Centralized recording and processing of received packet parameters

Abstract

The invention relates to an internet application flow rate identification method based on message sampling and application signing, comprising the following steps: firstly, message sampling capture: in accordance with sampling strategy and sampling rate the message is captured and decoded; secondly, decoding: the flow information and application data of the message is analyzed by decoding the message; thirdly, flow classification: according to the flow information of the message, a flow state table is found and maintained; fourthly, flow state distinguishing: the signature is matched if the application type of the flow state found through the flow classification is unknown; finally, signature matching: according to the application signature bank, the application data of the message is matched, if matched successfully, the application type of the flow state is updated, and the flow information and application type of that data stream is output. The method is of high accuracy in identification, high efficiency in processing, good expandability, high possibility in realization, and is applicable not only for message processing, but also for flow data analysis. The invention can be achieved in not only the network equipment, but also the network analysis system.