IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [dpi]

Deep packet inspection

Deep packet inspection (DPI, also called complete packet inspection and information extraction or IX) is a form of computer network packet filtering that examines the data part (and possibly also the header) of a packet as it passes an inspection point, searching for protocol non-compliance, viruses, spam, intrusions, or defined criteria to decide whether the packet may pass or if it needs to be routed to a different destination, or, for the purpose of collecting statistical information that functions at the Application layer of the OSI (Open Systems Interconnection model).

14 questions
5
votes
1 answer

Can DPI block websites with ESNI?

I live in a country with censorship and was wondering if it's possible to bypass DPI by just enabling ESNI, DNS over HTTPS and Always HTTPS? If not, what else should I enable to bypass DPI firewall without having to go the VPN route?
daegontaven
  • 153
  • 4
4
votes
2 answers

Analyzing Tor traffic through Deep Packet Inspection?

I've just read about the detecting and blocking of Tor traffic by DPI but now I'm curious about analyzing the data you send over Tor and matching it with your true identity by deep-inspecting the data packets that leave your PC/router. (If that…
h088bmIuXaskpzJEe3ld
  • 41
  • 4
3
votes
1 answer

Using VPN and hidding this fact from ISP.

My ISP blocked a bunch of networks I need to access. I installed VPS (unix box) outside of my ISP's network and I now can build VPN between my home router and VPS, but I want to hide this fact from my ISP. Here are several approaches and their…
user996142
  • 308
  • 1
  • 7
3
votes
1 answer

can HPKP certificate pinning disable DPI inspection on firewall?

Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored. What is impact of that? Will browser report any warning?
user3654268
  • 31
  • 1
3
votes
1 answer

Socket closed depending on data. Am I facing an active firewall? (DPI - Deep Packet Inspection)

Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place. The connection on that port works with nc on both sides (nc -l -p 8883 on the server, nc server.com…
Michael
  • 331
  • 1
  • 4
  • 11
2
votes
0 answers

Best way to avoid DPI/tunnel detection?

guys, I live in Russia and that pretty much says it all. I was using a standard self-hosted VPN on a DO droplet, but now I'm afraid that since VPN usage in Russia started to spread like a wildfire after the recent Instagram ban the Russian…
passingTHROUGH1263
  • 21
  • 1
2
votes
3 answers

How does a NG Firewall do application visibility and classification of TLS traffic without TLS interception and how reliable is this

How Does Application Visibility and Control Work? The application identification (App ID) classification engine and application signature pattern-matching engine operate at Layer 7 and inspect the actual content of the payload for…
emirjonb
  • 121
  • 5
1
vote
1 answer

Antivirus/DPI Solution with openvpn server

I wish to set up a system that I log into with openVPN on my Raspberry Pi 4. I have already set up an openVPN server with a PKI infrastructure as well as other services that run on the Pi (like pi hole dns + dhcp). The packet forwarding is set up in…
FalcoGer
  • 402
  • 3
  • 9
1
vote
1 answer

Can IPsec transport mode prevent DPI by your ISP?

It is well known that ISPs use deep packet inspection to deprioritize certain types of network traffic, such as that belonging to filesharing applications. If ISPs achieve this throttling of traffic by examining the payload of IP datagrams,…
aeb0
  • 640
  • 5
  • 8
0
votes
4 answers

Disable Encrypted Protocols Through Firewall

In my company, we have two internal domains with a firewall between them. When requesting firewall rules for an application with components on domain A and domain B, I was told that encrypted protocols were not allowed through the firewall. (e.g.…
c26c1a28808f39240df780eb8ee34e
  • 1
0
votes
1 answer

What kinds of web applications need dynamic packet filtering or deep packet inspection

I have some customers requesting that we put apply DPI or dynamic packet filtering in front of our web server. For the simplicity of my service, I'm feeling like this is over kill. What kinds of web apps really benefit from DPI / DPF as opposed to…
Brad
  • 103
  • 4
0
votes
1 answer

VPN, ISP & deep packet inspection

If I use OpenVPN on port 443 (TCP or UDP), is it possible for my ISP with deep packet inspection to find out VPN usage? If so, what is the alternative?
Siavash dst
  • 3
  • 2
-1
votes
1 answer

Surveillance by mobile network provider

I am customer of Vodafone Germany as my mobile network provider. After extension of my RED S mobile contract i realized, that the option "Vodafone Secure Net" is enforced by the company without informing me beforehand. After calling the customer…
alex
  • 101
  • 3
-1
votes
1 answer

Identifying URL in SSL

http://qosmos.com/products/protocol-support/ state they are able to identify "Video, URL, date, duration, frame rate, +30 other metadata" for Youtube traffic. Duration, Frame Rate and date seems possible. But how do they identify the URL since it is…
psy
  • 115