On Detection Accuracy of L7-filter and OpenDPI

Abstract

Traffic identification is an important issue in the network industry. Due to the rapid increase of applications and protocols in the Internet, traffic identification based on TCP/UDP port numbers is no longer a practical approach. Deep packet inspection (DPI) thus becomes necessary, which scans the payload of a flow for certain patterns. In this paper, we analyze the architectures of two popular open-source DPI solutions, L7-filter and OpenDPI, along with their capabilities and limitations. Our extension to L7-filter, called L7-filter-U, which improves the detection accuracy on UDP flows, is also presented. Experiments on real-world traces show that OpenDPI has higher detection accuracy than L7-filter-U, which in turn performs better than L7-filter.