A data flow classification method includes obtaining, by a packet forwarding device, a plurality of data flows, extracting, by the packet forwarding device, address information and time information of each of the data flows, selecting, by the packet forwarding device, a data flow set that is generated when a first client device accesses a plurality of services, determining, by the packet forwarding device, a service set that includes a first service and a second service and that is accessed by the first client device based on the address information of the data flows, determining, by the packet forwarding device, a correlation between services in the service set based on time information of each data flow in the data flow set, and determining, by the packet forwarding device, that the first service and the second service implement a first application.