Systems and methods for identifying the client applications of a network

A method for passively and automatically identifying a client application running on a network device of a network, comprising:

• identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;
• identifying one or more packets of the flow as one or more initiator packets;
• identifying one or more packets of the flow as one or more responder packets;
• if protocol fields of the one or more initiator packets match predefined initiator protocol fields which collectively identity the client application and if protocol fields of the one or more responder packets match predefined responder protocol fields which collectively identify the client application, then identifying the client application of the matched protocol fields as a client application running on one of the initiator network device and the responder network device.

A method for passively and automatically identifying a client application running on a network device of a network, comprising:

• maintaining a client application identifying data structure that comprises one or more predefined protocol fields which collectively identify one or more client applications;
• identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;
• comparing one or more protocol fields of one or more packets of the flow to the one or more predefined protocol fields of the one or more client applications of the client application identifying data structure;
• and
• recording a client application from the client application identifying structure which has protocol fields that match the protocol fields of the one or more packets as the client application of the initiator network device.

An apparatus for passively and automatically identifying a client application running on a network device of a network, comprising:

• a receiver for receiving a packet transmitted by the network device on the network;
• a decoder for decoding the packet into one or more protocol fields;
• a processor for comparing the one or more fields to predefined protocol fields which collectively identify a client application, stored in a client application identifying data structure;
• and
• a computer-readable medium for storing a matched client application which has protocol fields that match the protocol fields decoded from the packet as the client application running on the network device.