Deep Packet Inspection

Everything you send over the internet is broken down into small chunks. These chunks are called packets. Each packet has an address part, comparable to the envelope of a letter, and a content part, i.e. the letter itself. Normal network devices only read the envelope and forward the packet. Deep Packet Inspection goes further: the devices also open the content part and check what’s written inside. The German name would be roughly “tiefe Paketprüfung,” but the English term is the one commonly used.

Between Antivirus and Surveillance

For companies and authorities, the technology is useful. Malware often looks harmless on the envelope. Only in the content can you recognize the pattern that gives it away. Security systems in corporate networks therefore almost always work with Deep Packet Inspection. Network operators also use it to detect what kind of data is currently flowing.

But this very capability makes the technology politically sensitive. Whoever can read the content can also judge it. A provider could deliberately throttle videos from a certain service while favoring another. This contradicts the principle of net neutrality, i.e. the rule that all data should be treated equally. In the EU, such preferential treatment is heavily restricted.

In authoritarian states, the same technology serves censorship. It recognizes unwanted content and blocks it before it arrives. Deep Packet Inspection is thus a good example of a technology whose assessment depends almost entirely on who deploys it and for what purpose.

What the Device Looks for in the Data Stream

A DPI system sits at a point through which traffic flows anyway, for example at the boundary of a corporate network. It mentally reassembles the packets into complete messages. It then compares these messages against a list of known patterns, so-called signatures. If a match is found, the packet is discarded, flagged, or slowed down.

Pure pattern lists reach their limits, however, since attackers constantly change their code. That’s why learning-based methods are increasingly being used. A model is trained on a very large number of examples of normal and suspicious traffic. It can then also detect previously unknown attacks because they stand out statistically.

A major obstacle is encryption. The vast majority of web traffic today is encrypted, meaning the content is unreadable to intermediate stations. Some systems get around this by breaking the connection and rebuilding it. Others analyze only external characteristics, such as packet sizes and time intervals. Surprisingly often, this alone is enough to deduce which service is being used.

Firewall in the School Network, Debate in Parliament

Most commonly, you encounter the technology as a firewall, i.e. a protective barrier between an internal network and the internet. In school networks, it ensures that certain sites and games are inaccessible. In companies, it additionally prevents confidential files from leaking out. Products of this kind are often marketed as “Next-Generation Firewalls.”

In the news, the term usually comes up in debates about surveillance. When discussions turn to internet blocking, data retention, or chat control, Deep Packet Inspection is often the technology behind it. Privacy advocates criticize that this allows the content of uninvolved people to be read along the way. A common misconception, by the way, is that encryption completely locks out the technology. It hides the content, but not the behavioral pattern of a connection.