On Detection Accuracy of L7-filter and OpenDPI

Traffic identification is an important issue in the network industry. Due to the rapid increase of applications and protocols in the Internet, traffic identification based on TCP/UDP port numbers is no longer a practical approach. Deep packet inspection (DPI) thus becomes necessary, which scans the payload of a flow for certain patterns. In this paper, we analyze the architectures of two popular open-source DPI solutions, L7-filter and OpenDPI, along with their capabilities and limitations. Our extension to L7-filter, called L7-filter-U, which improves the detection accuracy on UDP flows, is also presented. Experiments on real-world traces show that OpenDPI has higher detection accuracy than L7-filter-U, which in turn performs better than L7-filter.