Limitations And Dependencies; Support For Websocket Protocol Identification; How It Works; Url Filtering - Cisco ASR 5000 Series Administration Manual

▀ Enhanced Features and Functionality

Limitations and Dependencies

The following are limitations to the TRM feature:
 TRM is supported only on the ASR5500 platform.
 TRM is limited to flows with no protocol routing rules with the exception of HTTP and HTTPS flows. All other
flows are not supported and TRM does not have any impact on other flows.
 When TRM is enabled, the following functionalities are affected:
 Per direction rule matching.
 TCP state rules for the duration of the TRM transaction.
 Configuring delay charging when the TRM feature is enabled impacts only packets outside transaction
 Once a flow is classified to a ruledef (first packet in flow for UDP, or the first data packet after the 3-way
handshake for a TCP flow), TRM will attempt to use that matched rule for the duration of the transaction. This
might result in the ruledefs such as those with mid-transaction TCP states or packet direction to be ignored for
the flow.

Support for WebSocket Protocol Identification

This feature extends support for WebSocket Protocol identification.
The Websocket protocol is an independent TCP based protocol. A connection is identified as Websocket through the
first HTTP Get Request header after the three way handshake. This packet includes an upgrade header (Upgrade:
websocket) and other Websocket headers (Sec-Websocket-*) to upgrade HTTP to Websocket protocol. This helps
operators to categorize Websocket traffic and apply different policies for such traffic.
A new CLI "
websocket flow-detection
The Websocket protocol identification can be enabled or disabled with the new CLI Websocket protocol.
For more information on these commands, see the ACS Rulebase Configuration Mode Commands chapter in the
Command Line Interface Reference guide.

How it Works

This section describes how Websocket Protocol Identification feature works.
If the Websocket detection is enabled in the rulebase, the ECS parser looks for the following fields in the HTTP Get
header fields Host, Upgrade, Connection, Sec-Websocket-Key, Origin, and Sec-Websocket-Version. If these
headers are present, the TCP connection is upgraded to a Websocket connection. A ruledef can be defined to identify the
HTTP GET request for the websocket and rate it in a certain way. The subsequent data that is transferred through the
websocket is also billed the same way as the first packet.
Important:
cannot be detected on ssecure-HTTP connections.

URL Filtering

The URL Filtering feature simplifies using rule definitions for URL detection.
▄ Cisco ASR 5x00 Enhanced Charging Services Administration Guide
52
boundaries. All packets within the transaction boundary will be applied to the application (i.e. HTTP).
You need to enable HTTP analysis to detect Websockets, and Websocket connections
" has been implemented at rulebase level to detect the Websocket protocol.
Enhanced Charging Service Overview