on between the end-hosts. However, in some cases layer 2 can be considered also in this group of layers for inspection. An illustration of DPI is given in Figure 2.16. The reasons for packet inspections may vary from case to case, SO the targets may include finding viruses, spam, intrusions, or certain protocol non-compliance, and SO on. However, there can be other criteria associated with DPI filtering rules, which may include security as well as QoS topics. In fact, DPI is directly related to the firewall concept, where firewalls have both types of implementation (stateful and stateless). Stateless refers to packet filtering where each packet is independently filtered in respect to other IP packets. Stateful inspection deals with the state of a given connection (e.g. between two end-hosts, a client and a server). DEEP PACKET INSPECTION (DPI) Layer 2 Layer 3 Layer 4+ Application layer header header header header Application data Figure 2.16 Deep packet inspection (DPI). 2 Internet QoS The state of the connections is a kind of vague definition because it very much depends upon the protocols being used (e.g. application layer protocols). In this regard, the DPI is in fact a stateful and dynamic packet inspection which identifies many applications and protocols (many times doing it with certain heuristic methods, i.e. not standard- ized ones, and methods being proprietary and developed by equipment vendors). DPI typically uses TCP and UDP port numbers as well as IP addresses in IP headers for matching packets belonging to the same connection (e.g. 5-tuple can identify any IP connection), but also it may inspect non-TCP and non-UDP IP protocols by using data packet inspections for certain matching values. What is the potential QoS role of DPI? Well, it can be used to provide classification of individual sessions and their application/traffic type, which may be needed for traffic management. Also, it can be used to provide differentiated charging (e.g. user traffic from/to certain OTT application not to be charged). 