Patent ID: 7804787

Claim:
A method for analyzing traffic on a network, comprising: at one or more monitoring devices connected to the network, monitoring packets exchanged between devices on the network by extracting from the packets header information comprising one or more of a source address, source port, destination address, and destination port; at a computing device: storing information that associates ranges of addresses and ports with applications that may be occurring between two devices on the network; identifying application flows occurring on the network based on header information of packets, wherein an application flow consists of a collection of packets exchanged between two devices on the network for a single application, wherein identifying comprises comparing one or more elements of the header information of packets with the stored information pertaining to possible applications occurring on the network and assigning a packet to an application flow based on said comparing, wherein identifying further comprises examining the header information of a packet to determine whether it identifies a port hop and modifying the stored information to identify a new port associated with an application flow if a port hop is identified in the packet; wherein when a port hop is detected in a collection of packets associated with an application flow previously identified from an original collection of packets, said assigning comprises assigning the collection of packets to the same application flow as the original collection of packets prior to the port hop in order to track the collection of packets after the port hop and the original collection of packets as one application flow; and analyzing data pertaining to the application flows that are identified to generate statistics from the identified application flows that indicate performance of the network.