08-02-2013 12:26 AM - edited 08-11-2013 06:37 AM
Anyone care to enlighten me as to how Aruba manages to figure out the voice/video/whatever streams on a Microsft Lync installation?
From what I hear from the Lync guys tcp 6001, the port Aruba uses to classify the media is actualy encrypted.
So how does an encrypted signalling session (client-server-client) lead to a correct classification of the udp voice stream that follows (client to client)?
-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Solved! Go to Solution.
08-02-2013 06:03 AM
The Lync ALG using the classify media option on the ACL uses deep packet inspection to look at heuristic information about the flows. Heuristics can use things like packet length, packet types, source destination ports etc to create a picture of the traffic types.
Through this we can determine what kind of traffic is flowing and idetify it as Lync. It is actually pretty accurate and the best of its kind today.
In 6.3 we introduced a new feature that uses signaling between the Lync server and the controller to replace this classify media option. Check out the user guide for 6.3 pages 775-789 for more info on this.