most modern NGFW's identify traffic by the layer 7 application. many (but not all) are identified by the time a tcp handshake completes.