Accurate identification of network traffic according to application type is a key issue for most companies, including ISPs. For example, some companies might want to ban p2p traffic from their network while some ISPs might want to offer additional services based on the application. To classify applications on the fly, most companies rely on deep packet inspection (DPI) solutions. While DPI tools can be accurate, they require constant updates of their signatures database. Recently, several statistical traffic classification methods have been proposed. In this paper, we investigate the use of these methods for an ADSL provider managing many Points of Presence (PoPs). We demonstrate that statistical methods can offer performance similar to the ones of DPI tools when the classifier is trained for a specific site. It can also complement existing DPI techniques to mine traffic that the DPI solution failed to identify. However, we also demonstrate that, even if a statistical classifier is very accurate on one site, the resulting model cannot be applied directly to other locations. We show that this problem stems from the statistical classifier learning site specific information.

RTP and Skype applications generate a growing part of the Internet traffic, especially for users on ADSL because of flatrate tarification. In this study, we focus on these two main Voice over IP traffic protocols to characterize the utilization, the performance and the evolution of VoIP systems over six months. We start by identifying the traffic generated by Skype and other classical RTP applications. We thus characterize the traffic of these applications and identify some statistical behaviors. We then analyze in more details and compare the performance of RTP and Skype applications in order to evaluate their influence over the traffic. From ISPs point of view, recognizing these real time applications and analyzing their characteristics and performance is a determining factor for quality of service and troubleshouting. Our analysis is based on ADSL traffic captured at TCP/UDP level on a Broadband Access Server comprising thousands of users. Thus, using a flow-based analysis, we characterize and compare the VoIP traffic and users, and we draw interesting results on traffic patterns and inter-arrivals, connectivity between users, location of sources and performance limitations.