Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a very simple question, which seems to be extremely difficult when put into practice.

I have a Cisco IOS router with two Internet links (one over a WAN, through a proxy, everywhere, etc.) the other direct Internet.

Most traffic destined for the internet goes through the proxy over the WAN.

I want Skype traffic (why the client uses skype, I don't know..) to go out of the Internet link, while the rest of the traffic goes over the WAN through the proxy, etc.

Apparently skype is very difficult to detect/classify because of it's many adaptations to being blocked.

Is there any way to identify Skype on an IOS router (2911), and set it's next hop IP/interface?

Thank you, Aaron

share|improve this question

NBAR - network based application recognition is what you are after ( can match on Skype with deep packet inspection. Once you match the protocol set a DSCP value via a service policy and then apply PBR based on this DSCP value, setting your next-hop to your ISP. The method is outlined here: . It's dated, but the method is still applicable.

share|improve this answer
Up until what seems like 15.2(2)T, IOS NBAR only supported up to SkypeV3, which I don't believe is ever used any more. As far as I understand, Skype can be incredibly sneaky and hide itself as HTTPS traffic if you try and block it. I'm hoping because I'm not being mean to it, it won't hide itself, and it'll let me classify it and next-hop it to the right interface/IP. The new Skype is supported in what seems to be called NBAR2, which was very difficult to find until I knew NBAR2 existed... I'll give this a go tomorrow (although I may have to upgrade). Cheers! – Azz May 28 '12 at 10:15
At least you've got the right hardware to give it a go. The pdlm's are getting better and better. I am curious how this turns out. – rnxrx May 28 '12 at 13:01
Yeah.. It'll definitely be interesting, I might give a few of the other protocols a go as well, apparently it's meant to be able to match encrypted bittorrent... Very interesting. – Azz May 28 '12 at 21:42

Rather than trying to do this, couldn't you just tell the Skype clients to use your proxy server, or even set up a special Skype proxy server, then do your QoS on traffic from the proxy - or just send it straight out to the internet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.