A method, comprising: intercepting a first data packet being transmitted from a domain name system, DNS, server to a first client device, the first data packet including a DNS response; extracting a first internet protocol address and a first hostname from the DNS response; creating a first entry in an identification table (S 1542), each entry of the identification table includes an IP address, a hostname, a last active time field, and a number of cumulative bytes field; storing the first IP address and the first hostname in the first entry of the identification table; intercepting a second data packet being transmitted in a data flow from a content server to a second client device; identifying a second IP address in a header of the second data packet, the second IP address being a source of the second data packet; determining that the second IP address is in the first entry in response to the first IP address stored in the first entry being identical to the second IP address (S 1230); in response to determining that the second IP address is in the first entry: determining, based on the first hostname of the first entry, whether a traffic management policy should be applied to the data flow, and in response to determining that the data traffic management policy should be applied, applying the traffic management policy to the data flow to deliver the second data packet to the second client device; characterized by: when the identification table exceeds a predetermined size, identifying a second entry of the identification table having the number of cumulative bytes field with a lowest value, and removing the second entry from the identification table, in response to determining that the second IP address is in the first entry, and determining a characteristic of the second data packet, the characteristic being an amount of bytes in the second data packet and a timestamp indicating a time of the second data packet being received, updating a last active time field of the first entry according to the timestamp of the characteristic, and updating a number of cumulative bytes field of the first entry according the amount of bytes of the characteristic. intercepting a first data packet being transmitted from a domain name system, DNS, server to a first client device, the first data packet including a DNS response; extracting a first internet protocol address and a first hostname from the DNS response; creating a first entry in an identification table (S 1542), each entry of the identification table includes an IP address, a hostname, a last active time field, and a number of cumulative bytes field; storing the first IP address and the first hostname in the first entry of the identification table; intercepting a second data packet being transmitted in a data flow from a content server to a second client device; identifying a second IP address in a header of the second data packet, the second IP address being a source of the second data packet; determining that the second IP address is in the first entry in response to the first IP address stored in the first entry being identical to the second IP address (S 1230); in response to determining that the second IP address is in the first entry: determining, based on the first hostname of the first entry, whether a traffic management policy should be applied to the data flow, and in response to determining that the data traffic management policy should be applied, applying the traffic management policy to the data flow to deliver the second data packet to the second client device; characterized by: determining, based on the first hostname of the first entry, whether a traffic management policy should be applied to the data flow, and in response to determining that the data traffic management policy should be applied, applying the traffic management policy to the data flow to deliver the second data packet to the second client device; characterized by: when the identification table exceeds a predetermined size, identifying a second entry of the identification table having the number of cumulative bytes field with a lowest value, and removing the second entry from the identification table, in response to determining that the second IP address is in the first entry, and determining a characteristic of the second data packet, the characteristic being an amount of bytes in the second data packet and a timestamp indicating a time of the second data packet being received, updating a last active time field of the first entry according to the timestamp of the characteristic, and updating a number of cumulative bytes field of the first entry according the amount of bytes of the characteristic. determining a characteristic of the second data packet, the characteristic being an amount of bytes in the second data packet and a timestamp indicating a time of the second data packet being received, updating a last active time field of the first entry according to the timestamp of the characteristic, and updating a number of cumulative bytes field of the first entry according the amount of bytes of the characteristic.