> For the complete documentation index, see [llms.txt](https://help.highlight.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.highlight.net/troubleshooting/nbar.md).

# NBAR

## Overview

This page explains symptoms experienced with the NBAR charts.

## Symptom 1. NBAR monitoring showing mainly Unknown Protocols

Cisco Bug CSCty56850

* Symptoms: NBAR analysis shows only **unknown** protocols or just **ftp** + **http**
* See the **\[Cisco Bug Search website]** (→ <https://tools.cisco.com/bugsearch/bug/CSCty56850/>) for more details (Cisco log in required)
* The fix is to change the IOS version to avoid this bug.

| Known affected IOS versions |
| --------------------------- |
| 15.1(3)T1                   |
| 15.1(4)M                    |
| 15.1(4)M1                   |
| 15.1(4)M2                   |
| 15.1(4)M3                   |
| 15.1(4)M4                   |
| 15.1(4)M5                   |
| 15.2(2)T                    |
| 15.2(3)T1                   |
| 15.2(3)T                    |

This issue will present in Highlight in the following way:

## Symptom 2. NBAR not showing as configured

This is related to setting up NBAR in Highlight. When testing for the interface in the Applications tab for the bearer if no interfaces are shown as "NBar enabled", possible causes for this are:

* The router must have a licence which supports NBAR. You will need the "advipservices" or "data" licence, or alternatively the "appxk9" licence. Use `show license` to check. Licence details are also available from **\[Reporting inventory]** (→ <https://support.highlight.net/help/reporting/inventory#column\\_headers>)
* Some firewall or security feature sets, especially on smaller devices, may not support NBAR or the NBAR mib.
* NBAR is not configured on the device

## Symptom 3. NBAR monitoring showing Inbound Only

A possible cause for this is:

* The device being monitored has only one interface connected (e.g. a newly installed device) and traffic sourced from the router is not reported by NBAR.

## Symptom 4. How to Identify Unknown Applications

Sometimes there will be applications which NBAR does not recognise. These applications will be labelled **unknown** in the display, but with appropriate configuration of the router better analysis can be achieved.

* For details of how to do this refer to the section **\[identifying unknown applications]** (→ <https://support.highlight.net/help/device\\_setup/nbar#identifying\\_unknown\\_applications>).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.highlight.net/troubleshooting/nbar.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.