An Improved Transport Layer Identification of PeertoPeer Traffic

Peer to peer (P2P) traffic identification is a hot topic in network measurement in recent years. The identification method based on P2P traffic transport layer behavior has good scalability, because it is independent of the signature strings of P2P application. But the network application’s behavior in transport layer is easy to be affected by network environment, so there is a great difference in the accuracy of this identification method between domestic and overseas network environment. In order to improve the existing transport layer identification method in domestic network environment, three proposals are offered in this paper. The first is a filtering mechanism based on nonP2P known port. The second is a counting mechanism using data flow. The third is an FTP flow filtering mechanism using reversed flow. Then, these proposals are validated using the domestic traces. The result of experiments indicates that the flow accuracy and bytes accuracy of the improved P2P traffic transport layer identification method approach 95% and 99% respectively. Finally, this improved method is firstly used to analyze the trace of the Internet backbone in China Education and Research Network. The result of measurement shows that the volume of P2P traffic increases from 0.76% roughly to 70% of the total traffic in the backbone.