gomez’s blog

If you are using some Cisco router which is capable of modular QoS you are able to get statistics about bandwidth consumption by specific protocol in your network. Cisco modular QoS is using Network Based Application Recognizition, feature that you will like a lot if you are working with QoS and feature that will make your networking job lot easier. Basically, NBAR is able to recognize type of application/protocol which is communicating over network, and based on that you are able to manipulate that data. You could mark that traffic, shape or police it. This blog post won’t cover those techniques, but my intention is to show how to get statistics. Procedure is very simple:

1. Verify your interface configuration:

R1#show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            80.239.11.100   YES NVRAM  up                    up
FastEthernet0/1            unassigned      YES NVRAM  up                    up
FastEthernet0/1.1          192.168.1.1     YES NVRAM  up                    up
FastEthernet0/1.20         192.168.20.1    YES NVRAM  up                    up
FastEthernet0/1.40         192.168.40.1    YES NVRAM  up                    up
NVI0                       unassigned      NO  unset  up                    up
Tunnel0                    10.100.100.1      YES NVRAM  up                    up

Verify which interface your WAN is working on. In this case it is FastEthernet0/0. We will use that interface for our statistics.

2. Navigate to global configuration mode, and then to interface configuration mode:

R1#
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#interface FastEthernet 0/0

3. While in interface configuration mode, activate NBAR protocol discovery:

R1(config-if)#ip nbar protocol-discovery
R1(config-if)#

4. It would be good to tune load interval for statistics that we will gather from default 5 minutes to 1 minute:

R1(config-if)#load-interval 60
R1(config-if)#

5. Next, we need to issue proper show command to get statistics, and that would be:

R1#show ip nbar protocol-discovery stats bit-rate top-n 10

FastEthernet0/0
Input                    Output
—–                    ——
Protocol                 1min Bit Rate (bps)      1min Bit Rate (bps)
———————— ———————— ————————
dhcp                     22000                    0
http                     0                        1000
gre                      0                        0
rtp                      0                        0
ipsec                    0                        0
secure-http              0                        0
ssh                      0                        0
dns                      0                        0
icmp                     0                        0
snmp                     0                        0
unknown                  64000                    0
Total                    86000                    1000

As you can see in above example, we are able to get statistics by protocol on specific interface in 1 min bit rate in inbound and outbound direction. Based on those statistics you can make some decisions, what needs to be blocked, shaped, policed or marked. I found this to be a first logical step when deploying QoS.

6. Optional step would be to create alias for show command that is being used in above example:

alias exec traffic ip nbar protocol-discovery stats bit-rate top-n 10

Now, once we type traffic command in privileged mode, we will get protocol statistics:

R1#traffic

FastEthernet0/0
Input                    Output
—–                    ——
Protocol                 1min Bit Rate (bps)      1min Bit Rate (bps)
———————— ———————— ————————
dhcp                     22000                    0
http                     0                        1000
gre                      0                        0
rtp                      0                        0
ipsec                    0                        0
secure-http              0                        0
ssh                      0                        0
dns                      0                        0
icmp                     0                        0
snmp                     0                        0
unknown                  64000                    0
Total                    86000                    1000

For more information please refer to following links:

1. Modular QoS
2. Quality of Service