Jabber - Cisco ASR 5000 series Product Overview

Hide thumbs Also See for ASR 5000 series:

Table of Contents

▀ How P2P Works

Jabber

Most clients that use Jabber for IM offer other services like Voice Call or File Transfer. These services are not

detected as Jabber.

Jabber with SSL encryption cannot be detected, because it uses SSL.

Gnutella / Morpheus

Some of the clients that use Gnutella protocol for file sharing can also use other file sharing protocols. The part

of traffic that follows Gnutella Protocol will only be detected as Gnutella.

Client specific patterns which are not part of the Gnutella Protocol will not be detected as Gnutella. UDP

contributes to about 20-30 % of most Gnutella clients. Detection is based on some strange patterns in the first

packet of these UDP flows. Untested Gnutella clients may have more strange patterns, causing drop in the

detection %.

The Morpheus Client creates a lot of TCP flows, without any string pattern in the application header. These

flows are not currently detected.

The Winny client also supports bbs. This is currently not detected.

SSL packets and HTTP packets from the Kazaa client is not detected. Only data transfer is detected.

Radio traffic passes through HTTP and is not detected.

Other Limitations

Most of the heuristic analysis for a subscriber is stateful and depends on building an internal state based on

certain patterns seen by the analyzer. Patterns occur over multiple packets in a single flow and over multiple

flows for a subscriber. If the system loses the state (due to a task failure for example), then the detection can

fail for the affected subscribers/flows after recovery.

▄ Cisco ASR 5000 Series Product Overview

Peer-to-Peer Overview