DPI in Packet Switched Networks

Deep packet inspection (DPI) is an advanced monitoring technique and a useful application for telcos. The main advantage of DPI is that it provides most accurate information on bandwidth as it reads the packet content. Analyzing digital traffic can reveal some very useful insights and help telcos to identify general consumer behaviour. For instance, how long customers stay at a location, how often is a customer joining a specific location, which transport medium is the customer using to come to a location. Based on this information it is possible to optimise the availability of resources. By studying metadata using deep packet inspection (DPI), network specialists can learn how best to optimise servers to reduce overhead, detect hackers, combat malware, and get intimate details about user behaviour.

On the engagement side, telcos can introduce innovative content-based plans to meet the needs of individual customers, study overall network usage to analyse aggregate behaviour, and identify behaviour patterns by application type. The operators can ensure service quality by instigating traffic control and bandwidth allocations, prioritising popular applications such as YouTube, Netflix, or Skype, over other less time-sensitive data. And from a revenue-generating perspective, operators can create plans with different service levels enforced through DPI application. Furthermore, DPI data enables operators to segment customers by their online behaviour, and this data can help the operators to find alternate means of generating revenue.

The other use case of DPI is the lawful interception. With this data security threats can be detected at a very early stage, because it is possible to see how many people are moving towards a place, and if this is an unusual behaviour then Law and Enforcement can react faster.

DPI typically entails decoding of packets above layer 4. It is used to identify the network protocol. It is also used to identify the application. There are two major DPI applications, and Cubro devices can perform both these functions:

​Filter with DPI and traffic steering - The Sessionmaster EXA can use its DPI features in the packet stream to identify a packet and then forward this related stream based on rules to an output port (original packets).

Metadata extraction - XDR - The Cubro Probe can use its DPI feature to look into the packet stream, identify a packet, extract metadata and send this to a server for the next processing step (non-original packets).

About Cubro Network Visibility

Cubro Network Visibility offers a wide range of passive and secure network TAPs, packet brokers and probes to connect the ever-growing number of monitoring tools to the production network. Our solutions include smart filtering based on higher layer - up to application layer (L7), monitoring, load balancing, aggregation, and meta data extraction. For more information check our website www.cubro.com.

Tamanna Bhatia
Marketing & Communications Manager
Cubro Network Visibility
Ghegastrasse 3/2nd Floor
1030 Vienna, Austria