So today I watched some material on nbar (Network Based Application Recognition), which is a feature originally used for classification of data, used in QoS to mark packets.
It uses very deep packet inspection, to figure out what data is being transfered over the network. It goes up to Layer 7 to figure out what is truly being transfered. This is especially useful for many new applications which uses protocol tunneling to “get through” a firewall. An application that uses this is Skype, which uses port 80, which we all know as web traffic, to carry voip packets. In this case, a regular ACL will not prevent this type of traffic, since we might only block the “skype” port.