Network Based Application Recognition: Difference between revisions

Revision as of 05:24, 19 May 2004

Revision as of 01:20, 23 July 2004

Line 1:

'''NBAR''', which stands for Network Based Application Recognition''' (NBAR) is the mechanism used to recognize a dataflow by the first [[packet]] sent.

The [[Computer network|networking]] equipment which uses NBAR does a [[deep packet inspection]] on the first packet in a dataflow, to determine which traffic category the flow belongs to. It then programmes the internal [[ASIC]]s to handle this flow appropriatly. The categorisation is usually done with [[OSI-layer4]] info, but new applications have made it difficult to cling to this kind of tagging.

Line 5:

The NBAR approach is useful in dealing with malicious [[software]] using known [[Port (computing)|ports]] to fake being "priority traffic", as well as non-standard apps using non-determinaly ports.

== External Linkslinks ==

*[http://www.cisco.com Cisco's website]