Add NBAR Source

Network-Based Application Recognition (NBAR) reveals a more accurate picture of traffic that is active on your network. NBAR Protocol Discovery leverages deep packet inspection performed at the router. NBAR looks at the packets being transferred (not just the port they use) to determine their ultimate protocol and help indicate their purpose.

Note: Class Based Quality of Service (CBQoS) metrics reflect a policy or priority given to certain types of traffic (usually time-sensitive traffic such as video or voice) by rules set at the router. These rules rely on NBAR classification.

Advantages to using NBAR traffic classification include:

• Identify non-conforming traffic. Unexpected or masquerading traffic can use well-known ports (a port reserved by the IETF standards body for a specific protocol). Port use does not guarantee the actual packet data is legitimate, so this makes packet inspection with NBAR necessary.
• Identify random use of UDP and TCP. Many legitimate application sessions (application level protocols) spawn UDP or TCP connections, and these connections use the next available port within a given port range. Packet inspection reveals the detailed protocol leveraging UDP or TCP.
• A clearer picture of mixed data. Revealing the underlying protocol that's used enables you to understand which traffic can be given priority (audio, video, and time sensitive data transfer) over others (bulk file upload, for example) while giving you insights into organizational trends, user trends, and organizational behavior.

Tip: NBAR classification is available on most Cisco routers.

Polled NBAR Statistics versus Statistics Embedded in Rich NetFlow Summaries

Using the NTA Sources library, there are two different ways to get NBAR reporting from Network Traffic Analysis.

	Method for Gathering NBAR Statistics	Requirements
	Embedded. Get NBAR statistics from a stream of NetFlow traffic summaries. Embedded yields a rich NBAR Application - Flow Details report. This means that NBAR data is delivered with observed traffic data NetFlow measurements. This adds meaning and context to what the NBAR packet inspection reveals and enables you to pivot through all aspects of the NetFlow data that interest you.	Automatic if enabled at a source device configured for Flexible NetFlow. NetFlow source is listed in NTA Sources Library as Enabled and Receiving Flows with NBAR Embedded listed as Embedded.
	Polled. Use SNMP to poll a device for NBAR metrics related to the traffic observed at the source. This is essentially a summary or breakdown of application packets seen use at the observation point (in other words the switch, router, or other enabled NBAR source). Yields NBAR Applications - Interface Totals report.	Device must be added to NTA Sources Library. Appropriate SNMP credentials are selected for polling. Poll Source for NBAR traffic is selected.

Gather NBAR/CBQoS Statistics through Polling

To add Polled NBAR classification gathering to an Network Traffic Analysis source:

1. Open the NTA Sources Library (SETTINGS menu > Network Traffic Analysis > NTA Sources).
2. Click Add > NBAR/CBQoS Polling Source.

   The Flow Source dialog displays.

3. Provide the following field values:
   • Source IP Address. IP address of the flow source device.
   • Display Name. (Optional.) Name to display in source and NTA reports.
4. Click to select Enable data collection from this source. (When you enable, the current source will count against your Network Traffic Analysis license).
5. Polling source.
   • NBAR. Click to enable gathering NBAR classification totals by way of SNMP. (For Flexible NetFlow and other cases where NBAR is already embedded, enabling NBAR collection here is not necessary).
   • CBQoS. (Optional) Click to enable statistics gathering related to CBQoS policies.

   Tip: QoS classes and policies need to be defined on the source device for meaningful report data.

   • Poll source for total interface traffic. Click on this box to enable the device as an SNMP statistics source for Network Traffic Analysis.
6. SNMP credentials. Select appropriate credentials from the drop down list.

   WhatsUp Gold Network Traffic Analysis queries the source device for interface information. The Interfaces frame displays known network interfaces for the current device.

7. Access rights. (Optional) Opens the Flow Source access rights dialog that enables you to block WhatsUp Gold users from the flow data.
8. Interfaces. Select one or more interfaces and click Show or Hide to have traffic included in source metrics and click OK.

   Network Traffic Analysis saves your SNMP source which also displays in your NTA Sources Library.

9. Check the NBAR Applications - Interface Totals report to ensure flow data is received by WhatsUp Gold.

See Also Enable and View Flow Collection Status NTA Sources Library View, Edit, Delete, and Enable Flow Sources Get SNMP Traffic Totals Scope User Access to NTA Traffic Data NTA Data Quick Access