Deep Packet Inspection: Techniques, DPI Firewalls, and Applications

Zapret 2 implements multiple sophisticated techniques to evade DPI detection. TCP segmentation splits TLS Client Hello messages across multiple packets, exploiting the fact that many DPI systems do not fully reassemble TCP streams. Fake packet injection sends spoofed packets with altered SNI values to trick DPI state machines into marking sessions as legitimate. Technical nuances include BAD_CS (incorrect TCP checksums ignored by DPI but rejected by servers), BAD_SEQ (sequence number manipulation), MD5_SC (obsolete TCP options), and TTL manipulation to ensure fake packets are destroyed by DPI devices before reaching servers. The most advanced technique is Split Handshake, which inverts client-server roles during TCP handshake, causing irrecoverable failure in DPI state machines and forcing them to drop flows from inspection.

NaiveProxy is a proxy protocol that masks internet traffic by leveraging the Chromium browser network stack, making it indistinguishable from regular HTTPS web traffic and thus highly effective at evading Deep Packet Inspection (DPI) systems that typically detect VPN protocols by their unique handshake signatures.

Fragmentation (fragment) breaks the Client Hello packet into multiple smaller packets to prevent DPI from reading the complete SNI value. Three key parameters control fragmentation: Packet ID (identifies which packet to fragment), Fragment Size (determines packet dimensions), and Interval (time delay between packets). Larger fragment sizes with smaller intervals improve connection quality and speed, while smaller fragments with larger intervals reduce performance. To successfully bypass DPI, fragment size must be smaller than the SNI value length. Using longer domain names (up to 63 characters maximum) allows larger fragment sizes, improving connection quality and speed by up to 7 times. Different ISPs have varying sensitivities: IranCell may allow fragment sizes up to 200 characters, while other ISPs require smaller sizes (10-15 characters).

Internet censorship has evolved from simple IP blocking to sophisticated systems using Technical Countermeasures Against Unwanted Information (TCU) and Deep Packet Inspection (DPI). DPI analyzes encrypted traffic at the application layer, examining the SNI field in Client Hello packets to identify target domains. Three main evasion strategies exist: (1) Packet fragmentation (Goodby DPI, Zapret) splits domain names across packets to confuse DPI; (2) Traditional VPNs encrypt all traffic but are easily detected by DPI; (3) Protocol masking disguises traffic as legitimate services like Microsoft updates. Technical challenges include QUIC/UDP protocols (used by YouTube and Discord voice) which DPI struggles to analyze, requiring specialized evasion techniques like Magic Cookie signature manipulation. The choice between tools depends on use case: local tools for specific sites, VPNs for complete privacy, and new-generation VPNs for balancing both.

This section introduces sophisticated protocols designed to evade advanced censorship systems. VLESS combined with Reality protocol creates complex traffic patterns using dual-server deployments (one in Russia, one abroad), offering significantly better performance than standard VPN approaches. The video contrasts this with the Tor network, which routes traffic through multiple volunteer-operated relays worldwide for anonymity. Orbot enables Tor routing on mobile devices, while Snowflake protocol offers faster alternatives to traditional Tor circuits. The presenter emphasizes understanding each tool's appropriate use case: direct DPI-circumvention for maximum speed, Tor for anonymity, and specialized protocols for white-listing evasion. Geographical server placement significantly impacts performance, with closer servers reducing latency for users in different regions.

This segment provides a comprehensive overview of Next-Generation Firewall (NGFW) and Unified Threat Management (UTM) technology. The presenters explain that Layer 7 (Application Layer) analysis is the highest level of the OSI model, representing the interaction between users and applications. NGFWs perform Layer 7 analysis by examining all protocols and content within this layer, allowing them to identify and control specific applications that users are accessing. They discuss bypass interfaces that allow network traffic to continue flowing even when the firewall is powered off or experiencing issues. The presenters explain that UTM systems include threat intelligence, updated threat databases, and the ability to perform deep packet inspection. They describe how UTM systems use heuristic analysis to examine packet metadata and identify malicious content, automatically blocking threats and source IP addresses.

UTM (Unified Threat Management) and NGFW (Next Generation Firewall) are essentially the same concept, defined by IDC (2004) and Gartner (2004) respectively. Both describe devices combining firewall, IPS, IDS, and antivirus in a single platform. Fortinet markets as UTM while competitors use NGFW terminology. UTM consolidates multiple security functions (firewall, deep packet inspection, application control, IPS, web filtering, antimalware, DLP, wireless controller, VPN) into a single device, providing comprehensive protection through unified management.

A Next Generation Firewall (NGFW) performs Deep Packet Inspection (DPI) and integrates IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) features. Unlike traditional firewalls that only filter packet headers, NGFWs inspect actual data payloads to detect malicious content. IDS monitors for suspicious behavior and alerts, while IPS actively blocks threats in real-time. This represents advanced network security beyond basic packet filtering.

Next-Generation Firewalls (NGFWs) represent the most advanced firewall technology, functioning as application-layer devices capable of examining application flows across all network communication. NGFWs can identify specific applications regardless of the IP addresses or port numbers they use, enabling intelligent traffic categorization and security policy application. These devices perform deep packet inspection to understand exactly what applications are running on the network, allowing administrators to see detailed breakdowns of traffic types such as web browsing, file sharing, and enterprise applications. NGFWs typically include intrusion prevention capabilities with application-specific rules that recognize and respond to vulnerabilities, along with URL filtering and categorization features.

Firewall technology spans a spectrum from basic to highly sophisticated: SPI (Stateful Packet Inspection) monitors communication streams to prevent piggybacking attacks; UTM (Unified Threat Management) integrates antivirus, anti-spam, and intrusion detection into single devices; NGFW (Next Generation Firewall) represents the pinnacle with upgradeable software, application awareness, and adaptive threat detection. Each category serves different organizational needs and budgets, with NGFWs providing future-proof security through continuous software updates and evolving threat intelligence.

Deep Packet Inspection (DPI) is a data processing technology that examines every data packet traveling through the internet, enabling identification of senders, recipients, application types, and even content itself; while DPI provides valuable benefits such as network security (preventing viruses, spyware, and cyber attacks), traffic management (prioritizing applications like VoIP and video streams), and quality of service improvements, it also raises significant privacy concerns because it allows surveillance, censorship, and extensive user profiling by capturing personal communication data, making it essential to establish guidelines for its appropriate use to balance technological benefits with individual privacy rights.

DPI faces fundamental challenges with encrypted data—it cannot prioritize content within encrypted packets, creating risks for civil society. Fully encrypted communications could be completely blocked or degraded. The technology enables discrimination against encrypted services essential for privacy and security. A distinction exists between non-discrimination (competition law) and equal treatment in net neutrality debates. Liberal approaches rely on competition and transparency rather than heavy regulation, with the Netherlands example showing price increases when explicit regulations were imposed. Technologies with high danger potential like DPI require legal regulations specifying minimally invasive approaches.

Deep Packet Inspection (DPI) is an advanced internet censorship technology that analyzes network traffic at the packet level to identify and block specific content. Unlike simple IP address blocking, DPI examines the actual data being transmitted, allowing authorities to detect and restrict access to websites and services even when users employ circumvention techniques like changing IP addresses. Russia has deployed extensive DPI equipment across its telecommunications infrastructure, claiming 100% coverage of all network nodes. This technology enables more sophisticated content filtering but also raises significant concerns about privacy, freedom of information, and the potential for abuse of censorship powers.

DPI serves dual purposes: corporate security and government censorship. Countries like China, Vietnam, and Egypt use DPI to filter politically sensitive content. For security, DPI detects malware early, helps GDPR compliance by defining sensitive data, and protects intellectual property through transfer restrictions. ISPs use DPI for traffic prioritization, improving service quality for high-demand applications like video streaming. This technology demonstrates how the same mechanism can protect organizations while enabling surveillance.

Deep Packet Inspection (DPI) is a network technology that examines the actual content of data packets rather than just their destination addresses, enabling ISPs to classify traffic types (such as VoIP, HTTP, or P2P downloads) and apply different Quality of Service treatments. While DPI originated from security research for malware detection and can be essential for network security and traffic management, it also enables content filtering, censorship, and discriminatory business practices that raise significant concerns about net neutrality, privacy, and market competition. The political implications of DPI vary significantly across countries depending on their legal frameworks, privacy regulations, and institutional structures, with some nations framing DPI issues as privacy concerns while others focus on network neutrality.