DPI software extracts metadata (as an additional function apart from classifying applications / protocols)

But how does it do this? For classification, I get that you can use pattern matching or port-based matching or heuristic analysis. But for metadata extraction, do they use these same methods? Or do they just read the metadata from the contents and headers of packets?


There is no single, rigid definition for deep packet inspection. It's usually understood as doing all those things: extracting transport-layer and application-layer data and analyzing it using various methods, including pattern matching, heuristics, scanning content for data-loss, malware protection, unwanted content, and so on.

Generally, DPI is known to use all information it can get at: headers, content, even breaking encryption (SSL inspection). Some products may even logically add metadata (from a central database) to a packet (e.g. geo location, provider, source ASN, ...) for analysis.

The capabilities of the many products vary widely, however. How those products exactly work is often a trade secret.

  • 1
    Thanks. I think the last line is especially correct, given that the definition of network traffic metadata itself varies by product. Jun 2 '21 at 9:29
  • Indeed - I've expanded the answer a bit on the metadata aspect.
    – Zac67
    Jun 2 '21 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.