1. A non-transitory computer-readable storage medium comprising instructions which, when executed by at least one hardware processor on a network device, causes performance of operations, comprising: determining a total number of sessions for a first port of the network device; determining whether the total number of sessions for the first port exceeds a threshold value; classifying an application associated with the first port as a peer-to-peer application if the total number of sessions for the first port exceeds the threshold value; enforcing a policy based on a classification of the application.