Payload Analysis M1: Flag a flow with a src/dst port number matching one of the well-known port numbers M2: Flag a flow as p2P if the 16-byte payload of any packet matches the signatures, else flag it as non-P2P A loose lower bound on P2p volume M3: Hash the (src, dst] ip pair of a flow flagged as P2P into a table. Flag the flows containing an IP address in the table as "possible P2P" even if no payload matches.Payload Analysis • M1: Flag a flow with a src/dst port number matching one of the well-known port numbers. • M2: Flag a flow as P2P if the 16-byte payload of any packet matches the signatures , else flag it as non-P2P. – A loose lower bound on P2P volume • M3: Hash the {src, dst} ip pair of a flow flagged as P2P into a table. Flag the flows containing an IP address in the table as “possible P2P” even if no payload matches