1. A client-side application-classifier comprising: an upper interface to a higher-level network-socket library, the higher-level network-socket library for providing high-level network functions to high-level user applications by generating a socket for connecting to a remote machine on a network; a lower interface to a network-transport layer, the network-transport layer for formatting data for transmission over the network; an interceptor, coupled between the upper and lower interfaces, for intercepting network events; an examiner, coupled to the interceptor, for examining the network event intercepted and collecting statistical information about the network event, the statistical information including: an application name of one of the high-level user applications that caused the network event; a timestamp for the network event; a byte count when the network event is a transfer of data over the network; Internet addresses and ports when the network event is a connection or a data transfer; and a process identifier of a running instance of the high-level user application; a consolidator, coupled to the examiner, for consolidating the statistical information into application-classifier tables, the application-classifier tables including current tables for currently-running instances of applications, and historical tables that include closed applications; and a reporter, coupled to the consolidator, for sending the statistical information from the application-classifier tables to a remote policy server on the network, the statistical information including the application name, whereby the statistical information for network events is collected by the client-side application-classifier.