1. A non-transitory computer-readable storage medium comprising instructions which, when executed by at least one hardware processor on a network device, causes performance of operations, comprising: determining a total number of sessions for a first port of the network device; determining whether the total number of sessions for the first port exceeds a threshold value; classifying an application associated with the first port as a peer-to-peer application in response to a determination that the total number of sessions for the first port exceeds the threshold value; determining whether the application supports multiple sessions from a particular source address using different source ports to a common destination address and destination port; excluding sessions associated with at least the first port and the second port from the classification of the application; and enforcing, with the network device, a policy on the application based on the classification of the application as a peer-to-peer application.