Particular embodiments include cooperative monitoring of peer-to-peer activity on a network including maintaining communication between a local monitoring process and a network monitoring process such that a process can use both network monitoring and local monitoring. The cooperative monitoring includes monitoring a local peer using local monitoring of a point in the network by monitoring packets passing through the point, monitoring the network using network monitoring by a monitoring system or agent coupled to the network, and analyzing the result of network monitoring and local monitoring to determine at least one file transfer association with the local peer.