Skip to main content
9 votes
Accepted

Can DPI block websites with ESNI?

A DPI solution cannot do targeted blocking when ESNI is used just by looking at the TLS ClientHello. But it can simply block any use of ESNI - see China is now blocking all encrypted HTTPS traffic ...
Steffen Ullrich's user avatar
3 votes

Analyzing Tor traffic through Deep Packet Inspection?

Deep Packet Inspection (DPI) is straight forward to do and is all or nothing capable, but sometimes only a subset is inspected for load reasons. However that is an inspection of the frame packets, it ...
user10216038's user avatar
  • 8,143
3 votes

Can IPsec transport mode prevent DPI by your ISP?

IPSec or other kind of VPN will prevent the ISP from using DPI to analyze the different kinds of traffic transported. But the ISP can detect that there is a IPSec/VPN tunnel and can treat it as low ...
Steffen Ullrich's user avatar
3 votes
Accepted

Using VPN and hidding this fact from ISP.

I recently ran into a similar situation. An internet connection I was legally making use of was using deep packet inspection to prevent the use of SSH Tunnels or VPN. To get around this I setup an ...
CaffeineAddiction's user avatar
2 votes

Identifying URL in SSL

In the case of youtube I have doubts that they can decrypt the Quic protocol or even the SSL, I think is what youtube uses right now. The rest of parameters of rate could be deduce a bit, but I think ...
camp0's user avatar
  • 2,267
2 votes

can HPKP certificate pinning disable DPI inspection on firewall?

can HPKP certificate pinning disable DPI inspection on firewall? No, HPKP has not automatic affect on the firewall and how it does DPI. Is it possible that Firefox and Chrome disable pin ...
Steffen Ullrich's user avatar
2 votes
Accepted

VPN, ISP & deep packet inspection

If your question is whether or not your ISP can tell that you're using OpenVPN rather than browsing an HTTPS website then the answer is yes. Even though both use the same port and TLS, the handshake ...
DKNUCKLES's user avatar
  • 9,217
2 votes

Socket closed depending on data. Am I facing an active firewall? (DPI - Deep Packet Inspection)

Shot in the dark, but maybe this is a firewall or other middlebox that can't handle ClientHello with length field >= 256 (and thus using both bytes of the encoding). When OpenSSL 1.0.1 first ...
dave_thompson_085's user avatar
2 votes
Accepted

What kinds of web applications need dynamic packet filtering or deep packet inspection

I'd ask your customers about what are they looking for in network packets and how deep they want to inspect them. If they want inspection at 4-th level - you can setup free snort/suricata. If they ...
odo's user avatar
  • 682
2 votes

Can a VPN connection be detected (and get blocked) even after the key exchange happens

Yes, the ISP could detect encrypted traffic (likely) corresponding to VPN. They could block it as well (such as blocking the server you are connecting to). They could not block specific traffic inside ...
Ángel's user avatar
  • 18.9k
2 votes

Analyzing Tor traffic through Deep Packet Inspection?

I found this question interesting. I will try to answer to each question assuming that I consider DPI, in this case, equivalent to SSL/TLS Man in The Middle. The DPI which only observe some clues in ...
Sibwara's user avatar
  • 1,338
1 vote

Disable Encrypted Protocols Through Firewall

Is this a normal practice? Well, it's more common (in my limited network security experience) to force the installation of a man-in-the-middle root cert on all clients on that network and then run a ...
CBHacking's user avatar
  • 49.3k
1 vote
Accepted

Surveillance by mobile network provider

(I assume that the service provides scanning of HTTP and HTTPS traffic) If you are using a device via someone else's network you have very little privacy. HTTPS is intended to address that (up to a ...
symcbean's user avatar
  • 18.7k
1 vote

How does a NG Firewall do application visibility and classification of TLS traffic without TLS interception and how reliable is this

They do it on Certificate basis. They check the data on the certificate exchange between server an client, and base on that, they now if you are trying to access to dropbox, outlook, or any other page....
bulw4rk's user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible