I have some customers requesting that we put apply DPI or dynamic packet filtering in front of our web server. For the simplicity of my service, I'm feeling like this is over kill. What kinds of web apps really benefit from DPI / DPF as opposed to just building in adequate protections at the web app level ie SQL injection prevention, etc?
I'd ask your customers about what are they looking for in network packets and how deep they want to inspect them.
If they want inspection at 4-th level - you can setup free snort/suricata. If they want it at level 7 - there are plenty of choices from free mod_security to cloud-based WAFs.
DPI as it meant to be is very resource-intencive, and mostly used by ISPs or large enterprises.