Glossary · Web tech

DPI (Deep Packet Inspection)

Also calleddeep packet inspectiondpi filter

Definition

Deep packet inspection reads not just packet headers but payload contents to identify and filter specific protocols, applications, or destinations.

Explanation

In depth

Basic firewalls filter on IP addresses and ports — cheap and fast but easy to evade. DPI systems reach into packet payloads to identify traffic by pattern: VPN protocol signatures, TLS SNI, HTTP request contents, even fingerprint patterns of specific applications. National-level censorship regimes (China, Iran, Russia) use DPI extensively to identify and block circumvention traffic. Enterprise firewalls use DPI to categorise traffic by application. DPI is expensive to run at scale — every packet needs pattern-matching — but hardware acceleration and machine learning have made it practical for major ISPs. Web proxies over ordinary HTTPS to well-known domains often slip through DPI that blocks VPN-protocol fingerprints reliably.

See alsoHow network filters work

Related terms

TLS SNITLS Server Name Indication (SNI) is a field in the TLS handshake that names the destination hostname — visible to any network observer even when the connection itself is encrypted.SNI inspectionSNI inspection is a firewall technique that reads the destination hostname from the TLS handshake and blocks connections to specific domains.DNS filteringDNS filtering blocks websites by making the DNS resolver return a fake response — the cheapest and most common first-line censorship tool.GFW (Great Firewall of China)The Great Firewall is China's national-level internet filter — one of the most technically sophisticated censorship systems in operation.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page