Characterizing and Detecting Skype-Relayed Traffic

Networked application developers have recently started to use end-users ’ computers as relay nodes – application instances that also act as bridges between pairs of hosts running the same application. Relay nodes can bring costs to both users and network operators, at least in terms of increased bandwidth consumption. An interesting problem is to characterize the nature of relayed traffic and to detect its presence in the network. This paper focuses on characterizing and detecting relayed traffic generated by Skype, a popular voice over IP application that uses relays. Our technique relies solely on flow-level properties rather than on application- or protocol-specific information. Using two different controlled experimental environments we generate and collect a large amount of Skype-relayed traffic. We propose several metrics to characterize the nature of relayed traffic. These metrics together with the results obtained from the experimental characterization of Skype-relayed traffic are used to detect Skyperelayed traffic traversing the access point of a large network. We show that the metrics proposed can be used to reliably detect Skype-relayed traffic. Finally, we believe the metrics proposed could be applied more broadly in the detection of relayed traffic generated by other multimedia applications. I.