Deep packet inspection (DPI) is software in an operator's network that recognises what kind of traffic each connection carries, such as a video stream, a voice call or a game, and then applies the operator's rules to it. Data on the internet travels in small pieces called packets. An ordinary router reads only the address on each packet. DPI looks deeper, at patterns inside and around the packets, to work out which app sent them.
Most traffic today is encrypted, so DPI usually cannot read the content. It works from other clues instead. At the start of a connection, the phone often names the server it wants, and DPI reads that name. DPI also looks at the size and timing of the packets. For example, a video call sends small packets in both directions every few milliseconds. A video stream sends large bursts in one direction, with pauses between them.
DPI sits on the path between the packet core and the internet. Beside it runs policy software. A policy is a rule written by the operator, and the policy software decides which rule applies to which connection.
Imagine a tower beside a college hostel in Nashik, where connections become slow every evening. The DPI report for that tower shows that between 8 p.m. and 11 p.m., 68% of the traffic is video streaming, and video calls are only 4%. So the operator's planners add capacity to that tower first. The same report helps the operator decide which streaming servers to host inside its own network, closer to users, so that popular videos do not have to travel across the internet each time.
In India, the rules limit what DPI may be used for. Under TRAI's 2016 rules on data tariffs, an operator may not charge differently for different apps or websites. Under the net neutrality conditions that DoT added to operators' licences in 2018, it may not slow down one app to favour another. Reasonable traffic management, such as sharing a crowded tower fairly among all users, is allowed. So Indian operators use DPI mainly for measurement, capacity planning, security and blocking websites under government orders.
DPI also supplies other systems. It reports usage by type to telecom billing and real-time charging, for business plans that need it. It helps lawful interception pick out the sessions named in an order. It reports traffic that does not match a customer's plan to revenue assurance and fraud management. A company's own next-generation firewall uses the same idea to recognise apps, but it protects one company's network, not an operator's.