TCP/UDP Heuristic Concurrent usage of both tcP UdP is typical for many p2P protocols Look for isrc, dst IP pairs that use both TCP udp protocols to identify p2P hosts Other protocols that also use TCP UDp concurrently DNS, NETBIOS, IRC, gaming, streaming Fixed well-known portsTCP/UDP Heuristic • Concurrent usage of both TCP & UDP is typical for many P2P protocols • Look for {src, dst} IP pairs that use both TCP & UDP protocols to identify P2P hosts • Other protocols that also use TCP & UDP concurrently – DNS, NETBIOS, IRC, gaming, streaming – Fixed well-known ports