Classroom Companion: Business

Box 21.1 Deep Packet Inspection
Deep packet inspection (DPI) implies, 
as a minimum, that the network pro-
vider reads the UDP/TCP headers to 
obtain the port numbers to identify the 
type of protocol being used (shallow 
DPI) and, if possible, analyzes the 
actual information in the packet itself 
(proper DPI).
Sometimes shallow DPI is enough 
for special treatment of the packet; in 
other cases, for example, distinguishing 
between different services using the 
World Wide Web, deeper analysis is 
required. Information obtained in this 
way, together with the addresses of the 
sender and the receiver, is used to dif-
ferentiate the traffic; that is, decide how 
the packets shall be treated in the router 
queues (e.g., be given priority, throttled, 
or blocked). Proper DPI is not possible 
for applications using Transport Layer 
Security (TLS) such as https since 
information beyond the port numbers is 
encrypted and cannot be decoded by 
the inspector of the packet unless the 
encryption key has been compromised 
 
Chapter 21 · Net Neutrality

---

331
21
or provided voluntarily or by law to the 
authority inspecting the packets. DPI is 
also impossible for packets sent over 
virtual private networks (VPN) because 
these networks are usually protected 
using the strong IPsec encryption pro-
tocol and tunneling techniques where 
even the addresses of the sender and 
receiver are hidden so that there is no 
information available for discriminat-
ing the traffic.
DPI is used within local networks 
both at the sending and receiving end 
(e.g., in stateful firewalls and for e-mail 
filtering) to detect illegal operations, 
intrusion attempts, spam, and malware 
and to prevent sending of protected 
information into the open Internet.