I'm having a problem where youtube outgoing packages are being unclassified and being pushed into the P2P class.
The problem is that someone on the network is uploading what I would assume to be dropbox through traffic monitoring.
I would assume that dropbox should have fallen into the filexfre class, but it falling into the P2P class is ok for now.
This is the youtube outgoing info:
TCP 192.168.1.164 3026 192.168.1.1 80 Unclassified 2034 1017
TCP 192.168.1.164 3033 192.168.1.1 80 Unclassified 2030 631
TCP 192.168.1.164 3022 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 2972 192.168.1.1 80 Unclassified 2034 1015
TCP 192.168.1.164 2992 192.168.1.1 80 Unclassified 2030 630
TCP 192.168.1.164 2989 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 3063 192.168.1.1 80 Unclassified 2298 13.03 KB
TCP 192.168.1.164 3012 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 3009 192.168.1.1 80 Unclassified 2034 1017
TCP 192.168.1.164 3006 192.168.1.1 80 Unclassified 2030 631
TCP 192.168.1.164 3015 192.168.1.1 80 Unclassified 2030 633
TCP 192.168.1.164 2999 192.168.1.1 80 Unclassified 2034 1017
TCP 192.168.1.164 3013 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 3028 192.168.1.1 80 Unclassified 2030 631
TCP 192.168.1.164 3047 192.168.1.1 80 Unclassified 2034 1074
TCP 192.168.1.164 3046 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 3036 192.168.1.1 80 Unclassified 2030 632
TCP 192.168.1.164 3073 192.168.1.1 80 Unclassified 2441 16.67 KB
TCP 192.168.1.164 3011 192.168.1.1 80 Unclassified 2034 1017
TCP 192.168.1.164 2997 192.168.1.1 80 Unclassified 2082 1054
TCP 192.168.1.164 3053 192.168.1.1 80 Unclassified 2030 633
So it's all port 80 with random source ports and all the sent packets are of the 2034 size. So I created a new classification in the qos outbound packets rules with port 80 as a destination port and 1900-2100kb as a packet size and put it into the media category. I moved it up the classification list so it's below the other youtube classifications.
I enabled all the rules but the traffic is still being classified as unclassified instead of Media.
Am I missing something here?