Aiming at the hysteretic characteristics of classification problem existed in current intemet traffic identification field, this paper investigates the traffic characteristic suitable for the on-line traffic classification, such as quality of service （QoS）. By the theoretical analysis and the experimental observation, two characteristics （the ACK-Len ab and ACK-Len ha） were obtained. They are the data volume which first be sent by the communication parties continuously. For these two characteristics only depend on data＇s total length of the first few packets on the flow, network traffic can be classified in the early time when the flow arrived. The experiment based on decision tree C4.5 algorithm, with above 97% accuracy. The result indicated that the characteristics proposed can commendably reflect behavior patterns of the network application, although they are simple.
