What does App-ID inspect to identify an application?

Source IP is a network layer identifier, not indicative of the application itself.

While traditional firewalls rely on ports, applications can run on non-standard ports, making source port an unreliable identifier for App-ID.

Time To Live (TTL) is a network layer field indicating hop count, which has no direct bearing on application identification.

App-ID identifies applications by performing deep packet inspection on the data payload, analyzing application headers, unique protocol characteristics, and even behavioral patterns across all ports and protocols. This deep inspection allows it to accurately identify applications regardless of the port they use or any evasive techniques.

While hashes might be used for file identification, they are not the primary mechanism App-ID uses to identify network applications.

Encryption keys are used for securing communication, not for identifying the application running over that communication.