Re: NBAR ..... mime type question

From: Niche (jackyliu419@gmail.com)
Date: Thu Oct 27 2005 - 13:14:54 GMT-3


IMHO,

It really depend you are treating this as a lab question or real world
requirement.

In lab, I surely will go for url "*.jpeg" option because the question is
asking me and I have to do exactly what the question request me to achieve.

However, I polly will go for proctor to clarify something which that's also
take real world experience (like below) as a counter proposal before I put
it as my final answer..

In real world, I think I will use url mime "*jpeg" instead.. why?
graphic.jpg in url is one of the reason. If I put this into kinda extreme..
I can even rename a .txt to .jpeg to make the nbar filter active.

Just a thought..
Cheers~
Jacky

On 10/27/05, simon hart <simon@harttel.com> wrote:
>
> Dave,
>
> I do not think this would be correct. If you have .jpeg, then I think you
> should use match protocol http url .jpeg
>
> The reason being that this will be an executable being requested
>
> Simon
>
> -----Original Message-----
> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com]On Behalf Of
> Schulz, Dave
> Sent: 27 October 2005 16:20
> To: ccielab@groupstudy.com
> Subject: NBAR ..... mime type question
>
>
> I was looking through the doc cd under the NBAR examples for MIMI and
> ran across and example that states.....
>
> The following example classifies, within class map foo, packets based on
> the JPEG MIME type:
> class-map foo
> match protocol http mime "*jpeg"
>
> However, if the question states to match a .jpeg file, then would it be
> just as correct to configure that as:
>
> class-map foo
> match protocol http mime "*.jpeg" (with the "dot" added)
>
> Thoughts?
>
>
> Dave Schulz,
> Email: dschulz@dpsciences.com <mailto:dschulz@dpsciences.com >
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
> --
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.361 / Virus Database: 267.12.5/149 - Release Date: 25/10/2005
>
> --
> No virus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.1.361 / Virus Database: 267.12.5/149 - Release Date: 25/10/2005
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html



This archive was generated by hypermail 2.1.4 : Sun Nov 06 2005 - 22:00:54 GMT-3