case, the traffic class is configured to match on the basis of the custom protocol.

To configure a traffic class to use the custom protocol, perform the following steps.

Note	The match protocolcommand is shown at Step 4. For the protocol-name argument, enter the protocol name used as the match criteria. For a custom protocol, use the protocol specified by the name argument of the ip nbar customcommand. (See Step 3 of the Defining a Custom Protocol task.)

1.    enable

2.    configure terminal

3.    class-map [match-all | match-any] class-map-name

4.    match protocol protocol-name

5.    end

Router(config)#
 ip nbar custom ftdd 23 variable scid 1 tcp range 5001 5005

Router(config)# 
class-map active-craft
Router(config-cmap)# match protocol ftdd scid 0x15
Router(config-cmap)# match protocol ftdd scid 0x21
Router(config-cmap)# match protocol ftdd scid 0x27

Router(config)# 
class-map passive-craft
Router(config-cmap)# match protocol ftdd scid 0x11
Router(config-cmap)# match protocol ftdd scid 0x22
Router(config-cmap)# match protocol ftdd scid 0x25

Traffic that matches a user-specified criterion can be organized into specific classes. The traffic in those classes can, in turn, receive specific QoS treatment when that class is included in a policy map.

To configure a traffic policy, perform the following steps.

Note	The bandwidth command is shown at Step 5. The bandwidth command configures the QoS feature class-based weighted fair queuing (CBWFQ). CBWFQ is just an example of a QoS feature that can be configured. Use the appropriate command for the QoS feature that you want to use.

1.    enable

2.    configure terminal

3.    policy-map policy-map-name

4.    class {class-name | class-default}

5.    bandwidth {bandwidth-kbps| remaining percent percentage| percent percentage}

6.    end

After a traffic policy (policy map) is created, the next step is to attach the policy map to an interface. Policy maps can be attached to either the input or output direction of the interface.

Note	Depending on the needs of your network, you may need to attach the policy map to a subinterface, an ATM PVC, a Frame Relay DLCI, or other type of interface.

To attach the traffic policy to an interface, perform the following steps.

1.    enable

2.    configure terminal

3.    interface type number [name-tag]

4.    pvc [name] vpi / vci [ilmi| qsaal| smds| l2transport]

5.    exit

6.    service-policy {input | output} policy-map-name

7.    end

1.    enable

2.    show ip nbar port-map [protocol-name]

3.    exit