Due to the collection and identification of application layer information， more accurate performance analysis and intrusion detection can be realized， which is of great significance for improving network security and performance. For this reason， the identification of application protocol under SSH tunnel is studied. First， analyze the SSH protocol to determine what information can be obtained from the connection establishment phase. Then， based on the extended functions created by the traffic monitoring infrastructure， the acquired information is analyzed， and information related to the application layer protocol included in the SSH data is obtained. Finally， the SSH connection is monitored on the real network and the monitoring results are analyzed. The research results show that through the analysis of SSH traffic data， application layer protocols including port and client software can be identified to improve the detection of security vulnerabilities such as brute force password attacks.