Methods, systems, and computer readable media for classifying application traffic received at a network traffic emulation device that emulates multiple application servers

Abstract

Methods, systems, and computer readable media for classifying application traffic at a network traffic emulation device that emulates multiple application servers are disclosed. The method may include, at a network traffic emulation device, providing a plurality of different application flows for monitoring mixed application traffic received from different client applications via a device under test on the same transport layer port. For each of the different application flows that monitor the same transport layer port, parsing a payload of received packets associated with the same session in the mixed application traffic and identifying non-matching application flows based on whether a portion of each payload matches a signature associated with the application flow. The method further includes eliminating, as identification candidates, non-matching application flows from the application flows that monitor packets received on the same transport layer port until an application flow that identifies an application for the received packets associated with the same session remains.