Content-based alternatives to conventional network monitoring systems
George Louthan, Brady Deetz, Matthew D Walker, John C. Hale · 2009
Network monitoring and management rely extensively upon network protocol identification as one of the most basic acts of analysis of network traffic. However, the conventional method of identifying network protocols based upon standard or well-known port numbers is no longer sufficient for modern networks, given the propensities for users and programs to change ports dynamically or use nonstandard ports. Unfortunately, this calls into question the ability of the collection of standard tools to gather reliable network intelligence.