Tobias Roeder, Application Engineer at ipoque – a Rohde & Schwarz company, has spent years working at the intersection of deep packet inspection (DPI), open source packet processing, and telecom infrastructure. In a recent interview and follow-up to his DPDK Summit presentation, Tobias offered a candid view into how ipoque’s DPI engine integrates with DPDK rte_table API , and how their customer base, spanning startups to large telcos, leverages DPDK features to build intelligent, efficient, and secure networks.
DPI at Scale: A Practical Overview
ipoque provides a commercial DPI SDK that classifies traffic in real time without requiring decryption. It’s used to classify a wide variety of consumer and enterprise applications (e.g., WhatsApp, Netflix, MS Teams or VPN-Services) up to industrial IOT protocols (e.g. MQTT, Modbus, OPC UA..). The ultimate goal is to identify encrypted flows, and support decisions in firewalls, gateways, loadbalancers, UPFs, and other network functions.
While DPI isn’t new, its complexity has risen dramatically with the growth of encrypted and obfuscated protocols. As Tobias explains, “It used to be simple, most traffic was unencrypted or used more verbose TLS handshakes. Now, TLS 1.3 ESNI and QUIC obfuscation make traditional methods ineffective. Our DPI uses supervised machine learning to differentiate things like video-streaming versus video-downloading. ”
“It used to be simple, most traffic was unencrypted or used basic TLS. Now, TLS 1.3 and QUIC make traditional methods ineffective. Our DPI uses supervised machine learning to differentiate things like video-streaming vs video-downloading.”
Why DPDK?
For ipoque, DPDK serves as the abstraction layer that simplifies NIC access and enables rapid deployment across diverse environments, from embedded NXP devices to BlueField DPUs. “DPDK creates a very well-maintained base layer that abstracts away network card complexity,” Tobias notes. “It is our customers’ first choice of open-source packet processing frameworks.”
“DPDK creates a very well-maintained base layer that abstracts away network card complexity,” Tobias notes. “It is our customers’ first choice of open-source packet processing frameworks.”
Many of ipoque’s customers already have DPDK integrated into their stacks. Others migrate with Tobias’s team’s help. DPDK’s LTS stability and availability of tooling like testpmd are cited as core strengths in onboarding new users.
Feature Focus: Flow Offload and State Tracking
Two DPDK features stand out for ipoque’s use cases:
- rte_flow offload: After DPI classifies a flow (especially long-running “elephant flows” like video or file-transfers), it can be offloaded to the NIC for efficient hardware processing.
- rte_table / rte_cuckoo_hash: These libraries enable robust flow tracking, which is critical for stateful inspection. See details of performance comparisons in Tobias`s DPDK Summit presentation
These libraries simplify otherwise complex aspects of connection tracking, which would need to be built and maintained independently.
AI and ML in DPI
While AI in packet processing is often discussed at the infrastructure level (CI systems, test automation, or inference at the edge), ipoque integrates supervised Machine Learning and Deep Learning algorithms directly into its SDK. This helps identify traffic types even when protocol handshakes offer no visibility.
For instance, distinguishing a user video-streaming from video-downloading (both encrypted) is no longer feasible through traditional methods “Enhancing DPDK QoS with DPI allows for video optimization in 4G/5G packet cores.” Tobias explains.
“Enhancing DPDK QoS with DPI allows for video optimization in 4G/5G packet cores.”
Technical Challenges and DPI Resilience
Tobias acknowledges the performance burden posed by encrypted traffic and evolving transport protocols like QUIC. Features like multiplexed streams over UDP present new challenges to fair scheduling in mobile networks. For this reason, DPI-enabled user plane functions (UPFs) benefit from accurate traffic classification within DPDK-forwarding paths.
Recent Developments at ipoque and Rohde & Schwarz
Tobias’s insights also align with a wave of recent updates from the company:
- Encrypted Traffic Intelligence (ETI): Unveiled at MWC 2025, ETI enhances the classification of TLS 1.3, QUIC, and ESNI traffic using advanced AI without needing decryption. It’s embedded in ipoque’s core DPI engines.
- Open RAN DPI Analytics Report: A 2025 study showed that 74% of RAN vendors view DPI as critical to telemetry, real-time traffic analytics, and slicing logic in Open RAN deployments.
- Partnership with ElastiFlow: By combining IPFIX flow records with DPI insights, the collaboration brings observability into fine-grained, application-aware dimensions — especially valuable for CSPs managing encrypted or obfuscated traffic.
- Expanded 5G Solutions: At MWC, Rohde & Schwarz showcased next-gen monitoring and QoE/QoS tools that integrate ipoque’s DPI stack for real-time 5G visibility.
DPI and the Future of DPDK
When asked what excites him most about the future, Tobias points to cross-project collaboration and expanding DPDK’s reach beyond traditional telecom and networking. “It’s been amazing to see projects like radio telescopes and sensor analytics using DPDK. We’re eager to support use cases that aren’t just about routers, 4G/5G cores and firewalls.”
“It’s been amazing to see projects like radio telescopes and sensor analytics using DPDK. We’re eager to support use cases that aren’t just about routers, 4G/5G cores and firewalls.”
As protocols evolve and encryption deepens, DPI’s role becomes more nuanced. The toolkit must be accurate, passive, and fast, and the packet processing framework underneath must be efficient, adaptable, and stable.
For ipoque, DPDK is the first choice for user-space packet processing. And for the wider ecosystem, Tobias’s work highlights how DPI isn’t just surviving encryption, it’s evolving with it.
[img source p5. https://www.ipoque.com/media/brochures/Solution_guide_en_DPI_3608-7309-62_v0201_144dpi.pdf]
Learn More:
