SonicWALL Deep Packet Inspection
17
SonicWALL TZ 180 TotalSecure
Figure 1 Deep Packet Inspection Flow Diagram
The following steps describe how the SonicWALL Deep Packet Inspection Architecture functions:
1. Pattern Definition Language Interpreter uses signatures that can be written to detect and prevent
against known and unknown protocols, applications and exploits.
2. TCP packets arriving out-of-order are reassembled by the Deep Packet Inspection framework.
3. Deep Packet Inspection engine preprocessing involves normalization of the packet’s payload. For
example, a HTTP request may be URL encoded and thus the request is URL decoded in order to
perform correct pattern matching on the payload.
4. Deep Packet Inspection engine postprocessors perform actions which may either simply pass the packet
without modification, or could drop a packet or reset a TCP connection.
5. SonicWALL’s Deep Packet Inspection framework supports complete signature matching across the
TCP fragments without performing any reassembly (unless the packets are out of order). This results
in more efficient use of processor and memory for greater performance.
/UTPUT0ACKET
)NPUT0ACKET
