With the improvement of computer network and the growth of bandwidth, the types of Internet traffic have been changed. The P2P file sharing application became the significant source of network traffic. In this paper, we figure out the features of P2P file sharing according to the packets of OSI layer 3 and layer 4. Four features are defined in this paper, including total packet count, percentage of TCP packets count, percentage of packet count with specific size, and percentage of duplicate destination port. Based on these features, we can identify the hosts running P2P file sharing application. The specific keywords in the payload of OSI layer 7 are used to verify which P2P file sharing application the host is running.