# What is Deep Packet Inspection (DPI)?

> Deep packet inspection (DPI) is a non-standard industry term for examining packet payloads and protocol context beyond basic network and transport headers.

- Canonical URL: https://yellowcube.eu/glossary/deep-packet-inspection/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A DPI function may reconstruct flows, decode supported application protocols, validate message structure, identify applications or content, and apply policy using information that address-and-port filtering cannot see.

The label does not define a universal inspection depth or capability. DPI can support intrusion detection, prevention, application control, data policy, troubleshooting, or traffic management. It may observe only metadata when content is encrypted; viewing protected content generally requires authorized termination or decryption, endpoint evidence, or application cooperation.

### Key points

- **Inspection scope:** Document the protocols, message fields, file types, encodings, fragmentation, tunneling, and traffic directions the implementation can actually reconstruct and analyze.
- **Policy use:** Separate identification from enforcement, validate signatures and protocol models, test evasions and malformed traffic, and define what happens when decoding is uncertain or resources are exhausted.
- **Privacy and security:** Establish authority and purpose, minimize inspected and retained data, protect keys and captured content, restrict analyst access, and account for legal or contractual constraints.
- **Important limitation:** DPI does not make allowed traffic safe or reveal content protected by sound end-to-end encryption without changing the trust model. Unsupported protocols, application changes, evasion, packet loss, and performance limits can all reduce accuracy.

### Related terms

[Network traffic](<https://yellowcube.eu/glossary/network-traffic/>) · [Intrusion detection system (IDS)](<https://yellowcube.eu/glossary/intrusion-detection-system/>) · [Intrusion prevention system (IPS)](<https://yellowcube.eu/glossary/intrusion-prevention-system/>) · [Next-generation firewall (NGFW)](<https://yellowcube.eu/glossary/next-generation-firewall/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>)

### Sources

[NIST glossary: Deep Packet Inspection](https://csrc.nist.gov/glossary/term/deep_packet_inspection) · [NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final) · [IETF RFC 8404: Effects of Pervasive Encryption on Operators](https://datatracker.ietf.org/doc/html/rfc8404)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.