CyberGlossary

Network Security

Deep Packet Inspection (DPI)

Also known as: DPI, Content inspection

Definition

An inspection technique that examines the full payload of network packets — not just headers — to identify applications, content, and threats.

Deep Packet Inspection (DPI) parses traffic beyond the IP and TCP/UDP headers, reaching into application protocols (HTTP, DNS, SMB, TLS metadata, etc.) to identify the actual application or content. It powers application-aware firewalls, IPS, NDR, anti-malware gateways, and traffic-shaping tools, and is essential for detecting protocol abuse, data exfiltration, and signature-based threats. Because much modern traffic is TLS-encrypted, DPI is typically combined with TLS interception or with metadata-based techniques (JA3, JA4, certificate fingerprints, traffic analytics). Operators must balance security benefits against privacy, performance, and legal/regulatory constraints around inspecting user content.

Examples

  • An IPS detecting a Cobalt Strike beacon by matching a payload signature in HTTP traffic.
  • An NGFW classifying traffic as Zoom or YouTube using DPI even when on TCP/443.

Related terms