It is well known that ISPs use deep packet inspection to deprioritize certain types of network traffic, such as that belonging to filesharing applications. If ISPs achieve this throttling of traffic by examining the payload of IP datagrams, couldn't encrypting the payload with IPsec prevent such throttling?

1 Answer 1


IPSec or other kind of VPN will prevent the ISP from using DPI to analyze the different kinds of traffic transported. But the ISP can detect that there is a IPSec/VPN tunnel and can treat it as low priority traffic, this way making it even worse for you.

  • So the average ISP assumes there aren't likely to be 'legitimate' uses of IPsec, and categorically marks them low priority?
    – aeb0
    Commented Feb 20, 2017 at 21:15
  • 1
    That's not what was said... In Europe ISPs aren't allowed to do DPI and unnecessary prioritization of traffic at all. Net neutrality is a good thing :) Commented Feb 20, 2017 at 22:27
  • 1
    @aeb0: in an ideal world you don't need traffic prioritization because you have enough room for traffic spikes. In the real world and especially in the mobile world you don't have enough so you need to prioritize what is important and what not. In an ideal world this would be easy because traffic has specific tags. In the real world you cannot trust these user given tags so you try to guess by looking closer at the packet. DPI is comparably expensive so most ISP would rather do without but if you want to get the best experience for all users from limited resources prioritization is needed. Commented Feb 21, 2017 at 3:42
  • 1
    @SanderSteffann: Net neutrality does not forbid DPI and does not forbid prioritization because if you have limited resources you need to somehow manage it to get the best user experience. Net neutrality does not forbid use of such techniques but it forbids misuse of such techniques, i.e. it allows to prefer VoIP vs. HTTP but it does not allow to limit traffic from competitors or prefer your own traffic. The idea is not to have no rules but to have the same and non-discriminating rules for everybody. Commented Feb 21, 2017 at 3:46
  • 1
    @SanderSteffann: maybe we have a different understanding of what DPI is. For me this includes everything which looks at the content of the packet, i.e. not only at IP, port and protocol. In ISP environments this is usually not the invasive DPI found in firewalls which is used to block based on URL's or detect malware. Instead it is a fast and less invasive DPI which just tries to use heuristics for classifying the traffic apart from what is possible with IP, port and protocol. Commented Feb 21, 2017 at 9:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .