How DPI Works in the Alta Labs Platform

Deep Packet Inspection (DPI) lets the system look beyond basic IP/port details to recognize applications and services. Within the Alta Labs platform, DPI powers traffic graphs, the dashboard Top Applications view, and application-aware filtering.

This article explains how DPI works in our products, where you can view DPI data, and how to enable or disable it. For readers interested in a broader background on DPI technology, we’ve included external resources at the end of this article.

Where You’ll See It

DPI data is visible in several areas of the dashboard and client views:

• Dashboard → Top Applications
  Displays the top applications currently detected by the DPI engine. Data can be viewed across fixed time windows: live, 1 hour, 2 days, or 2 months. Below is the main dashboard.
  
  And this is an example showing 2 months of Top Active Application data for this example site.
  
   
• Access Point (AP) view
  Go to Network → [AP] → Info → DPI.
  Here, you can view DPI data aggregated for all connected clients, shown for the last minute.
  
   
• Client device view
  Go to Devices → [Client] → Info → DPI.
  Shows DPI data on a per-device basis. This applies to both wired and wireless clients.
  
  Or if you hover over traffic on the traffic graph for a client device found on the Devices page from a web browser, then you may see a hover modal that resembles what is shown below.

Note: At the time of writing, APs display one-minute DPI data aggregated across their connected wireless clients. Wired DPI data is available only on a per-client basis. For an overall view of all wired and wireless traffic together, see the Top Applications section on the dashboard.

DPI and Content Filtering

DPI powers features such as Content Filtering by identifying applications, services, and protocols. Configuration of Content Filtering is managed separately in its own section of the dashboard.

For details, please see our Content Filtering article.

How to Enable or Disable DPI

DPI is enabled by default. You can disable it at any time if required for troubleshooting or personal preference:

1. Go to Settings → System → Advanced → DPI Engine.
2. Toggle APs to control wireless DPI.
3. Toggle Router to control wired DPI.

There is no performance penalty when DPI is enabled, so we recommend leaving it on in most cases.

Wrap-Up

DPI is enabled by default and provides visibility into application traffic across your network. It also serves as the foundation for features like Content Filtering. While you can disable it if needed, most environments will benefit from keeping it enabled.

Want to Learn More About DPI?

If you want to dig deeper into DPI beyond how we use it, here are some good starting points:

• Deep Packet Inspection (DPI) Explained – Splunk Blog  A straightforward overview of what DPI is, how it works, and where it’s used.
• Deep Packet Inspection – Wikipedia  A regularly updated reference with technical background, use cases, and history.
• What Is Deep Packet Inspection (DPI)? – Zenarmor  Tutorial-style writeup with diagrams and examples.
• Deep Packet Inspection (DPI) – Fortinet Cyberglossary  A glossary entry with a quick definition and common uses.

These links are provided for general educational purposes only.