Editing Deep packet inspection (section)

{{Short description|Procedures examining network data}}
{{globalize|date=February 2018}}
{{Net neutrality}}

'''Deep packet inspection''' ('''DPI''') is a type of data processing that inspects in detail the data ([[Network packet|packet]]s) being sent over a [[computer network]], and may take actions such as alerting, blocking, re-routing, or logging it accordingly. Deep packet inspection is often used for baselining application behavior, analyzing network usage, troubleshooting network performance, ensuring that data is in the correct format, checking for malicious code, [[Man-in-the-middle attack|eavesdropping]], and [[internet censorship]],<ref>Duncan Geere, https://www.wired.co.uk/article/how-deep-packet-inspection-works</ref> among other purposes.<ref>{{cite journal|first1=Sarang|last1=Dharmapurikarg|first2=Praveen|last2=Krishnamurthy|first3=Todd|last3=Sproull|first4=John|last4=Lockwood|title=Deep packet inspection using parallel bloom filters|journal=11th Symposium on High Performance Interconnects}}</ref> There are multiple headers for [[Internet Protocol|IP packets]]; network equipment only needs to use the first of these (the [[IPv4 header|IP header]]) for normal operation, but use of the second header (such as [[IPv4#Data|TCP or UDP]]) is normally considered to be shallow packet inspection (usually called [[stateful packet inspection]]) despite this definition.<ref name=Porter2005>{{cite web|url=http://www.securityfocus.com/infocus/1817|title=The Perils of Deep Packet Inspection|website=[[SecurityFocus]].com|author=Thomas Porter|date=2005-01-11|access-date=2008-03-02}}</ref>

There are multiple ways to acquire packets for deep packet inspection. Using [[port mirroring]] (sometimes called [[Span Port]]) is a very common way, as well as physically inserting a [[network tap]] which duplicates and sends the data stream to an analyzer tool for inspection.

Deep Packet Inspection (and filtering) enables advanced [[network management]], user service, and [[information security|security]] functions as well as internet [[data mining]], [[eavesdropping]], and [[internet censorship]]. Although DPI has been used for Internet management for many years, some advocates of [[Network neutrality|net neutrality]] fear that the technique may be used anticompetitively or to reduce the openness of the Internet.<ref name=Lewis2009>{{cite web|url=https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2009/ledeen-lewis_200903|title=Just Deliver the Packets, in: "Essays on Deep Packet Inspection", Ottawa|website=Office of the [[Privacy Commissioner of Canada]]|author1=Hal Abelson|author2=Ken Ledeen|author3=Chris Lewis|year=2009|access-date=2010-01-08}}</ref>

DPI is used in a wide range of applications, at the so-called "enterprise" level (corporations and larger institutions), in telecommunications service providers, and in governments.<ref name=Bendrath2009>{{cite web|url=http://userpage.fu-berlin.de/~bendrath/Paper_Ralf-Bendrath_DPI_v1-5.pdf|title=Global technology trends and national regulation: Explaining Variation in the Governance of Deep Packet Inspection, Paper presented at the International Studies Annual Convention, New York City, 15–18 February 2009|publisher=[[International Studies Association]]|author=Ralf Bendrath|date=2009-03-16|access-date=2010-01-08}}</ref>