Large companies are now starting to evaluate deep packet inspection technologies for several different purposes and a lot of questions are being made for network/security professionals about this technology. Let's talk about some of these questions:
First:
What is Deep Packet Inspection?
Deep packet inspection (DPI) is a form of packet analysis that examines the entire payload of a packet (sometimes at wirespeed) searching for non-protocol compliance, viruses, spam, intrusions, applications (P2P programs using well known ports like port 80 per example) to decide if the packet can pass or if it needs to be routed/rated/blocked, or for the purpose of collecting statistical information.
Second:
What's being done related with Security?
DPI enables advanced security functions like full packet string search that enable administrators to identify/block Layer 7 attacks like virus, worms, spam, etc with less false positives. Also Law Enforcement Agencies are start using DPI for Lawful Interception in core IP networks.
Third:
What's being done related with Network?
DPI is being used for companies/carriers for Internet data mining, application traffic control and network visibility. It enables companies/carriers to control non desired applications (P2P, Video Streaming, etc) wich consumes bandwidth with control and don't generate revenue (for carriers), allows administrators to identify users that are using non permited applications (for companies). With network visibility administrator can identify more easily network pain points (bottlenecks) and plan better the nework growth.
Fourth:
What else?
There's several other applications that DPI can help.
- Quality os Service
- Advertising
- SLA
- Traffic Monitoring
Why there's so controverse related to DPI?
DPI is a controversial technology (some says that DPI can change the Net neutrality) and there's rumors that is being used for Internet censorship. In my point of view like everything else DPI can be used for the good or the bad...It's always up to us to decide.
It really works?
I evaluated some DPI technologies and for sure there's a lot of beneficts that administrators can get with it. There are limitations but in the overall It really works.
My recomendation? See for yourself!
Regards