Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to block skype via policy routing but it's not working ... here's my configuration:

class-map match-any block
 match protocol skype

policy-map QoS-Priority-Input
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

policy-map QoS-Priority-Output
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

interface FastEthernet4
 description WAN
 service-policy input QoS-Priority-Input
 service-policy output QoS-Priority-Output
share|improve this question
add comment

2 Answers

match protocol skype will only match Skype Protocol v1.

v2 of the protocol is very good at finding ways around any blocks - for example it will simply use HTTPS if it has to.

Here is a very good description of how to block it by forcing it to use HTTPS and then using DPI to inspect and block Skype HTTPS traffic

http://www.scribd.com/doc/28067970/Blocking-Skype-Using-IOS

share|improve this answer
add comment

If Skype behaves like a lot of P2P protocols, you're probably better off allocating it the smallest bandwidth allocation you can rather than outright blocking it. When faced with a complete block, they tend to negotiate new ports, but faced with a very choked channel, they stay in it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.