Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be very helpful. Thanks.

share|improve this question
up vote 0 down vote accepted

There is no simple way to find the application from a trace. Reading the ports may give an idea (25 = SMTP, 80 = HTTP, etc) but it is far from enough since some applications use a lot of varying ports (BitTorrent) and some applications run (cuckoo-style) on another port to pass through firewalls (for instance, it is quite common to have SSH servers on port 443, to be sure to reach them even from airport and hotel hotspots).

DPI (Deep Packet Inspection) may help but many applications are encrypted or use other DPI evasion techniques, since DPI is often used for nefarious reasons.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.