1

I've got a very simple question, which seems to be extremely difficult when put into practice.

I have a Cisco IOS router with two Internet links (one over a WAN, through a proxy, everywhere, etc.) the other direct Internet.

Most traffic destined for the internet goes through the proxy over the WAN.

I want Skype traffic (why the client uses skype, I don't know..) to go out of the Internet link, while the rest of the traffic goes over the WAN through the proxy, etc.

Apparently skype is very difficult to detect/classify because of it's many adaptations to being blocked.

Is there any way to identify Skype on an IOS router (2911), and set it's next hop IP/interface?

Thank you, Aaron

2 Answers 2

2

NBAR - network based application recognition is what you are after (http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/15-0m/nbar-mqc.html) can match on Skype with deep packet inspection. Once you match the protocol set a DSCP value via a service policy and then apply PBR based on this DSCP value, setting your next-hop to your ISP. The method is outlined here: http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00800fc176.shtml. . It's dated, but the method is still applicable.

4
  • Up until what seems like 15.2(2)T, IOS NBAR only supported up to SkypeV3, which I don't believe is ever used any more. As far as I understand, Skype can be incredibly sneaky and hide itself as HTTPS traffic if you try and block it. I'm hoping because I'm not being mean to it, it won't hide itself, and it'll let me classify it and next-hop it to the right interface/IP. The new Skype is supported in what seems to be called NBAR2, which was very difficult to find until I knew NBAR2 existed... I'll give this a go tomorrow (although I may have to upgrade). Cheers!
    – Azz
    May 28, 2012 at 10:15
  • At least you've got the right hardware to give it a go. The pdlm's are getting better and better. I am curious how this turns out.
    – rnxrx
    May 28, 2012 at 13:01
  • Yeah.. It'll definitely be interesting, I might give a few of the other protocols a go as well, apparently it's meant to be able to match encrypted bittorrent... Very interesting.
    – Azz
    May 28, 2012 at 21:42
0

Rather than trying to do this, couldn't you just tell the Skype clients to use your proxy server, or even set up a special Skype proxy server, then do your QoS on traffic from the proxy - or just send it straight out to the internet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .