IDENTIFICATION OF AN APPLICATION BASED ON PACKET SIZE

1 . A method, executable by a networking device, the method comprising:

collecting packet size information over an encrypted tunnel; and

identifying an application communicated via the encrypted tunnel based on the packet size information.

2 . The method of claim 1 wherein collecting packet size information communicated via the encrypted tunnel comprises:

determining a number of data packets corresponding to a particular packet size over an interval of time.

3 . The method of claim 1 wherein collecting the packet size information communicated via the encrypted tunnel comprises:

identifying data packets in accordance with a particular packet size; and

tracking a number of the data packets corresponding to the particular size.

4 . The method of claim 1 wherein the networking device collects the packet size information without decrypting a data packet.

5 . The method of claim 1 comprising:

identifying a tunneling protocol communicated via the encrypted tunnel based on the packet size information.

6 . The method of claim 1 wherein identifying the application communicated via the encrypted tunnel based on the packet size information comprises:

utilizing a classifier corresponding to a particular packet size, the classifier representative of a tunneling protocol in combination with the application.

7 . A networking device comprising:

a classifier, corresponding to an application, that classifies data packets over an encrypted tunnel according to a particular packet size; and

a controller that identifies the application communicated via the encrypted tunnel based on the particular packet size.

8 . The networking device of claim 7 comprising:

a different classifier, corresponding to a different application, that classifies the data packets over the encrypted tunnel according to a different packet size.

9 . The networking device of claim 7 wherein:

the classifier corresponds to a tunneling protocol; and

the controller that identifies the tunneling protocol communicated via the encrypted tunnel based on the particular packet size.

10 . The networking device of claim 7 wherein the classifier that classifies the data packets over the encrypted tunnel according to the particular packet size comprises:

determines a number of the data packets corresponding to the particular packet size.

11 . A non-transitory machine-readable storage medium comprising instructions that when executed by a processing resource cause a networking device to:

collect packet size information over an encrypted tunnel for an interval of time; and

determine an application communicated via the encrypted tunnel based on the packet size information.

12 . The non-transitory machine-readable storage medium of claim 11 comprising instructions that when executed by the processing resource cause the networking device to:

determine a tunneling protocol communicated via the encrypted tunnel based on the packet size information, wherein the tunneling protocol and the application are dependent on a particular packet size.

13 . The non-transitory machine-readable storage medium of claim 11 wherein to collect the packet size information over the encrypted tunnel for the interval of time comprises instructions that when executed by the processing resource cause the networking device to:

determine a number of data packets corresponding to a particular packet size, the number of data packets indicates whether the application is being communicated via the encrypted tunnel.

14 . The non-transitory machine-readable storage medium of claim 11 wherein to collect packet size information over the encrypted tunnel for the interval of time comprises instructions that when executed by the processing resource cause the networking device to:

identify a packet size for each data packet transmitted over the encrypted tunnel.

15 . The non-transitory machine-readable storage medium of claim 11 wherein the application corresponds to a particular packet size.