A service identification method and a network device, where the method includes receiving, by the network device, service packets and identifying service packets that belong to a same terminal, determining, by the network device, a service traffic feature based on session information of the terminal and packet information of the service packet, where the service traffic feature includes at least one of session duration, a quantity of concurrent sessions, a traffic rate, traffic rate stability, a packet transmit/receive frequency, a quantity of packets, a packet length, or a round-trip time related to a request packet and a response packet, and determining, by the network device, a service type of a to-be-identified service based on the service traffic feature.