Restrict Skype Traffic

Instructions to discourage Skype traffic on your network.

Skype works differently than other Voice over IP (VoIP) clients: it operates on a peer-to-peer model, rather than the more traditional server-client model. This design allows Skype to route calls through other Skype peers on the network to ease the traversal of Symmetric NATs and firewalls. The result is that an individual's computer and network bandwidth may be used to route the calls of other users. Because of liability and security concerns — not to mention unsanctioned bandwidth usage — many companies opt to block Skype traffic on their networks.

Controlling Skype traffic is a bit tricky, though. Because Skype is an aggressive and adaptive application, if you attempt to deny all Skype traffic, the application senses the block and attempts to work around it. Packeteer recommends that you allow Skype to set up a call but restrict the VoIP stream: users may deem call quality unacceptable and hang up, and in some cases, Skype will terminate the low-quality call on its own.

Steps:

1. If the Skype class doesn't already exist, create the class on both the Inbound and Outbound branches of the traffic tree.
   
   
2. Create sub-classes for SkypeCommand and SkypeData (in Inbound and Outbound):
        Skype
             SkypeCommand
             SkypeData
             Default
   
   
3. Create a partition for the SkypeData class under both Inbound and Outbound. The partition should be a 10 Kbps non-bursting partition.
   
   
4. Set a rate policy on each SkypeData class. The rate should be set at a small value such as 1 Kbps.
   
   
5. Set a never-admit policy on each SkypeCommand class.