DPI software extracts metadata (as an additional function apart from classifying applications / protocols)
But how does it do this? For classification, I get that you can use pattern matching or port-based matching or heuristic analysis. But for metadata extraction, do they use these same methods? Or do they just read the metadata from the contents and headers of packets?