A data flow classification method, comprising: obtaining, by the packet forwarding device, a plurality of data flows, and extracting address information and time information of each of the plurality of data flows, wherein the plurality of data flows are data flows generated when a plurality of client devices access a plurality of services separately, the service is used to implement a sub-function of an application, and the address information comprises a source IP address, a source port number, a destination IP address, and a destination port number; characterized in that the method further comprises: selecting, by the packet forwarding device from the plurality of data flows based on the source IP address of each data flow, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address; determining, by the packet forwarding device based on a destination IP address and a destination port number of each data flow in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service; obtaining, by the packet forwarding device, time information of each service in the service set based on time information of each data flow in the data flow set, and determining a correlation between services in the service set; determining, by the packet forwarding device based on the correlation, that the first service and the second service are used to implement a first application; and determining, by the packet forwarding device, that data flows corresponding to the first service and the second service are data flows of the first application. obtaining, by the packet forwarding device, a plurality of data flows, and extracting address information and time information of each of the plurality of data flows, wherein the plurality of data flows are data flows generated when a plurality of client devices access a plurality of services separately, the service is used to implement a sub-function of an application, and the address information comprises a source IP address, a source port number, a destination IP address, and a destination port number; characterized in that the method further comprises: selecting, by the packet forwarding device from the plurality of data flows based on the source IP address of each data flow, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address; determining, by the packet forwarding device based on a destination IP address and a destination port number of each data flow in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service; obtaining, by the packet forwarding device, time information of each service in the service set based on time information of each data flow in the data flow set, and determining a correlation between services in the service set; determining, by the packet forwarding device based on the correlation, that the first service and the second service are used to implement a first application; and determining, by the packet forwarding device, that data flows corresponding to the first service and the second service are data flows of the first application. selecting, by the packet forwarding device from the plurality of data flows based on the source IP address of each data flow, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address; determining, by the packet forwarding device based on a destination IP address and a destination port number of each data flow in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service; obtaining, by the packet forwarding device, time information of each service in the service set based on time information of each data flow in the data flow set, and determining a correlation between services in the service set; determining, by the packet forwarding device based on the correlation, that the first service and the second service are used to implement a first application; and determining, by the packet forwarding device, that data flows corresponding to the first service and the second service are data flows of the first application.