What is Packet Inspection?
Updated: 3 days ago
Packet inspection is the process of examining information carried by network packets so a device or security system can decide how that traffic should be handled. At its simplest, inspection can look at packet headers such as source and destination addresses, protocols and ports. More advanced inspection can also track connection state or examine visible application data.
The important distinction is that packet inspection is not one single technique. Stateless packet filtering, stateful inspection and deep packet inspection look at different information and make different kinds of decisions.
What does packet inspection actually inspect?
Every packet contains control information that helps networks deliver it. Depending on the protocol and inspection system, useful fields can include source and destination IP addresses, transport protocol, source and destination ports, flags and other header values. A basic packet filter can compare these fields against a ruleset without needing to understand the application payload.
RFC 2647 describes packet filtering as controlling access by examining packet headers. NIST similarly explains that packet filters can make decisions using information such as source and destination addresses and TCP or UDP ports.
How does packet inspection work?
A packet reaches an inspection point such as a router, firewall, host firewall or security appliance.
The inspection system reads the information relevant to its policy. This may be packet headers, connection state, visible application content or a combination of these.
The packet is compared with rules, state information, signatures or other policy criteria.
The system decides what to do with the packet. Typical outcomes include allowing it, blocking it, rejecting it, logging it or passing it to another inspection stage.
If stateful inspection is in use, information about the connection can be retained so later packets are evaluated in the context of that flow.
This is why packet inspection is closely associated with firewalls. A firewall controls traffic according to policy, and inspection provides the information needed to make those decisions.
Packet filtering vs stateful inspection vs deep packet inspection
Stateless packet filtering: evaluates individual packets against rules, commonly using header fields such as addresses, protocols and ports.
Stateful inspection: maintains information about active connections and uses that state when deciding whether a packet belongs to an expected flow.
Deep packet inspection: can examine content carried by traffic as well as lower-layer information, where that content is visible to the inspection system.
These categories can overlap in real products. A modern security appliance may combine header filtering, connection tracking, application awareness and other controls rather than fitting neatly into only one label.
What is deep packet inspection?
Deep packet inspection, usually shortened to DPI, goes beyond simple header-based filtering. RFC 7754 describes DPI systems as inspecting traffic as it passes through a network and making allow or block decisions based on characteristics or content of the communication.
DPI can be useful for application identification, security filtering, intrusion detection, malware controls, policy enforcement and network management. It should not be treated as magical visibility into every connection. What a system can inspect depends on protocols, encryption, where inspection occurs and whether the system is actually able or authorised to decrypt traffic.
How does encryption affect packet inspection?
Encryption changes what an intermediary can see. With protected application traffic, an inspection device may still see information needed to route and transport packets, but it cannot simply read encrypted application payload as plain text. Deeper content inspection requires visibility at a point where traffic is decrypted or terminated, or another supported inspection method.
TLS protects application data in transit between endpoints. Packet inspection and encryption therefore interact, but they are not opposites. A network can still apply useful policy to encrypted traffic using information that remains available.
Is packet inspection the same as packet capture?
No. Packet inspection means examining traffic to understand it or make a decision about it. Packet capture means recording packets so they can be analysed, often later. A troubleshooting tool can capture traffic without enforcing a security policy, while a firewall can inspect and act on packets without retaining a complete capture of everything it sees.
Does packet inspection slow down broadband?
It can, but it does not automatically do so. Inspection consumes processing resources. The effect depends on the inspection depth, traffic volume, packet rate, rule complexity, hardware acceleration and the capabilities of the router, firewall or security appliance.
On a fast FTTP or multi-gigabit connection, the broadband line may be capable of moving traffic faster than an older router can inspect it. In that situation the inspection device, rather than the access network, becomes the bottleneck. This is especially relevant when advanced security features are enabled on consumer or prosumer routers.
Packet inspection on home and business networks
Packet inspection is not limited to large enterprise networks. Home routers routinely use stateful firewalling to distinguish expected return traffic from unsolicited inbound traffic. Business networks may add more detailed policy between VLANs or other network zones.
That relationship matters for network segmentation. Creating separate network segments establishes boundaries, while inspection and firewall policy determine what is actually permitted to cross those boundaries.
Packet inspection and VPN traffic
A VPN encrypts traffic between VPN endpoints. An intermediate device can still inspect the outer packets needed to carry the VPN tunnel, but it does not automatically gain visibility into the protected inner traffic. Inspection at or beyond the VPN endpoint is different because the traffic has been removed from that tunnel.
IPv4 and IPv6 packet inspection
Packet inspection applies to both IPv4 and IPv6. The protocols have different header structures and IPv6 depends on ICMPv6 for important network functions, so firewall policy should not simply copy an IPv4 ruleset and assume the result is correct for IPv6.
Practical packet inspection troubleshooting
Identify where inspection is happening. Check the router, firewall, endpoint security software and any separate security appliance.
Temporarily compare performance with optional advanced inspection features enabled and disabled, where it is safe and appropriate to do so.
Check whether the router or firewall can sustain the speed and packet rate of the broadband service with the required inspection features enabled.
Review firewall logs for explicit blocks, rejects or policy matches rather than assuming the ISP or broadband line is responsible.
If a service fails only across a particular VLAN or network segment, inspect the inter-segment policy and connection state.
For IPv6 problems, check ICMPv6 handling and IPv6-specific rules rather than relying only on IPv4 tests.
Common packet inspection misconceptions
Packet inspection always means deep packet inspection: it does not. Header filtering and stateful inspection are also forms of packet inspection.
DPI can always read encrypted traffic: it cannot simply read protected application payload unless the inspection point has appropriate visibility into decrypted traffic.
Packet inspection and packet capture are the same: inspection evaluates traffic, while capture records it.
More inspection always means better security: controls still need correct policy, adequate hardware and appropriate placement.
If broadband is slow, packet inspection must be the cause: it is only one possible bottleneck among the access network, router, Ethernet, WiFi, device and remote service.
Packet inspection FAQs
Can my ISP inspect my packets?
An ISP necessarily handles packets as they cross its network and can process information needed to route and operate that traffic. What application content is visible depends heavily on the protocol and encryption in use. Encrypted application payload is not the same as unencrypted traffic.
Is packet inspection a privacy risk?
It can raise privacy considerations because inspection can reveal information about communications, especially when application content is visible. The practical impact depends on what is inspected, where, for what purpose, what is retained and the legal or organisational context.
Does a firewall inspect every packet?
A firewall processes traffic according to its implementation and policy, but not every product performs the same depth of inspection on every packet. Some decisions can be made from header fields or existing connection state without repeatedly analysing application content.
Can packet inspection block malware?
Some inspection systems can detect and block known malicious patterns or prohibited content when they have sufficient visibility, but packet inspection is not a guarantee that all malware will be detected. Encryption, evasion techniques, unknown threats and configuration all affect what a system can identify.
The key takeaway
Packet inspection is the process of examining network traffic so a device can understand enough about packets or connections to apply policy. Basic filtering looks mainly at headers, stateful inspection adds connection context, and deep packet inspection can examine visible application content. The more work an inspection system performs, the more its hardware capability, configuration, encryption visibility and policy design matter.
To explore the related technical concepts used in this Packet Inspection guide, visit our broadband terminology guide.
