A high-performance Deep Packet Inspection (DPI) Engine built in C++17 for real-world network traffic analysis, application-level traffic classification, TLS inspection, and multi-threaded packet processing.
Real traffic. Real packets. Real protocol parsing.
No simulations. No APIs. Just raw network traffic.
Most packet analyzers stop at basic packet parsing. This DPI Engine goes several layers deeper by performing:
- Deep Packet Inspection (DPI)
- TLS Server Name Indication (SNI) Extraction
- Five Tuple Flow Tracking
- Multi-threaded Packet Processing
- Application-Level Traffic Classification
- Rule-Based Packet Filtering
- Real Internet Traffic Analysis
- PCAP Traffic Processing
- Load Balanced Packet Distribution
Unlike conventional packet analyzers, this engine was validated using real-world network traffic captured through Wireshark and processed using a multi-threaded DPI pipeline.
✔ 25,520 Real Network Packets Analyzed
✔ 29+ Million Bytes Processed
✔ Multi-threaded Architecture
✔ Application-Level Traffic Classification
✔ TLS SNI & DNS Inspection
✔ Five Tuple Based Flow Tracking
✔ Rule-Based Packet Filtering
✔ Wireshark Integration
✔ Real World Traffic Analysis
✔ Modular Systems Programming Design
Captured actual internet traffic using Wireshark and exported it as a PCAP file for Deep Packet Inspection.
The captured traffic was exported as a PCAP file and processed by the DPI Engine.
The engine initializes Load Balancer and Fast Path threads to efficiently distribute packet workloads.
The DPI Engine successfully analyzed real network traffic.
| Metric | Value |
|---|---|
| Total Packets | 25,520 |
| Total Bytes | 29,252,849 |
| TCP Packets | 1,988 |
| UDP Packets | 23,532 |
| Forwarded Packets | 25,520 |
| Dropped Packets | 0 |
| Multi-threaded | Yes |
| Real Traffic Tested | Yes |
The DPI Engine identifies applications and services using:
- TLS Server Name Indication (SNI)
- HTTP Host Headers
- DNS Queries
- Packet Metadata
- Port-based Classification
Successfully detected traffic from services such as:
GitHub
Google Services
YouTube
Twitter / X
HTTPS Traffic
DNS Traffic
Mozilla Services
TLS Traffic
Various CDN Services
INPUT PCAP FILE
|
v
PCAP READER
|
v
PACKET PARSER
|
v
LOAD BALANCER
|
v
FAST PATH THREADS
|
v
APPLICATION CLASSIFIER
|
v
RULE BASED FILTERING
|
v
OUTPUT PCAP FILE
|
v
TRAFFIC REPORTS
Ethernet Frame
↓
IPv4 Packet
↓
TCP / UDP Parsing
↓
Payload Extraction
↓
TLS SNI Inspection
↓
Application Detection
↓
Rule Evaluation
↓
Packet Filtering
↓
Traffic Statistics Generation
↓
Output PCAP File
The multi-threaded pipeline uses:
- Reader Thread
- Load Balancer Threads
- Fast Path Threads
- Thread Safe Queues
- Output Writer Thread
- Consistent Hashing for Flow Tracking
Reader Thread
|
v
Packet Queue
|
-------------------------
| |
v v
LB-0 LB-1
| |
---------- ----------
| | | |
v v v v
FP0 FP1 FP2 FP3
\ | | /
\ | | /
Output Queue
|
v
Output Writer Thread
This architecture ensures packets belonging to the same connection are processed by the same Fast Path thread, enabling accurate flow tracking and better scalability.
The DPI Engine performs Deep Packet Inspection on TLS Client Hello packets to extract:
- Server Name Indication (SNI)
- Domain Names
- Application Signatures
Example:
TLS Client Hello
↓
SNI Extension
↓
www.youtube.com
↓
Application Classification
↓
YOUTUBE
This allows application-level traffic identification even for HTTPS traffic.
- Ethernet Frame Parsing
- IPv4 Packet Parsing
- TCP Packet Parsing
- UDP Packet Parsing
- TLS SNI Inspection
- HTTP Host Header Inspection
- DNS Query Inspection
- Application-Level Classification
- Service Identification
- Traffic Statistics Generation
- Five Tuple Flow Tracking
- Multi-threaded Processing
- Load Balancing Architecture
- Fast Path Packet Processing
- Thread-safe Queues
- Rule-Based Packet Filtering
- Application Blocking Support
- IP Based Blocking Support
Ethernet
IPv4
TCP
UDP
HTTP
HTTPS
DNS
TLS
PCAP
GitHub
Google
YouTube
Twitter / X
HTTPS
DNS
Mozilla
TLS
Various CDN Services
The project follows a modular architecture where packet parsing, traffic classification and packet processing are separated into independent components.
| Category | Technologies |
|---|---|
| Language | C++17 |
| Networking | TCP/IP, UDP, IPv4 |
| Packet Capture | Wireshark |
| Packet Format | PCAP |
| Traffic Analysis | Deep Packet Inspection |
| Classification | TLS SNI Inspection |
| Architecture | Multi-threaded |
| Programming Paradigm | Systems Programming |
Real World Traffic Tested YES
Packets Processed 25,520
Traffic Processed 29+ MB
Application Classification YES
TLS SNI Extraction YES
Five Tuple Flow Tracking YES
Rule Based Filtering YES
Multi-threaded Architecture YES
Wireshark Integration YES
Output PCAP Generation YES
Clone the repository:
git clone https://github.com/girish-xd/Deep-Packet-Inspection-Engine.gitMove into the project:
cd Deep-Packet-Inspection-EngineCompile:
g++ -std=c++17 -pthread -O2 -I include -o dpi_engine \
src/dpi_mt.cpp \
src/pcap_reader.cpp \
src/packet_parser.cpp \
src/sni_extractor.cpp \
src/types.cppAnalyze a PCAP file:
./dpi_engine input.pcap output.pcapRun the multi-threaded engine:
./dpi_engine test_dpi.pcap output.pcapGenerate sample PCAP data:
python3 generate_test_pcap.py- Live Packet Capture Support
- Real-time Traffic Monitoring
- QUIC / HTTP3 Support
- Interactive Traffic Dashboard
- Advanced Application Classifiers
- Enhanced Protocol Support
- Performance Optimizations
- Persistent Rule Management