Add NBAR Source

Network-Based Application Recognition (NBAR) reveals a more accurate picture of traffic that is active on your network. NBAR Protocol Discovery leverages deep packet inspection performed at the router. NBAR looks at the packets being transferred (not just the port they use) to determine their ultimate protocol and help indicate their purpose.

Note: Class Based Quality of Service (CBQoS) metrics reflect a policy or priority given to certain types of traffic (usually time-sensitive traffic such as video or voice) by rules set at the router. These rules rely on NBAR classification.

Advantages to using NBAR traffic classification include:

Tip: NBAR classification is available on most Cisco routers.

Polled NBAR Statistics versus Statistics Embedded in Rich NetFlow Summaries

Using the NTA Sources library, there are two different ways to get NBAR reporting from Network Traffic Analysis.


Method for Gathering NBAR Statistics


Embedded. Get NBAR statistics from a stream of NetFlow traffic summaries.

Embedded yields a rich NBAR Application - Flow Details report. This means that NBAR data is delivered with observed traffic data NetFlow measurements. This adds meaning and context to what the NBAR packet inspection reveals and enables you to pivot through all aspects of the NetFlow data that interest you.

Automatic if enabled at a source device configured for Flexible NetFlow.

NetFlow source is listed in NTA Sources Library as Enabled and Receiving Flows with NBAR Embedded listed as Embedded.

Polled. Use SNMP to poll a device for NBAR metrics related to the traffic observed at the source.

This is essentially a summary or breakdown of application packets seen use at the observation point (in other words the switch, router, or other enabled NBAR source).

Yields NBAR Applications - Interface Totals report.

Device must be added to NTA Sources Library.

  • Appropriate SNMP credentials are selected for polling.
  • Poll Source for NBAR traffic is selected.

Gather NBAR/CBQoS Statistics through Polling

To add Polled NBAR classification gathering to an Network Traffic Analysis source:

  1. Open the NTA Sources Library (SETTINGS menu > Network Traffic Analysis > NTA Sources).
  2. Click Add > NBAR/CBQoS Polling Source.

    The Flow Source dialog displays.

  3. Provide the following field values:
    • Source IP Address. IP address of the flow source device.
    • Display Name. (Optional.) Name to display in source and NTA reports.
  4. Click to select Enable data collection from this source. (When you enable, the current source will count against your Network Traffic Analysis license).
  5. Polling source.
    • NBAR. Click to enable gathering NBAR classification totals by way of SNMP. (For Flexible NetFlow and other cases where NBAR is already embedded, enabling NBAR collection here is not necessary).
    • CBQoS. (Optional) Click to enable statistics gathering related to CBQoS policies.

    Tip: QoS classes and policies need to be defined on the source device for meaningful report data.

    • Poll source for total interface traffic. Click on this box to enable the device as an SNMP statistics source for Network Traffic Analysis.
  6. SNMP credentials. Select appropriate credentials from the drop down list.

    WhatsUp Gold Network Traffic Analysis queries the source device for interface information. The Interfaces frame displays known network interfaces for the current device.

  7. Access rights. (Optional) Opens the Flow Source access rights dialog that enables you to block WhatsUp Gold users from the flow data.
  8. Interfaces. Select one or more interfaces and click Show or Hide to have traffic included in source metrics and click OK.

    Network Traffic Analysis saves your SNMP source which also displays in your NTA Sources Library.

  9. Check the NBAR Applications - Interface Totals report to ensure flow data is received by WhatsUp Gold.

See Also

Enable and View Flow Collection Status

NTA Sources Library

View, Edit, Delete, and Enable Flow Sources

Get SNMP Traffic Totals

Scope User Access to NTA Traffic Data

NTA Data Quick Access