NBAR HTTP classification

Question

Hi Guys,
I am trying to match traffic from pingdom.com from probing some web servers. So I have:
 Class Map match-all unwanted (id 1)
   Match protocol http c-header-field "Pingdom.com_bot_version_1.4_(http://www.pingdom.com/)\r\n"
 Class Map match-any class-default (id 0)
   Match any
  Policy Map ingress
    Class unwanted
    Class class-default
interface GigabitEthernet0/0.13102
  service-policy input ingress
But I am getting no matches for the traffic, even though wireshark shows traffic with the user agent field exactly listed above.
The class-default class does hits. Is there something I am missing here?
Thanks!
Jacques

Answer 1

You may be a bit too literal in your match statement, especially with including the carriage return and linefeed. I could be mistaken, but I don't believe this is used when doing a match against the field.
The "match protocol http c-header-field" command looks for headers that contain the argument anywhere within the field, so you can be much more generic and use something like:
match protocol http c-header-field "pingdom"
In the policy map, the "class class-default" entry is a catch-all and will match anything that isn't caught by the other classes. You don't even need to define it separately as a class map. Because it catches everything not otherwise defined, you're going to get hits on it as long as the policy is applied properly... which is a good sign.