Inferring Client-Server Relations for UDP Connections

An apparatus for monitoring a computing system comprising multiple endpoints, the apparatus comprising:

• an interface, configured to receive, from at least some of the endpoints, monitored operating-system (OS) system calls relating to a transport protocol having no handshake mechanism;
• and
• a processor, configured to identify, from among the multiple endpoints, first and second endpoints that exchange a flow of packets with one another using the transport protocol, and to deduce, from the monitored system calls, which of the first and second endpoints acts as a server in the flow of packets, and which of the first and second endpoints acts as a client in the flow of packets.