Hi,
I have a Cisco 2801, IOS 12.4(24)T2 (C2801-IPBASEK9-M) on a WAN link to another 2801, which appears to be wrongly detecting our cross-site EMC replication traffic as Skype.
I am 100% sure that Skype isn't running on any of our PC's, yet the Skype protocol is by far the highest used out of everything. I have watched these traffic stats late at night when nobody is on the network and when the only traffic is replication, and this is the protocol which is constantly increasing.
If I run 'sh ip nbar port' , Skype isn't listed in the port-map. If I use ? at the end of the command, it lists Skype as option. The 'sh ip nbar protocol-discovery' show the following (among others):
FastEthernet0/1/0
Last clearing of "show ip nbar protocol-discovery" counters 6d10h
Input Output
----- ------
Protocol Packet Count Packet Count
Byte Count Byte Count
5min Bit Rate (bps) 5min Bit Rate (bps)
5min Max Bit Rate (bps) 5min Max Bit Rate (bps)
------------------------ ------------------------ ------------------------
skype 76133998 146572068
6167477623 173614718864
0 0
1221000 8973000
EMC have informed me that the port used for replication is 8888, but I can't see how NBAR can think this is Skype.
Does anybody have any ideas why NBAR is detecting Skype traffic?!
Thanks,
Lee
