Deep Packet Inspection

Deep Packet Inspection (DPI) is a technique that allows network security devices such as firewalls to look "deeper" into the IP packet to try to learn its true intent. Instead of relying on fairly standard packet header information (essentially Layers 2 and 3), which again is starting to look the same for every application on the network, DPI can look much further up the OSI stack, into Layers 4 through 7.

With the increased visibility that DPI provides, it is possible for network security devices to understand more about the actual applications being run across the network, what information is being passed, and whether the information is appropriate in the context.

DPI has other potential applications as well. Although we certainly want to halt bad traffic, we also want to accelerate critical traffic. DPI can be one tool used to recognize which applications on the network are vital to the company's business and to give those applications preferential treatment as they are routed through the network.

Finally, a note about encryption. Encryption can be a very effective way to secure communications between two devices, whether it is a laptop encrypting a session across the Internet to the corporate headquarters (such as with IPSec VPN) or securing a voice-over-IP phone call between two IP phones (such as with SRTP).

The downside is that encrypted packets do not lend themselves well to being inspected. Typically network security devices do not have access to the decryption keys required to decode the encrypted packets and to understand what is occurring in the packet conversation. This is an example where one security policy may make it exceptionally difficult to enforce another.

Continue reading here: Types of Data Centers

Was this article helpful?

0 0