Classification Using Class Maps
MQC-based tools classify packets using the match subcommand inside an MQC class map. The following list details the rules surrounding how class maps work for matching and classifying packets:
■ The match command has many options for matching packets, including QoS fields, ACLs, and MAC addresses. (See Table 12-10 in the "Foundation Summary" section for a reference.)
■ Class-map names are case sensitive.
■ The match protocol command means that IOS uses Network Based Application Recognition (NBAR) to perform that match.
■ The match any command matches any packet—in other words, any and all packets.
Example 12-1 shows a simple CB Marking configuration, with comments focused on the classification configuration. Note that the names and logic match Figure 12-4.
12-1 Basic CB Marking Example
! CEF is required for CB Marking. Without it, the class map and policy map ! configuration would be allowed, but the service-policy command would be rejected, ip cef
! The first class map matches all UDP/RTP packets with UDP ports between 16384 and ! 32767 (the 2nd number is added to the first to get the end of the range.) The ! second class map matches any and all packets, class-map match-all msclassl match ip rtp 16384 16383 class-map match-all myclass2 match any
! The policy map calls each of the two class maps for matching. The set command ! implies that the PHB is marking, meaning that this is a CB Marking config. policy-map mypolicy class myclass1
set dscp EF class myclass2 set dscp default ! The policy map processes packets leaving interface fa0/0. interface Fastethernet0/0 service-policy output mypolicy
With Example 12-1, each packet leaving interface fa0/0 will match one of the two classes. Because the policy map uses a set dscp command in each class, and all packets happen to match either myclass1 or myclass2, each packet will leave the interface marked either with DSCP EF (decimal 46) or default (decimal 0). (If the matching logic was different and some packets match neither myclass1 nor myclass2, those packets would not be marked, and would retain their existing DSCP values.)
Key Topic
Example
Using Multiple match Commands
In some cases, a class map may need to examine multiple items in a packet to decide whether the packet should be part of that class. Class maps can use multiple match commands, and even nest class maps inside other class maps, to achieve the desired combination of logic. The following list summarizes the key points regarding these more complex matching options:
Up to four (CoS and IPP) or eight (DSCP) values can be listed on a single match cos, match precedence, or match dscp command, respectively. If any of the values are found in the packet, the statement is matched.
If a class map has multiple match commands in it, the match-any or match-all (default) parameter on the class-map command defines whether a logical OR or a logical AND (default) is used between the match commands, respectively.
The match class name command refers to another class map by name, nesting the named class map's matching logic; the match class name command is considered to match if the referenced class-map also results in a match.
Example 12-2 shows several examples of this more complicated matching logic, with notations inside the example of what must be true for a class map to match a packet.
Example 12-2 Complex Matching with Class Maps
! class-map examplel uses match-all logic (default), so this class map matches ! packets that are permitted by ACL 102, and that also have an IP precedence of 5. class-map match-all examplel match access-group 102 match precedence 5
! class-map example2 uses match-any logic, so this class map matches packets that ! are permitted by ACL 102, or have DSCP AF21, or both, class-map match-any example2 match access-group 102 match dscp AF21
! class-map example3 matches no packets, due to a common mistake — the two match ! commands use a logical AND between them due to the default match-all argument, meaning ! that a single packet must have DSCP 0 and DSCP 1, which is impossible, class-map example4 ! shows how to correctly match either DSCP 0 or 1. class-map match-all example3 match dscp 0 match dscp 1
class-map match-any example4 match dscp 0 1
! class-map i-am-nesting refers to class-map i-am-nested through the match class ! i-am-nested command. The logic is explained after the example, class-map match-all i-am-nested match access-group 102
Key Topic
Example 12-2 Complex Matching with Class Maps (Continued) match precedence 5
class-map match-any i-am-nesting match class i-am-nested match cos 5
The trickiest part of Example 12-2 is how the class maps can be nested, as shown at the end. class-map i-am-nesting uses OR logic between its two match commands, meaning "I will match if the CoS is 5, or if class-map i-am-nested matches the packet, or both." When combined with the match-all logic of the i-am-nested class map, the logic matches the following packets/frames:
Packets that are permitted by ACL 102, AND marked with precedence 5 or frames with CoS 5
Classification Using NBAR
NBAR classifies packets that are normally difficult to classify. For instance, some applications use dynamic port numbers, so a statically configured match command, matching a particular UDP or TCP port number, simply could not classify the traffic. NBAR can look past the UDP and TCP header, and refer to the host name, URL, or MIME type in HTTP requests. (This deeper examination of the packet contents is sometimes called deep packet inspection.) NBAR can also look past the TCP and UDP headers to recognize application-specific information. For instance, NBAR allows recognition of different Citrix application types, and allows searching for a portion of a URL string.
NBAR itself can be used for a couple of different purposes. Independent of QoS features, NBAR can be configured to keep counters of traffic types and traffic volume for each type. For QoS, NBAR can be used by CB Marking to match difficult-to-match packets. Whenever the MQC match protocol command is used, IOS is using NBAR to match the packets. Table 12-6 lists some of the more popular uses of the match protocol command and NBAR.
|
Field |
Comments |
|
RTP audio versus video |
RTP uses even-numbered UDP ports from 16,384 to 32,768. The odd-numbered port numbers are used by RTCP for call control traffic. NBAR allows matching the even-numbered ports only, for classification of voice payload into a different service class from that used for voice signaling. |
|
Citrix applications |
NBAR can recognize different types of published Citrix applications. |
|
Field |
Comments |
|
Host name, URL string, MIME type |
NBAR can also match URL strings, including the host name and the MIME type, using regular expressions for matching logic. |
|
Peer-to-peer applications |
NBAR can find file-sharing applications like KaZaa, Morpheus, Grokster, and Gnutella. |
Continue reading here: Queuing Tools CBWFQ and LLQ
Was this article helpful?