NBAR ID Lookup

[rhbirkelund]

So, I was getting a lot of events in my eventlog on an NBAR ID being blocked, but with no classification. So I opened a case.

I'm sharing this for others to find, since I struggled to find out my self, but to lookup NBAR IDs, go to the protocol pack, and drill down the specific protocols to find out what ID it's using. I downloaded the PDF and searched through it for the ID.

The protocol pack can be found here; NBAR Protocol Pack.

Some IDs that Meraki uses are not listed in the pdf.

Some of these are;

• ID 2572 - Google Advertising.
• ID 2619 - AppNexus
• ID 2836 - Miscellaneous Video

[PhilipDAth]

Great info, thanks!

[sebvasseur]

I have ID 2836 but unable to find why 

TCP 443 some internal website 

[rhbirkelund]

I've asked in my own case, as it was still open. Let's see what they get back with...

[sebvasseur]

2836 is "Miscellaneous video" 

but i don't know how they decide a site is containing video 

[rhbirkelund]

Hm.. Odd.. Hope Meraki Support will give you the answers. 🙂

[JohnEricAnderso]

I realize this is almost a year old, but I am newer to the Meraki MX.
Would be GREAT if the Meraki NBAR Protocol Pack listed all of the protocol numbers.
Be even better to get a list by number with a short name after it.
Be even better if my Meraki Event Log for Layer 7 Alerts would simply use English words with the Protocol Number.

How did you find the answers to:

"Some IDs that Meraki uses are not listed in the pdf.

Some of these are;

• ID 2572 - Google Advertising.
• ID 2619 - AppNexus
• ID 2836 - Miscellaneous Video"
  
  

Curious minds want to know.
THANKS in advance.
John