Method and device for detecting peer-to-peer (P2P) flow

Abstract

The invention provides a method and a device for detecting peer-to-peer (P2P) flow. The method comprises the following steps of: 1, acquiring session data packets in appointed time in the communication process of a data flow at a detection point of a P2P application on the internet by using a sniffing tool; 2, performing statistic analysis on the flow characteristic data of all acquired session data packets, and concluding according to a transmission control protocol (TCP) and a user datagram protocol (UDP); 3, observing a connection relation between P2P peering points at the detection point; and 4, calculating the flow of the P2P application according to the connection relation and a statistic equation of the corresponding TCP and / or the corresponding UDP. By the invention, the accuracy of detection of the special P2P flow can be improved, the serious problems of erroneous judgment and missing judgment of engine equipment are solved, and an optimization way is customized for the flow characteristics of mainstream complicated application.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a P2P traffic detection method and device. Background technique [0002] A large number of individual users on the Internet do not have a public IP address, and multiple clients often share an IP through NAT technology, and the networking method generally accesses the Internet through a LAN. [0003] Due to the existence of NAT, P2P software can use various technologies to traverse NAT to achieve direct communication. Generally speaking, the initiator of the connection is an individual user behind NAT rather than a user on the Internet. [0004] The difference between the traditional communication model and the P2P general communication model: the traditional communication model is that the nodes behind NAT are connected to a few IPs on the Internet, and the number of connections between this node and these IPs is large, because the users in the traditional traffic model need to...

AI Technical Summary

Problems solved by technology

[0006] At present, some mainstream P2P applications on the Internet are often software that combines multiple transmission methods and multiple resource integration technologies. The traffic characteristics of these P2P applications are far more complicated than those of general P2P applications. DPI equipment When detecting these excellent mainstream P2P applications on the Internet or detecting unknown P2P application traffic or P2P encrypted traffic, serious misjudgments and missed judgments are prone to occur

Images