Deep Packet Inspection Material Digest

In our first issue of the DPI-digest, we picked up materials from experts on the topic of traffic analysis and blocking, comparison of platforms and manufacturers of DPI-systems. Today we decided to make a selection for those who are interested in the work of the Internet provider and more detailed information on the work of the Deep Packet Inspection technology.

/ Flickr / pascal / PD

“Quick start”: 5 steps to start an Internet provider

• We conducted a brief analysis of the market of Internet providers and made a basic instruction for those who would like to launch their own company. About what is required to solve such a difficult task - in our material.

“Cache and compress”: 4 ways to save bandwidth

• Even with the rapid expansion of the capabilities of the IT infrastructure of the provider, you should think about saving bandwidth. This is necessary in order to ensure the comfortable work of all customers. We considered practical options for action, taking into account the capabilities of the cache server - an additional component of the DPI system.

"Rating of Internet resources": Traffic analysis by means of DPI

• Here we figured out why the provider should analyze the data broken down by application, protocol, tariff plan and other categories. At the same time, we dwelled a little on how the “ module for viewing statistics and reports ” helps with solving the problem of optimization and cost reduction.

“Unload and ensure speed”: Experience of SCAT implementation on ANADYR.NET communication network

• We tell how to implement the DPI solution, which is not tied to any equipment, in just two weeks. And also about how the provider can solve the problem of traffic distribution, without shifting the problem to the client, and at the same time fulfill all the requirements of Roskomnadzor.

How to use QoS to ensure the quality of Internet access

• We give an illustrative example to understand the essence of the traffic distribution system, give universal advice, consisting of several specific steps, on setting up the quality of service function in the home network. And also we tell how QoS is used by the provider, and most importantly - why.

Filtering Internet content for schools. Using Whitelists (ACL)

• Let's talk about how providers help schools protect students online. Why, in the case of schoolchildren, the formation of a blacklist does not have the effect, and how to make it so that it was impossible to bypass the lock. And also about the laws governing access to the Internet in schools.

Alerting the public in case of emergencies - a solution for telecom operators

• Today, the standard methods of warning the public through televisions and radio are unlikely to work - many people have not only radio receivers, but even televisions. Therefore, for this category, the most reliable, if not the only possible way of warning today is the Internet. And DPI systems give this opportunity to providers.

/ Flickr / pascal / PD

Library of the administrator of systems for traffic analysis (DPI)

• We offer you a selection of books that must be read both for those who are only at the beginning of the path of learning DPI, and for specialists in this field. Selected 8 books will give you the knowledge and understanding of how to work with network traffic: configure, analyze, and manage it.

Choosing the Russian DPI system

• We talk about what is important when choosing a platform for in-depth analysis of traffic. And also we compare the characteristics of the largest players on the Russian market of DPI-systems and choose the best systems in three nominations.

Public Wi-Fi. Analyze and manage with DPI

• Using a specific example, we show how the DPI platform helps to distribute the network load during a major event and thereby reduces this load. Also, we compare traffic consumption with enabled and disabled restrictions and describe the security situation for a public Wi-Fi network.

Subscriber identification in a Wi-Fi network by phone number

• In the article you will find information about why identification is needed and who should carry it out. Did you know that there are only three ways to identify? In addition, we will describe in detail how identification is performed using our SCAT DPI system and show how our system is configured.

New features of SCAT: SNI, BRAS, CG-NAT

• How our DPI system is developing: how sites are blocked now, how SNI filtering allows dot-blocking of domains and how SCAT can be used to create IPoE tariff plans. And also about the current functions of the platform and plans for the near future.

What's new in SCAT 6.0 “Sevastopol”

• In the article, we will describe in more detail about the new features: for example, how NAT functions can make life easier for corporate clients, what new features appeared in IPFIX, what new functions SCAT acquired as BRAS, and what updates are planned for 2017.

DPI system SCAT as L3 BRAS

• We are talking about what BRAS is, what tasks the device solves, about its configuration and the conditions for ensuring its correct operation. Consider the types of termination of subscribers that are used in the SCAT system, and the integration of BRAS into the operator’s network. In conclusion, we give examples of the application of our system with this function.

/ Flickr / pascal / PD

Introduction to DPI: System Composition and Connection Diagrams

• In this post on Habré, we talked about the standards of 3GPP and the elements of mobile networks built to meet these standards. And also about the differences between the active installation scheme "into the gap" from the passive traffic mirroring scheme, their advantages, possible problems and ways to solve them.

DPI Technology at a Glance - Deep Packet Inspection

• Here you can read more about what the DPI system is, what major global manufacturers are on the market, how to use in-depth traffic analysis systems and why they are needed at all. And a little bit about how the network model will change in the future, due to which providers will be able to earn more, as well as a few words about how DPI uses special services, and what network neutrality is.

Machine learning instead of DPI - traffic classifier

• The main disadvantage of DPI is the need to see the payload, which is not always possible. But the main task of DPI can be performed without the most in-depth analysis. Read more about how to implement the definition of an application-level protocol with a minimum set of information, read the article.

Bypassing the DPI provider on the OpenWrt router using only busybox

• It has long been known that the more restrictions there are, the more ways there are to circumvent them. In the post, read more about how users found a way around DPI if the system tries to allocate a URL from the first packet with data from the client to the server.

We fool the DPI with two scripts

• Another way to bypass DPI, developed by the user. How can you easily and easily access the blocked page if the provider redirects you to the blank page?

Fighting DDoS - CAPTCHA and its history

• Everyone knows that CAPTCHA is used to protect against DDoS attacks and helps to identify who generates requests to the site - a person or a bot. But not everyone knows when and by whom such a system was developed, why the developers needed archival numbers from The New York Times and old books, and why images with cats rather than text are now increasingly used to protect them.

DDoS attack with IoT devices

• Why do attackers choose IoT devices? How is hacking done? What do you need to do to protect yourself and what does the provider do for your safety? Read the answers to these and other questions in the article.