2

Suppose I have a server running different services, say Email exchange, storage space, web server, and SQL database. Assuming this server is bounded with one IP address and one NIC card, how can I distinguish which traffic that belongs to each service since all services share the server IP address and MAC address? Looking at the packet header alone won't help in this case, right?

Thanks.

Improve this question
1

In general each of the applications you list actually use different network protocols - so the web server is likely on TCP/80 and TCP/443 while the database is probably on TCP/1433. If you're tagging packets on a switch or router it's fairly typical to base classification on this layer-4 info.

It's also possible for the server to actually tag its own packets as they're created. This can be accomplished on a bulk basis (more or less equivalent to the classification above - L4-based) or by the app itself if the developer has made appropriate accommodations.

Improve this answer
6
  • Thank you so much. You said the server can tag its own packets. Is this the typical case of most servers?
    – Steven
    Jan 12 '17 at 3:18
  • It's a function of the operating system in use. I don't do a whole lot with Windows but there are a bunch of articles on TechNet about enabling QoS / DSCP marking. In the Linux world it can be accomplished through the use of iptables.
    – rnxrx
    Jan 12 '17 at 3:42
  • Thank you very much. My last question: As you said, using port numbers would be a good clue to identify the service that has generated this packet. Would it be reasonable to make mapping table that maps the most common applications with their ports? If so, can you help me gathering the most common port numbers. Is there a reliable source that can provide me these numbers. THANK YOU
    – Steven
    Jan 12 '17 at 3:54
  • A lot of the common mappings can be found in /etc/services on a UNIX-like machine or on Wikipedia (en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers). A big caveat here is that some services (i.e. NetBIOS) serve lots of different apps on the same port. Does it make sense to set up a map everywhere? Not usually. Honestly the utility of hyper-granular QoS is pretty limited in most circumstances and most folks opt to tag out delay-critical traffic (voice, video, etc) and everything else - not web from database, etc.
    – rnxrx
    Jan 12 '17 at 3:59
  • THANK YOU VERY MUCH. Really Appreciate your quick response.
    – Steven
    Jan 12 '17 at 4:00
0

Configure filters in layer3 devices with specific service ports and check for traffic . We should able to see traffic when Configured filters with specific service ports .

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.