-
Cisco IOS Quality of Service Solutions Command Reference
-
A through C
-
D through F
-
identity policy (policy-map) through ip rsvp pq-profile
-
ip rsvp precedence through load protocol
-
match access-group through mls ip pbr
-
mls qos (global configuration mode) through mpls experimental
-
N through P
-
Q through R
-
send qdm message through show atm bundle svc statistics
-
show auto discovery qos through show ip rsvp hello client lsp detail
-
show ip rsvp hello client lsp summary through show lane qos database
-
show mls qos through wrr-queue threshold
-
Table Of Contents
match mpls experimental topmost
match packet length (class-map)
match protocol pppoe-discovery
match access-group
To configure the match criteria for a class map on the basis of the specified access control list (ACL), use the match access-group command in class-map configuration mode. To remove ACL match criteria from a class map, use the no form of this command.
match access-group {access-group | name access-group-name}
no match access-group access-group
Syntax Description
Command Default
No match criteria are configured.
Command Modes
Class-map configuration
Command History
Usage Guidelines
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including ACLs, protocols, input interfaces, quality of service (QoS) labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
Note
For Zone-Based Policy Firewall, this command is not applicable to CBWFQ.
The match access-group command specifies a numbered or named ACL whose contents are used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.
Supported Platforms Other than Cisco 10000 Series Routers
To use the match access-group command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
•
•
•
Note
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
Note
Cisco 10000 Series Routers
To use the match access-group command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.
Note
Examples
The following example specifies a class map called acl144 and configures the ACL numbered 144 to be used as the match criterion for that class:
class-map acl144match access-group 144The following example pertains to Zone-Based Policy Firewall. The example defines a class map called c1 and configures the ACL numbered 144 to be used as the match criterion for that class.class-map type inspect match-all c1match access-group 144Related Commands
match any
To configure the match criteria for a class map to be successful match criteria for all packets, use the match any command in class-map configuration mode. To remove all criteria as successful match criteria, use the no form of this command.
match any
no match any
Syntax Description
This command has no arguments or keywords.
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Examples
In the following configuration, all packets leaving Ethernet interface 1/1 will be policed based on the parameters specified in policy-map class configuration mode:
Router(config)# class-map matchanyRouter(config-cmap)# match anyRouter(config-cmap)# exitRouter(config)# policy-map policy1Router(config-pmap)# class class4Router(config-pmap-c)# police 8100 1500 2504 conform-action transmit exceed-action set-qos-transmit 4Router(config-pmap-c)# exitRouter(config)# interface ethernet1/1Router(config-if)# service-policy output policy1Related Commands
match atm-clp
To enable packet matching on the basis of the ATM cell loss priority (CLP), use the match atm-clp command in class-map configuration mode. To disable packet matching on the basis of the ATM CLP, use the no form of this command.
match atm-clp
no match atm-clp
Syntax Description
This command has no arguments or keywords.
Command Default
Packets are not matched on the basis of the ATM CLP.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
This command is supported on policy maps that are attached to ATM main interfaces, ATM subinterfaces, or ATM permanent virtual circuits (PVCs). However, policy maps (containing the match atm-clp command) that are attached to these types of ATM interfaces can be input policy maps only.
This command is supported on the PA-A3 adapter only.
Examples
In the following example, a class called "class-c1" has been created using the class-map command, and the match atm-clp command has been configured inside that class. Therefore, packets are matched on the basis of the ATM CLP and are placed into this class.
Router> enable
Router# configure terminal
Router(config)# class-map class-c1
Router(config-cmap)# match atm-clp
Router(config-cmap)# end
Related Commands
match atm-vci
To enable packet matching on the basis of the ATM virtual circuit interface (VCI), use the match atm-vci command in class-map configuration mode. To disable packet matching on the basis of the ATM VCI, use the no form of this command.
match atm-vci vc-id [-vc-id]
no match atm-vci
Syntax Description
Command Default
No match criteria are configured.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
When you configure the match atm-vci command in class-map configuration mode, you can add this class map to a policy map that can be attached only to an ATM permanent virtual path (PVP).
Note
You can use the match not command to remove the match criteria.
Examples
The following example enables matching on VC-ID 50:
Router(config)# class-map map1Router(config-cmap)# match atm-vci 50Related Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match cos
To match a packet on the basis of a Layer 2 class of service (CoS)/Inter-Switch Link (ISL) marking, use the match cos command in class-map configuration mode. To remove a specific Layer 2 CoS/ISL marking as a match criterion, use the no form of this command.
match cos cos-value [cos-value [cos-value [cos-value]]]
no match cos cos-value [cos-value [cos-value [cos-value]]]
Syntax Description
Command Default
Packets are not matched on the basis of a Layer 2 CoS/ISL marking.
Command Modes
Class-map configuration (config-cmap)
Command History
Examples
In the following example, the CoS values of 1, 2, and 3 are successful match criteria for the interface that contains the classification policy called cos:
Router(config)# class-map cosRouter(config-cmap)# match cos 1 2 3In the following example, classes called voice and video-n-data are created to classify traffic based on the CoS values. QoS treatment is then given to the appropriate packets in the CoS-based-treatment policy map (in this case, the QoS treatment is priority 64 and bandwidth 512). The service policy configured in this example is attached to all packets leaving Fast Ethernet interface 0/0.1. The service policy can be attached to any interface that supports service policies.
Router(config)# class-map voiceRouter(config-cmap)# match cos 7Router(config)# class-map video-n-dataRouter(config-cmap)# match cos 5Router(config)# policy-map cos-based-treatmentRouter(config-pmap)# class voiceRouter(config-pmap-c)# priority 64Router(config-pmap-c)# exitRouter(config-pmap)# class video-n-dataRouter(config-pmap-c)# bandwidth 512Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet0/0.1Router(config-if)# service-policy output cos-based-treatmentRelated Commands
match cos inner
To match the inner cos of QinQ packets on a Layer 2 class of service (CoS) marking, use the match cos inner command in class-map configuration mode. To remove a specific Layer 2 CoS inner tag marking, use the no form of this command.
match cos cos-value
no match cos cos-value
Syntax Description
cos-value
Specific IEEE 802.1Q/ISL CoS value. The cos-value is from 0 to 7; up to four CoS values can be specified in one match cos statement.
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
12.2(18)SXE
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Examples
In the following example, the inner CoS-values of 1, 2, and 3 are successful match criteria for the interface that contains the classification policy called cos:
Router(config)# class-map cos Router(config-cmap)# match cos inner 1 2 3Related Commands
match destination-address mac
To use the destination MAC address as a match criterion, use the match destination-address mac command in class-map configuration mode. To remove a previously specified destination MAC address as a match criterion, use the no form of this command.
match destination-address mac address
no match destination-address mac address
Syntax Description
Command Default
No destination MAC address is specified.
Command Modes
Class-map configuration
Command History
Examples
The following example specifies a class map called macaddress and specifies the destination MAC address to be used as the match criterion for this class:
class-map macaddressmatch destination-address mac 00:00:00:00:00:00Related Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match discard-class
To specify a discard class as a match criterion, use the match discard-class command in class-map configuration mode. To remove a previously specified discard class as a match criterion, use the no form of this command.
match discard-class class-number
no match discard-class class-number
Syntax Description
Command Default
Packets will not be classified as expected.
Command Modes
Class-map configuration
Command History
Usage Guidelines
A discard-class value has no mathematical significance. For example, the discard-class value 2 is not greater than 1. The value simply indicates that a packet marked with discard-class 2 should be treated differently than a packet marked with discard-class 1.
Packets that match the specified discard-class value are treated differently from packets marked with other discard-class values. The discard-class is a matching criterion only, used in defining per hop behavior (PHB) for dropping traffic.
Examples
The following example shows that packets in discard class 2 are matched:
Router(config-cmap)# match discard-class 2Related Commands
match dscp
To identify one or more differentiated service code point (DSCP), Assured Forwarding (AF), and Certificate Server (CS) values as a match criterion, use the match dscp command in class-map configuration mode. To remove a specific DSCP value from a class map, use the no form of this command.
match [ip] dscp dscp-value [dscp-value dscp-value dscp-value dscp-value dscp-value dscp-value dscp-value]
no match [ip] dscp dscp-value
Syntax Description
Command Default
No match criteria is configured.
If you do not enter the ip keyword, matching occurs on both IPv4 and IPv6 packets.
Command Modes
Class-map configuration
Command History
Usage Guidelines
DSCP Values
You must enter one or more differentiated service code point (DSCP) values. The command may include any combination of the following:
•
•
•
•
•
For example, if you wanted the DCSP values of 0, 1, 2, 3, 4, 5, 6, or 7 (note that only one of the IP DSCP values must be a successful match criterion, not all of the specified DSCP values), enter the match dscp 0 1 2 3 4 5 6 7 command.
This command is used by the class map to identify a specific DSCP value marking on a packet. In this context, dscp-value arguments are used as markings only and have no mathematical significance. For instance, the dscp-value of 2 is not greater than 1. The value simply indicates that a packet marked with the dscp-value of 2 is different than a packet marked with the dscp-value of 1. The treatment of these marked packets is defined by the user through the setting of Quality of Service (QoS) policies in policy-map class configuration mode.
Match Packets on DSCP Values
To match DSCP values for IPv6 packets only, the match protocol ipv6 command must also be used. Without that command, the DSCP match defaults to match both IPv4 and IPv6 packets.
To match DSCP values for IPv4 packets only, use the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets. Alternatively, the match protocol ip command may be used with match dscp to classify only IPv4 packets.
After the DSCP bit is set, other QoS features can then operate on the bit settings.
The network can give priority (or some type of expedited handling) to marked traffic. Typically, you set the precedence value at the edge of the network (or administrative domain); data is then queued according to the precedence. Weighted fair queueing (WFQ) can speed up handling for high-precedence traffic at congestion points. Weighted Random Early Detection (WRED) can ensure that high-precedence traffic has lower loss rates than other traffic during times of congestion.
Cisco 10000 Series Router
The Cisco 10000 series router supports DSCP matching of IPv4 packets only. You must include the ip keyword when specifying the DSCP values to use as match criterion.
You cannot use the set ip dscp command with the set ip precedence command to mark the same packet. DSCP and precedence values are mutually exclusive. A packet can have one value or the other, but not both.
Examples
The following example shows how to set multiple match criteria. In this case, two IP DSCP value and one AF value.
Router(config)# class-map map1Router(config-cmap)# match dscp 1 2 af11Related Commands
match field
To configure the match criteria for a class map on the basis of the fields defined in the protocol header description files (PHDFs), use the match field command in class-map configuration mode. To remove the specified match criteria, use the no form of this command.
match field protocol protocol-field {eq [mask] | neq [mask] | gt | lt | range range | regex string} value [next next-protocol]
no match field protocol protocol-field {eq [mask] | neq [mask] | gt | lt | range range | regex string} value [next next-protocol]
Syntax Description
Command Default
No match criteria are configured.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Before issuing the match-field command, you must load a PHDF onto the router via the load protocol command. Thereafter, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.
Match criteria are defined via a start point, offset, size, value to match, and mask. A match can be defined on a pattern with any protocol field.
Examples
The following example shows how to configure FPM for blaster packets. The class map contains the following match criteria: TCP port 135, 4444 or UDP port 69; and pattern 0x0030 at 3 bytes from start of IP header.
load protocol disk2:ip.phdfload protocol disk2:tcp.phdfload protocol disk2:udp.phdfclass-map type stack match-all ip-tcpmatch field ip protocol eq 0x6 next tcpclass-map type stack match-all ip-udpmatch field ip protocol eq 0x11 next udpclass-map type access-control match-all blaster1match field tcp dest-port eq 135match start 13-start offset 3 size 2 eq 0x0030class-map type access-control match-all blaster2match field tcp dest-port eq 4444match start 13-start offset 3 size 2 eq 0x0030class-map type access-control match-all blaster3match field udp dest-port eq 69match start 13-start offset 3 size 2 eq 0x0030policy-map type access-control fpm-tcp-policyclass blaster1dropclass blaster2droppolicy-map type access-control fpm-udp-policyclass blaster3droppolicy-map type access-control fpm-policyclass ip-tcpservice-policy fpm-tcp-policyclass ip-udpservice-policy fpm-udp-policyinterface gigabitEthernet 0/1service-policy type access-control input fpm-policyRelated Commands
match flow pdp
To specify a Packet Data Protocol (PDP) flow as a match criterion in a class map, use the match flow pdp command in class-map configuration mode. To remove a PDP flow as a match criterion, use the no form of this command.
match flow pdp
no match flow pdp
Syntax Description
This command has no arguments or keywords.
Command Default
A PDP flow is not specified as a match criterion.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
The match flow pdp command allows you to match and classify traffic on the basis of a PDP flow.
The match flow pdp command is included with the Flow-Based QoS for GGSN feature available with Cisco IOS Release 12.4(9)T. The Flow-Based QoS for GGSN feature is designed specifically for the Gateway General Packet Radio Service (GPRS) Support Node (GGSN).
Per-PDP Policing
The Flow-Based QoS for GGSN feature includes per-PDP policing (session-based policing).
The match flow pdp command (when used in conjunction with the class-map command, the policy-map command, the police rate pdp command, and the service-policy command) allows you to configure per-PDP policing (session-based policing) for downlink traffic on a GGSN.
Note the following points related to per-PDP policing:
•
•
•
For More Information
For more information about the GGSN, along with the instructions for configuring the Flow-Based QoS for GGSN feature, see the Cisco GGSN Release 6.0 Configuration Guide, Cisco IOS Release 12.4(2)XB.
Note
For more information about the GGSN-specific commands, see the Cisco GGSN Release 6.0 Command Reference, Cisco IOS Release 12.4(2)XB.
Examples
The following example specifies PDP flows as the match criterion in a class map named "class-pdp":
class-map class-pdpmatch flow pdpRelated Commands
match fr-dlci
To specify the Frame Relay data-link connection identifier (DLCI) number as a match criterion in a class map, use the match fr-dlci command in class-map configuration mode. To remove a previously specified DLCI number as a match criterion, use the no form of this command.
match fr-dlci dlci-number
no match fr-dlci dlci-number
Syntax Description
Command Default
No DLCI number is specified.
Command Modes
Class-map configuration
Command History
12.2(13)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This match criterion can be used in main interfaces and point-to-multipoint subinterfaces in Frame Relay networks, and it can also be used in hierarchical policy maps.
Examples
In the following example a class map called "class1" has been created and the Frame Relay DLCI number of 500 has been specified as a match criterion. Packets matching this criterion are placed in class1.
Router(config)# class-map class1Router(config-cmap)# match fr-dlci 500Router(config-cmap)# endRelated Commands
match input vlan
To configure a class map to match incoming packets that have a specific virtual local area network (VLAN) ID, use the match input vlan command in class map configuration mode. To remove the matching of VLAN IDs, use the no form of this command.
match input vlan input-vlan-list
no match input vlan input-vlan-list
Syntax Description
Command Default
By default, no matching is done on VLAN IDs.
Command Modes
Class map configuration
Command History
Usage Guidelines
The match input vlan command allows you to create a class map that matches packets with one or more specific VLAN IDs, as they were received on the input (ingress) interface. This enables hierarchical Quality of Service (HQoS) for Ethernet over MPLS (EoMPLS) Virtual Circuits (VC), allowing parent and child relationships between QoS class maps and policy maps. This in turn enables service providers to easily classify and shape traffic for a particular EoMPLS network.
In EoMPLS applications, the parent class map typically specifies the maximum bandwidth for all of the VCs in a specific EoMPLS network. Then the child class maps perform other QoS operations, such as traffic shaping, on a subset of this traffic.
Do not confuse the match input vlan command with the match vlan command, which is also a class-map configuration command.
•
•
The match input vlan command can also be confused with the match input-interface vlan command, which matches packets being received on a logical VLAN interface that is used for inter-VLAN routing.
Tip
Note
Restrictions
The following restrictions apply when using the match input vlan command:
•
•
•
Examples
The following example creates a class map and policy map that matches packets with a VLAN ID of 1000. The policy map shapes this traffic to a committed information rate (CIR) value of 10 Mbps (10,000,000 bps). The final lines then apply this policy map to a specific gigabit Ethernet WAN interface.
Router# configure terminalRouter(config)# class-map match-any vlan1000Router(config-cmap)# match input vlan 1000Router(config-cmap)# exitRouter(config)# policy-map policy1000Router(config-pmap)# class vlan1000Router(config-pmap-c)# exitRouter(config-pmap)# shape average 10000000Router(config-pmap)# interface GE-WAN 3/0Router(config-if)# service-policy output policy1000Router(config-if)#The following example shows a class map being configured to match VLAN IDs 100, 200, and 300:
Router# configure terminalRouter(config)# class-map match-any hundredsRouter(config-cmap)# match input vlan 100 200 300Router(config-cmap)#The following example shows a class map being configured to match all VLAN IDs from 2000 to 2999 inclusive:
Router# configure terminalRouter(config)# class-map match-any vlan2000sRouter(config-cmap)# match input vlan 2000-2999Router(config-cmap)#The following example shows a class map being configured to match both a range of VLAN IDs, as well as specific VLAN IDs:
Router# configure terminalRouter(config)# class-map match-any miscRouter(config-cmap)# match input vlan 1 5 10-99 2000-2499Router(config-cmap)#Related Commands
match input-interface
To configure a class map to use the specified input interface as a match criterion, use the match input-interface command in class-map configuration mode. To remove the input interface match criterion from a class map, use the no form of this command.
match input-interface interface-name
no match input-interface interface-name
Syntax Description
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Supported Platforms Other Than Cisco 10000 Series Routers
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including input interfaces, access control lists (ACLs), protocols, quality of service (QoS) labels, and experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match input-interface command specifies the name of an input interface to be used as the match criterion against which packets are checked to determine if they belong to the class specified by the class map.
To use the match input-interface command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
•
•
•
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
Cisco 10000 Series Routers
For CBWFQ, you define traffic classes based on match criteria including input interfaces, ACLs, protocols, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
To use the match input-interface command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.
Examples
The following example specifies a class map called ethernet1 and configures the input interface named ethernet1 to be used as the match criterion for this class:
class-map ethernet1match input-interface ethernet1Related Commands
match ip dscp
The match ip dscp command is replaced by the match dscp command. See the match dscp command for more information.
match ip precedence
The match ip precedence command is replaced by the match precedence command. See the match precedence command for more information.
match ip rtp
To configure a class map to use the Real-Time Protocol (RTP) port as the match criterion, use the match ip rtp command in class-map configuration mode. To remove the RTP port match criterion, use the no form of this command.
match ip rtp starting-port-number port-range
no match ip rtp
Syntax Description
starting-port-number
The starting RTP port number. Values range from 2000 to 65535.
port-range
The RTP port number range. Values range from 0 to 16383.
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Usage Guidelines
This command is used to match IP RTP packets that fall within the specified port range. It matches packets destined to all even User Datagram Port (UDP) port numbers in the range from the starting port number argument to the starting port number plus the port range argument.
Use of an RTP port range as the match criterion is particularly effective for applications that use RTP, such as voice or video.
Examples
The following example specifies a class map called ethernet1 and configures the RTP port number 2024 and range 1000 to be used as the match criteria for this class:
class-map ethernet1match ip rtp 2024 1000Related Commands
match mpls experimental
To configure a class map to use the specified value or values of the experimental (EXP) field as a match criteria, use the match mpls experimental command in class-map configuration mode. To remove the EXP field match criteria from a class map, use the no form of this command.
match mpls experimental number
no match mpls experimental number
Syntax Description
number
EXP field value (any number from 0 through 7) to be used as a match criterion. You can specify multiple values, separated by a space (for example, 3 4 7).
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Supported Platforms Other Than the Cisco 10000 Series
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria such as input interfaces, access control lists (ACLs), protocols, quality of service (QoS) labels, and experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match mpls experimental command specifies the name of an EXP field value to be used as the match criterion against which packets are compared to determine if they belong to the class specified by the class map.
To use the match mpls experimental command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
•
•
•
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
Cisco 10000 Series
This command is available only on the ESR-PRE1 module.
For CBWFQ, you define traffic classes based on match criteria such as input interfaces, ACLs, protocols, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
To use the match mpls experimental command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.
Examples
The following example specifies a class map called ethernet1 and configures the Multiprotocol Label Switching (MPLS) experimental values of 1 and 2 to be used as the match criteria for this class:
Router(config)# class-map ethernet1Router(config-cmap)# match mpls experimental 1 2Related Commands
match mpls experimental topmost
To match the experimental (EXP) value in the topmost label header, use the match mpls experimental topmost command in class-map configuration mode. To remove the EXP match criterion, use the no form of this command.
match mpls experimental topmost number
no match mpls experimental topmost number
Syntax Description
number
Multiprotocol Label Switching (MPLS) EXP field in the topmost label header. Valid values are 0 to 7.
Command Default
No EXP match criterion is configured for the topmost label header.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
You can enter this command on the input interfaces and the output interfaces. It will match only on MPLS packets.
Examples
The following example shows that the EXP value 3 in the topmost label header is matched:
Router(config-cmap)# match mpls experimental topmost 3Related Commands
set mpls experimental topmost
Sets the MPLS EXP field value in the topmost MPLS label header at the input or output interfaces.
match not
To specify the single match criterion value to use as an unsuccessful match criterion, use the match not command in QoS class-map configuration mode. To remove a previously specified source value to not use as a match criterion, use the no form of this command.
match not match-criterion
no match not match-criterion
Syntax Description
match-criterion
The match criterion value that is an unsuccessful match criterion. All other values of the specified match criterion will be considered successful match criteria.
Command Default
No default behavior or values
Command Modes
QoS class-map configuration
Command History
Usage Guidelines
The match not command is used to specify a quality of service (QoS) policy value that is not used as a match criterion. When the match not command is used, all other values of that QoS policy become successful match criteria.
For instance, if the match not qos-group 4 command is issued in QoS class-map configuration mode, the specified class will accept all QoS group values except 4 as successful match criteria.
Examples
In the following traffic class, all protocols except IP are considered successful match criteria:
Router(config)# class-map noipRouter(config-cmap)# match not protocol ipRouter(config-cmap)# exitRelated Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match packet length (class-map)
To specify the Layer 3 packet length in the IP header as a match criterion in a class map, use the match packet length command in class-map configuration mode. To remove a previously specified Layer 3 packet length as a match criterion, use the no form of this command.
match packet length {max maximum-length-value [min minimum-length-value] | min minimum-length-value [max maximum-length-value]}
no match packet length {max maximum-length-value [min minimum-length-value] | min minimum-length-value [max maximum-length-value]}
Syntax Description
Command Default
The Layer 3 packet length in the IP header is not used as a match criterion.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
This command considers only the Layer 3 packet length in the IP header. It does not consider the Layer 2 packet length in the IP header.
When using this command, you must at least specify the maximum or minimum value. However, you do have the option of entering both values.
If only the minimum value is specified, a packet with a Layer 3 length greater than the minimum is viewed as matching the criterion.
If only the maximum value is specified, a packet with a Layer 3 length less than the maximum is viewed as matching the criterion.
Examples
In the following example a class map called "class 1" has been created, and the Layer 3 packet length has been specified as a match criterion. In this example, packets with a minimum Layer 3 packet length of 100 bytes and a maximum Layer 3 packet length of 300 bytes are viewed as meeting the match criteria.
Router> enable
Router# configure terminal
Router(config)# class-map match-all class1Router(config-cmap)# match packet length min 100 max 300Router(config-cmap)# end
Related Commands
match port-type
To match the access policy on the basis of the port for a class map, use the match port-type command in class-map configuration mode. To delete the port type, use the no form of this command.
match port-type {routed | switched}
no match port-type {routed | switched}
Syntax Description
Command Default
Access policy is not matched.
Command Modes
Class-map configuration
Command History
Usage Guidelines
This command is used because, on the basis of the port on which a user is connecting, the access policies that are applied to it can be different.
Examples
The following example shows that an access policy has been matched on the basis of the port for a class map:
Router(config-cmap)# match port-type routedRelated Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match tag (class-map)
Specifies the tag to be matched for a tag type of class map.
match precedence
To identify IP precedence values to use as the match criterion, use the match precedence command in class-map configuration mode. To remove IP precedence values from a class map, use the no form of this command.
match [ip] precedence {precedence-criteria1 | precedence-criteria2 | precedence-criteria3 | precedence-criteria4}
no match [ip] precedence {precedence-criteria1 | precedence-criteria2 | precedence-criteria3 | precedence-criteria4}
Syntax Description
Command Default
No match criterion is configured.
If you do not enter the ip keyword, matching occurs on both IPv4 and IPv6 packets.
Command Modes
Class-map configuration mode (config-cmap)
Command History
Usage Guidelines
You can enter up to four matching criteria, as number abbreviation (0 to 7) or criteria names (critical, flash, and so on), in a single match statement. For example, if you wanted the precedence values of 0, 1, 2, or 3 (note that only one of the precedence values must be a successful match criterion, not all of the specified precedence values), enter the match ip precedence 0 1 2 3 command. The precedence-criteria numbers are not mathematically significant; that is, the precedence-criteria of 2 is not greater than 1. The way that these different packets are treated depends upon quality of service (QoS) policies, set in the policy-map configuration mode.
You can configure a QoS policy to include IP precedence marking for packets entering the network. Devices within your network can then use the newly marked IP precedence values to determine how to treat the packets. For example, class-based weighted random early detection (WRED) uses IP precedence values to determine the probability that a packet is dropped. You can also mark voice packets with a particular precedence. You can then configure low-latency queueing (LLQ) to place all packets of that precedence into the priority queue.
Matching Precedence for IPv6 and IPv4 Packets on the Cisco 10000 and 7600 Series Routers
On the Cisco 7600 Series and 10000 Series Routers, you set matching criteria based on precedence values for only IPv6 packets using the match protocol command with the ipv6 keyword. Without that keyword, the precedence match defaults to match both IPv4 and IPv6 packets. You set matching criteria based on precedence values for IPv4 packets only, use the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets.
Precedence Values and Names
The following table lists all criteria conditions by value, name, binary value, and recommended use. You may enter up to four criteria, each separated by a space. Only one of the precedence values must be a successful match criterion. Table 9 lists the IP precedence values.
Do not use IP precedence 6 or 7 to mark packets, unless you are marking control packets.
Examples
IPv4-Specific Traffic Match
The following example shows how to configure the service policy called "priority50" and attach service policy "priority50" to an interface, matching for IPv4 traffic only. In a network where both IPv4 and IPv6 are running, you might find it necessary to distinguish between the protocols for matching and traffic segregation. In this example, the class map called "ipprec5" will evaluate all IPv4 packets entering Fast Ethernet interface 1/0/0 for a precedence value of 5. If the incoming IPv4 packet has been marked with the precedence value of 5, the packet will be treated as priority traffic and will be allocated with bandwidth of 50 kbps.
Router(config)# class-map ipprec5Router(config-cmap)# match ip precedence 5Router(config)# exitRouter(config)# policy-map priority50Router(config-pmap)# class ipprec5Router(config-pmap-c)# priority 50Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fa1/0/0Router(config-if)# service-policy input priority50IPv6-Specific Traffic Match
The following example shows the same service policy matching on precedence for IPv6 traffic only. Notice that the match protocol command with the ipv6 keyword precedes the match precedence command. The match protocol command is required to perform matches on IPv6 traffic alone.
Router(config)# class-map ipprec5Router(config-cmap)# match protocol ipv6Router(config-cmap)# match precedence 5Router(config)# exitRouter(config)# policy-map priority50Router(config-pmap)# class ipprec5Router(config-pmap-c)# priority 50Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fa1/0/0Router(config-if)# service-policy input priority50Related Commands
match protocol
To configure the match criterion for a class map on the basis of the specified protocol, use the match protocol command in class-map configuration mode. To remove protocol-based match criterion from a class map, use the no form of this command.
match protocol protocol-name
no match protocol protocol-name
Syntax Description
protocol-name
Name of the protocol (for example, bgp) used as a matching criterion. See the "Usage Guidelines" for a list of protocols supported by most routers.
Command Default
No match criterion is configured.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
Supported Platforms Other Than Cisco 7600 Routers and Cisco 10000 Series Routers
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria protocols, access control lists (ACLs), input interfaces, quality of service (QoS) labels, and Experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.
The match protocol ipx command matches packets in the output direction only.
To use the match protocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
•
•
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
To configure NBAR to match protocol types that are supported by NBAR traffic, use the match protocol (NBAR) command.
Cisco 7600 Routers
The match protocol command in QoS class-map configuration configures NBAR and sends all traffic on the port, both ingress and egress, to be processed in the software on the Multilayer Switch Feature Card 2 (MSFC2).
For CBWFQ, you define traffic classes based on match criteria like protocols, ACLs, input interfaces, QoS labels, and Multiprotocol Label Switching (MPLS) EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.
If you want to use the match protocol command, you must first enter the class-map command to specify the name of the class to which you want to establish the match criteria.
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
This command can be used to match protocols that are known to the NBAR feature. For a list of protocols supported by NBAR, see the "Classification" part of the Cisco IOS Quality of Service Solutions Configuration Guide.
Cisco 10000 Series Routers
For CBWFQ, you define traffic classes based on match criteria including protocols, ACLs, input interfaces, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.
The match protocol ipx command matches packets in the output direction only.
To use the match protocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.
If you are matching NBAR protocols, use the match protocol (NBAR) command.
Supported Protocols
Table 10 lists the protocols supported by most routers. Some routers support a few additional protocols. For example, the Cisco 7600 router supports the aarp and decnet protocols, while the Cisco 7200 router supports the directconnect and pppoe protocols. For a complete list of supported protocols, see the online help for the match protocol command on the router that you are using.
* This protocol is not supported on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine.Match Protocol Command Restrictions (Catalyst 6500 Series Switches Only)
Policy maps contain traffic classes. Traffic classes contain one or more match commands that can be used to match packets (and organize them into groups) on the basis of a protocol type or application. You can create as many traffic classes as needed.
Cisco IOS Release 12.2(18)ZY includes software intended for use on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine. For this release and platform, note the following restrictions for using policy maps and match protocol commands:
•
•
Examples
The following example specifies a class map called ftp and configures the protocol as a match criterion:
Router(config)# class-map ftpRouter(config-cmap)# match protocol ftpRelated Commands
match protocol (NBAR)
To configure Network-Based Application Recognition (NBAR) to match traffic by a protocol type that is known to NBAR, use the match protocol command in class-map configuration mode. To disable NBAR from matching traffic by a known protocol type, use the no form of this command.
match protocol protocol-name [variable-field-name value]
no match protocol protocol-name [variable-field-name value]
Syntax Description
protocol-name
Particular protocol type that is known to NBAR. These known protocol types can be used to match traffic. For a list of protocol types that are known to NBAR, see Table 11 in "Usage Guidelines."
variable-field-name
(Optional and usable only with custom protocols) Predefined variable that was created when you created a custom protocol. The variable-field-name will match the field-name variable entered when you created the custom protocol using the ip nbar custom command.
value
(Optional and usable only with custom protocols) Specific value in the custom payload to match. A value can be entered along with a variable-field-name only. The value can be expressed in decimal or hexadecimal format.
Command Default
Traffic is not matched by a protocol type that is known to NBAR.
Command Modes
Class-map configuration (config-cmap)
Command History
12.0(5)XE2
This command was introduced.
12.1(1)E
This command was integrated into Cisco IOS Release 12.1(1)E, and the variable-field-name value option was added.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
12.1(13)T
This command was implemented on Catalyst 6000 family switches without FlexWAN modules.
12.2(14)S
This command was integrated into Cisco IOS Release 12.2(14)S.
12.2(17a)SX1
This command was integrated into Cisco IOS Release 12.2(17a)SX1.
12.4(2)T
This command was modified to include support for additional protocols, such as the BitTorrent protocol.
12.4(4)T
This command was modified to include support for additional protocols, such as the Skype and DirectConnect protocols.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)ZY
This command was integrated into Cisco IOS Release 12.2(18)ZY. This command was modified to enhance NBAR functionality on the Catalyst 6500 series switch that is equipped with the Supervisor 32/programmable intelligent services accelerator (PISA) engine.
12.2(18)ZYA
This command was modified to integrate NBAR and Firewall Service Module (FWSM) functionality on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine and to recognize additional protocols as noted in Table 11 in "Usage Guidelines."
Cisco IOS XE Release 2.1
This command was integrated into Cisco IOS XE Release 2.1 and implemented on Cisco ASR 1000 series routers.
12.2(18)ZYA1
This command was modified to recognize additional protocols as noted in Table 11 in "Usage Guidelines."
Cisco IOS XE Release 2.3
This command was modified to recognize additional protocols as noted in Table 11 in "Usage Guidelines."
12.2(18)ZYA2
This command was modified to recognize additional protocols, such as the TelePresence protocol.
Usage Guidelines
Use the match protocol (NBAR) command to match protocol types that are known to NBAR. NBAR is capable of classifying the following types of protocols:
•
•
•
•
Table 11 lists the NBAR-supported protocols available in Cisco IOS software, sorted by category. The table also provides information about the protocol type, the well-known port numbers (if applicable), and the syntax for entering the protocol in NBAR. The table is modified as new protocols are added or supported by different releases.
Note
Table 11 NBAR-Supported Protocols
Enterprise Application
Citrix ICA
TCP/
UDPTCP: 1494, 2512, 2513, 2598
UDP: 1604Citrix ICA traffic
citrix
citrix app
citrix ica-tag12.1(2)E
12.1(5)T
12.2(18)ZYA1Exchange1
TCP
135
MS-RPC for Exchange
exchange
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZY
12.2(18)ZYA
12.2(18)ZYA1MAPI
TCP
135
Messaging Application Programming Interface
mapi
12.2(18)ZYA
12.2(18)ZYA1Novadigm
TCP/ UDP
3460-3465
Novadigm Enterprise Desktop Manager (EDM)
novadigm
12.1(2)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Oracle
TCP
1525
Oracle
ora-serv
Cisco IOS XE Release 2.3
PCAnywhere
TCP/UDP
TCP: 5631, 65301
UDP: 22, 5632Symantic PCAnywhere
pcanywhere
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SAP
TCP
3300-3315 (sap-pgm. pdlm)
3200-3215 (sap-app. pdlm)
3600-3615 (sap-msg. pdlm)Application server to application server traffic (sap-pgm.pdlm)
Client to application server traffic (sap-app.pdlm)
Client to message server traffic (sap-msg.pdlm)
sap
12.1E
12.2T
12.3
12.3T
12.2(18)ZYA1Routing Protocol
BGP
TCP/ UDP
179
Border Gateway Protocol
bgp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3EGP
IP
8
Exterior Gateway Protocol
egp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3EIGRP
IP
88
Enhanced Interior Gateway Routing Protocol
eigrp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3OSPF
IP
89
Open Shortest Path First
ospf
12.3(8)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3RIP
UDP
520
Routing Information Protocol
rip
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Database
CIFS
TCP
139, 445
Common Internet File System
cifs
12.2(18)ZYA
12.2(18)ZYA1MS-SQLServer
TCP
1433
Microsoft SQL Server Desktop Videoconferencing
sqlserver
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1SQL-exec
TCP/UDP
9088
SQL Exec
sqlexec
Cisco IOS XE Release 2.3
SQL*NET
TCP/ UDP
1521
SQL*NET for Oracle
sqlnet
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1Health
DiCom
TCP
Dynamically Assigned
Digital Imaging and Communications in Medicine
dicom
12.2(18)ZYA
12.2(18)ZYA1HL7
TCP
Dynamically Assigned
Health Level Seven
hl7
12.2(18)ZYA
12.2(18)ZYA1Financial
FIX
TCP
Dynamically Assigned
Financial Information Exchange
fix
12.2(18)ZYA
12.2(18)ZYA1Security and Tunneling
GRE
IP
47
Generic Routing Encapsulation
gre
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3IPINIP
IP
4
IP in IP
ipinip
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3IPsec
IP
50, 51
IP Encapsulating Security Payload/
Authentication-
Headeripsec
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3L2TP
UDP
1701
L2F/L2TP Tunnel
l2tp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3PPTP
TCP
1723
Point-to-Point Tunneling Protocol for VPN
pptp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SFTP
TCP
990
Secure FTP
secure-ftp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Security and Tunneling (continued)
SHTTP
TCP
443
Secure HTTP
secure-http
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1
Cisco IOS XE Release 2.3SIMAP
TCP/
UDP585, 993
Secure IMAP
secure-imap
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SIRC
TCP/
UDP994
Secure IRC
secure-irc
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SLDAP
TCP/
UDP636
Secure LDAP
secure-ldap
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SNNTP
TCP/
UDP563
Secure NNTP
secure-nntp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SOCKS
TCP
1080
Firewall Security Protocol
socks
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SPOP3
TCP/
UDP995
Secure POP3
secure-pop3
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Security and Tunneling (continued)
SSH
TCP
22
Secured Shell
ssh
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3STELNET
TCP
992
Secure Telnet
secure-telnet
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Network Management
ICMP
IP
1
Internet Control Message Protocol
icmp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3SNMP
TCP/
UDP161, 162
Simple Network Management Protocol
snmp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Syslog
UDP
514
System Logging Utility
syslog
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Network Mail Services
IMAP
TCP/
UDP143, 220
Internet Message Access Protocol
imap
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Notes
TCP/
UDP1352
Lotus Notes
notes
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3POP3
TCP/
UDP110
Post Office Protocol
pop3
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1
Cisco IOS XE Release 2.3SMTP
TCP
25
Simple Mail Transfer Protocol
smtp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Directory
DHCP/
BOOTPUDP
67, 68
Dynamic Host Configuration Protocol/Bootstrap Protocol
dhcp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1DNS
TCP/
UDP53
Domain Name System
dns
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1Finger
TCP
79
Finger User Information Protocol
finger
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Kerberos
TCP/
UDP88, 749
Kerberos Network Authentication Service
kerberos
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3LDAP
TCP/
UDP389
Lightweight Directory Access Protocol
ldap
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Streaming Media
CU-SeeMe
TCP/
UDPTCP: 7648, 7649
UDP: 24032Desktop Video Conferencing
cuseeme
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1MGCP
TCP/ UDP
2427, 2428, 2727
Media Gateway Control Protocol
mgcp
12.2(18)ZYA1
12.3(7)TNetshow
TCP/ UDP
Dynamically Assigned
Microsoft Netshow
netshow
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1RealAudio
TCP/ UDP
Dynamically Assigned
RealAudio Streaming Protocol
realaudio
12.0(5)XE2
12.1(1)E
12.1(5)TRTSP
TCP/ UDP
Dynamically Assigned
Real Time Streaming Protocol
rtsp
12.2(18)ZYA1
12.3(11)T
Cisco IOS XE Release 2.1StreamWorks
UDP
Dynamically Assigned
Xing Technology Stream Works Audio and Video
streamwork
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1VDOLive
TCP/ UDP
Static (7000) with inspection
VDOLive Streaming Video
vdolive
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1YouTube2
TCP
Both static (80) and dynamically assigned
Online Video-Sharing Website
youtube
12.2(18)ZYA
12.2(18)ZYA1Internet
FTP
TCP
Dynamically Assigned
File Transfer Protocol
ftp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1Gopher
TCP/ UDP
70
Internet Gopher Protocol
gopher
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3HTTP
TCP
803
Hypertext Transfer Protocol
http
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1IRC
TCP/ UDP
194
Internet Relay Chat
irc
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3NNTP
TCP/ UDP
119
Network News Transfer Protocol
nntp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Telnet
TCP
23
Telnet Protocol
telnet
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1TFTP
UDP
Static (69) with inspection
Trivial File Transfer Protocol
tftp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1Signaling
AppleQTC
TCP/UDP
458
Apple Quick Time
appleqtc
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Chargen
TCP/UDP
19
Character Generator
chargen
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3ClearCase
TCP/UDP
371
Clear Case Protocol Software Informer
clearcase
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Corba
TCP/UDP
683, 684
Corba Internet Inter-Orb Protocol (IIOP)
corba-iiop
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Daytime
TCP/UDP
13
Daytime Protocol
daytime
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Doom
TCP/UDP
666
Doom
doom
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Echo
TCP/UDP
7
Echo Protocol
echo
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3IBM DB2
TCP/UDP
523
IBM Information Management
ibm-db2
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3IPX
TCP/UDP
213
Internet Packet Exchange
server-ipx
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3ISAKMP
TCP/UDP
500
Internet Security Association and Key Management Protocol
isakmp
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3Signaling (continued)
ISI-GL
TCP/UDP
55
Interoperable Self Installation Graphics Language
isi-gl
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3KLogin
TCP
543
KLogin
klogin
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3KShell
TCP
544
KShell
kshell
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3LockD
TCP/UDP
4045
LockD
lockd
12.2(18)ZYA
Cisco IOS XE Release 2.3MSSQL
TCP
1433
Microsoft Structured Query Language (SQL) Server
mssql
Cisco IOS XE Release 2.3
RSVP
UDP
1698, 1699
Resource Reservation Protocol
rsvp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3RPC
AOL-messenger
TCP
5190, 443
AOL Instant Messenger Chat Messages
aol-messenger
12.2(18)ZYA
12.2(18)ZYA1MSN-messenger
TCP
1863
MSN Messenger Chat Messages4
msn-messenger
12.2(18)ZYA
12.2(18)ZYA1NFS
TCP/ UDP
2049
Network File System
nfs
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1Sunrpc
TCP/ UDP
Dynamically Assigned
Sun Remote Procedure Call
sunrpc
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1Yahoo-messenger
TCP
5050, 5101
Yahoo Messenger Chat Messages
yahoo-messenger
12.2(18)ZYA
12.2(18)ZYA1Non-IP and LAN/
LegacyMicrosoft-DS
TCP/UDP
445
Microsoft Directory Services
microsoftds
12.2(18)ZYA
12.2(18)ZYA1NetBIOS
TCP/ UDP
137, 138, 139
NetBIOS over IP (MS Windows)
netbios
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Nickname
TCP/UDP
43
Nickname
nickname
12.2(18)ZYA
12.2(18)ZYA1Cisco IOS XE Release 2.3NPP
TCP/UDP
92
Network Payment Protocol
npp
12.2(18)ZY
12.2(18)ZYA1 Cisco IOS XE Release 2.3Miscellaneous
Cisco-phone5
UDP
5060
Cisco IP Phones and PC-Based Unified Communicators
cisco-phone
12.2(18)ZYA
12.2(18)ZYA1NTP
TCP/ UDP
123
Network Time Protocol
ntp
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3ORASRV
TCP
1525
ORASRV
ora-srv
12.2(18)ZYA
12.2(18)ZYA1Printer
TCP/ UDP
515
Printer
printer
12.1(2)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3r-commands
TCP
Dynamically Assigned
rsh, rlogin, rexec
rcmd
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1Miscellaneous (continued)
RCP
TCP/UDP
469
Rate Control Protocol
rcp
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3RTelnet
TCP/UDP
107
Remote Telnet Service
rtelnet
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3SQLExec
TCP/UDP
9088
SQL Exec
sqlexec
12.2(18)ZYA
12.2(18)ZYA1Systat
TCP/UDP
11
System Statistics
systat
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3TACACS
TCP/UDP
49, 65
Terminal Access Controller Access-Control System
tacacs
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3Time
TCP/UDP
37
Time
time
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3VNC
UDP
5800, 5900, 5901
Virtual Network Computing
vnc
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3Whois++
TCP/UDP
63
Whois++
whois++
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3XDMCP
UDP
177
X Display Manager Control Protocol
xdmcp
12.2(18)ZYA
12.2(18)ZYA1
Cisco IOS XE Release 2.3X Windows
TCP
6000-6003
X11, X Windows
xwindows
12.0(5)XE2
12.1(1)E
12.1(5)T
12.2(18)ZYA1
Cisco IOS XE Release 2.3Voice
H.323
TCP
Dynamically Assigned
H.323 Teleconferencing Protocol
h323
12.3(7)T
12.2(18)ZYA1
Cisco IOS XE Release 2.1
Cisco IOS XE Release 2.3RTCP
TCP/ UDP
Dynamically Assigned
Real-Time Control Protocol
rtcp
12.1E
12.2T
12.2(18)ZYA1
12.3
12.3TRTP
TCP/ UDP
Dynamically Assigned
Real-Time Transport Protocol Payload Classification
rtp
12.2(8)T
12.2(18)ZYA1SCCP/Skinny
TCP
2000, 2001, 2002
Skinny Client Control Protocol
skinny
12.2(18)ZYA1
12.3(7)TSIP
TCP/UPD
5060
Session Initiation Protocol
sip
12.3(7)T
Cisco IOS XE Release 2.1
12.2(18)ZYA1
Cisco IOS XE Release 2.3Skype6
TCP/UDP
Dynamically Assigned
Peer-to-Peer VoIP Client Software
skype
12.2(18)ZYA1
12.4(4)T
Cisco IOS XE Release 2.1TelePresence
TCP/UDP
Dynamically Assigned
Cisco TelePresence System
telepresence-media
telepresence-control
12.2(18)ZYA2
Peer-to-Peer File-Sharing Applications
BitTorrent
TCP
Dynamically Assigned or
6881-6889BitTorrent File Transfer Traffic
bittorrent
12.2(18)ZYA1
12.4(2)TDirect Connect
TCP/ UDP
411
Direct Connect File Transfer Traffic
directconnect
12.2(18)ZYA1
12.4(4)TeDonkey/eMule
TCP
4662
eDonkey File-Sharing Application
eMule traffic is also classified as eDonkey traffic in NBAR.
edonkey
12.2(18)ZYA1
12.3(11)TFastTrack
N/A
Dynamically Assigned
FastTrack
fasttrack
12.1(12c)E
12.2(18)ZYA1Gnutella
TCP
Dynamically Assigned
Gnutella
gnutella
12.1(12c)E
12.2(18)ZYA1KaZaA
TCP/ UPD
Dynamically Assigned
KaZaA
Note that earlier KaZaA version 1 traffic can be classified using FastTrack.
kazaa2
12.2(8)T
12.2(18)ZYA1WinMX
TCP
6699
WinMX Traffic
winmx
12.2(18)ZYA1
12.3(7)T
1 For Release 12.2(18)ZYA, Cisco supports Exchange 03 and 07 only. MS client access is recognized, but web client access is not recognized.
2 For Release 12.2(18)ZYA, access to YouTube via HTTP only will be recognized.
3 In Release 12.3(4)T, the NBAR Extended Inspection for HTTP Traffic feature was introduced. This feature allows NBAR to scan TCP ports that are not well known and to identify HTTP traffic that is traversing these ports. For Cisco IOS XE Release 2.1, classification of HTTP traffic by URL or hostname is not supported.
4 For Release 12.2(18)ZYA, messages ("chat") from Yahoo, MSN, and AOL are recognized. Messages from Lotus and SameTime are not recognized. Video and voice from Instant Messaging are also not recognized.
5 For Release 12.2(18)ZYA, only SIP and Skinny telephone connections (cisco-phone traffic connections) are recognized. H.323 telephone connections are not recognized.
6 Skype was introduced in Cisco IOS Release 12.4(4)T. As a result of this introduction, Skype is now native in (included with) the Cisco IOS software and uses the NBAR infrastructure new to Cisco IOS Release 12.4(4)T. Cisco software supports Skype 1.0, 2.5, and 3.0. For Cisco IOS XE Software Release 2.1, Skype is supported in the TCP type only. Note that certain hardware platforms do not support Skype. For instance, Skype is not supported on the Catalyst 6500 series switch that is equipped with a Supervisor/PISA engine.
Custom Protocols Created with the ip nbar custom Command
The variable-field-name value is used in conjunction with the variable field-name field-length options that are entered when you create a custom protocol using the ip nbar custom command. The variable option allows NBAR to match traffic on the basis of a specific value of a custom protocol. For instance, if ip nbar custom ftdd 125 variable scid 2 tcp range 5001 5005 is entered to create a custom protocol, and then a class map using the match protocol ftdd scid 804 is created, the created class map will match all traffic that has the value "804" at byte 125 entering or leaving TCP ports 5001 to 5000.
Up to 24 variable values per custom protocol can be expressed in class maps. For instance, in the following configuration, 4 variables are used and 20 more "scid" values could be used.
Router(config)# ip nbar custom ftdd field scid 125 variable 1 tcp range 5001 5005Router(config)# class-map active-craftRouter(config-cmap)# match protocol ftdd scid 0x15Router(config-cmap)# match protocol ftdd scid 0x21Router(config)# class-map passive-craftRouter(config-cmap)# match protocol ftdd scid 0x11Router(config-cmap)# match protocol ftdd scid 0x22match protocol Command Restrictions (Catalyst 6500 Series Switches Only)
Policy maps contain traffic classes. Traffic classes contain one or more match commands that can be used to match packets (and organize them into groups) on the basis of a protocol type or application. You can create as many traffic classes as needed.
Cisco IOS Release 12.2(18)ZY includes software intended for use on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine. For this release and platform, note the following restrictions for using policy maps and match protocol commands:
•
•
Examples
The following example configures NBAR to match FTP traffic:
Router(config-cmap)# match protocol ftpIn the following example, custom protocol ftdd is created by using a variable. A class map matching this custom protocol based on the variable is also created. In this example, class map matchscidinftdd will match all traffic that has the value "804" at byte 125 entering or leaving TCP ports 5001 to 5005. The variable scid is 2 bytes in length.
Router(config)# ip nbar custom ftdd 125 variable scid 2 tcp range 5001 5005Router(config)# class-map matchscidinftddRouter(config-cmap)# match protocol ftdd scid 804The same example above can also be done by using hexadecimal values in the class map as follows:
Router(config)# ip nbar custom ftdd 125 variable scid 2 tcp range 5001 5005Router(config)# class-map matchscidinftddRouter(config-cmap)# match protocol ftdd scid 0x324In the following example, the variable keyword is used while you create a custom protocol, and class maps are configured to classify different values within the variable field into different traffic classes. Specifically, in the example below, variable scid values 0x15, 0x21, and 0x27 will be classified into class map active-craft, while scid values 0x11, 0x22, and 0x25 will be classified into class map passive-craft.
Router(config)# ip nbar custom ftdd field scid 125 variable 1 tcp range 5001 5005Router(config)# class-map active-craftRouter(config-cmap)# match protocol ftdd scid 0x15Router(config-cmap)# match protocol ftdd scid 0x21Router(config-cmap)# match protocol ftdd scid 0x27Router(config)# class-map passive-craftRouter(config-cmap)# match protocol ftdd scid 0x11Router(config-cmap)# match protocol ftdd scid 0x22Router(config-cmap)# match protocol ftdd scid 0x25Related Commands
match protocol citrix
To configure network-based application recognition (NBAR) to match Citrix traffic, use the match protocol citrix command in class-map configuration mode. To disable NBAR from matching Citrix traffic, use the no form of this command.
match protocol citrix [app application-name-string] [ica-tag ica-tag-value]
no match protocol citrix [app application-name-string] [ica-tag ica-tag-value]
Syntax Description
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Entering the match protocol citrix command without the app keyword establishes all Citrix traffic as successful match criteria.
Entering the match protocol citrix command with the ica-tag keyword prioritizes Citrix ICA traffic. The priority tag values can be a number from 0 to 3, with 0 having the highest priority and 3 the lowest.
Examples
The following example configures NBAR to match all Citrix traffic:
match protocol citrixThe following example configures NBAR to match Citrix traffic with the application name of packet1:
match protocol citrix app packet1The following example configures NBAR to give Citrix ICA traffic a priority of 1:
match protocol citrix ica-tag-1match protocol fasttrack
To configure network-based application recognition (NBAR) to match FastTrack peer-to-peer traffic, use the match protocol fasttrack command in class-map configuration mode. To disable NBAR from matching FastTrack traffic, use the no form of this command.
match protocol fasttrack file-transfer "regular-expression"
no match protocol fasttrack file-transfer "regular-expression"
Syntax Description
Command Default
NBAR is not configured to match FastTrack peer-to-peer traffic.
Command Modes
Class-map configuration
Command History
Usage Guidelines
To specify that all FastTrack traffic be identified by the traffic class, use "*" as the regular expression.
Applications that use FastTrack include KaZaA, Grokster, and Morpheus (although newer versions of Morpheus use Gnutella).
Examples
The following example configures NBAR to match all FastTrack traffic:
match protocol fasttrack file-transfer "*"In the following example, all FastTrack files that have the ".mpeg" extension will be classified into class map nbar:
class-map match-all nbarmatch protocol fasttrack file-transfer "*.mpeg"The following example configures NBAR to match FastTrack traffic that contains the string "cisco":
match protocol fasttrack file-transfer "*cisco*"match protocol gnutella
To configure network-based application recognition (NBAR) to match Gnutella peer-to-peer traffic, use the match protocol gnutella command in class-map configuration mode. To disable NBAR from matching Gnutella traffic, use the no form of this command.
match protocol gnutella file-transfer "regular-expression"
no match protocol gnutella file-transfer "regular-expression"
Syntax Description
Command Default
No behavior or values are predefined.
Command Modes
Class-map configuration
Command History
Usage Guidelines
To specify that all Gnutella traffic be identified by the traffic class, use "*" as the regular expression.
Applications that use Gnutella include the following:
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example configures NBAR to match all Gnutella traffic:
match protocol gnutella file-transfer "*"In the following example, all Gnutella files that have the ".mpeg" extension will be classified into class map nbar:
class-map match-all nbarmatch protocol gnutella file-transfer "*.mpeg"In the following example, only Gnutella traffic that contains the characters "cisco" is classified:
class-map match-all nbarmatch protocol gnutella file-transfer "*cisco*"match protocol http
To configure Network-Based Application Recognition (NBAR) to match HTTP traffic by URL, host, Multipurpose Internet Mail Extension (MIME) type, or fields in HTTP packet headers, use the match protocol http command in class-map configuration mode. To disable NBAR from matching HTTP traffic by URL, host, or MIME type, or fields in HTTP packet headers, use the no form of this command.
match protocol http [url url-string | host hostname-string | mime MIME-type | c-header-field c-header-field-string | s-header-field s-header-field-string]
no match protocol http [url url-string | host hostname-string | mime MIME-type | c-header-field c-header-field-string | s-header-field s-header-field-string]
Catalyst 6500 Series Switch Equipped with the Supervisor 32/PISA Engine
match protocol http [content-encoding content-encoding-name-string | from from-address-string | host hostname-string | location location-name-string | mime MIME-type | referer referer-address-string | server server-software-name-string | url url-string | user-agent user-agent-software-name-string]
no match protocol http [content-encoding content-encoding-name-string | from from-address-string | host hostname-string | location location-name-string | mime
MIME-type | referer referer-address-string | server server-software-name-string | url url-string | user-agent user-agent-software-name-string]Syntax Description
Command Default
NBAR does not match HTTP traffic by URL, host, MIME type, or fields in HTTP packet headers.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
Classification of HTTP Traffic by Host, URL, or MIME
In Cisco IOS Release 12.3(4)T, the NBAR Extended Inspection for HTTP Traffic feature was introduced. This feature allows NBAR to scan TCP ports that are not well-known and that identify HTTP traffic traversing these ports. This feature is enabled automatically when a service policy containing the match protocol http command is attached to an interface.
When matching by MIME type, the MIME type can contain any user-specified text string. See the following web page for the IANA-registered MIME types:
http://www.iana.org/assignments/media-types/index.html
When matching by MIME type, NBAR matches a packet containing the MIME type and all subsequent packets until the next HTTP transaction.
When matching by host, NBAR performs a regular expression match on the host field contents inside the HTTP packet and classifies all packets from that host.
HTTP client request matching supports GET, PUT, HEAD, POST, DELETE, OPTIONS, and TRACE. When matching by URL, NBAR recognizes the HTTP packets containing the URL and then matches all packets that are part of the HTTP request. When specifying a URL for classification, include only the portion of the URL that follows the www.hostname.domain in the match statement. For example, for the URL www.cisco.com/latest/whatsnew.html, include only /latest/whatsnew.html with the match statement (for instance, match protocol http url /latest/whatsnew.html).
Note
To match the www.anydomain.com portion, use the hostname matching feature. The parameter specification strings can take the form of a regular expression with the following options:
Classification of HTTP Header Fields
In Cisco IOS Release 12.3(11)T, NBAR introduced expanded ability for users to classify HTTP traffic using information in the HTTP Header Fields.
HTTP works using a client/server model: HTTP clients open connections by sending a request message to an HTTP server. The HTTP server then returns a response message to the HTTP client (this response message is typically the resource requested in the request message from the HTTP client). After delivering the response, the HTTP server closes the connection and the transaction is complete.
HTTP header fields are used to provide information about HTTP request and response messages. HTTP has numerous header fields. For additional information on HTTP headers, see section 14 of RFC 2616: Hypertext Transfer Protocol—HTTP/1.1. This document can be read at the following URL:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
For request messages (client to server), the following HTTP header fields can be identified by using NBAR:
•
•
For response messages (server to client), the following header fields can be identified by using NBAR:
•
•
•
•
Note
Within NBAR, the match protocol http c-header-field command is used to specify request messages (the "c" in the c-header-field portion of the command is for client). The match protocol http s-header-field command is used to specify response messages (the "s" in the s-header-field portion of the command is for server).
It is important to note that combinations of URL, host, MIME type, and HTTP headers can be used during NBAR configuration. These combinations provide customers with more flexibility to classify specific HTTP traffic based on their network requirements.
Note
Examples
The following example classifies, within class map class1, HTTP packets based on any URL containing the string whatsnew/latest followed by zero or more characters:
class-map class1match protocol http url whatsnew/latest*The following example classifies, within class map class2, packets based on any hostname containing the string cisco followed by zero or more characters:
class-map class2match protocol http host cisco*The following example classifies, within class map class3, packets based on the JPEG MIME type:
class-map class3match protocol http mime "*jpeg"In the following example, any response message that contains "gzip" in the Content-Base (if available), Content-Encoding, Location, or Server header fields will be classified by NBAR. Typically, the term "gzip" would be found in the Content-Encoding header field of the response message.
class-map class4match protocol http s-header-field "gzip"In the following example, HTTP header fields are combined with a URL to classify traffic. In this example, traffic with a User-Agent field of "CERN-LineMode/3.0" and a Server field of "CERN/3.0", along with URL "www.cisco.com", will be classified using NBAR.
class-map match-all c-http match protocol http c-header-field "CERN-LineMode/3.0" match protocol http s-header-field "CERN/3.0" match protocol http url "www.cisco.com"Catalyst 6500 Series Router Equipped with a Supervisor 32/PISA Engine Example
In the following two examples, the individual keywords and associated arguments are used to specify traffic (instead of the c-header-field and the s-header-field keywords).
In the first example, the user-agent, referrer, and from keywords are specified. In the second example, the server, location, content-encoding keywords are specified.
class-map match-all test1match protocol http user-agent Mozillamatch protocol http referrer *10.0.10.50match protocol http from *cisco.comclass-map match-all test2match protocol http server Apachematch protocol http location *cisco.commatch protocol http content-encoding compressmatch protocol pppoe-discovery
To match and classify PPP over Ethernet (PPPoE) control packets that are sent to the control plane, use the match protocol pppoe-discovery command in class-map configuration mode. To remove this match criterion, use the no form of this command.
match protocol pppoe-discovery
no match protocol pppoe-discovery
Syntax Description
This command has no arguments or keywords.
Command Default
PPPoE control packets sent to the control plane are not matched or classified.
Command Modes
Class-map configuration (config-cmap)
Command History
Cisco IOS XE Release 2.3
This command was introduced on Cisco ASR 1000 Series Routers.
Usage Guidelines
The match protocol pppoe-discovery command is associated with control-plane-related features such as Control Plane Policing (CoPP).
When used in a class map, the match protocol pppoe-discovery command can classify either ingress PPPoE control-plane packets or egress PPPoE control-plane packets and include them in a specified traffic class. That class can then be configured in a policy map and can receive the desired quality of service (QoS) feature (such as traffic policing).
Examples
The following is an example of the match protocol pppoe-discovery command configured in a class-map called copplass-pppoe-discovery. PPPoE control-plane traffic identified as meeting the match criterion is placed in a class called coppclass-pppoe-discovery.
The coppclass-pppoe-discovery class is then configured in a policy map called copp-policy-pppoe-discovery, and the QoS traffic policing feature is applied using the police command.
Router> enable
Router# configure terminal
Router(config)# class-map match-all coppclass-pppoe-discovery
Router(config-cmap)# match protocol pppoe-discovery
Router(config-cmap)# exit
Router(config)# class-map match-all coppclass-pppoe-discovery
Router(config-cmap)# exit
Router(config)# policy-map copp-policy-pppoe-discovery
Router(config-pmap)# class coppclass-pppoe-discovery
Router(config-pmap-c)# police rate 8000 bps conform-action transmit exceed-action drop
Router(config-pmap-c)# end
Related Commands
match protocol rtp
To configure network-based application recognition (NBAR) to match Real-Time Transfer Protocol (RTP) traffic, use the match protocol rtp command in class-map configuration mode. To disable NBAR from matching RTP traffic, use the no form of this command.
match protocol rtp [audio | video | payload-type payload-string]
no match protocol rtp [audio | video | payload-type payload-string]
Syntax Description
Command Default
No match criteria are specified.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Entering the match protocol rtp command without any other keywords establishes all RTP traffic as successful match criteria.
RTP is a packet format for multimedia data streams. It can be used for media-on-demand as well as interactive services such as Internet telephony. RTP consists of a data and a control part. The control part is called Real-Time Transport Control Protocol (RTCP). It is important to note that the NBAR RTP Payload Classification feature does not identify RTCP packets and that RTCP packets run on odd-numbered ports while RTP packets run on even-numbered ports.
The payload type field of an RTP packet identifies the format of the RTP payload and is represented by a number. NBAR matches RTP traffic on the basis of this field in the RTP packet. A working knowledge of RTP and RTP payload types is helpful if you want to configure NBAR to match RTP traffic. For more information about RTP and RTP payload types, refer to RFC 1889, RTP: A Transport Protocol for Real-Time Applications.
Examples
The following example configures NBAR to match all RTP traffic:
class-map class1match protocol rtpThe following example configures NBAR to match RTP traffic with the payload-types 0, 1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, and 64:
class-map class2match protocol rtp payload-type "0, 1, 4-0x10, 10001b-10010b, 64"match qos-group
To identify a specific quality of service (QoS) group value as a match criterion, use the match qos-group command in class-map configuration mode. To remove a specific QoS group value from a class map, use the no form of this command.
match qos-group qos-group-value
no match qos-group qos-group-value
Syntax Description
Command Default
No match criterion is specified.
Command Modes
Class-map configuration (config-cmap)
Command History
Usage Guidelines
The match qos-group command is used by the class map to identify a specific QoS group value marking on a packet. This command can also be used to convey the received Multiprotocol Label Switching (MPLS) experimental (EXP) field value to the output interface.
The qos-group-value argument is used as a marking only. The QoS group values have no mathematical significance. For instance, the qos-group-value of 2 is not greater than 1. The value simply indicates that a packet marked with the qos-group-value of 2 is different than a packet marked with the qos-group-value of 1. The treatment of these packets is defined by the user through the setting of QoS policies in QoS policy-map class configuration mode.
The QoS group value is local to the router, meaning that the QoS group value that is marked on a packet does not leave the router when the packet leaves the router. If you need a marking that resides in the packet, use IP precedence setting, IP differentiated services code point (DSCP) setting, or another method of packet marking.
This command can be used with the random-detect discard-class-based command.
Examples
The following example shows how to configure the service policy called "priority50" and attach service policy "priority50" to an interface. In this example, the class map called "qosgroup5" will evaluate all packets entering Fast Ethernet interface 1/0/0 for a QoS group value of 5. If the incoming packet has been marked with the QoS group value of 5, the packet will be treated with a priority level of 50.
Router(config)# class-map qosgroup5Router(config-cmap)# match qos-group 5Router(config)# exitRouter(config)# policy-map priority50Router(config-pmap)# class qosgroup5Router(config-pmap-c)# priority 50Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet1/0/0Router(config-if)# service-policy output priority50Related Commands
match source-address mac
To use the source MAC address as a match criterion, use the match source-address mac command in QoS class-map configuration mode. To remove a previously specified source MAC address as a match criterion, use the no form of this command.
match source-address mac address-destination
no match source-address mac address-destination
Syntax Description
Command Default
No default behavior or values
Command Modes
QoS class-map configuration
Command History
Usage Guidelines
This command can be used only on an input interface with a MAC address, for example, Fast Ethernet and Ethernet interfaces.
This command cannot be used on output interfaces with no MAC address, such as serial and ATM interfaces.
Examples
The following example uses the MAC address mac 0.0.0 as a match criterion:
Router(config)# class-map matchsrcmacRouter(config-cmap)# match source-address mac 0.0.0Related Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match start
To configure the match criteria for a class map on the basis of the datagram header (Layer 2 ) or the network header (Layer 3), use the match start command in class-map configuration mode. To remove the specified match criteria, use the no form of this command.
match start {l2-start | l3-start} offset number size number
{eq | neq | gt | lt | range range | regex string} {value [value2] | [string]}no match start {l2-start | l3-start} offset number size number
{eq | neq | gt | lt | range range | regex string} {value [value2] | [string]}Syntax Description
Defaults
No match criteria are configured.
Command Modes
Class-map configuration
Command History
Usage Guidelines
To the match criteria that is to be used for flexible packet matching, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. Thereafter, you can enter one of the following commands:
•
•
Examples
The following example shows how to configure FPM for blaster packets. The class map contains the following match criteria: TCP port 135, 4444 or UDP port 69; and pattern 0x0030 at 3 bytes from start of IP header.
load protocol disk2:ip.phdfload protocol disk2:tcp.phdfload protocol disk2:udp.phdfclass-map type stack match-all ip-tcpmatch field ip protocol eq 0x6 next tcpclass-map type stack match-all ip-udpmatch field ip protocol eq 0x11 next udpclass-map type access-control match-all blaster1match field tcp dest-port eq 135match start 13-start offset 3 size 2 eq 0x0030class-map type access-control match-all blaster2match field tcp dest-port eq 4444match start 13-start offset 3 size 2 eq 0x0030class-map type access-control match-all blaster3match field udp dest-port eq 69match start 13-start offset 3 size 2 eq 0x0030policy-map type access-control fpm-tcp-policyclass blaster1dropclass blaster2droppolicy-map type access-control fpm-udp-policyclass blaster3droppolicy-map type access-control fpm-policyclass ip-tcpservice-policy fpm-tcp-policyclass ip-udpservice-policy fpm-udp-policyinterface gigabitEthernet 0/1service-policy type access-control input fpm-policyRelated Commands
match tag (class-map)
To specify the tag to be matched for a tag type of class map, use the match tag command in class-map configuration mode. To delete the tag, use the no form of this command.
match tag tag-name
no match tag tag-name
Syntax Description
Command Default
No match tags are defined.
Command Modes
Class-map configuration
Command History
Usage Guidelines
The access control server (ACS) sends the tag attribute to the network access device (NAD) using the Cisco attribute-value (AV) pair. (The tag attribute can also be sent to the NAD using the IETF attribute 88.)
Examples
The following example shows that the tag to be matched is named "healthy":
Router(config)# class-map type tag healthy_classRouter(config-cmap)# match tag healthyRouter(config-cmap)# endRelated Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match vlan (QoS)
To match and classify traffic on the basis of the virtual local-area network (VLAN) identification number, use the match vlan command in class-map configuration mode. To remove a previously specified VLAN identification number as a match criterion, use the no form of this command.
match vlan vlan-id-number
no match vlan vlan-id-number
Syntax Description
vlan-id-number
VLAN identification number, numbers, or range of numbers. Valid VLAN identification numbers must be in the range of 1 to 4095.
Command Default
Traffic is not matched on the basis of the VLAN identification number.
Command Modes
Class-map configuration
Command History
12.2(31)SB2
This command was introduced for use on Cisco 10000 series routers only.
Usage Guidelines
Specifying VLAN Identification Numbers
You can specify a single VLAN identification number, multiple VLAN identification numbers separated by spaces (for example, 2 5 7), or a range of VLAN identification numbers separated by a hyphen (for example, 25-35).
Support Restrictions
The following restrictions apply to the match vlan command:
•
•
Examples
In the following sample configuration, the match vlan command is enabled to classify and match traffic on the basis of a range of VLAN identification numbers. Packets with VLAN identification numbers in the range of 25 to 50 are placed in the class called class1.
Router> enable
Router# configure terminal
Router(config)# class-map class1
Router(config-cmap)# match vlan 25-50
Router(config-cmap)# end
Note
Related Commands
match vlan inner
To configure a class map to match the innermost VLAN ID in an 802.1q tagged frame, use the match vlan inner command in ATM interface configuration mode. To remove matching on the innermost VLAN ID of an 802.1q tagged frame, use the no form of this command.
match vlan inner vlan-ids
no match vlan inner vlan-ids
Syntax Description
Command Default
Packets are not matched on the basis of incoming dot1q VLAN inner IDs.
Command Modes
Class map configuration
Command History
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(18)SXF
This command was implemented on Cisco 7600 series routers.
Examples
The following example creates a class map that matches packets with a VLAN IDs of 100 to 300.
Router(config)# class-map match-all vlan100Router(config-cmap)# match vlan inner 100Router(config-cmap)# exitRouter(config)# class-map match-all vlan200Router(config-cmap)# match vlan inner 200Router(config-cmap)# exitRouter(config)# class-map match-all vlan300Router(config-cmap)# match vlan inner 300Related Commands
maximum (local policy)
To set the limits for Resource Reservation Protocol (RSVP) resources, use the maximum command in local policy configuration mode. To delete the limits, use the no form of this command.
maximum [bandwidth [group x] [single y] | senders n]
no maximum [bandwidth [group x] [single y] | senders n]
Syntax Description
Command Default
No maximum bandwidth limit is set and no RSVP senders are configured.
Command Modes
Local policy configuration
Command History
12.0(29)S
This command was introduced.
12.4(6)T
This command was modified to apply to RESV messages.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
Previously, the maximum bandwidth command applied only to PATH messages. However, as part of the application ID enhancement, this command now applies only to RESV messages. This change has the following benefits:
•
•
Examples
The following example specifies the maximum bandwidth for a group of reservations and for a single reservation, respectively:
Router(config-rsvp-local-policy)# maximum bandwidth group 500Router(config-rsvp-local-policy)# maximum bandwidth single 50Related Commands
maximum header
To specify the maximum size of the compressed IP header, use the maximum header command in IPHC-profile configuration mode. To return the maximum size of the compressed IP header to the default size, use the no form of this command.
maximum header number-of-bytes
no maximum header
Syntax Description
number-of-bytes
The maximum header size, in bytes. Valid entries are numbers from 20 to 168. Default is 168.
Command Default
The maximum size of the compressed IP header is 168 bytes.
Command Modes
IPHC-profile configuration
Command History
Usage Guidelines
The maximum header command allows you to define the maximum size of the IP header of a packet to be compressed. Any packet with an IP header that exceeds the maximum size is sent uncompressed.
Use the number-of-bytes argument of the maximum header command to restrict the size of the IP header to be compressed.
Intended for Use with IPHC Profiles
The maximum header command is intended for use as part of an IPHC profile. An IPHC profile is used to enable and configure header compression on your network. For more information about using IPHC profiles to configure header compression, see the "Header Compression" module and the "Configuring Header Compression Using IPHC Profiles" module of the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4T.
Prerequisite
Before using the maximum header command, you must enable either TCP header compression or non-TCP header compression. To enable TCP header compression, use the tcp command. To enable non-TCP header compression, use the non-tcp command.
Examples
The following is an example of an IPHC profile called profile2. In this example, the maximum size of the compressed IP header is set to 75 bytes.
Router> enable
Router# configure terminal
Router(config)# iphc-profile profile2 ietf
Router(config-iphcp)# non-tcp
Router(config-iphcp)# maximum header 75
Router(config-iphcp)# end
Related Commands
iphc-profile
Creates an IPHC profile.
non-tcp
Enables non-TCP header compression within an IPHC profile.
tcp
Enables TCP header compression within an IPHC profile.
max-reserved-bandwidth
To change the percent of interface bandwidth allocated for Resource Reservation Protocol (RSVP), class-based weighted fair queueing (CBWFQ), low latency queueing (LLQ), IP RTP Priority, Frame Relay IP RTP Priority, Frame Relay PVC Interface Priority Queueing (PIPQ), or hierarchical queueing framework (HQF), use the max-reserved bandwidth command in interface configuration mode. To restore the default value, use the no form of this command.
max-reserved-bandwidth percent
no max-reserved-bandwidth
Syntax Description
percent
Amount of interface bandwidth allocated for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, Frame Relay PIPQ, and HQF.
Command Default
75 percent on all supported platforms except the Cisco 7500 series routers, which do not have this restriction.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The max-reserved-bandwidth command is not supported in Cisco IOS Release 12.2SR or in 12.2SX. It is supported in 12.4T, but only up to the 12.4(20)T release in which HQF functionality was integrated.
The sum of all bandwidth allocation on an interface should not exceed 75 percent of the available bandwidth on an interface. The remaining 25 percent of bandwidth is used for overhead, including Layer 2 overhead, control traffic, and best-effort traffic.
If you need to allocate more than 75 percent for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, Frame Relay PIPQ, or HQF, you can use the max-reserved-bandwidth command. The percent argument specifies the maximum percentage of the total interface bandwidth that can be used.
If you do use the max-reserved-bandwidth command, make sure that not too much bandwidth is taken away from best-effort and control traffic.
Examples
In the following example, the policy map called policy1 is configured for three classes with a total of 8 Mbps configured bandwidth, as shown in the output from the show policy-map command:
Router# show policy-map policy1Policy Map policy1Weighted Fair QueueingClass class1Bandwidth 2500 (kbps) Max Threshold 64 (packets)Class class2Bandwidth 2500 (kbps) Max Threshold 64 (packets)Class class3Bandwidth 3000 (kbps) Max Threshold 64 (packets)When you enter the service-policy command in an attempt to attach the policy map on a 10-Mbps Ethernet interface, an error message such as the following is produced:
I/f Ethernet1/1 class class3 requested bandwidth 3000 (kbps) Available only 2500 (kbps)The error message is produced because the default maximum configurable bandwidth is 75 percent of the available interface bandwidth, which in this example is 7.5 Mbps. To change the maximum configurable bandwidth to 80 percent, use the max-reserved-bandwidth command in interface configuration mode, as follows:
max-reserved-bandwidth 80service output policy1endTo verify that the policy map was attached, enter the show policy-map interface command:
Router# show policy-map interface e1/1Ethernet1/1 output :policy1Weighted Fair QueueingClass class1Output Queue:Conversation 265Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Class class2Output Queue:Conversation 266Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Class class3Output Queue:Conversation 267Bandwidth 3000 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Virtual Template Configuration Example
The following example configures a strict priority queue in a virtual template configuration with CBWFQ. The max-reserved-bandwidth command changes the maximum bandwidth allocated between CBWFQ and IP RTP Priority from the default (75 percent) to 80 percent.
multilink virtual-template 1interface virtual-template 1ip address 172.16.1.1 255.255.255.0no ip directed-broadcastip rtp priority 16384 16383 25service-policy output policy1ppp multilinkppp multilink fragment-delay 20ppp multilink interleavemax-reserved-bandwidth 80endinterface Serial0/1bandwidth 64ip address 10.1.1.2 255.255.255.0no ip directed-broadcastencapsulation pppppp multilinkend
Note
Related Commands
mls ip pbr
To enable the multilayer switching (MLS) support for policy-routed packets, use the mls ip pbr command in global configuration mode. To disable the MLS support for policy-routed packets, use the no form of this command.
mls ip pbr [null0]
no mls ip pbr
Syntax Description
Command Default
MLS support for policy-routed packets is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720.
Note
When you enable the hardware-policy routing by entering the mls ip pbr command, all policy routing occurs in the hardware and is applied to all interfaces, regardless of which interface was configured for policy routing.
Use the null0 keyword when you have routed traffic only to enable the hardware support for the set interface null0 in the route-maps.
Examples
This example shows how to enable the MLS support for policy-routed packets:
Router(config)# mls ip pbrRelated Commands
show tcam interface vlan acl
Displays information about the interface-based TCAM.
