Depends on which categories you want to have. You can use the TCP port (http vs bittorrent vs email, or individual games which often use a well-known port for

Depends on which categories you want to have. You can use the TCP port (http vs bittorrent vs email, or individual games which often use a well-known port for communication), deep packet inspection (eg. to distinguish between normal web and HTTP video streaming), reverse IP lookups to detect location of the remote endpoint or what company it's assigned to (through AS number for example).