Now look, realistically it'll be impossible for us to be able to inspect every single packet
and also maintain reliability of speed if we're the network and security administrators of an
organization. As the example I gave earlier with the mysterious package that was mailed to me,
imagine that the package was sent from a user yourself and then it goes to a website
and all the post office network in between is the internet that is being able to route this packet
to from point A to point B. Now inside of that packet are going to be a few of the different
parts of the OSI model. More specifically in relation to our example here, it's a to and
from address as far as figuring out who it's coming from and who it's going to. All the
information in the middle is for the purposes of this exercise irrelevant. And so what happens is
is that packet makes it to the website and there's stuff inside of it and that normally that packet
just gets looked at on the outside. To, from, and everything looks valid we're just going to pass
the packet on through and once it makes it to the final destination of its intended recipient
then it gets opened up. And what's inside of that packet once it's opened up is where us
pen testers make our money at. Because it could be that it's like I said Netcat earlier or it could
be something else that we made with Metasploit or a fake file or whatever the case may be.
Now without the use of encryption or encapsulation of any type those packets can be looked at
normally by the end user system. So basically whoever the recipient is once it makes it to
them. So they open it up and they take a look at what's inside and they see that's all these
little fake crystal things from my electric fireplace. Now this is not encrypted. You can
see these plain as day and they are what they are. So as far as the end user is concerned when they
get the package it's legitimate. Because let's say the end user has requested these because they
just installed an electric fireplace of their own and they wanted these. So opening up the package
they get these and everything looks right on the actual heading of the envelope itself or the
packaging and everything looks hunky-dory. Nobody's none the wiser because there was nothing to be
wiser about. But then we go a little bit deeper pun intended there because with deep packet
inspection we would actually be inspecting the contents from point A to point B somewhere in the
middle. Usually at an IDS or IPS device of some type whether it be host or network based. And
there's a couple of things that can happen here. We could set rules to say deep packet inspect
packets that don't pass the smell test. More on that in a second. Or we could say deep packet
inspect everything. And this is where we get into the cluster that we were discussing earlier in
this video where speed efficiency takes place. Because if you deep packet inspect every single
packet that's coming in and out of your network it's going to slow down the speed of all data
going in and out. Because every packet has to stop, get opened up, take a look at all the contents
because this entire box is filled with these things. Make sure that each one of these little
fake crystals is a fake crystal for an electric fireplace. Repackage it back up, seal the envelope,
and then send it on to the intended recipient or allow it inside of our actual network itself.
And that can cause a lot of slowness. So in order to be able to compensate for that
the organization that's doing the deep packet inspection either has to have a lot of different
load balancing and inspections dedicated hardware and also a blast of bandwidth. Or they just have
to accept the fact that things are going to slow down because there will be a backlog. Because the
bigger these packets are, let's say this is just a normal sized packet, and you get another one here
10 minutes later that's a whole box of them. And you have to be able to slow down and inspect
every single one of those. Well or the other reason that we would inspect is that it doesn't
pass the smell test. And there's a lot of things that can trigger the smell test alert. Now I'm
using smell test as the you know the qualified technical term of how we would do this. But there
are rules that we can put in place to be able to trigger a deep packet inspection on something
that doesn't look quite right. Let's say the to and from recipients are a little mangled up and
they're not fully uh not legible but not what they should be. We have a packet that's technically
coming from Canada for instance, but inside of the actual header itself the IP address of
origination is from Texas. That kind of doesn't make sense so this may trigger a deep packet
inspection. So in mail terms, and this is a law inside the United States, that if I send a package
from point A to point B through regular stale mail, let's say the markings on the package are written
in uh the old ransom note letters. You know a letter from each different type of magazine is
pasted on here looks like a ransom note. That might trigger somebody to take a deeper look at
the actual package itself. Or let's say that I go to my garage and package this package this up
and send it to somebody and unbeknownst to me because I'm used to it already, I have a can
that's opened up in there of gasoline and for whatever reason the smell got onto this box.
And so somewhere in transit the postal service sees this and smells it and says whoa something's
not right here we want to take a deeper look at that. And so they start going into it just to
make sure that it's not something malicious. And that's kind of the same rules on the digital side
of the house as well too because if the rules don't they pass the rules but they don't quite
line up or something seems a little bit off about it then that might trigger a deep packet inspection.
But like I said there's one of two ways we could do this as security technicians and it's either
do it all the time or do it some of the time with qualified rules justifying the some of the time
occurrence and frequency of that.