P2P flows identification method based on listening port

It is important to identify P2P flows accurately for effective network planning and design, security insuring, network management, network behavior understanding and so on. Firstly, an algorithm for identifying listening port of P2P host (LPIA for short) is proposed. Secondly, a heuristic algorithm of P2P flow identification (PFIA for short) is presented, which combines P2P host´s listening port, flow duration, flow length, the relationship of negotiation flow and data flow between different peers. And then a distributed P2P flows identification system (DPFIS) is introduced. DPFIS decentralizes LPIA and PFIA on different PC as well as NetFlow is used for flow clustering, which reduce the complexity for identifying P2P flows in high speed network. Finally, the algorithms are applied in campus network. Results show that our algorithms are simple and could recognize more kinds of P2P flows efficiently.