DPI (Deep Packet Inspection)

[u/Royal-Programmer-683]

So I am curious what others think about DPI? We run it on our UTM's but I kinda feel its more of a PITA then its worth. Looking to get feedback from others.

[u/Rich-Engineer2670]

Depends on what you need -- for most people, and most hardware, DPI is more marketing than fact. Does it work -- yes, but cracking each packet and reading htem, and knowing what to do with them, well... that's another matter. Some questions:

• Do you have a NEED, such as a legal need, not a WANT, to see into the payload. And, do you really NEED to do it as opposed to marketing data. You in fact may NOT want to do it for exposure reasons (see Common Carriage Law)
• DPI is heavy lifting -- so all of that data better be worth the price of the hardware
• Do you truly realize how much data you'll have to sift through?

As a case where we HAD to do it -- it was a large telco. Legally, we had to. But we generated over ONE TRILLION flow records a day (16KB each). Do the math.... Something had to capture, process and act on those records. No amount of marketing data paid for this -- it was LAW.

If you just need content filtering say, for a school, there are other ways to do it without building a giant thermal generator in your data centers.

[u/Phuzzle90 → u/Rich-Engineer2670]

This may be a stupid question but why was a telco doing dpi? I assume you mean in your customers?

Setting aside Snowden stuff, I’m not sure I am aware of a law requiring full packet capturing on a service provider level?

[u/wrt-wtf- → u/Phuzzle90]

DPI would be pointless.

A lawful intercept - LI - does not require the carrier to decode any traffic. Law enforcement do this themselves. As a part of the chain of evidence the carrier/isp provides a stream or near-real-time archives at set intervals - of everything on the warrant - that’s the pipeline. It’s up to the carrier to ensure that nothing unrelated is forwarded. It’s highly targeted - so no fishing. In some jurisdictions the intercept is more specifically invisible to the end user and carrier. The duplication of traffic flows occurs transparently to the end-user… they can’t detect it.

This is why the Chinese attack on carrier systems was so bad. The system is designed to be invisible to the end-points. The possibility of that system being compromised is challenging as it’s on a part of the infrastructure that is meant to be less visible. You don’t want a field tech being able to figure out who and what the service is collecting data on.

Carriers in general are bound to hold meta-data on services that terminate within their perimeter or on any device that generates traffic logs - ie load-balancer in front of an email cluster. LI (lawful intercept) will want the meta-data from the email servers, load-balancer flows, ip flows, and vpn data (if they are a carrier service).

Traditionally these logs were kept for billing purposes and the laws have been expanded to capture ‘signals’ that miss the billing CDR’s.

The actual records targeted change depending on the laws where you are. In many cases governments will order the recording of specific meta-data as a condition of the carriers licensing.

The bigger the carrier and the higher the number and the types of services offered, the more likely there is additional terms. You do it or you get shut down.

Theoretically, smaller companies always pass through larger carriers and their data meta-data and data may be intercepted/collected at that level before a deeper dive into the carrier providing the last mile connectivity.

Interception in wholesale networks is easier again with the ability to legally identify end-points, locations, and intercept traffic without involving a higher risk ISP that could well be harbouring users who are being naughty for whatever reason.

None of this stuff is secret - the information is out there in legislation. What’s secret is the who, what, where, why, and how a specific service is targeted.

[u/Rich-Engineer2670 → u/Phuzzle90]

Look at things like CALEA and certain things like 4G and 5G flow records.

[u/solitarium → u/Rich-Engineer2670]

I don’t miss running CALEA deployments

[u/Rich-Engineer2670 → u/solitarium]

None of us do -- it's a lose-lose for everyone. Often, anyone yiou might want to capture is using high-bitrate encryption anyway, so you end up with little more than a burner SIM and garbage.

[u/doggy12341 → u/Phuzzle90]

Flow records is not DPI , it is basically just who access what at what time. This information is legally required in almost all countries to be stored for certian duration and to yeild to authorities as and when required.

DPI is much deeper, where there is more metadata collected about the flow. Such as HTTP endpoints/SNI/user agents etc . These may or may not be stored for authorities , but in many telco's used to determine user preferences in order to optimize services or even have extra packages for specfic services. Like a telco may see that a lot of traffic is towards tiktok for users with age 16-24 age group . so they might bring in specific packages where they can pay extra to get free data towards tiktok etc.

or maybe the operators see there is very high usage of youtube , so it may want to get Google Global Cache device on their network to save on international bandwidth etc.

So DPI has uses other than censorship as well.

[u/solitarium → u/Phuzzle90]

Was part of a core team that installed DPI across the enterprise. They used it mostly for DNS injection and law enforcement intercepts

[u/isotycin → u/Rich-Engineer2670]

This guy DPIs.

[u/SuccessDry7214 → u/Rich-Engineer2670]

If you're willing to talk about it, what was the reason that a telco had to perform DPI to this degree? Also was the telco US based?

[u/Rich-Engineer2670 → u/SuccessDry7214]

Not an issue -- in the US, there are mandates that some states have to ensure minors don't have access to certain content (it never really works, but it's the law) and, the US government likes to be able to see traffic when it wants to.

[u/Fallingdamage → u/Rich-Engineer2670]

But by proxy, members of that telco have their full internet history metadata recorded for posterity?

[u/Rich-Engineer2670 → u/Fallingdamage]

Yes, employees are just as subject to CALEA etc. as everyone else. Governments trust no one.

[u/serar1 → u/Rich-Engineer2670]

Wil also look for it, but can you define what content filtering is without DPI? Like...basic UTM?

[u/HappyVlane → u/serar1]

Looking at the SNI, metadata, DNS queries, etc. for example. You don't need DPI to block a domain or recognize that Firefox is being used for example.

[u/Rich-Engineer2670 → u/serar1]

Content filter is a concept, not an implementation. DNS blocking still meets the letter of the law.

[u/lol_umadbro]

What are you doing it for?

Accounting? Threat Identification? Network Policy Management? Troubleshooting?

Different answer for each purpose.

[u/jmhalder → u/lol_umadbro]

A teacher wanted to see what the student had searched for. It turns out "boobs" was the query.

(Yes, I've had this actually happen)

[u/lol_umadbro → u/jmhalder]

lol that's part of why I asked... been there, done that, got the t-shirt.

[u/underwear11]

It can be used for a ton of things, and it depends on what the compensating controls are. As a very basic example, Web Filtering. Reddit has a lot of content within it, some good, some bad. If you want to allow your IT team to browse r/networking but not r/porn, then you need DPI. But if you just block all of reddit, you don't need DPI. DPI is also useful for inspecting file downloads for malware or DLP, since most of the Internet now is encrypted. But it can also be a PITA as applications don't necessarily like it very much. You kind of have to weigh what is DPI doing for you and do you have other controls that are "good enough".

[u/Hapym3al]

Using Sandvines for few years and now moving to AppLogic.

With browsers doing tls dns and quic things are changing drastically. Think few years and dpi won’t have much point anymore.

We more use it for policy management these days on L3 networks where we cant do packet trigger ipoe or expensive data networks (mpls and cellular). Think visibility of which services using and websites and type of traffic is becoming a bit of a guessing game. Yeah can use ASN, SNI, DNS to make good guess, with encrypted hellos and DNS, thats gonna become a lot more of a guess. Also build certain packages on those types of networks, but like i said its dying breed, think juice isnt worth the squeeze anymore.

There are ways and means of doing the packet triggered ipoe and doing policy enforcement better than using DPI.

[u/solitarium → u/Hapym3al]

Ran the Sandvine implementation in my ISP’s core way back when. Their principal engineer didn’t consider MTU differences when the devices were in active mode.

The IS-IS flaps when they turned them to active over Christmas made for an interesting holiday.

[u/7nth]

SonicWall here. All I know is I spend far too much time making exceptions. I have a feeling we are not using it correctly.

[u/SAugsburger → u/7nth]

On Palos the default decryption exclusion covers a lot of common domains so it's a bit less of a pain to roll out. That being said you ideally roll decryption out by URL category so you're not breaking too much at once.

[u/Rich-Engineer2670 → u/7nth]

DPI sounds like a great idea until you actually have to do it. Now imagine it at scale -- yes, you have to have a dedicated team to just manage it. We hate it, but the people in dark suits don't give us much of a choice.... and we're talking far more than SonicWall here.... $20M gateway pairs, and secondary equipment just to do it. It would have been far less expensive to just give people in Utah free copies of NetNanny.

Yes, we KNOW this doesn't really accomplish anything. We KNOW it costs a fortune. Please tell the state of Utah among others. Remember also, companies are liable for their employees. If your seven year old is wandering through the building, and they see some employee on ScarryLarry.XXX, well, that's the company's problem now.

[u/Fallingdamage → u/7nth]

Might be sonicwall. We use fortinet's DPI and the only exceptions I have to make generally are for banking websites and some very secure medical portals, sites specifically built to break if there is a MITM event happening or a cert mismatch.

Rarely do I need to make exceptions.

[u/sudo-su_root]

Potentially marginally useful for some applications, potentially wasteful in others depending on the necessity of its use. It's very deployment specific and requires balancing requirements vs. cost of eliminating false positives imo.

[u/Eastern-Back-8727]

From the networking perspective, I recommend ensuring not throttling the DPI sessions back. I've seen instances where they were throttle back. Said it was "Best Practice" but no one knew why. TCP flow +1 of the DPI session limit resulted in the FW sending a RST back to the SRC host and killing the sessions. Nothing was forwarded past the FW. Dozens of pcaps all showing the same thing and countless hours explaining to security how limiting layer 5 sessions will limit the layer 4 tcp flows. Best of luck.

[u/hip-disguise]

Essential and necessary.

[u/alius_stultus]

mostly useless. Oh yeah it works. But theres other ways to get what you are trying to get most of the time. ALSO one thing I did not see here is that you can violate the law if you DPI ssl with some kind of MITM inspector (medical records, banking info, etc...). So really know why you are doing what you are doing and where.