1. © 2006 Cisco Systems, Inc. All rights reserved. QOS Lecture 6- Classification and Marking

2. © 2006 Cisco Systems, Inc. All rights reserved. Classification  Classification is the process of identifying and categorizing traffic into classes, typically based upon: Incoming interface IP precedence DSCP Source or destination address Application  Without classification, all packets are treated the same.  Classification should take place as close to the source as possible.

3. © 2006 Cisco Systems, Inc. All rights reserved. Marking  Marking is the QoS feature component that “colors” a packet (frame) so it can be identified and distinguished from other packets (frames) in QoS treatment.  Commonly used markers: Link layer: CoS (ISL, 802.1p) MPLS EXP bits Frame Relay Network layer: DSCP IP precedence

4. © 2006 Cisco Systems, Inc. All rights reserved. Classification and Marking in the LAN with IEEE 802.1Q  IEEE 802.1p user priority field is also called CoS.  IEEE 802.1p supports up to eight CoSs.  IEEE 802.1p focuses on support for QoS over LANs and 802.1Q ports.  IEEE 802.1p is preserved through the LAN, not end to end.

5. © 2006 Cisco Systems, Inc. All rights reserved. Classification and Marking in the Enterprise

6. © 2006 Cisco Systems, Inc. All rights reserved. DiffServ Model  Describes services associated with traffic classes, rather than traffic flows.  Complex traffic classification and conditioning is performed at the network edge.  No per-flow state in the core.  The goal of the DiffServ model is scalability.  Interoperability with non-DiffServ-compliant nodes.  Incremental deployment.

7. © 2006 Cisco Systems, Inc. All rights reserved. Classification Tools IP Precedence and DiffServ Code Points  IPv4: three most significant bits of ToS byte are called IP Precedence (IPP)—other bits unused  DiffServ: six most significant bits of ToS byte are called DiffServ Code Point (DSCP)—remaining two bits used for flow control  DSCP is backward-compatible with IP precedence 76543210 IDOffsetTTLProtoFCSIP SAIP DADataLen Version Length ToS Byte DiffServ Code Point (DSCP)IP ECN IPv4 Packet IP PrecedenceUnused Standard IPv4 DiffServ Extensions

8. © 2006 Cisco Systems, Inc. All rights reserved. IP ToS Byte and DS Field Inside the IP Header

9. © 2006 Cisco Systems, Inc. All rights reserved. IP Precedence and DSCP Compatibility  Compatibility with current IP precedence usage (RFC 1812)  Differentiates probability of timely forwarding: (xyz000) >= (abc000) if xyz > abc  That is, if a packet has DSCP value of 011000, it has a greater probability of timely forwarding than a packet with DSCP value of 001000.

10. © 2006 Cisco Systems, Inc. All rights reserved. Per-Hop Behaviors  DSCP selects PHB throughout the network: Default PHB (FIFO, tail drop) Class-selector PHB (IP precedence) EF PHB AF PHB

11. © 2006 Cisco Systems, Inc. All rights reserved. Standard PHB Groups

12. © 2006 Cisco Systems, Inc. All rights reserved. Expedited Forwarding (EF) PHB  EF PHB: Ensures a minimum departure rate Guarantees bandwidth—class guaranteed an amount of bandwidth with prioritized forwarding Polices bandwidth—class not allowed to exceed the guaranteed amount (excess traffic is dropped)  DSCP value of 101110: Looks like IP precedence 5 to non-DiffServ- compliant devices: Bits 5 to 7: 101 = 5 (same 3 bits are used for IP precedence) Bits 3 and 4: 11 = No drop probability Bit 2: Just 0

13. © 2006 Cisco Systems, Inc. All rights reserved. Assured Forwarding (AF) PHB  AF PHB: Guarantees bandwidth Allows access to extra bandwidth, if available  Four standard classes: AF1, AF2, AF3, and AF4  DSCP value range of aaadd0: aaa is a binary value of the class dd is drop probability

14. © 2006 Cisco Systems, Inc. All rights reserved. AF PHB Values  Each AF class uses three DSCP values.  Each AF class is independently forwarded with its guaranteed bandwidth.  Congestion avoidance is used within each class to prevent congestion within the class.

15. © 2006 Cisco Systems, Inc. All rights reserved. Mapping CoS to Network Layer QoS

16. © 2006 Cisco Systems, Inc. All rights reserved. QoS Service Class  A QoS service class is a logical grouping of packets that are to receive a similar level of applied quality.  A QoS service class can be: A single user (such as MAC address or IP address) A department, customer (such as subnet or interface) An application (such as port numbers or URL) A network destination (such as tunnel interface or VPN)

17. © 2006 Cisco Systems, Inc. All rights reserved. Implementing QoS Policy Using a QoS Service Class

18. © 2006 Cisco Systems, Inc. All rights reserved. QoS Service Class Guidelines  Profile applications to their basic network requirements.  Do not over engineer provisioning; use no more than four to five traffic classes for data traffic: Voice applications: VoIP Mission-critical applications: Oracle, SAP, SNA Interactive applications: Telnet, TN3270 Bulk applications: FTP, TFTP Best-effort applications: E-mail, web Scavenger applications: Nonorganizational streaming and video applications (Kazaa, Yahoo)  Do not assign more than three applications to mission-critical or transactional classes.  Use proactive policies before reactive (policing) policies.  Seek executive endorsement of relative ranking of application priority prior to rolling out QoS policies for data.

19. © 2006 Cisco Systems, Inc. All rights reserved. Classification and Marking Design QoS Baseline Marking Recommendations Application L3 Classification DSCPPHBIPPCoS Transactional Data 18AF2122 Call Signaling24CS3*33 Streaming Video 32CS444 Video Conferencing34AF4144 Voice46EF55 Network Management16CS222 L2 Bulk Data10AF1111 Scavenger8CS111 Routing48CS666 Mission-Critical Data26AF31*33 Best Effort0000

20. © 2006 Cisco Systems, Inc. All rights reserved. How Many Classes of Service Do I Need? 4/5 Class Model Scavenger Critical Data Call Signaling Realtime 8 Class Model Critical Data Video Call Signaling Best Effort Voice Bulk Data Network Control Scavenger 11 Class Model Network Management Call Signaling Streaming Video Transactional Data Interactive-Video Voice Best Effort IP Routing Mission-Critical Data Scavenger Bulk Data Time Best Effort

21. © 2006 Cisco Systems, Inc. All rights reserved. Trust Boundaries: Classify Where?  For scalability, classification should be enabled as close to the edge as possible, depending on the capabilities of the device at: Endpoint or end system Access layer Distribution layer

22. © 2006 Cisco Systems, Inc. All rights reserved. Trust Boundaries: Mark Where?  For scalability, marking should be done as close to the source as possible.

23. © 2006 Cisco Systems, Inc. All rights reserved. Network-Based Application Recognition  Used in conjunction with QoS class- based features, NBAR is an intelligent classification engine that: Classifies modern client-server and web- based applications Discovers what traffic is running on the network Analyzes application traffic patterns in real time  NBAR functions: Performs identification of applications and protocols (Layer 4–7) Performs protocol discovery Provides traffic statistics  New applications are easily supported by loading a PDLM. My application is too slow! Sample Link Utilization Citrix25% Netshow 15% Fasttrack10% FTP30% HTTP20%

24. © 2006 Cisco Systems, Inc. All rights reserved. NBAR Functions & Features  NBAR performs the following two functions: Identification of applications and protocols (Layer 4 to Layer 7) Protocol discovery  Some examples of class-based QoS features that can be used on traffic after the traffic is classified by NBAR include: Class-Based Marking (the set command) Class-Based Weighted Fair Queueing (the bandwidth and queue-limit commands) Low Latency Queueing (the priority command) Traffic Policing (the police command) Traffic Shaping (the shape command)

25. © 2006 Cisco Systems, Inc. All rights reserved. NBAR Application Support  NBAR can classify applications that use: Statically assigned TCP and UDP port numbers Non-UDP and non-TCP IP protocols Dynamically assigned TCP and UDP port numbers negotiated during connection establishment (requires stateful inspection) Subport and deep packet inspection classification

26. © 2006 Cisco Systems, Inc. All rights reserved. Packet Description Language Module  PDLMs allow NBAR to recognize new protocols matching text patterns in data packets without requiring a new Cisco IOS software image or a router reload.  An external PDLM can be loaded at run time to extend the NBAR list of recognized protocols.  PDLMs can also be used to enhance an existing protocol recognition capability.  PDLMs must be produced by Cisco engineers.

27. © 2006 Cisco Systems, Inc. All rights reserved. PDLM Command Syntax  Used to enhance the list of protocols recognized by NBAR through a PDLM.  The filename is in the URL format (for example, flash://citrix.pdlm). ip nbar pdlm pdlm-name router(config)# ip nbar port-map protocol-name [tcp | udp] port-number router(config)#  Configures NBAR to search for a protocol or protocol name using a port number other than the well-known port.  Up to 16 additional port numbers can be specified.

28. © 2006 Cisco Systems, Inc. All rights reserved. NBAR Protocol-to-Port Maps  Displays the current NBAR protocol-to-port mappings router#show ip nbar port-map port-map bgp udp 179 port-map bgp tcp 179 port-map cuseeme udp 7648 7649 port-map cuseeme tcp 7648 7649 port-map dhcp udp 67 68 port-map dhcp tcp 67 68 port-map dns udp 53 port-map dns tcp 53 show ip nbar port-map [protocol-name] router#

29. © 2006 Cisco Systems, Inc. All rights reserved. NBAR Protocol Discovery  Analyzes application traffic patterns in real time and discovers which traffic is running on the network  Provides bidirectional, per-interface, and per-protocol statistics  Important monitoring tool supported by Cisco QoS management tools: Generates real-time application statistics Provides traffic distribution information at key network locations

30. © 2006 Cisco Systems, Inc. All rights reserved. Configuring and Monitoring NBAR Protocol Discovery  Configures NBAR to discover traffic for all protocols known to NBAR on a particular interface  Requires that CEF be enabled before protocol discovery  Can be applied with or without a service policy enabled ip nbar protocol-discovery router(config-if)# show ip nbar protocol-discovery router#  Displays the statistics for all interfaces on which protocol discovery is enabled

31. © 2006 Cisco Systems, Inc. All rights reserved. Configuring and Monitoring Protocol Discovery Output router#show ip nbar protocol-discovery Ethernet0/0 Input Output Protocol Packet Count Packet Count Byte Count Byte Count 5 minute bit rate (bps) 5 minute bit rate (bps) ---------- ------------------------ ------------------------ realaudio 2911 3040 1678304 198406 19000 1000 http 19624 13506 14050949 2017293 0 0

32. © 2006 Cisco Systems, Inc. All rights reserved. Steps for Configuring NBAR for Static Protocols  Required steps: Enable NBAR Protocol Discovery. Configure a traffic class. Configure a traffic policy. Attach the traffic policy to an interface. Enable PDLM if needed.

33. © 2006 Cisco Systems, Inc. All rights reserved. Configuring NBAR for Static Protocols Commands  Configures the match criteria for a class map on the basis of the specified protocol using the MQC configuration mode.  Static protocols are recognized based on the well-known destination port number.  A match not command can be used to specify a QoS policy value that is not used as a match criterion; in this case, all other values of that QoS policy become successful match criteria. match protocol protocol router(config-cmap)#

34. © 2006 Cisco Systems, Inc. All rights reserved. Configuring NBAR Example  HTTP is a static protocol using a well-known port number 80. However, other port numbers may also be in use.  The ip nbar port-map command will inform the router that other ports are also used for HTTP.

35. © 2006 Cisco Systems, Inc. All rights reserved. Steps for Configuring Stateful NBAR for Dynamic Protocols  Required steps: Configure a traffic class. Configure a traffic policy. Attach the traffic policy to an interface.

36. © 2006 Cisco Systems, Inc. All rights reserved. Enhanced NBAR Classification for HTTP  Recognizes the HTTP GET packets containing the URL, and then matches all packets that are part of the HTTP GET request  Include only the portion of the URL following the address or host name in the match statement match protocol http url url-string router(config-cmap)# match protocol http host hostname-string router(config-cmap)#  Performs a regular expression match on the host field content inside an HTTP GET packet and classifies all packets from that host

37. © 2006 Cisco Systems, Inc. All rights reserved. match protocol http mime MIME-type router(config-cmap)# match protocol fasttrack file-transfer regular-expression router(config-cmap)# Special NBAR Configuration for HTTP and FastTrack  Matches a packet containing the MIME type and all subsequent packets until the next HTTP transaction for stateful protocol.  Stateful mechanism to identify a group of peer-to-peer file-sharing applications.  Applications that use FastTrack peer-to-peer protocol include Kazaa, Grokster, Gnutella, and Morpheus.  A Cisco IOS regular expression is used to identify specific FastTrack traffic.  To specify that all FastTrack traffic will be identified by the traffic class, use asterisk (*) as the regular expression.

38. © 2006 Cisco Systems, Inc. All rights reserved. URL or HOST Specification String Options OptionsDescription * Match any zero or more characters in this position. ? Match any one character in this position. | Match one of a choice of characters. (|) Match one of a choice of characters in a range. For example, xyz.(gif | jpg) matches either xyz.gif or xyz.jpg. [ ] Match any character in the range specified, or one of the special characters. For example, [0-9] is all of the digits; [*] is the "*" character, and [[] is the "[" character.

39. © 2006 Cisco Systems, Inc. All rights reserved. match protocol rtp [audio | video | payload-type payload-string] router(config-cmap)# Configuring Stateful NBAR for RTP  Identifies real-time audio and video traffic in the class-map mode of MQC  Differentiates on the basis of audio and video codecs  The match protocol rtp command has these options: audio: Match by payload type values 0 to 23, reserved for audio traffic video: Match by payload type values 24 to 33, reserved for video traffic payload-type: Match by a specific payload type value; provides more granularity than the audio or video options

40. © 2006 Cisco Systems, Inc. All rights reserved. Classification of RTP Session