Accurate, Scalable In›Network Identication of P2P Trafc Using Application Signatures
Subhabrata Bapi Sen, Oliver Spatscheck, Dongmei Wang · 2004
The ability to accurately identify the network trafc associated with different P2P applications is important to a broad range of network operations including application-specic trafc engineering, capacity planning, provisioning, service differentiation, etc. However, traditional trafc to higher-level application mapping techniques such as default server TCP or UDP network-port based disambiguation is highly inaccurate for some P2P applications. In this paper, we provide an efcient approach for identifying the P2P application trafc through application level signatures. We rst identify the application level signatures by examining some available documentations, and packet-level traces. We then utilize the identied signatures to develop online lters that can efciently and accurately track the P2P trafc even on high-speed network links. We examine the performance of our application-level identication approach using ve popular P2P protocols. Our measurements show that our technique achieves less than false positive and false negative ratios in most cases. We also show that our approach only requires the examination of the very rst few packets (less than packets) to identify a P2P connection, which makes our approach highly scalable. Our technique can signicantly improve the P2P trafc volume estimates over what pure network port based approaches provide. For instance, we were able to identify times as much trafc for the popular Kazaa P2P protocol, compared to the traditional port-based approach.