On Top of Cisco IWAN dictionary, eye.lo can recognize traffic based on IP, port, HTTP hostname, SSL (HTTPS) server name. The workflow is the following:
- Does the flow match an embedded eye.lo customer specific application ?
- If no match, does it belong to the Nbar2 dictionary?
- If no match, does it match with a IANA service based on well-known ports?
If no match then the flow is classified as unknown