Abstract: A method and a detection system are provided for detecting encrypted peer-to-peer (EP2P) sessions associated with a particular EP2P network. Seed data associated with the EP2P network is extracted from a selected packet, and an encryption seed is obtained from the seed data. An encryption key is obtained from the encryption seed by using a key function associated with the EP2P network, and a cipher associated with the EP2P network is initialized with the encryption key. A portion or whole of the packet is decrypted, and checksum data associated with the EP2P network is extracted. A checksum is obtained from the checksum data, and the obtained checksum is compared with a reference checksum associated with the EP2P network. If the obtained checksum matches the reference checksum, a session including the packet is determined to be an EP2P session associated with the EP2P network.