Cisco ASR 5000 Series, Обзор продукта

Страница: 904 / 992

Peer-to-Peer Overview
▀ How P2P Works
▄ Cisco ASR 5000 Series Product Overview
OL-22938-02
Jabber
Most clients that use Jabber for IM offer other services like Voice Call or File Transfer. These services are not
detected as Jabber.
Jabber with SSL encryption cannot be detected, because it uses SSL.
Gnutella / Morpheus
Some of the clients that use Gnutella protocol for file sharing can also use other file sharing protocols. The part
of traffic that follows Gnutella Protocol will only be detected as Gnutella.
Client specific patterns which are not part of the Gnutella Protocol will not be detected as Gnutella. UDP
contributes to about 20-30 % of most Gnutella clients. Detection is based on some strange patterns in the first
packet of these UDP flows. Untested Gnutella clients may have more strange patterns, causing drop in the
detection %.
The Morpheus Client creates a lot of TCP flows, without any string pattern in the application header. These
flows are not currently detected.
Winny
The Winny client also supports bbs. This is currently not detected.
FastTrack
SSL packets and HTTP packets from the Kazaa client is not detected. Only data transfer is detected.
Gadu-Gadu
Radio traffic passes through HTTP and is not detected.
Other Limitations
Most of the heuristic analysis for a subscriber is stateful and depends on building an internal state based on
certain patterns seen by the analyzer. Patterns occur over multiple packets in a single flow and over multiple
flows for a subscriber. If the system loses the state (due to a task failure for example), then the detection can
fail for the affected subscribers/flows after recovery.