Method and an Arrangement of Identifying Traffic Flows in a Communication Network

A method of identifying traffic flows in a traffic generating node, each traffic flow being associated with a respective application process running on said traffic generating node, said method comprising:

• recognizing a change to a socket associated with an application process;
• and
• performing a mapping operation with respect to that application process responsive to recognizing said change, wherein performing said mapping operation comprises linking the application process to a signature that uniquely identifies a traffic flow and an associated socket, and maintaining information regarding said linking in a list.

A method implemented by a server for classifying traffic flows transmitted to or received from a traffic generating node, wherein the server comprises at least one processing element, wherein the method comprises:

• maintaining a copy of a list created by the traffic generating node, wherein the list contains accumulated content regarding linking of each of one or more application processes running on the traffic generating node to a respective signature that uniquely identifies a traffic flow and an associated socket, wherein said maintaining comprises receiving one or more notifications from the traffic generating node comprising the content of one or more mapping entries created or updated in said list by the traffic generating node;
• and
• classifying traffic flows on the basis of at least one predefined rule and the accumulated content of said list .

A method implemented by a server for controlling traffic flows transmitted to or received from a traffic generating node, wherein the server comprises at least one processing element, wherein the method comprises:

• maintaining a copy of a list created by the traffic generating node, wherein the list contains accumulated content regarding linking of each of one or more application processes running on the traffic generating node to a respective signature that uniquely identifies a traffic flow and an associated socket, wherein said maintaining comprises receiving one or more notifications from the traffic generating node comprising the content of one or more mapping entries created or updated in said list by the traffic generating node;
• and
• controlling traffic flows on the basis of at least one predefined rule and the accumulated content of said list .

A traffic generating node comprising a client for identifying traffic flows, each traffic flow being associated with a respective application process running on said traffic generating node, said client comprising a signature engine configured to:

• recognize a change to a socket associated with an application process;
• and
• perform a mapping operation with respect to that application process responsive to recognizing said change, wherein performing said mapping operation comprises linking the application process to a signature that uniquely identifies a traffic flow and an associated socket, and maintaining information regarding said linking in a list.

A server comprising at least one processing element that is configured to classify traffic flows transmitted to or received from a traffic generating node, wherein the processing element is configured to:

• maintain a copy of a list created by the traffic generating node, wherein the list contains accumulated content regarding linking of each of one or more application processes running on the traffic generating node to a respective signature that uniquely identifies a traffic flow and an associated socket, wherein said maintaining comprises receiving one or more notifications from the traffic generating node comprising the content of one or more mapping entries created or updated in said list by the traffic generating node;
• and
• classify traffic flows on the basis of at least one predefined classification rule and the accumulated content of said list.

A server comprising at least one processing element that is configured to control traffic flows transmitted to or received from a traffic generating node, wherein the processing element is configured to:

• maintain a copy of a list created by the traffic generating node, wherein the list contains accumulated content regarding linking of each of one or more application processes running on the traffic generating node to a respective signature that uniquely identifies a traffic flow and an associated socket, wherein said maintaining comprises receiving one or more notifications from the traffic generating node comprising the content of one or more mapping entries created or updated in said list by the traffic generating node;
• and
• control traffic flows on the basis of at least one predefined classification rule and the accumulated content of said list.