<p class="MsoNormal" style="text-align: left; margin: 0cm 0cm 0pt; layout-grid-mode: char;" align="left"><span class="text"><span style="font-family: ";Arial";,";sans-serif";; font-size: 9pt;">Recent measurement studies report that a significant portion of Internet traffic is unknown. It is very likely that the majority of the unidentified traffic originates from peer-to-peer (P2P) applications. However, traditional techniques to identify P2P traffic seem to fail since these applications usually disguise their existence by using arbitrary ports. In addition to the identification of actual P2P traffic, the characteristics of that type of traffic are also scarcely known.The main purpose of this paper is twofold. First, we propose a novel identification method to reveal P2P traffic from traffic aggregation. Our method does not rely on packet payload so we avoid the difficulties arising from legal, privacy-related, financial and technical obstacles. Instead, our method is based on a set of heuristics derived from the robust properties of P2P traffic. We demonstrate our method with current traffic data obtained from one of the largest Internet providers in Hungary. We also show the high accuracy of the proposed algorithm by means of a validation study.Second, several results of a comprehensive traffic analysis study are reported in the paper. We show the daily behavior of P2P users compared to the non-P2P users. We present our important finding about the almost constant ratio of the P2P and total number of users. Flow sizes and holding times are also analyzed and results of a heavy-tail analysis are described. Finally, we discuss the popularity distribution properties of P2P applications. Our results show that the unique properties of P2P application traffic seem to fade away during aggregation and characteristics of the traffic will be similar to that of other non-P2P traffic aggregation.</span></span><span style="font-family: ";Arial";,";sans-serif";; font-size: 9pt;"></span></p>

SUMMARYSkype applies strong encryption to provide secure communication inside the whole Skype network. It also uses several techniques to conceal the traffic and the protocol. As a consequence, traditional port-based or payload-based identification of Skype traffic cannot be applied. In this paper, after an overview of the Skype P2P system, network entities and operation, we introduce novel algorithms to detect several types of communications (including voice calls primarily) that the Skype client initiates toward dedicated servers of the Skype network and other peers.The common point in these algorithms is that all of them are based on packet headers only and the extracted flow level information. We do not need information from packet payloads. The identification methods allow us to discover logged on Skype users and their voice calls. The whole identification process is scripted in Transact-SQL; it can thus be executed automatically on a prerecorded (offline) data set. We present identification results, analysis and comparison of data sets captured in mobile and fixed networks. We also present the validation of the algorithms in both network types.

Skype applies strong encryption to provide secure communication inside the whole Skype network. The communication ports of clients are chosen randomly. As a consequence, traditional port based or payload based identification of Skype traffic cannot be applied. In this paper we present a novel flow dynamics based identification method to discover both Skype hosts and voice calls. The method is based only on packet headers and extracted flow level information. This method is the second algorithm from our research. It has a significant improvement over our first method [1]. It can detect the randomly selected communication port of the Skype client, which makes the identification more reliable. The whole identification process is scripted in Transact-SQL, thus it can be executed automatically. We also present the validation of the new algorithm together with the analysis of the identification results.

Skype applies strong encryption to provide secure communication inside the whole Skype network. The communication ports of clients are chosen randomly. As a consequence, traditional port based or payload based identification of Skype traffic cannot be applied. In this paper we present a novel flow dynamics based identification method to discover both Skype hosts and voice calls. The method is based only on packet headers and extracted flow level information. This method is the second algorithm from our research. It has a significant improvement over our first method [1]. It can detect the randomly selected communication port of the Skype client, which makes the identification more reliable. The whole identification process is scripted in Transact-SQL, thus it can be executed automatically. We also present the validation of the new algorithm together with the analysis of the identification results.

The main purpose of this paper is twofold. First, we propose a novel identification method to reveal P2P traffic from traffic aggregation. Our method is based on a set of heuristics derived from the robust properties of P2P traffic. We show the high accuracy of the proposed algorithm based on a validation study. Second, several results of a comprehensive traffic analysis, focusing on the differences between P2P and non-P2P traffic, are reported in the paper. Our results show that the unique properties of P2P application traffic seem to fade away during aggregation and characteristics of the traffic will be similar to that of other non-P2P traffic aggregation.