[unisog] Inbound traffiic from Internet

Velasquez Venegas Jaime Omar jaime at ulima.edu.pe
Wed Jun 14 20:08:13 GMT 2006

Hi there.


I've been analyzing inbound traffic from Internet to our lan since some
portion of that traffic (specifically http traffic) seems to be causing
a high rise on the percentage use of bandwidth.On the other
hand,bandwith usage from our lan to Internet seems to be pretty low,
around 20% of the incoming traffic explained above.

Several captures at peak times of the problematic traffic lead me to
conclude that it should be some way of streaming over http (i.e
youtube.com , yahoo broadcasts bcst.yahoo.com,winamp
playlists,etc..).Ethereal captures shows a number of "continuation or
non-http traffic" events which makes me conclude that.

Given this, I tried one of the Cisco QoS solution which is Nbar and
applied to the wan interface at the inbound (that is from Internet to
our lan) but I've had no success with trying to "detect" this "streaming
over http" traffic in order to put a limit on it.

Has anyone faced this problem? How woul I solve this with nbar? Am I
using the right tool? (and no, I can't use a Packeteer box for the
moment :-) ).






-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.dshield.org/pipermail/unisog/attachments/20060614/e5b6f392/attachment-0001.htm 

More information about the unisog mailing list