Can deep packet inspection work on encrypted traffic?

Only on the parts that are not encrypted, unless you decrypt. Deep packet inspection (DPI) means reading past the packet headers into the content. With TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. the content is encrypted, so classic signatures that look for a malicious file or command inside the stream no longer match. What stays readable are the unencrypted handshake messages, with the TLS version, cipher and key-exchange choices, a client fingerprint and usually the server name, and the DNS answers that came before the connection. Combined with flow metadata, meaning who, when, how often and how much, that is enough for many detections: beaconing to a command-and-control server, scanning, lateral movement and unusual uploads. To see content you need an interception proxy that decrypts and re-encrypts traffic, with its own costs and risks. NetSenX reads the handshake fields where its agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, not in the basic macOS mode, and it never decrypts traffic.

← All 40 questions on Encryption and encrypted trafficAll topics