Vendor throws DPI under the bus, says ISP deployment “risky”

Companies don't often announce that they aren't doing something, much less that they stopped doing it two years ago. But that's what bandwidth-shaping hardware vendor APconnections did in a press release yesterday, throwing deep packet inspection (DPI) under the bus and running it over several times for good measure. Customers, it seems, were increasingly asking questions about the legal implications of deploying the company's products, and CEO Art Reisman said that it is now "quite risky that any public US based ISP would invest in this technique, especially after the FCC slapped Comcast's wrists in a recent decision." Is DPI dying?

Deep packet inspection is a network management tools generally used to identify and control Internet traffic. It was at the heart of the Comcast P2P throttling system that was recently ruled illegal by the FCC. In that ruling, the agency trotted out the envelope metaphor: all Internet packets contain both routing information and content and, when DPI vendors "look inside the envelope," it's no different from postal employees who might do the same thing. In response, Comcast is switching to a system that simply looks at total bandwidth consumption of each user, without trying to identify the type of protocol or content being transmitted.

In the case of APconnections, the company actually shifted to this behavioral approach several years ago, abandoning DPI as a management tool. Reisman says that "our behavior-based techniques worked so well that current customers stopped asking for the layer-7 techniques we had a one time implemented into our system."

"What prompted us to make a formal announcement was the continued industry lack of understanding that deep packet inspection not only does not work very well, but it also puts you at risk of violating privacy laws if you use these techniques without customer consent," he added.

APconnections isn't one of the larger players in the network management space, however; is the company's views shared throughout the industry, or was the announcement simply a way to sow fear, uncertainty, and doubt (FUD) about its competitors' DPI-based tools?

Competitors weigh in

Procera's DPI monster

Procera, a DPI vendor, has an answer: APconnections doesn't know what it's talking about. VP of Global Marketing Jon Lindén tells Ars that his company "strongly disagrees" with APconnections' conclusion.

"The term DPI is being used very broadly here," he says. "It’s true; when talking about Layer 7 shaping, if wrongfully used, it can do more harm than good. But the DPI APconnections is referencing—P2P control based on Layer 7 shaping—is a thing of the past. Although P2P originally presented an opportunity for DPI, this technology has—and continues to—evolve."

As evidence of that evolution, Procera yesterday announced a major $4 million contract with an unnamed Tier-1 mobile operator that wanted its DPI gear. As to legality, Lindén says that much of the fear about the technology is based on misconceptions. "All of our customers have been able to utilize DPI to improve their service and their service offerings—without violating any laws or subscriber privacy," he says. "We work very close with them to help them do this properly."

Arbor Networks, another major US DPI vendor, concedes that the Comcast ruling has "helped providers better understand where and how to apply the technology," but insists that demand "remains very strong."

In contrast to APconnections' claim of legal uncertainty regarding DPI, an Arbor spokesperson tells Ars that "the US government has encouraged the use of DPI for security and filtering illegal content" through laws such as CALEA.

"The debate," he adds, "has always been the application of the technology and the disclosure around it."

But even within the industry, concerns about DPI remain quite real. Vendors want to avoid being put of business by unfavorable court rulings or Congressional hearings, which came close to happening this year with NebuAd. Even foreign vendors are watching US cases carefully to see how they might affect their business.

Ipoque, a traffic-shaping vendor based in Germany, uses DPI and behavioral analysis in its products. Is the company have second thoughts about DPI? "Yes, of course," a spokesperson tells Ars. "We are watching the Comcast-FCC debate carefully. And we are afraid that this might go in the wrong direction."