Usefulness of Deep Packet Inspection (DPI)

Question

Guys, can anyone give me a real wordl example of the usefulness of DPI? An engineer enabled it across the board on our agents but the info it provides to my eye is pretty useless. It seems to tell you things like 'traffic to Active Directory is slow' but so what! No detail on what process, what type of packet etc. Seems useless. I used Splunk stream and its free and much more powerful. Maybe I'm missing something?

m_roberts · Accepted Answer

First of all, you do not need the Quality of Experience functionality enabled on all your agents. QoE should be used in locations where you wish to analyse the performance of the traffic flowing over it; either as a spanned port on a switch or installed directly on an end point server that provides the service.

As far as the use of the Orion DPI capabilities, it is NOT designed to perform true DPI, rather to measure the performance of packets based on the timings of the returned packets to help identify issues related to the network or application responsiveness. While you can create new HTTP based application entities and update mapped network port traffic to traffic categories, for now that is not something you can use as a security tool.

I cannot speak for SolarWinds' future plans, but that is it for current usage of the DPI feature (QoE) for now.

Usefulness of Deep Packet Inspection (DPI)

Top Replies