A novel network traffic identifying method

The present invention is adapted to the technical field of networks, and provides a method for identifying and QOS a data stream in the network. The specific technical solution is: defining three elements, i.e., a protocol (tcp/udp), a source IP address, and a source port, as one session, adding a specific hash algorithm, and establishing a link for the session in an internal storage; and after identifying a certain message therein, tabbing the entire session, and subsequent messages matching with the tab. Such solution is adapted to a situation of multiple P2P links. When a conventional DPI is at P2P, the same P2P source port may be connected to a plurality of target IP addresses and ports at the same time. A conventional approach is to identify the protocol (tcp/udp), the source IP address, the source port, the target IP address, the target port as an link, while in the present invention, as long as the source IP, the source port, a basic protocol are the same, they are identified as one session, which greatly reduces items of the linking number and the problem of repeated identifications of the application protocol.