1

I'm trying to block skype via policy routing but it's not working ... here's my configuration:

class-map match-any block
 match protocol skype

policy-map QoS-Priority-Input
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

policy-map QoS-Priority-Output
class block
    police 1000000 31250 31250 conform-action drop  exceed-action drop  violate-action drop 

interface FastEthernet4
 description WAN
 service-policy input QoS-Priority-Input
 service-policy output QoS-Priority-Output
4

match protocol skype will only match Skype Protocol v1.

v2 of the protocol is very good at finding ways around any blocks - for example it will simply use HTTPS if it has to.

Here is a very good description of how to block it by forcing it to use HTTPS and then using DPI to inspect and block Skype HTTPS traffic

http://www.scribd.com/doc/28067970/Blocking-Skype-Using-IOS

1

If Skype behaves like a lot of P2P protocols, you're probably better off allocating it the smallest bandwidth allocation you can rather than outright blocking it. When faced with a complete block, they tend to negotiate new ports, but faced with a very choked channel, they stay in it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.