1

I'm trying to block skype via policy routing but it's not working ... here's my configuration:

class-map match-any block
 match protocol skype

policy-map QoS-Priority-Input
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

policy-map QoS-Priority-Output
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

interface FastEthernet4
 description WAN
 service-policy input QoS-Priority-Input
 service-policy output QoS-Priority-Output

2 Answers 2

4

match protocol skype will only match Skype Protocol v1.

v2 of the protocol is very good at finding ways around any blocks - for example it will simply use HTTPS if it has to.

Here is a very good description of how to block it by forcing it to use HTTPS and then using DPI to inspect and block Skype HTTPS traffic

http://www.scribd.com/doc/28067970/Blocking-Skype-Using-IOS

1

If Skype behaves like a lot of P2P protocols, you're probably better off allocating it the smallest bandwidth allocation you can rather than outright blocking it. When faced with a complete block, they tend to negotiate new ports, but faced with a very choked channel, they stay in it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .