Forrester: Deep Packet Inspection As An Enabling Technology

Deep packet inspection (DPI) is a technique that has seen success in traffic management, security, and network analysis. It is a technology that performs content analysis of network packets at line speed but is different from header or metadata-based packet inspection, which is typically performed by switches, firewalls, and IDS/IPS devices. A general DPI solution provides deep packet inspection for different applications.

Header-only processing limits what you can see from packet processing and hence cannot detect content-based threats or differentiate applications using common communication platforms. DPI inspects the content/payload of the packet and can extract content-level information, such as malware, specific data, and application types that are otherwise unavailable.

As network operators, Internet service providers (ISPs), and corporations alike are increasingly dependent on the efficiency of their networks and the applications that run on them, the need to manage bandwidth and control the complexity and security of communications becomes paramount. DPI provides exactly the means for such purposes. User organizations that seek better network management and compliance should view DPI as an essential technology.

DPI technology works by first reassembling packets into network flows. Data processing, including protocol classification, then kicks in and extracts information from the flow content. Flow reassembly and content extraction both require heavyweight-processing capabilities, especially in high-volume data streams. A successful DPI technology must therefore provide fundamental features like high performance computing and flexible support for analysis tasks.

A DPI-processing unit must provide scalability and performance that is in accordance with the performance of the communication network. Deep content inspection requires heavier processing than mere header inspection. As such, DPI often uses a parallel processing architecture to speed up computational tasks. A DPI technology ultimately provides users with information extracted from the network flow. The actual content processing can vary widely depending on the information extracted. DPI technology should behave somewhat like a platform-providing the utility (the "how") for content processing, but letting users decide "what" is to be processed.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine