Analysis and signature of skype VoIP session traffic

Skype is a peer-to-peer V61P application that has gained substantial popularity since its launch in 2003. However, none of Skype's algorithms or its protocol specification are available for public inspection which impedes evaluation from a security perspective. In this paper we present an analysis of Skype operation from the network point of view. From the analysis we develop traffic signatures that allow a third party monitoring entity to detect the usage of the Skype application. These signatures concentrate on Skype signalling traffic and contain different characteristics, including port usage, network packet sizes and payload content. The application of theses signatures in a detection tool shows their effectiveness to properly detect Skype versions 1.4, 2.0, and 2.5 traffic.