Automatic identification of application protocols through dynamic mapping of application-port associations

Abstract

A system, method, and software product dynamically determine network applications associated with any ports being used by packets on a network, allowing the packets to be properly routed, counted, and reported according to their applications. In one embodiment, an application-port mapping table stores static associations or mappings between applications and ports, as defined by a standards body or other source. The application-port mapping table is dynamically updated during runtime to reflect dynamic associations between applications and ports as extracted from packet data. The associations are identified by a packet analysis module which performs a two step verification of an application for a packet. In a first step, the packet analysis module applies the ports from a packet to the application-port mapping table to obtain a first application identifier. In a second, separate step, the packet analysis module applies identification logic to the packet to identify an application based on packet data. The second step may be used for each packet or only where the packet is not identified by the application-port mapping table. If a second application is successfully identified, the packet analysis module updates the application-port mapping table by adding a new association between the second identified application, and a port of the packet. To keep the application-port mapping table current, the table is periodically scanned to remove associations which have expired; alternatively, an association is removed when an end of sequence packet for its application is detected.