Apply QoS for Youtube or Streaming Media

[ppeters86]

I'm trying to wrestle down some NetFlix and Twitch users on my network.  Because they're running in a browser, the application match for their traffic is only "SSL".  However, I know that anything headed for nflxvideo.net is NetFlix traffic, for example.

I can't find a way to apply QoS policy based on a wildcard match against the source DNS name.  I don't have a FQND--I have a partially qualified domain name.

Any ideas? 

Thanks

Pat

[jvalentine · Accepted solution]

I noticed something similar this last week.  I'd recommend opening a case with TAC so that this can be tracked and the Netflix AppID updated accordingly.  

Until there's an official resolution, you can create a custom Application called "netflix-streaming-custom" and have your signature do a pattern match for "nflxext" or "nflxvideo" in the "ssl-req-client-hello" context.  That way any SSL traffic to/from domains containing those two patterns will be detected as "netflix-streaming-custom", and from there you'll be able to apply QoS (without having to QoS the entire SSL category).  

Here's a screenshot from the signature portion that worked for me:  

[ppeters86]

Now my users have shifted to running Netflix in a browser *without* SSL.  I don't have a certificate exchange to look at any longer.  Any suggestions for how to get there for just plain old web browsing?

And, yes, the device apparently doesn't recognize NetFlix in a browser on port 80 either...

Thanks!

Patrick

[jvalentine]

Any idea how they run netflix in a browser without SSL?  Happy to test it out... I just wasn't aware that this was possible.