Deep packet inspection

Common card · No. 267582

Deep packet inspection (DPI) is a type of data processing that inspects in detail the data (packets) being sent over a computer network, and may take actions such as alerting, blocking, re-routing, or logging them accordingly. Deep packet inspection is often used for baselining application behavior, analyzing network usage, troubleshooting network performance, ensuring that data is in the correct format, checking for malicious code, eavesdropping, and Internet censorship, among other purposes. There are multiple headers for IP packets; network equipment only needs to use the first of these (the IP header) for normal operation, but use of the second header (such as TCP or UDP) is normally considered to be shallow packet inspection (usually called stateful packet inspection) despite this definition. There are multiple ways to acquire packets for deep packet inspection. Using port mirroring (sometimes called Span Port) is a very common way, as well as physically inserting a network tap which...

Read on Wikipedia