Traffic classification

Traffic classification is an automated process which categorises computer network traffic according to various parameters (for example, based on port number or ) into a number of traffic classes. Each resulting traffic class can be treated differently in order to differentiate the service implied for the user (data generator/ consumer).

Packets are classified to be differently processed by the network scheduler. Upon classifying a traffic flow using a particular protocol, a predetermined policy can be applied to it and other flows to either guarantee a certain quality (as with VoIP or media streaming service) or to provide best-effort delivery. This may be applied at the ingress point (the point at which traffic enters the network) with a granularity that allows traffic management mechanisms to separate traffic into individual flows and queue, police and shape them differently.

Classification is achieved by various means.

Matching bit patterns of data to those of known protocols is a simple, yet widely used technique. An example to match the handshaking phase would be a check to see if a packet began with character 19 which was then followed by the 19-byte string 'BitTorrent protocol'.

A comprehensive comparison of various network traffic classifiers, which depend on Deep Packet Inspection (PACE, OpenDPI, 4 different configurations of L7-filter, NDPI, Libprotoident, and Cisco NBAR), is shown in the Independent Comparison of Popular DPI Tools for Traffic Classification.

Both, the Linux network scheduler and Netfilter contain logic to identify and mark or classify network packets.

Operators often distinguish three broad types of network traffic: Sensitive, Best-Effort, and Undesired.

Sensitive traffic is traffic the operator has an expectation to deliver on time. This includes VoIP, online gaming, video conferencing, and web browsing. Traffic management schemes are typically tailored in such a way that the quality of service of these selected uses is guaranteed, or at least prioritized over other classes of traffic. This can be accomplished by the absence of shaping for this traffic class, or by prioritizing sensitive traffic above other classes.

...
Wikipedia