Point of view to Deep Packet Inspection technology evolution Current products and maket state, application and ecosystem

1. Deep Packet inspection:
Technology and products
Daniel Vinyar
daniel@jet.msk.su
Network Solution Center
11.02.2014

2. DPI technology & products
•
•
•
•
•
DPI technology evolution
DPI current products market
DPI as a product
DPI ecosystem & cases
Technology trends
© 2011 Инфосистемы Джет
2

3. DPI technology evolution
tcp statement
control fw,
simple
NAT/PAT
1992-1997
© 2011 Инфосистемы Джет
Server load
balancing, app
lication
proxy, ADC
1996-2001
SBC, Channel
Optimization,
Security
products
DPI product
2000-2006
2006-xxxx
3

4. DPI current products market
• Traffic identification core- Qosmos, VineYard Networks, Agata Solutions,
Ipoque, windriver
• Hardware components - Tilera, Napatech, Cavium, Radisys
• Standalone solution - Allot Communications, Cisco, Huawei, Ipoque,
Procera Networks, Sandvine, F5
• Embedded solution - Alu, Cisco, Ericsson, Huawei, NSN
Russian developers:
• Natsys-lab http://natsys-lab.com
• VAS Experts http://pcef.ru
• MFIsoft http://mfisoft.ru
• RuChip http://ruchip.com/
© 2011 Инфосистемы Джет
4

5. DPI as a product
•
•
•
•
•
•
•
•
•
•
Network integration – in-line transparent
Flow identification – by IP header 5-tuples
Per flow protocol/application identification
Asymmetric flow control
Flow per Protocol/Application classification
Subscriber identification
Flow per subscriber classification
External control plain integration
Flow per external criteria classification
Flow property extraction
© 2011 Инфосистемы Джет
5

6. DPI as a product
Statistics/accounting
• Long term statistics
• Accounting for billing
• API for BI/Billing
Technical parameters
Billing parameters
Marketing parameters
© 2011 Инфосистемы Джет
6

7. DPI as a product
Traffic Management:
• Shaping & priority – queue management
• Filtering – accept/drop/reject/redirect
• Traffic steering – divert, ADC
• Packet header manipulation – 802.1q, IP, MAC
• HTTP header manipulation/enreachment
© 2011 Инфосистемы Джет
7

8. DPI platform features & parameters
Performance:
• By bandwidth, pps, cps, concurrent flow/subscribers
• By traffic identification
• By external software interfaces
Traffic identification quality (accuracy):
• Number of identified protocols & applications
• Share of unidentified traffic
• Share of identification mistakes
• Protocol property extraction
Traffic management quality:
• Flow description & classification features
• Queue & priority management
• Filters and filtering actions
• Traffic steering features
© 2011 Инфосистемы Джет
8

9. DPI ecosystem
© 2011 Инфосистемы Джет
9

10. Traffic management points
External
National
BB router
Border
router
Transport Intercity/
International backbone
BB router
Mobile
Broadband 3G
External
International
Border
router
BB router
City
Backbone
Mobile IP
Backbone
GGSN
BB router
BRAS
BRAS
FTTB Access
segment
FTTB Access
segment
BRAS
BRAS
Remote town
FTTB Access
segment
FTTB Access
segment
© 2011 Инфосистемы Джет
10

11. Most popular use cases
•
•
•
•
•
•
•
•
Tiered services:
• Differentiated charging
• Service prioritization
• Parental Control
Data CAPS:
• Fair usage
• Quotas
Bandwidth on demand
Shared plans
• Single account multiple devices
• Single account multiple users
RAT type based bandwidth
Location based services
Device type specific
• Different application per device
• Tethering control
Congestion control/network offload
© 2011 Инфосистемы Джет
11

12. Tendencies and trends
•
New application/protocol development
•
Software defined networking/Network function Virtualization
© 2011 Инфосистемы Джет
12

13. Thank you
© 2011 Инфосистемы Джет
13

14. DPI technology evolution
Mid 90 - Syn flood vs. tcp statement control fw, simple NAT/PAT
Second part 90 - Server load balancing, application proxy
• ADC – Alteon, Radware, F5, Brocade, Cisco (HTTP, DNS, SSL)
First half of first decade – different application area:
• SBC - Acme Packet, Audiocodes, Cisco, Genband (SIP, SIGTRAN,
RTP/SRTP)
• Security products – Arbor, BlueCoat, SonicWall (tcp session behaviour,
HTTP URL classification/Filtering)
• Channel optimization - Riverbed (Corp application caching, de-duplication,
compression)
Second half of first decade – DPI as a product
• Mass protocols/application identification
• Per flow manipulation – Statistics/Shaping/filtering
• External control plane for subscriber identification
• Flow classification
© 2011 Инфосистемы Джет
14