DPI software extracts metadata (as an additional function apart from classifying applications / protocols)

But how does it do this? For classification, I get that you can use pattern matching or port-based matching or heuristic analysis. But for metadata extraction, do they use these same methods? Or do they just read the metadata from the contents and headers of packets?

1 Answer 1


There is no single, rigid definition for deep packet inspection. It's usually understood as doing all those things: extracting transport-layer and application-layer data and analyzing it using various methods, including pattern matching, heuristics, scanning content for data-loss, malware protection, unwanted content, and so on.

Generally, DPI is known to use all information it can get at: headers, content, even breaking encryption (SSL inspection). Some products may even logically add metadata (from a central database) to a packet (e.g. geo location, provider, source ASN, ...) for analysis.

The capabilities of the many products vary widely, however. How those products exactly work is often a trade secret.

  • 1
    Thanks. I think the last line is especially correct, given that the definition of network traffic metadata itself varies by product. Jun 2, 2021 at 9:29
  • Indeed - I've expanded the answer a bit on the metadata aspect.
    – Zac67
    Jun 2, 2021 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.