Application characterization using transport protocol analysis

A system comprising:

• one or more processors;
• and
• one or more nontransitory computer readable media including instructions which, when executed by one or more processors, cause the one or more processors to:
• obtain transport protocol state information for each of a first plurality of transport protocol packets received at a network node, each of the first plurality of transport protocol packets including data transferred between a client endpoint and a server endpoint via a transport protocol connection, the first plurality of transport protocol packets including a first plurality of forward packets each including data transferred from the client endpoint to the server endpoint and a first plurality of reverse packets each including data transferred from the server endpoint to the client endpoint;
• identify a first plurality of request/response periods for the transport protocol connection, each of the first plurality of request/response periods being identified based on the transport protocol state information obtained for one or more of the first plurality of forward packets and the transport protocol state information obtained for one or more of the first plurality of reverse packets, the first plurality of request/response periods including first and second request/response periods, and the identifying the first plurality of request/response periods including:
• identify a beginning of the first request/response period based on the transport protocol state information for a first forward packet included in the first plurality of forward packets,
• calculate a first expected sequence number based on the transport protocol state information for a reverse packet included in the first plurality of reverse packets, and
• identify an end of the first request/response period and a beginning of the second request/response period based on an acknowledgement value for the second forward packet corresponding to the first expected sequence number;
• associate a first application type with the server endpoint based on the first plurality of request/response periods;
• and
• control behavior of a communication network for transmission of a second plurality of transport protocol packets transferred to the server endpoint based on the first application type.