Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI?

Also, where along the data path is this operation performed (Is it in the input interface/ingress buffer or the input packet memory or some other place)? Data Path of a Switch

  • 1
    Typically routers and switches do not do DPI. It is done by specialized devices.
    – Ron Trunk
    Sep 25, 2016 at 14:32

1 Answer 1


Mostly, that would be done by a dedicated appliance, such as a next-generation firewall. Some vendors implement this as an optional service in software on routers, e.g. Cisco's NBAR2, performed using the router's CPU. The service is very CPU intensive, and the performance/throughput of a router running something like this is severely impacted, which is why you normally do this on a dedicated appliance.

  • Oh ok. And where along the data path is this done? We need to do DPI as early as the interface so as to prioritize control traffic to go straight to the CPU and not be stuck in the input queue right? Sep 25, 2016 at 17:39
  • If you are wanting to mark the traffic for QoS, that is something you should do as close to the source as possible, either on the host, or if you don't trust the host, then on the access switch. This allows you to treat the traffic from the source. Also, you only mark traffic on a router as a last resort because of performance problems. You can drive a router CPU to unacceptable levels. Mark at the access, queue at the router.
    – Ron Maupin
    Sep 25, 2016 at 17:45
  • DPI is usually reserved for protecting your network, which is why it is normally on NG firewalls.
    – Ron Maupin
    Sep 25, 2016 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.