Abstract –Recent measurement studies report that asignificant portion of Internet traffic is unknown. It is verylikely that the majority of the unidentified traffic originatesfrom peer-to-peer (P2P) applications. However, traditionaltechniques to identify P2P traffic seem to fail since theseapplications usually disguise their existence by usingarbitrary ports. In addition to the identification of actualP2P traffic, the characteristics of that type of traffic are alsoscarcely known.The main purpose of this paper is twofold. First, we proposea novel identification method to reveal P2P traffic fromtraffic aggregation. Our method does not rely on packetpayload so we avoid the difficulties arising from legal,privacy-related, financial and technical obstacles. Instead,our method is based on a set of heuristics derived from therobust properties of P2P traffic. We demonstrate ourmethod with current traffic data obtained from one of thelargest Internet providers in Hungary. We also show thehigh accuracy of the proposed algorithm by means of avalidation study.Second, several results of a comprehensive traffic analysisstudy are reported in the paper. We show the daily behaviorof P2P users compared to the non-P2P users. We presentour important finding about the almost constant ratio of theP2P and total number of users. Flow sizes and holding timesare also analyzed and results of a heavy-tail analysis aredescribed. Finally, we discuss the popularity distributionproperties of P2P applications. Our results show that theunique properties of P2P application traffic seem to fadeaway during aggregation and characteristics of the trafficwill be similar to that of other non-P2P traffic aggregation.

Index Terms – Peer-to-peer, identification, traffic analysis,heuristics

Cite: Marcell Perényi, Trang Dinh Dang, András Gefferth, Sándor Molnár, "Identification and Analysis of Peer-to-Peer Traffic," Journal of Communications, vol. 1, no. 7, pp. 36-43, 2006.