thank you! so it is basically looking at identifiable patterns in the packet flow and matching them to protocols. i also found this paper about traffic identification interesting.