Tools classifying network traffic to applications

Thu Sep 22 15:51:38 UTC 2005

On Thu, 22 Sep 2005, Petri Helenius wrote:

>
> Christopher L. Morrow wrote:
>
> >>which can't really tell bittorrent (or ssh or aim or...) over tcp/80 from
> >>http over tcp/80... I think Joe's looking for something that knows what
> >>protocols look like below the port number and can spit out numbers for
> >>that... these, it would seem to me, would all require in-line traffic
> >>capture or mirrored port (mirrored traffic, not necessarily an ethernet
> >>port mirror) to be effective.
> >>
> >>
> >>
> We can do that up to 2Gbps; http://www.rommon.com/  , BitTorrent, KaZaa,
> eDonkey, HTTP, etc. supported.
>
> Pete
>