All DDoS Definitions
DDoS Testing Definition

Deep Packet Inspection (DPI)

Deep packet inspection (DPI) is a defensive control, one of the filtering mechanisms a DDoS test exercises to confirm it separates attack traffic from legitimate flows. Unlike header-only filtering (ACLs, basic firewalls) that decides on IP, port, and protocol alone, DPI examines the packet payload, reading into the application layer to match signatures, anomalous request patterns, or malformed protocol behavior. That visibility lets it drop floods that look valid at the transport layer but carry attack content, such as L7 request floods or protocol-abuse vectors.

Deep packet inspection: read the payload, not just the header header payload GET /? x 10k incoming packet Header filter (ACL) src, port, protocol only looks valid, pass Deep inspection reads into the payload, matches an L7 flood signature, drop drop Cost of inspecting every byte DPI CPU load, near saturation DPI catches what header filtering cannot, but the inspection tier can itself become the layer of first failure. A test characterizes the packet rate where inspection cost saturates the device, and checks its false-positive rate. BlackNeuron™
Diagram: deep packet inspection reads the payload to drop a flood that passed header-only filtering, at a high CPU cost

Why it matters in DDoS testing

DPI is computationally expensive: inspecting every byte at line rate consumes far more CPU than header matching, so a DPI tier can itself become the layer of first failure under a high packet rate. A test characterizes that ceiling, the point at which inspection cost saturates the device, and checks its false-positive rate so legitimate users are not caught in the filter.

For where inspection sits relative to edge scrubbing, see AWS Shield vs Cloudflare DDoS Protection.