The reason of the world moving majorly onto the techniques such as DPI is the recognition of protocols on a non-standard port as well. Consider a scenario where an FTP server is listening on port 10008, which is a non-standard FTP port, or where an attacker infiltrated the network and is using port 443 to listen to FTP packets. How would you recognize that the HTTP port is used for FTP services? DPI allows that and discovers what lies inside the packet rather than just identifying the type of service based on the port numbers. Let's see an example of a capture file:
From the preceding screenshot, we cannot exactly figure out the type of application layer the TCP packets are referring to. However, if we look closely in the data of the packet, to our surprise, we have the following:
We can see that the decoded data contains a list of FTP commands...
