Network Based Application Recognition
Network Based Application Recognition (NBAR)[1] is the mechanism used to recognize a dataflow by the first packet sent.
The networking equipment which uses NBAR does a deep packet inspection on the first packet in a dataflow, to determine which traffic category the flow belongs to. It then programs the internal ASICs to handle this flow appropriately. The categorization is usually done with OSI_layer_4 info, but new applications have made it difficult to cling to this kind of tagging.
The NBAR approach is useful in dealing with malicious software using known ports to fake being "priority traffic", as well as non-standard applications using dynamic ports.[2] That's why NBAR is also known as OSI_layer_7 categorization.
On Cisco routers, NBAR is mainly used for Quality of Service and Security purposes.
References
- ^ NBAR defined at Cisco website
- ^ Using Network-Based Application Recognition and ACLs for Blocking the "Code Red" Worm, Cisco.
External links
 | This computer networking article is a stub. You can help Wikipedia by expanding it. |