An apparatus for P2P classification in Netflow traces

Application classification from Netflow traces is a challenging process due to the lack of payload information. It is even becoming more challenging when the applications running in the network tend to hide under well known ports, encrypt packets and are distributed. In this paper, we propose an in-the-box apparatus for Netflow classification of Bit Torrent applications. The apparatus includes several device optimizations and requires low processing power. It was developed by reverse engineering the Bit Torrent protocol and by identifying connection patterns. The accuracy of the algorithm reaches high values specifically for Bit Torrent peers that use the DHT protocol.