NBAR URL and host matching

From: Mark Turner (markturner101@gmail.com)
Date: Mon Sep 03 2007 - 20:41:32 ART


Hello,

I am looking for some clarity when using NBAR for URL and host
matching. For example assume that i want to match the website and
directory, www.cisco.com/ccie. I also want to drop any pics with .jpg,
.jpeg or .gif from this site. Below is how i would configure it but i
have a couple of questions.

Would the cisco class below match hits from www.cisco.com/ccie?

Is the / in front of the ccie correct? Is it needed at all? Should one
be included afterwards? /ccie/ ?

class-map match-all CISCO
        match protocol http host "*www.cisco.com"
         match protocol http url "/ccie"

Class-map MATCH-ANY PICS
        Match protocol http url "*.jpg|*.jpeg|*.gif"
        
Thanks,

M.T.



This archive was generated by hypermail 2.1.4 : Sat Oct 06 2007 - 12:01:09 ART