DPI (Deep Packet Inspection)

ISP & telecomsecurity

Examining traffic beyond its headers to classify what protocol or application it carries - used legitimately for network management and troubleshooting, and equally for blocking, throttling and surveillance.

Encryption removed the content but not the shape: modern inspection classifies by handshake characteristics, packet timing and size patterns rather than by reading payloads. That is why circumvention moved from encrypting traffic to making traffic look ordinary, and why pluggable transports and protocol obfuscation exist at all. The arms race is asymmetric in an instructive way - the censor only needs a classification good enough to be politically acceptable, while the tool must be indistinguishable.

Also known as: deep packet inspection, protocol fingerprinting, traffic classification

← All glossary entries