Information About NBAR Coarse-Grain Classification
Overview of NBAR Coarse-Grain Classification
NBAR provides two levels of application recognition-coarse-grain and fine-grain. By default NBAR operates in the coarse-grain mode.
By minimizing deep packet inspection, coarse-grain mode offers a performance advantage and reduces memory resource demands. This mode is useful in scenarios where the full power of fine-grain classification is not required.
Simplified Classification
Coarse-grain mode employs a simplified mode of classification, minimizing deep packet inspection. NBAR caches classification decisions made for earlier packets, then classifies later packets from the same server similarly.
Limitations of Coarse-Grain Mode
Coarse-grain mode has the following limitations in metric reporting detail:
-
Granularity: Caching may result in some reduction in the granularity. For example, NBAR might classify some traffic as ms-office-365 instead of as the more specific ms-office-web-apps.
-
Evasive applications: Classification of evasive applications, such as BitTorrent, eMule, and Skype, may be less effective than in fine-grain mode. Consequently, blocking or throttling may not work as well for these applications.
Comparison of Fine-grain and Coarse-grain Modes
Coarse-grain mode has the following limitations in metric reporting detail:
Fine-Grain Mode |
Coarse-Grain Mode |
|
---|---|---|
Classification |
Full-power of deep packet inspection |
Simplified classification Some classification according to similar earlier packets. |
Performance |
Slower |
Faster |
Memory Resources |
Higher memory demands |
Lower memory demands |
Sub-classification |
Full supported |
Partial support |
Field Extraction |
Full supported |
Partial support |
Ideal usage |
Per-packet policy Example: class-map that looks for specific url |
When there is no requirement for specific per-packet operations. |