# Can deep packet inspection work on encrypted traffic?

Only on the parts that are not encrypted, unless you decrypt. Deep packet inspection (DPI) means reading past the packet headers into the content. With TLS the content is encrypted, so classic signatures that look for a malicious file or command inside the stream no longer match. What stays readable are the unencrypted handshake messages, with the TLS version, cipher and key-exchange choices, a client fingerprint and usually the server name, and the DNS answers that came before the connection. Combined with flow metadata, meaning who, when, how often and how much, that is enough for many detections: beaconing to a command-and-control server, scanning, lateral movement and unusual uploads. To see content you need an interception proxy that decrypts and re-encrypts traffic, with its own costs and risks. NetSenX reads the handshake fields where its agent captures packets, on Linux or as a SPAN/TAP sensor, not in the basic macOS mode, and it never decrypts traffic.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/can-deep-packet-inspection-work-on-encrypted-traffic

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can malware be detected from flow statistics alone?](https://netsenx.com/en/faq/can-malware-be-detected-from-flow-statistics)
- [Can encrypted traffic reveal what is inside it?](https://netsenx.com/en/faq/can-encrypted-traffic-reveal-what-is-inside)
- [Is network metadata personal data under GDPR?](https://netsenx.com/en/faq/is-network-metadata-personal-data-under-gdpr)
- [Can you get malware from an HTTPS website?](https://netsenx.com/en/faq/can-you-get-malware-from-an-https-website)
- [Can HTTPS traffic be intercepted by a man in the middle?](https://netsenx.com/en/faq/can-https-traffic-be-intercepted)