Abstract: An Internet Protocol network having service differentiation depending on whether or not a flow in the network is a real-time flow. An aggregated flow within the Internet Protocol network passes through a flow classifier before entering a node. The flow classifier distinguishes the aggregated flow into set of flows, each flow corresponding to a unidirectional packet stream from a single session. The flow classifier then executes at least one of a plurality of checks including: checking payload size; checking for static behavior in header fields that are predictably constant if the flow is a real-time flow; and checking for incremental behavior of header fields, which predictably increment if the flow is a real-time flow. Based on the checks, the flow classifier decides whether the flow is a real-time flow or a non-real-time flow.