Release Notes for NBAR2 Protocol Pack 24.0.0 for Cisco Wireless Controllers

Supported Platforms

Network-Based Application Recognition (NBAR2) Protocol Pack 24.0.0 support is provided for Cisco Wireless LAN Controller platforms, starting with the Cisco Wireless Release 8.4.

NBAR2 Protocol Pack 24.0.0 is supported on the following Cisco Wireless Controller platforms:

  • Cisco 5508 Wireless Controller

  • Cisco 5520 Wireles Controller

  • Cisco Flex 7510 Wireless Controllers

  • Cisco 8510 Wireless Controller

  • Cisco 8540 wireless Controller

  • Cisco Wireless Services Module 2 (WiSM2)


Note

  • Cisco Wireless Release 8.4, uses NBAR engine 23, and contains NBAR2 Protocol Pack 19.1.0 built-in. Optionally, you can upgrade to NBAR2 Protocol Pack 24.0.0. For more information about software releases and compatible protocol packs, see Working with Protocol Packs.

  • Though the NBAR2 protocol library and the protocol signatures support IPv6 traffic classification, Cisco Wireless Controller platforms currently support only IPv4 traffic classification.

  • The Cisco 2504 Wireless Controller supports Application Visibility and Control, but supports only built-in protocol packs present in Wireless Controller software releases. It does not support downloading and installing protocol packs.


New Protocols in NBAR2 Protocol Pack 24.0.0

The table below lists the new protocols added in NBAR2 Protocol Pack 24.0.0 (protocols added since 19.1.0).

Protocol Name

Common Name

Long Description

avast-antivirus

Avast Antivirus

Avast Antivirus and security.

cassandra

Cassandra

Apache Cassandra is an open source distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure.

cisco-collab-control

Cisco Collaboration Control

Cisco Collaboration Control messages by various Cisco Unified Communication clients.

cisco-collaboration-audio

Cisco Collaboration Audio

Cisco Collaboration Voice traffic associated with various Cisco Unified Communication clients.

cisco-collab-video

Cisco Collaboration Video

Cisco Collaboration Video by various Cisco Unified Communication clients.

cisco-phone-control

Cisco Phone Control

Control flow of Cisco IP phone.

cisco-phone-media

Cisco Phone Media

Cisco-media is used mainly in corporations and can be used on- or off-site.

cisco-spark-audio

Cisco Spark Audio

Cisco Spark Audio - Audio of unified communications client and SaaS with mobile team communication: group chat, private chat, video calls with screen sharing and file sharing.

cisco-spark-media

Cisco Spark Media

Cisco Spark Media - Media of unified communications client and SaaS with mobile team communication: group chat, private chat, video calls with screen sharing and file sharing.

cisco-spark-video

Cisco Spark Video

Cisco Spark Video - Video of unified communications client and SaaS with mobile team communication: group chat, private chat, video calls with screen sharing and file sharing

facebook-audio

Facebook Audio Streaming

Facebook audio streaming services.

facebook-media

Facebook Media Streaming

Facebook media streaming services.

facebook-video

Facebook Video Streaming

Facebook video streaming services.

google-services-audio

Google Services Audio

Audio streaming related to various Google services, APIs, and collaboration software.

google-services-media

Google Services Media

Media streaming related to various Google services, APIs, and collaboration software.

google-services-video

Google Services Video

Media streaming related to various Google services, APIs, and collaboration software.

ipass

iPass

iPass allow users to connect millions of hotspots around the world.

itunes-media

iTunes Media

Media streaming for iTunes media player and media library application.

mcafee-antivirus

McAfee Antivirus

McAfee Antivirus and security.

ms-lync-control

Skype for Business (MS-Lync) Control

Skype for Business (formerly Microsoft Lync) is a communications and collaboration platform that brings together an experience inspired by Skype with enterprise-grade security, compliance, and control.

Features include presence, IM, voice and video calls, and online meetings. Because it is built into Microsoft Office, initiating chats, calls, and meetings is an integrated experience within Office.

telepresence-audio

Telepresence Audio

Telepresence Voice.

tus-files

TusFiles

TusFiles is a cloud storage provider for online hosting and sharing of files.

web-rtc

WebRTC

WebRTC provides browsers and mobile applications with Real-Time Communications (RTC) capabilities.

web-rtc-audio

WebRTC Audio

WebRTC provides browsers and mobile applications with Real-Time Communications (RTC) capabilities.

web-rtc-video

WebRTC Video

WebRTC provides browsers and mobile applications with Real-Time Communications (RTC) capabilities.

wechat

WeChat

WeChat is a mobile text and voice messaging communication service. The app is available on Android, iPhone, BlackBerry, Windows Phone and Symbian phones.

Deprecated Protocols in NBAR2 Protocol Pack 24.0.0

In this release, no protocol has been deprecated.

Updated Protocols in NBAR2 Protocol Pack 24.0.0

This release includes the following improvements to classification:

  • Improved classification of many client programs through HTTP user-agents.

  • New capabilities for classifying clients and servers in the network.

  • Separate classification of audio and video for cisco-spark and web-rtc protocols.

  • Improved separation of various Google services, using socket-cache mechanism.

  • Improvements to host-based signatures.

The following table lists the protocols updated in NBAR2 Protocol Pack for Cisco IOS Version 15.5(3)M2 since 19.1.0.

Protocol

Updates

amazon-web-services

Updated signatures

cifs

Updated signatures

cisco-collaboration

Updated signatures

cisco-jabber-control

Updated signatures

cisco-phone

Updated signatures, changed attributes

cisco-phone-media

Changed attributes

cisco-phone-video

Changed attributes

cisco-spark

Updated signatures

conference-server

Updated signatures

conferencing

Updated signatures

connected-backup

Updated signatures

crashplan

Updated signatures

google-services

Updated signatures

http

Updated signatures

icloud

Updated signatures

kerberos

Updated signatures

ldap

Updated signatures

mongo

Updated signatures

ms-office-365

Updated signatures

ms-office-web-apps

Updated signatures

ms-services

Updated signatures

ms-wbt

Updated signatures

mysql

Updated signatures

ntp

Updated signatures

oracle-sqlnet

Updated signatures

outlook-web services

Updated signatures

perforce

Updated signatures

rtcp

Updated signatures

rtcp

Updated signatures

rtp

Updated signatures

rtp-audio

Updated signatures

rtp-video

Updated signatures

sip

Updated signatures

sqlserver

Updated signatures

ssl

Updated signatures

tcpoverdns

Updated signatures

telepresence-audio

Updated signatures

telepresence-control

Updated signatures

telepresence-media

Updated signatures

telnet

Updated signatures

tftp

Updated signatures

vmware-vsphere

Updated signatures

vnc

Updated signatures

webex-meeting

Updated signatures

wifi-calling

Updated signatures

Caveats in NBAR2 Protocol Pack 24.0.0


Note

If you have an account on Cisco.com, you can view information on select caveats, using the Bug Search Tool (https://tools.cisco.com/bugsearch/search).


Open Caveats in NBAR2 Protocol Pack 24.0.0

The following table lists the caveats open in NBAR2 Protocol Pack 24.0.0 (since 19.1.0) for Cisco IOS Version 15.5(3)M2:

Caveat ID Number

Description

CSCuh49380

PCoIP session-priority configuration limitation.

CSCuh53623

Segmented packets are not classified when using NBAR sub classification.

CSCun61772

IPv4 bundles might be used in IPv6 traffic.

Caveats Resolved in NBAR2 Protocol Pack 24.0.0

The following table lists the caveats resolved in NBAR2 Protocol Pack 24.0.0 (since 19.1.0) for Cisco IOS Version 15.5(3)M2:

Caveat ID Number

Description

CSCuz03729

DNS parser skips on additional records which include valid A and AAA.

CSCuz38621

NBAR does not classify SIP voice traffic properly

CSCuz51687

Missing host for icloud-content.coms

CSCva08934

Different classification between coarse-grain and fine-grain granularity.

CSCva18641

SIP traffic port 5061 is classified as unknown.

CSCva23181

IMAP protocol does not receive final classification.

CSCva26298

Socket cache entry causes YouTube classification.

CSCva30089

NBAR attributes are not supported for static protocols.

CSCva65247

mySQL port 3306 traffic is classified as unknown.

Special Notes and Limitations

Protocol Name

Special Note or Limitation

apple-app-store

Login and a few encrypted sessions are classified as iTunes.

bittorrent

HTTP traffic generated by the bitcomet bittorrent client might be classified as HTTP.

capwap-data

For capwap-data to be classified correctly, capwap-control must also be enabled.

ftp

During configuring QoS class-map with ftp-data, the FTP protocol must be selected. As an alternative, the FTP application group can be selected.

hulu

Encrypted video streaming generated by hulu may be classified as its underlying protocol rtmpe.

logmein

Traffic generated by the logmein android app may be classified incorrectly as ssl.

ms-lync

Login and chat traffic generated by the ms-lync client may be classified incorrectly as ssl.

pcanywhere

Traffic generated by pcanywhere for mac may be classified as unknown.

perfect-dark

Some perfect-dark sessions may be classified as unknown.

qq-accounts

Login to QQ applications which is not via the internet may not be classified as qq-accounts.

ssl

The Sub Classification (SC) mechanism was modified to include search for wildcard.

Note 

The SC rule for the part of the Server Name Indication (SNI) or the common name (CN) can now include a wildcard. If a wildcard is not used, the complete SNI or the CN is required.

For example, you can either use, "*.pqr.com" or "abc.pqr.com" to classify abc.pqr.com.