Slinkin Technologies is a software development company in the field of network traffic analysis. The Internet, IoT, Industrial, Infrastructure traffic monitoring.

Slinkin Technologies

SL DC Engine - Dissection and Classification Engine

SL DC Engine

SL Sniifer - Network independent monitor

SL Sniffer

DC Engine

Traffic Engine

DLog

Policy Hub

Packet Patcher

SL Shaper - Network traffic blocking and shaping with full DC Engine capability

SL Shaper



![](/blog/why-is-inline-traffic-monitoring-important/images/webp/inline-cover.webp)

---

#### Content Table

- [Introduction](#introduction)
- [Endpoint node attack](#endpoint-node-attack)
- [Endpoint hardware limitation](#endpoint-hardware-limitation)
- [Agent control](#agent-control)
- [Endpoint software limitation](#endpoint-software-limitation)
- [Conclusion](#conclusion)

---

#### Introduction {#introduction}

The article descrbes the advantages of using **DPI** software not on endpoint devices. It is important to note that, despite the title of the article, the described cases are not related fully to **in-line** mode and it is also applibable for **asymmetric** and **mirroring** modes.

---

#### Endpoint node attack {#endpoint-node-attack}

In the field of information security, no one will be surprised when an attacker gets into the local network of the company and gains _access_ (or even _root access_) to some device within it. Such cases can be very costly to the company. Even more, if an attacker continues invasion by infecting other devices in the network this can lead to critical consequences.

The recommended sequence of actions in such a case:

- **Detect** invasion
- **Isolate** infected node
- **Collect** the important data from the affected device and remove malware/spyware software
- **Analyze** the incident

**DPI** system helps to detect and prevent further spreading of infection (or evil activity) inside the local network. In addition to that, it provides valuable log information for the incident analysis.

![](/blog/why-is-inline-traffic-monitoring-important/images/webp/endpoint-attack.webp)


The advantages of having **DPI** system on the local network:

- It is clearer to detect suspicious activity in the network log than to analyze different kinds of logs on different machines running different operating systems.
- If an attacker gains _root access_ then they can clean any log data on the infected computer to hide traces of the presence such as established connections, login events, data transmitting, etc.
- If an attacker tries to scan the network or do network spoofing - such activity will be visible on **DPI** node immediately. On endpoint devices, such activity can be undetected.

---

#### Endpoint hardware limitation {#endpoint-hardware-limitation}

These days, there are many **IoT** devices that operate within local networks. The main lack of using them is hardware limitation. They are inveted/built to perform one task and nothing more. It is absolutely different story than PC/Laptop/etc. **IoT** devices in the most cases cannot be upgraded.

![](/blog/why-is-inline-traffic-monitoring-important/images/webp/endpoint-hardware-limitation.webp)

In a case, when **DPI** system is presented in the network then there is no need to install security programs on each device. **DPI** collects all network activity and the network engineer can get network log information for any interested device.

---

#### Agent control

Another important note about event collection is a count of agents. When the network is huge enough and it contains machines with different hardware and different operating systems - it becomes difficult to manage them. Much easier to collect data when count of agents are limited by few instances.

![](/blog/why-is-inline-traffic-monitoring-important/images/webp/agent-control.webp)

In such cases it is more reliable to have one **DPI** system for the whole network or at least on instance per network cluster for network log collection. It will reduce the amount of work for network software debugging at endpoint devices drammaticly.

---

#### Endpoint software limitation {#endpoint-software-limitation}

**IoT** devices are the part of many companies and they cannot be ignored. They are difficult to manage, not to mention difficult to install anything on them (in most cases, simply impossible). But they also need protection, because like any device on the network, it is accessible and potentially vulnerable.

![](/blog/why-is-inline-traffic-monitoring-important/images/webp/endpoint-software-limitation.webp)

For such cases, **DPI** can resolve the problem just like in all previous cases - monitoring traffic on a separate node.

---

#### Conclusion {#conclusion}

No one argues, it is important to have security software on endpoint devices. However, it doesn't always work and much better to have **DPI** system in your local network and also have another security solution since working together they provide the best results. **DPI** plays not only security role. It also provides an important information about network activity what can be used for network touble shooting and building reports of user activities or network load statistic.

---

ℹ️ If you find an error in the article, please let us know - edit@slinkin.tech.


Why is in-line traffic monitoring is important? | Slinkin Tech.

Universal Network Solutions