|
Class Name
|
Description
|
Version Introduced
|
| Client/Server |
| CVSpserver |
CVS (Concurrent Versions System) pserver |
5.2.3
|
| CVSup |
CVS-Optimized Network File Distribution System |
5.1
|
| FIX |
Financial Information eXchange |
pre-5.0.0
|
| FoldingAtHome |
Distributed Computation Screen Saver (foldingathome.stanford.edu) |
5.0.2
|
| INFOC-RTMS |
Attachmate INFOConnect Response Time Monitor System |
5.0.0
|
| INT-1 |
Unisys Interactive 1 (2200, ClearPath IX) |
5.0.0
|
| MATIP |
Mapping of Airline Traffic over IP (RFC 2351) service
group |
5.0.0
|
| MATIP-A |
MATIP Type A |
5.0.0
|
| MATIP-B |
MATIP Type B |
5.0.0
|
| MeetingMaker |
Meeting Maker |
5.0.0
|
| NetIQ |
NetIQ AppManager |
5.1
|
| OpenConnect-JCP |
OpenConnect JCP clients (browser-based access to host
applications) |
pre-5.0.0
|
| PEPGate |
Attachmate PEP Gateway (Unisys 2200) |
5.0.0
|
| Unisys-TCPA |
Unisys TCPA (A Series, ClearPath LX, NX) |
5.0.0
|
| Content Delivery |
| Apple-iTunes |
Apple iTunes - Music Downloads |
6.0.2
|
| Ariel-419 |
Infotrieve document delivery system (on port 419) |
6.0.2
|
| Ariel-422 |
Infotrieve document delivery system (on port 422) |
6.0.2
|
| BackWeb |
Push technology. Polite BackWeb has an agent on the client
to prevent BackWeb background traffic from interfering with other
IP network applications. |
pre-5.0.0
|
| Chaincast |
Chaincast Flexible Content Delivery System |
5.2.3
|
| EntryPoint |
EntryPoint push traffic (formerly PointCast) |
5.0.0
|
| Kontiki |
Kontiki - Content Distribution Network |
5.2.2
|
| Marimba |
Marimba Castanet push traffic |
pre-5.0.0
|
| Napster2 |
Napster Pay-Per-Use Music
Note: The original Napster and Napster P2P clients are classified
in the Napster
service.
|
6.2.0
|
| Napster2-Data |
Napster Music File Downloads |
6.2.0
|
| Napster2-Other |
Other Napster Traffic |
6.2.0
|
| NewsStand |
NewsStand-Reader - publication subscription service |
pre-5.0.0
|
| PointCast |
See EntryPoint |
pre-5.0.0
|
| Webshots |
Webshots Desktop (photo screensaver application) |
pre-5.0.0
|
| Database and Enterprise Resource
Planning (ERP) Software |
| BAAN |
Baan enterprise management system |
pre-5.0.0
|
| FileMaker |
FileMaker Pro database service group |
pre-5.0.0
|
| FileMaker-DB |
FileMaker database access |
pre-5.0.0
|
| FileMaker-R |
FileMaker network host response |
pre-5.0.0
|
| JDENet |
J. D. Edwards OneWorld JDENet protocol |
5.0.0
|
| MSSQL |
Microsoft Structured Query Language service group |
pre-5.0.0
|
| MSSQL-Mon |
SQL monitoring traffic |
pre-5.0.0
|
| MSSQL-Server |
SQL server traffic |
pre-5.0.0
|
| Oracle |
Oracle database application service group |
pre-5.0.0
|
| Oracle-netv1 |
Oracle SQL*Net v1-based traffic (v6, Oracle7)
Note: Oracle-netv1 traffic is no longer autodiscovered by PacketWise;
however, you can create this class manually. |
pre-5.0.0
|
| Oracle-netv2 |
Oracle SQL*Net v2/Net8-based traffic (Oracle7, 8, 8i,
9i, 10g) |
pre-5.0.0
5.2.1 (Oracle 9i)
|
| Oracle-JVM-SSL |
Oracle JVM (IIOP) traffic over SSL |
pre-5.0.0
|
| Oracle-SSL |
Oracle database over SSL |
pre-5.0.0
|
| OracleClient |
Oracle Java client (Webforms) |
pre-5.0.0
|
| OracleEM |
Oracle Enterprise Manager |
5.2.1
|
| OracleEM1 |
Oracle Enterprise Manager-1 |
5.2.1
|
| OracleEM2 |
Oracle Enterprise Manager-2 |
5.2.1
|
| PostgreSQL |
PostgreSQL freeware SQL database |
6.0.2
|
| Progress |
Progress database traffic |
5.0.0
|
| SAP |
SAP - Systemanalyse und Programmentwicklung (Services,
Applications, and Products in Data Processing) |
5.0.0
|
| SAP.MCAST.NET |
Multicast Service Announcement Protocol: 224.2.127.254 |
5.0.0
|
| Directory Services |
| CRS |
Microsoft Content Replication Service |
pre-5.0.0
|
| DHCP |
Dynamic Host Configuration Protocol service group |
pre-5.0.0
|
| DHCP-C |
DHCP or BootP Client |
pre-5.0.0
|
| DHCP-S |
DHCP or BootP Server |
pre-5.0.0
|
| DNS |
Domain Name Service |
pre-5.0.0
|
| Finger |
Finger User Information Protocol |
pre-5.0.0
|
| Ident |
Identification Protocol |
pre-5.0.0
|
| Kerberos |
Network Authentication Service (ticket granting and checking) |
pre-5.0.0
|
| LDAP |
Lightweight Directory Access Protocol service group |
pre-5.0.0
|
| LDAP-Clear |
LDAP |
pre-5.0.0
|
| LDAP-Secure |
Secure LDAP |
pre-5.0.0
|
| mDNS |
Multicast DNS (Apple Rendezvous) |
7.0
|
| RADIUS |
Service group for Remote Authentication Dial-in User Service |
pre-5.0.0
|
| RADIUS-Acct |
RADIUS accounting service |
pre-5.0.0
|
| RADIUS-Auth |
RADIUS authentication service |
pre-5.0.0
|
| RRP |
NSI Registry Registrar Protocol |
5.1
|
| rwho |
UNIX remote who (rwho) command; reports current users
for all hosts on the local network |
pre-5.0.0
|
| SSDP |
Simple Service Discovery Protocol |
5.3
|
| TACACS |
Login host protocol |
pre-5.0.0
|
| WHOIS |
WHOIS service (application that identifies the owner of
a domain name) |
pre-5.0.0
|
| WINS |
Windows Internet Name Service |
pre-5.0.0
|
| Email and Collaboration |
| Biff |
UNIX new mail notification |
pre-5.0.0
|
| ccMail |
Lotus cc:Mail email application |
pre-5.0.0
|
| DCOM |
Microsoft Distributed Component Object Model |
pre-5.0.0
|
| Groupwise |
Novell Groupwise messaging system service group |
pre-5.0.0
|
| Groupwise-MTA |
Novell Groupwise Message Transfer Agent |
pre-5.0.0
|
| Groupwise-POA |
Novell Groupwise Post Office Agent |
pre-5.0.0
|
| IMAP |
Interactive Mail Access Protocol service group |
pre-5.0.0
|
| IMAP-Clear |
Interactive Mail Access Protocol |
pre-5.0.0
|
| IMAP-Secure |
Secure Interactive Mail Access Protocol |
pre-5.0.0
|
| LotusNotes |
Groupware for collaborative communication |
pre-5.0.0
|
| MSSQ |
Microsoft Message Queue service group |
pre-5.0.0
|
| MSSQ-CQ |
MSSQ Client Queue |
pre-5.0.0
|
| MSSQ-IS |
MSSQ Information Store |
pre-5.0.0
|
| MSSQ-Ping |
MSSQ Ping Mechanism |
pre-5.0.0
|
| MSSQ-QMT |
MSSQ Queue Manager Traffic |
pre-5.0.0
|
| MSSQ-SQ |
MSSQ Server Queue |
pre-5.0.0
|
| OSI |
Open System Interconnection (OSI) over TCP (RFC2126),
e.g., Microsoft Exchange X.400 |
pre-5.0.0
|
| POP3 |
Mail reception (Post Office Protocol) service group |
pre-5.0.0
|
| POP3-Clear |
Post Office Protocol for e-mail |
pre-5.0.0
|
| POP3-Kerberos |
Secure Mail Reception (Post Office Protocol
with Kerberos) |
5.0.2
|
| POP3-Secure |
Secure Post Office Protocol for e-mail |
pre-5.0.0
|
| SMTP |
Simple Mail Transport Protocol (mail transmission) service
group |
pre-5.0.0
|
| SMTP-Clear |
Mail transmission |
pre-5.0.0
|
| SMTP-Secure |
Secure mail transmission with SSL |
pre-5.0.0
|
| File Server |
| AFS |
Andrew File System service group |
5.0.2
|
| AFS-FS |
Andrew File System file server |
5.0.2
|
| AFS-VL |
Andrew File System volume location database |
5.0.2
|
| CIFS-TCP |
Common Internet File System (SMB) over TCP |
5.0.0
|
| CU-Dev |
Fujitsu Device Control (CU-DEV on TCP/IP) |
pre-5.0.0
|
| lockd |
NFS file lock daemon |
pre-5.0.0
|
| Microsoft-ds |
Microsoft Common Internet File System / Server Message
Block (SMB) protocol |
5.0.0
|
| NetBIOS-IP |
NetBIOS over IP service group (NetBIOS is a program that
allows applications on different computers to communicate within a
LAN) |
pre-5.0.0
|
| NetBIOS-IP- DGM |
NetBIOS Datagram Service |
pre-5.0.0
|
| NetBIOS-IP-NS |
NetBIOS Name Service |
pre-5.0.0
|
| NetBIOS-IP-SSN |
NetBIOS Session Service |
pre-5.0.0
|
| NFS |
UNIX Network File System (both TCP and UDP) |
pre-5.0.0
|
| NW5-CMD |
Netware 5 - Compatibility Mode Drivers service group |
pre-5.0.0
|
| NW5-CMD-TCP |
Netware 5 - Compatibility Mode Drivers over TCP |
pre-5.0.0
|
| NW5-CMD-UDP |
Netware 5 - Compatibility Mode Drivers over UDP |
pre-5.0.0
|
| NW5-NCP |
Netware 5 Core Protocol |
pre-5.0.0
|
| rsync |
UNIX remote file synchronization protocol |
5.3
|
| SunND |
Sun Network Disk boot protocol |
6.1.0
|
| Games |
| AsheronsCall |
Asheron's Call network game by Microsoft |
5.0.2
|
| Battle.net |
Blizzard Entertainment online gaming services, including
Diablo, Warcraft, and StarCraft |
5.0.1, 5.2.3 (Warcraft III, Diablo II)
|
| Doom |
Doom game |
pre-5.0.0
|
| Everquest |
classified as SonyOnline |
5.2.1
|
| Half-Life |
Service group for Half-Life network games by Valve and
Sierra Studios (including Opposing Forces, CounterStrike, and Team
Fortress) |
5.0.2
|
| Half-Life-TCP |
Half-Life chat and server |
5.0.2
|
| Half-Life-UDP |
Half-Life request and game play |
5.0.2
|
| Kali |
Gaming protocol |
pre-5.0.0
|
| LucasArts |
Jedi Knight II: Jedi Outcast |
5.2.3
|
| MSN-Zone |
Microsoft Network Gaming Zone, including Age of Empires |
5.0.2
|
| MSN-Zone-TCP |
Microsoft Network Gaming Zone - TCP traffic |
5.0.2
|
| MSN-Zone-UDP |
Microsoft Network Gaming Zone - UDPtraffic |
5.0.2
|
| Mythic |
Mythic Entertainment games (Dark Age of Camelot) |
5.2.2
|
| Quake |
Quake game service group |
pre-5.0.0
|
| Quake-A |
Quake (port 26000) |
pre-5.0.0
|
| Quake-B |
Quake (port 27500) |
pre-5.0.0
|
| Quake-II-TCP |
Quake II over TCP |
pre-5.0.0
|
| Quake-II-UDP |
Quake II over UDP |
pre-5.0.0
|
| Quake-III |
Quake III Arena |
5.0.2
|
| SonyOnline |
Games by Sony Online Entertainment (e.g., EverQuest) |
5.2.1
|
| Tribes |
Starsiege Tribes network game by Sierra Studios (includes
Tribes 2) |
5.0.2, 5.2.1 (Tribes 2)
|
| Unreal |
Unreal Tournament PC Game |
5.0.2
|
| Unreal-Browser |
Unreal Tournament - Browser |
5.0.2
|
| Unreal-Ping |
Unreal Tournament - Info Ping |
5.0.2
|
| Unreal-Play |
Unreal Tournament - Game Play |
5.0.2
|
| Unreal-Status |
Unreal Tournament - Status Request |
5.0.2
|
| YahooGames |
Yahoo! Games |
5.0.2
|
|
Healthcare
For details on managing this type of traffic, see Common
Performance-Management Strategies for Healthcare Environments.
|
| DICOM |
Digital Imaging and Communications in Medicine |
5.2.3
|
| HL7 |
Health Level Seven |
5.2.3
|
| Host Access |
| ATSTCP |
Galileo 2915 Terminal and Printer Traffic |
5.0.0
|
| Attachmate-GW |
Attachmate INFOConnect-e-Vantage Gateway |
5.0.0
|
| Persona |
Persoft Persona service group |
5.0.0
|
| Persona-Clear |
Persoft Persona non-encrypted (port 1917) |
5.0.0
|
| Persona-Secure |
Persoft Persona secure SSL |
5.0.0
|
| SHARESUDP |
ALC over UDP for EDS/Shares (TPF) |
5.0.0
|
| SMTBF |
Attachmate Lantern Gateway |
5.0.0
|
| tn3270 |
Telnet for IBM 3270 terminals and 3270 emulation |
pre-5.0.0
|
| tn5250 |
IBM 5250 terminal traffic over Telnet |
pre-5.0.0
|
| Internet Protocols |
| ActiveX |
Microsoft object-oriented program technologies and tools |
pre-5.0.0
|
| BITS |
Microsoft Background Intelligent Transfer Service |
6.2.0
|
| FTP |
File Transfer Protocol service group classification -
both FTP commands and data |
pre-5.0.0
|
| FTP-Cmd-Clear |
File Transfer Protocol command channel |
pre-5.0.0
|
| FTP-Cmd-Secure |
Secure FTP command channel (SSL) |
pre-5.0.0
|
| FTP-Data-Clear |
FTP data transport channel |
pre-5.0.0
|
| FTP-Data-Secure |
Secure FTP data transfer channel (SSL) |
pre-5.0.0
|
| Gopher |
Search application |
pre-5.0.0
|
| HTTP |
Web traffic - Hypertext Transport Protocol |
pre-5.0.0
|
| HTTP-Tunnel |
HTTP Tunnel Traffic (traffic that is sent through an HTTP tunnel
via an HTTP proxy server on the Internet - perhaps to bypass firewall
rules) See the Tech Info Library for information about restricting
traffic in an HTTP tunnel.
|
6.0
|
| IP |
Internet Protocol (not autodiscovered) |
pre-5.0.0
|
| IPIP |
IP-within-IP Encapsulation Protocol |
5.2.1
|
| IPv6 |
Internet Protocol version 6 (IPng) |
pre-5.0.0
|
| NNTP |
Usenet NetNews Transfer Protocol |
pre-5.0.0
|
| NNTP-Clear |
Clear Text Usenet newsgroup transmission |
pre-5.0.0
|
| NNTP-Secure |
Secure Usenet newsgroup transmission |
pre-5.0.0
|
| SOAP-HTTP |
Simple Object Access Protocol over HTTP |
7.0
|
| TCP |
Transmission Control Protocol - all Internet TCP traffic
(not autodiscovered) |
pre-5.0.0
|
| TFTP |
Trivial File Transfer Protocol |
pre-5.0.0
|
| UDP |
User Datagram Protocol - all Internet UDP traffic (not
autodiscovered) |
pre-5.0.0
|
| UUCP |
Unix-to-Unix Copy Protocol |
pre-5.0.0
|
| Legacy LAN or Non-IP |
| AFP |
AppleTalk Filing Protocol (AppleShare IP) |
pre-5.0.0
|
| AppleTalk |
Apple network protocol |
pre-5.0.0
|
| DECnet |
Digital Equipment Corporation network protocol |
pre-5.0.0
|
| FNA |
Fujitsu Network Architecture (a variant of SNA) |
pre-5.0.0
|
| FNAonTCP |
FNA on TCP service group |
pre-5.0.0
|
| FNAonTCP-1 |
Transport Independent Convergence (FNA on TCP port 492) |
pre-5.0.0
|
| FNAonTCP-2 |
Transport Independent Convergence (FNA on TCP port 493) |
pre-5.0.0
|
| IPX |
Novell networking protocol |
pre-5.0.0
|
| LAT |
DEC Printer Support (Local Area Transport) |
pre-5.0.0
|
| MOP-DL |
Maintenance Operations Protocol Dump/Load |
5.1
|
| MOP-RC |
Maintenance Operations Protocol Remote Console |
5.1
|
| NetBEUI |
NetBEUI - Network protocol for PCs |
pre-5.0.0
|
| PPPoE |
Point-to-Point Protocol over Ethernet |
5.2.1
|
| PPPoE-Control |
Point-to-Point Protocol over Ethernet - Control |
5.2
|
| PPPoE-Data |
Point-to-Point Protocol over Ethernet - Data |
5.2
|
| SLP |
Service Location Protocol |
pre-5.0.0
|
| SNA |
IBM Systems Network Architecture protocol |
pre-5.0.0
|
|
Messaging
For details on managing this type of traffic, see Control
Instant Messaging.
|
| AOL-AIM-ICQ |
AOL 8.0 - AOL Instant Messenger & ICQ service group |
5.0.1
|
| AOL-IM |
AOL - Instant Messenger & ICQ Client-Server |
5.0.1
|
| ICQ-2000 |
ICQ - ICQ2000 Client to Client Protocol |
5.0.2
|
| AOL-IM-Talk |
AOL Instant Messaging Point-to-Point Talk |
5.2.1
|
| AOL-IM-IMAGE |
AOL Instant Messaging Point-to-Point Chat |
5.2.1
|
| AOL-IM-File |
AOL Instant Messaging Point-to-Point File Transfer |
5.2.1
|
| AOL-ISP |
AOL 8.0 ISP client traffic |
6.0
|
| AOL-Default |
Unknown AOL traffic |
6.0
|
| IRC |
Internet Relay Chat service group |
pre-5.0.0
|
| IRC-Chat |
Internet Relay Chat - General chat traffic |
5.2.1
|
| IRC-DCC |
Internet Relay Chat - Direct Client-to-Client traffic |
5.2.1
|
| IRC-Secure |
Secure Internet Relay Chat with SSL (port 994) |
pre-5.0.0
|
| IRC-Servers |
Internet Relay Chat - Server-to-Server traffic |
5.2.1
|
| IRC-194 |
IRC on port 194 |
pre-5.0.0
|
| IRC-6665 |
IRC on port 6665 (server to server) |
pre-5.0.0
|
| IRC-6667 |
IRC on port 6667 (client to server) |
pre-5.0.0
|
| Lotus-IM |
IBM Lotus Instant Messaging
Note: Some Instant Messenger traffic is classified into
pre-existing services: Broadcast Service will classify into RTSP,
Meeting Data into T.120, and Meeting Updates into LotusNotes. In
order to track and manage Lotus messaging traffic most effectively,
you may want to group Lotus-IM, RTSP, T.120, and LotusNotes into
a single folder.
|
6.0.2
|
| Lotus-IM-CommC |
IBM Lotus Instant Messaging - Tunnelled Community Service |
6.0.2
|
| Lotus-IM-CommS |
IBM Lotus Instant Messaging - Community Service |
6.0.2
|
| Lotus-IM-MtgS |
IBM Lotus Instant Messaging - Meeting Service |
6.0.2
|
| Lotus-IM-SrvrEx |
IBM Lotus Instant Messaging - Server Exchange |
6.0.2
|
| MSN-Messenger |
MSN Messenger Chat Service |
5.0.1
|
| Windows-POPUP |
Windows Messenger Delivery (RPC); classifies Windows Messenger
spam pop-up windows that were sent out with applications such as DirectAdvertising
|
6.0.2
|
| YahooMsg |
Yahoo! Messenger |
pre-5.0.0
|
|
Middleware
|
| CORBA |
CORBA Internet Inter-ORB Protocol (IIOP) |
pre-5.0.0
|
| JavaRMI |
Java 1.1.4 TCP Remote Method Invocation service group |
5.0.0
|
| JavaRMI- Act |
Java 1.1.4 TCP Remote Method Invocation - Activate |
5.0.0
|
| JavaRMI - Call |
Java 1.1.4 TCP Remote Method Invocation - Call |
5.0.0
|
| JavaRMI-Reg |
Java 1.1.4 TCP Remote Method Invocation - Registry |
5.0.0
|
| SmartSockets |
Tibco SmartSockets traffic |
6.0.2
|
| SunRPC |
Sun Remote Procedure Calls (UDP) service group |
pre-5.0.0
|
| SunRPC-Call |
Sun Remote Procedure Calls |
pre-5.0.0
|
| SunRPC-PortMap |
Sun Remote Procedure Calls Port Mapper |
pre-5.0.0
|
|
Multimedia
For details on managing this type of traffic, see Control
Streaming Media.
|
| Abacast |
Abacast distributed streaming technology |
7.0
|
| Motion |
Motion video (ESPN Motion, etc.) using DIGStream |
7.0
|
| MPEG-Audio |
Moving Picture Experts Group - Audio Streams |
pre-5.0.0
|
| MPEG-Video |
Moving Picture Experts Group - Video Streams |
pre-5.0.0
|
| Ogg |
Ogg over HTTP |
7.1.0
|
| QuickTime |
QuickTime over HTTP |
5.0.0
|
| RadioNetscape |
Radio@Nestcape streaming music application, powered
by Spinner |
6.2.0
|
| Real |
Service group for Real Networks streaming audio/video
application |
pre-5.0.0
|
| Real-BackChan |
Real Networks multicast back-channel traffic |
pre-5.0.0
|
| Real-Encoder |
Real Networks encoder traffic over HTTP or RTSP |
pre-5.0.0
|
| Real-Multicast |
Real Networks real data transport UDP multicast traffic |
pre-5.0.0
|
| Real-Player |
Real Networks Player traffic over HTTP or RTSP |
pre-5.0.0
|
| Real-RDT-TCP |
Real Networks Real Data transport TCP traffic |
pre-5.0.0
|
| Real-RDT-UDP |
Real Networks Real Data transport UDP traffic |
pre-5.0.0
|
| Real-RTP-TCP |
Real Networks Real-time Transport Protocol TCP traffic |
5.0.0
|
| Real-RTP-UDP |
Real Networks Real-time Transport Protocol UDP traffic |
pre-5.0.0
|
| Real-Web |
Real Networks traffic over HTTP or RTSP |
pre-5.0.0
|
| RTP-B |
Real-Time Protocol (Broadcast) |
pre-5.0.0
|
| RTP-I |
Real-Time Protocol (Interactive) |
pre-5.0.0
|
| RTSP |
Real-Time Streaming Protocol |
pre-5.0.0
|
| Shoutcast |
Shoutcast streaming audio |
pre-5.0.0
|
| ST2 |
Internet Stream protocol, version 2 |
pre-5.0.0
|
| StreamWorks |
StreamWorks Audio and Video |
pre-5.0.0
|
| VideoFrame |
Citrix VideoFrame service group |
pre-5.0.0
|
| VideoFrame-TCP |
Citrix VideoFrame control (TCP) |
pre-5.0.0
|
| VideoFrame-UDP |
Citrix VideoFrame streaming data (UDP) |
pre-5.0.0
|
| WebEx |
WebEx Real-Time Communications Platform |
5.2.1
|
| WinampStream |
Winamp streaming traffic |
6.0.2
|
| WinMedia |
Microsoft Windows Media service group |
pre-5.0.0
|
| WinMedia-Mcast |
Windows Media Streaming over UDP Multicast |
5.0.0
|
| WinMedia-MSBD |
Windows Media Encoder |
5.0.0
|
| WinMedia-TCP |
Microsoft Windows Media (NetShow) Streaming over TCP |
pre-5.0.0
|
| WinMedia-UDP |
Windows Media Streaming over UDP Unicast |
pre-5.0.0
|
| Network Management |
| CiscoDiscovery |
Cisco Router Discovery Protocol |
pre-5.0.0
|
| Day-Time |
Day-Time (port 13) |
5.0.2
|
| Echo |
Echo Protocol |
5.2.1
|
| FlowRecords |
Packeteer Proprietary Flow Detail Records |
7.0
|
| ICMP |
Internet Control Message Protocol |
pre-5.0.0
|
| IPComp |
IP Payload Compression Protocol (IPComp); a protocol to
reduce the size of IP packets |
6.0
|
| NetFlowV5 |
NetFlow v5 |
7.0
|
| NTP |
Network Time Protocol service group |
pre-5.0.0
|
| RSVP |
Resource Reservation Protocol |
5.0.0
|
| SMS |
Microsoft SMS 2.0 - Service Pack 2 or later |
5.2.1
|
| SMS-Auth |
SMS authentication |
5.2
|
| SMS-Chat |
SMS remote chat |
5.2
|
| SMS-File |
SMS file transfer |
5.2
|
| SMS-RC |
SMS remote control |
5.2
|
| SNMP |
Simple Network Management Protocol service group |
pre-5.0.0
|
| SNMP-Mon |
SNMP monitoring traffic |
pre-5.0.0
|
| SNMP-Trap |
SNMP event notification |
pre-5.0.0
|
| Syslog |
UNIX system logging |
pre-5.0.0
|
| TimeServer |
Time Server (port 37) |
5.0.2
|
|
Peer-to-Peer (P2P) Applications
For details on controlling this type of traffic, see Control
Peer-2-Peer Downloads.
Note: Traffic for TCP handshakes will be classified in the
Default class while a Peer-to-Peer application is looking for hosts
that are online. Traffic will get classified into the appropriate
P2P class once the data downloads begin.
|
| Aimster |
Aimster file sharing application service group |
5.1
|
| Aimster-Cmd |
Aimster command traffic |
5.1
|
| Aimster-Data |
Aimster file transfer traffic (upload/download) |
5.1
|
| Aimster-Init |
Aimster initial connection to redirector |
5.1
|
| Audiogalaxy |
Audiogalaxy Satellite File Sharing Community (including
Rhapsody) |
5.0.2
5.3 (Rhapsody)
|
| BitTorrent |
Bit Torrent Distributed File Sharing System |
6.0.1
|
| Blubster |
Blubster File Sharing Application |
5.0.0
|
| DirectConnect |
NeoModus Direct Connect File Sharing Community |
5.1
|
EarthStationV
|
EarthStation V p2p |
7.0
|
| EarthV-Search |
EarthStation V search traffic |
7.0
|
| EarthV-HTTP |
EarthStation V over HTTP |
7.0
|
| EarthV-SSL |
EarthStationV secure traffic |
7.0
|
| EarthV-PXP |
EarthStation V pxp file transfers |
7.0
|
| eDonkey |
eDonkey2000 File Sharing Application service group |
5.2
6.0.1 (eMule, Overnet)
|
| eDonkey-TCP |
eDonkey2000 data traffic |
5.2
|
| eDonkey-Ping |
eDonkey2000 host location ping requests |
5.2
|
| FileRogue |
FileRogue File Sharing Application |
5.2.3
|
| Filetopia |
Filetopia community traffic |
6.0.2
|
| Furthurnet |
Furthur Network Peer to Peer File Sharing |
5.3
|
| Gnutella |
File sharing and distribution network service group (a
variety of look-alike clients get classified as Gnutella, for example
Mutella, Shareaza, Xolox, Ares, Acquisition, Phex, Qtraxmax, and Morpheus).
|
5.0.0
|
| Gnutella-Cmd |
Gnutella command and query traffic |
5.0.0
|
| Gnutella-Download |
Gnutella file transfer from the outside to the inside |
5.0.0
|
| Gnutella-Init |
Gnutella initial connection |
5.0.0
|
| Gnutella-Upload |
Gnutella file transfer from the inside to the outside |
5.0.0
|
| Groove |
Groove Peer-to-Peer Application |
5.1
|
| Hotline |
Hotline File Sharing Community service group |
5.1
|
| Hotline-TCP |
Hotline File Sharing Community - TCP |
5.1
|
| Hotline-UDP |
Hotline File Sharing Community - UDP |
5.1
|
| iMesh |
User-to-User Media Exchange. |
5.0.0
|
| KaZaA |
KaZaA File Sharing Application service group
Note: MusicCity Morpheus also classifies as KaZaA |
5.1
|
| KaZaA-Cmd |
KaZaA command traffic |
5.1
|
| KaZaA-Download |
KaZaA file transfer from the outside to the inside |
5.1
|
| KaZaA-Query |
KaZaA peer server query |
5.2.3
|
| KaZaA-Upload |
KaZaA file transfer from the inside to the outside |
5.1
|
| Napster |
Napster Music Community service group
Note: This is the orginal protocol that classifies Napster
or Napster look-alike P2P clients. The pay-for-music Napster protocol
is classified with Napster2.
|
5.0.0
|
| Napster-Cmd |
Napster command traffic |
5.0.0
|
| Napster-Data |
Napster data traffic (upload/download) |
5.0.0
|
| Napster-Init |
Napster initial connection to napster.com |
5.0.0
|
| Naptser-UDP |
Napster UDP traffic (upload/download) |
5.0.0
|
| PeerEnabler |
Altnet over KaZaA (v2.5) and PeerEnabler traffic |
6.0.2
|
| ScourExchange |
ScourExchange File Sharing Community. |
5.0.0
|
| Scour-Web |
Scour Exchange - web traffic |
5.0.0
|
| Scour-CSC |
Scour Exchange - CSC protoco |
5.0.0
|
| Soulseek |
Soulseek P2P Filesharing Application |
7.1.0
|
| Tripnosis |
Tripnosis File Sharing Application |
5.1
|
| Print Traffic |
| IPP |
Internet Printing Protocol |
5.0.0
|
| Printer |
UNIX line printer spooler (LPR) |
pre-5.0.0
|
| tn3287 |
IBM 3270 print traffic (TN 3287 extensions) |
pre-5.0.0
|
| tn5250p |
IBM 5250 print traffic over Telnet |
pre-5.0.0
|
| Routing Protocols |
| AURP |
AppleTalk Update-based Routing Protocol |
pre-5.0.0
|
| BGP |
Border Gateway Protocol |
pre-5.0.0
|
| CBT |
Core-Based Trees (Multicast Routing Protocol) |
pre-5.0.0
|
| DRP |
DECnet Routing Protocol |
pre-5.0.0
|
| DTP |
Dynamic Trunking Protocol |
7.2.1
|
| EGP |
Exterior Gateway Protocol (network routing information) |
pre-5.0.0
|
| EIGRP |
Enhanced Interior Gateway Routing Protocol |
pre-5.0.0
|
| IGMP |
Internet Group Management Protocol |
pre-5.0.0
|
| IGP |
Interior Gateway Protocol |
5.0.0
|
| OSPF |
Open Shortest-Path First network routing information |
pre-5.0.0
|
| PAgP |
Port Aggregation Protocol |
7.2.1
|
| PIM |
Protocol-Independent Multicast Routing Protocol |
pre-5.0.0
|
| PVSTP |
Cisco Per-VLAN Spanning Tree Plus protocol (PVST+) |
7.2.1
|
| RARP |
Reverse Address Resolution Protocol |
pre-5.0.0
|
| RIP |
Routing Information Protocol (UDP) |
pre-5.0.0
|
| SpanningTree |
IEEE802.1 Bridge Spanning Tree |
pre-5.0.0
|
| VLAN-Bridge |
VLAN Bridge Protocol |
7.2.1
|
| VTP |
VLAN Trunking Protocol |
7.2.1
|
| Security Protocols |
| DLS |
SNA over TCP transport - Service group classification
of Data Link Switch traffic, both read and write port numbers |
pre-5.0.0
|
| DLS-RPN |
Data Link Switch Read Port Number |
pre-5.0.0
|
| DLS-WPN |
Data Link Switch Write Port Number |
pre-5.0.0
|
| DPA |
Microsoft Distributed Password Authentication |
pre-5.0.0
|
| GRE |
General Routing Encapsulation |
pre-5.0.0
|
| IPMobility |
Minimal encapsulation for IP [RFC 2004] |
6.1.0
|
| IPSec |
IP Security Encapsulation service group |
pre-5.0.0
|
| IPSec-AH |
IPSec Authentication Header |
pre-5.0.0
|
| IPSec-ESP |
IPSec Encapsulating Security Payload |
pre-5.0.0
|
| ISAKMP |
ISAKMP/IKE key exchange |
pre-5.0.0
|
| L2TP |
Layer 2 Tunneling Protocol for VPN connections (UDP encapsulation) |
pre-5.0.0
|
| PPTP |
Point-to-Point Tunneling Protocol |
pre-5.0.0
|
| RC5DES |
DES (data encryption standard) encryption-cracking application |
pre-5.0.0
|
| SOCKS |
SOCKSv4 and SOCKSv5 proxy protocol |
pre-5.0.0
|
| SoftEther |
Japanese SSL VPN secure traffic |
7.1.0
|
| SSH |
Secure Shell remote login protocol |
pre-5.0.0
|
| SSL |
Secure Sockets Layer protocol (secure Web traffic) |
pre-5.0.0
|
| SSL-Shell |
SSL Secure Shell remote login protocol |
pre-5.0.0
|
| SWIPE |
swIPe: network layer encapsulated encrypted IP protocol |
6.1.0
|
| Session |
| GoToMyPC |
GoToMyPC HTTP traffic |
6.0.2
|
| pcAnywhere |
Remote management collaboration tool service group |
pre-5.0.0
|
| pcAnywhere-D |
pcAnywhere data |
pre-5.0.0
|
| pcAnywhere-OD |
pcAnywhere data (old port) |
pre-5.0.0
|
| pcAnywhere-OS |
pcAnywhere status (old port) |
pre-5.0.0
|
| pcAnywhere-S |
pcAnywhere status |
pre-5.0.0
|
| radmin |
Remote Administrator (remote control software) |
6.2.0
|
| RemotelyAnywhere |
RemotelyAnywhere Remote Desktop Services |
7.2.1
|
| rexec |
UNIX remote execution protocol |
pre-5.0.0
|
| rlogin |
Remote login |
pre-5.0.0
|
| rsh |
UNIX remote shell command |
5.1
|
| Telnet |
Telnet terminal service group |
pre-5.0.0
|
| Telnet-Clear |
Network terminal protocol |
pre-5.0.0
|
| Telnet-Secure |
Secure Network terminal protocol |
pre-5.0.0
|
| Timbuktu |
Timbuktu Pro service group (networked remote control) |
pre-5.0.0
|
| Timbuktu-Ctl |
Timbuktu Control Channel |
pre-5.0.0
|
| Timbuktu-HS |
Timbuktu Handshaking |
pre-5.0.0
|
| Timbuktu-Obs |
Timbuktu Observe Channel |
pre-5.0.0
|
| Timbuktu-Snd |
Timbuktu Send Channel |
pre-5.0.0
|
| Timbuktu-Xch |
Timbuktu Exchange Channel |
pre-5.0.0
|
| VNC |
Virtual Network Computing |
5.0.0
|
| XWindows |
X11 Windowing agent (UDP) |
pre-5.0.0
|
| XWindows-DM |
XWindows Display Manager (XDMCP) |
pre-5.0.0
|
| XWindows-S |
XWindows Server |
pre-5.0.0
|
| Thin Client or Server Based |
| Citrix |
Citrix connectivity application service group. Enables
any type of client to access applications across any type of network
connection. |
5.1
|
| Citrix-ICA |
Citrix Independent Computer Architecture (ICA) |
5.1
|
| Citrix-SB |
Citrix Server Browsing (UDP) |
pre-5.0.0
|
| CitrixIMA |
Citrix Integrated Management Architecture service group |
5.0.1
|
| CitrixIMA-CMC |
Citrix IMA Management Console |
5.0.1
|
| CitrixIMA-Svr |
Citrix IMA Server to Server |
5.0.1
|
| RDP |
Remote Desktop Protocol - Microsoft Windows Terminal Server |
pre-5.0.0
|
|
Voice Over IP (VOIP)
For details on managing this type of traffic, see Manage
Voice and Video Sessions.
|
| CiscoCTI |
Cisco Computer Telephony Interface |
5.2.3
|
| Clarent-CC |
Clarent Voice over IP Command Center |
pre-5.0.0
|
| Clarent-Complex |
Clarent complex traffic |
pre-5.0.0
|
| Clarent-Mgmt |
Clarent management traffic |
pre-5.0.0
|
| Clarent-Voice-S |
Clarent voice traffic (simple) |
pre-5.0.0
|
| CUSeeMe |
Video chat services application service group |
pre-5.0.0
|
| CUSeeMe-AV |
Video chat services audio/video |
pre-5.0.0
|
| CUSeeMe-CC |
Video chat services connection control |
pre-5.0.0
|
| CUSeeMe-CE |
Video chat services connection establishment |
pre-5.0.0
|
| Dialpad |
Dialpad Internet Telephone service group |
5.2.1
|
| Dialpad-Ctrl |
Dialpad Internet Telephone - control traffic |
5.2
|
| Dialpad-Stream |
Dialpad Internet Telephone - RTP stream |
5.2
|
| H.323 |
Internet telephony standard service group |
pre-5.0.0
|
| H.323-GKD |
H.323 Gatekeeper Discovery |
pre-5.0.0
|
| H.323-H.245 |
H.323 call control |
pre-5.0.0
|
| H.323-Q.931 |
H.323 call setup |
pre-5.0.0
|
| H.323-RAS |
H.323 Gatekeeper Control (Registration, Admission, and
Status) |
pre-5.0.0
|
| I-Phone |
Vocaltec Internet telephone service |
pre-5.0.0
|
| MCK-Signaling |
MCK Signaling (not autodiscovered) |
5.0.0
|
| MCK-Voice |
MCK Voice (not autodiscovered) |
5.0.0
|
| Megaco |
Media Gateway Control (H.248) |
6.0
|
| Megaco-Text |
Media Gateway Control (H.248) Text |
6.0
|
| Megaco-Bin |
Media Gateway Control (H.248) Binary |
6.0
|
| MGCP |
Media Gateway Control Protocol |
6.0
|
| MGCP-Gateway |
Media Gateway Control Protocol Gateway |
6.0
|
| MGCP-CallAgent |
Media Gateway Control Protocol CallAgent |
6.0
|
| MGCP-KpAlive |
Media Gateway Control Protocol KeepAlive Connection |
6.0
|
| Micom-VIP |
Micom Voice over IP (V/IP) |
pre-5.0.0
|
| Net2Phone |
Net2Phone CommCenter |
5.2.3
|
| Net2Phone-TCP |
Net2Phone Call Setup and Control |
5.2.3
|
| Net2Phone-UDP |
Net2Phone Internet Phone Calls |
5.2.3
|
| RTCP-B |
Real-Time Control Protocol (Broadcast) |
pre-5.0.0
|
| RTCP-I |
Real-Time Control Protocol (Interactive) |
pre-5.0.0
|
SIP
|
Session Initiation Protocol |
6.0
|
| SIP60 |
Session Initiation Protocol over port 5060 |
7.1.0
|
| SIP61 |
Session Initiation Protocol over port 5061 |
7.1.0
|
| Skinny |
Cisco's Skinny Client Control Protocol (SCCP)
Note: This service is not autodiscovered, but you can create
a class manually for this service.
|
6.0
|
| Skype |
Skype P2P Telephony Application |
7.0
|
| SkypeCommand |
Skype Command |
7.0
|
| SkypeData |
Skype Data |
7.0
|
| T.120 |
Collaboration application |
pre-5.0.0
|
| VDOPhone |
Service group for Internet telephone service group (not
autodiscovered) |
pre-5.0.0
|
| VDOPhone-a |
Internet telephone application - TCP port 1 (not autodiscovered) |
pre-5.0.0
|
| VDOPhone-b |
Internet telephone application - TCP port 2 (not autodiscovered) |
pre-5.0.0
|
| VDOPhone-UDP |
VDOPhone real-time media (not autodiscovered) |
pre-5.0.0
|
| Vonage |
Vonage VoIP |
7.1.0
|
| Vonage-SIP |
Vonage Session Initiation Protocol |
7.1.0
|
| Vonage-RTP |
Vonage Real-Time Control Protocol |
7.1.0
|
