{"id":2409,"date":"2026-09-16T14:30:22","date_gmt":"2026-09-16T13:30:22","guid":{"rendered":"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/dpi-for-law-enforcement\/"},"modified":"2026-09-16T14:47:49","modified_gmt":"2026-09-16T13:47:49","slug":"dpi-for-law-enforcement","status":"publish","type":"page","link":"https:\/\/ic-services.io\/de\/solutions\/deep-packet-inspection\/dpi-for-law-enforcement\/","title":{"rendered":"DPI f\u00fcr die Strafverfolgung"},"content":{"rendered":"\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-1 is-layout-constrained wp-container-core-group-is-layout-b07bb602 wp-block-group-is-layout-constrained\" style=\"color:#ffffff;background:linear-gradient(135deg,#071426 0%,#0b2240 60%,#0e3b4f 100%);padding-top:80px;padding-right:24px;padding-bottom:80px;padding-left:24px\">\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-1f0287b6 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:54%\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#3DD6D0;font-size:14px;font-weight:700;letter-spacing:2px;text-transform:uppercase\">ENCRYPTED TRAFFIC ANALYSIS<\/p>\n\n\n\n<h1 class=\"wp-block-heading has-text-color\" style=\"color:#ffffff;font-size:clamp(32px, 3.6vw, 46px);line-height:1.2\">DPI for Law Enforcement: Making Encrypted Intercepts Usable<\/h1>\n\n\n\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#c9d8e6;font-size:19px;line-height:1.6\">Identify apps, devices and activities in encrypted IP intercepts with TLS fingerprinting, traffic pattern recognition and correlation, inside the ICS LEMF analyst workbench.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-container-core-buttons-is-layout-184438a2 wp-block-buttons-is-layout-flex\" style=\"margin-top:28px\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-text-color has-background wp-element-button\" href=\"https:\/\/ic-services.io\/contact\/\" style=\"border-radius:6px;color:#ffffff;background-color:#258e6f;padding-top:14px;padding-right:26px;padding-bottom:14px;padding-left:26px;font-weight:700\">Request a demo<\/a><\/div>\n\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link has-text-color has-border-color wp-element-button\" href=\"https:\/\/ic-services.io\/products\/software-solutions\/law-enforcement-monitoring-facility\/\" style=\"border-color:#ffffff;border-width:2px;border-radius:6px;color:#ffffff;padding-top:12px;padding-right:24px;padding-bottom:12px;padding-left:24px;font-weight:700\">Discover ICS LEMF<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:46%\">\n<figure class=\"wp-block-image size-full has-custom-border\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"900\" src=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics.jpg\" alt=\"DPI for law enforcement: encrypted traffic analysis of intercepted IP data with TLS fingerprinting, app classification and correlation timelines\" class=\"wp-image-2387\" style=\"border-radius:14px\" srcset=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics.jpg 1200w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-300x225.jpg 300w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-1024x768.jpg 1024w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-768x576.jpg 768w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-16x12.jpg 16w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-d0fb4031 wp-block-group-is-layout-constrained\" style=\"background-color:#ffffff;padding-top:56px;padding-right:24px;padding-bottom:8px;padding-left:24px\">\n<div class=\"wp-block-group has-background is-layout-flow wp-container-core-group-is-layout-95f3ba79 wp-block-group-is-layout-flow\" style=\"border-radius:10px;border-left-color:#258e6f;border-left-width:5px;background-color:#ecf3f1;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:19px;line-height:1.7\">DPI for law enforcement is deep packet inspection of lawfully intercepted IP traffic inside the agency&#8217;s monitoring facility. It decodes what is still readable and classifies what is encrypted, using TLS fingerprinting, traffic pattern recognition and IP correlation. It does not break end-to-end encryption.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-2 is-layout-constrained wp-container-core-group-is-layout-a1ce3644 wp-block-group-is-layout-constrained\" id=\"key-facts\" style=\"color:#e8f3fa;background-color:#0b2240;padding-top:48px;padding-right:24px;padding-bottom:48px;padding-left:24px\">\n<h2 id=\"key-facts\" class=\"wp-block-heading has-text-color\" style=\"color:#ffffff;font-size:30px;line-height:1.2\">Key facts<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-d5ff150a wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul style=\"font-size:17px;line-height:1.8\" class=\"wp-block-list\">\n<li><strong>Two jobs:<\/strong> decode readable traffic, classify everything else.<\/li>\n\n\n\n<li><strong>TLS fingerprinting:<\/strong> JA4 identifies client software from the handshake without decryption.<\/li>\n\n\n\n<li><strong>Pattern recognition:<\/strong> packet sizes and timing reveal messages, calls and file transfers.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul style=\"font-size:17px;line-height:1.8\" class=\"wp-block-list\">\n<li><strong>Correlation:<\/strong> an IP registry links activity across targets, devices and time.<\/li>\n\n\n\n<li><strong>Evidential discipline:<\/strong> versioned classifiers, known error rates, warrant scope enforced.<\/li>\n\n\n\n<li><strong>Available in ICS LEMF<\/strong> for agencies.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"why-does-dpi-for-law-enforcement-matter-now\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"why-does-dpi-for-law-enforcement-matter-now\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">Why does DPI for law enforcement matter now?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">When an operator delivers a target&#8217;s internet traffic, almost all of it is encrypted. HTTPS, QUIC, end-to-end encrypted messengers, VPNs and DNS over HTTPS leave little content to decode. A monitoring facility that only shows gigabytes of TLS gives investigators nothing to work with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Encrypted traffic analysis changes that. Even without content, traffic shows which application was used, when, how intensively and alongside which other activities. Analysts expect continuously updated classifiers, and they want to adjust the rules themselves.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"what-can-encrypted-traffic-analysis-still-see\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"what-can-encrypted-traffic-analysis-still-see\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">What can encrypted traffic analysis still see?<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\" style=\"font-size:16px\"><table><thead><tr><th>Signal<\/th><th>What it reveals<\/th><th>Limitations<\/th><\/tr><\/thead><tbody><tr><td>IP addresses, ports, ASN<\/td><td>Server infrastructure, cloud or CDN, VPN endpoints<\/td><td>Shared CDN addresses serve many services<\/td><\/tr><tr><td>DNS (unencrypted)<\/td><td>Domains the target looked up<\/td><td>Hidden by DoH and DoT<\/td><\/tr><tr><td>TLS SNI<\/td><td>Requested server name<\/td><td>Can be hidden or misleading<\/td><\/tr><tr><td>TLS version, ciphers, ALPN<\/td><td>Client type and protocol stack<\/td><td>Needs fingerprinting to interpret<\/td><\/tr><tr><td>Server certificate<\/td><td>Organization, domain, issuer<\/td><td>Encrypted in TLS 1.3<\/td><\/tr><tr><td>QUIC Initial packets<\/td><td>Server name and client parameters<\/td><td>Later packets fully encrypted<\/td><\/tr><tr><td>Packet sizes and timing<\/td><td>Message, call, video or file transfer<\/td><td>Needs trained models<\/td><\/tr><tr><td>Flow volume and duration<\/td><td>Usage intensity and daily patterns<\/td><td>Needs context to interpret<\/td><\/tr><tr><td>STUN\/TURN traffic<\/td><td>Real-time calls and peer-to-peer media<\/td><td>App-specific<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">For the impact of encrypted DNS, read <a href=\"https:\/\/ic-services.io\/resources\/blog\/encrypted-dns-doh-dot-li-impact\/\">DoH, DoT and lawful interception<\/a>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"tls-fingerprinting-ja3-vs-ja4\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"tls-fingerprinting-ja3-vs-ja4\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">TLS fingerprinting: JA3 vs JA4<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Every TLS client builds its ClientHello in a characteristic way. TLS fingerprinting condenses version, cipher suites, extensions and ALPN values into a short, comparable string. It identifies apps, browsers, libraries and tools without decrypting anything.<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\" style=\"font-size:16px\"><table><thead><tr><th>Method<\/th><th>Approach<\/th><th>Practical note<\/th><\/tr><\/thead><tbody><tr><td>JA3<\/td><td>MD5 hash of ClientHello fields in the order sent<\/td><td>Breaks when browsers randomize extension order<\/td><\/tr><tr><td>JA4<\/td><td>Sorted values plus a readable prefix (transport, TLS version, SNI, counts, ALPN)<\/td><td>Stable despite randomization; BSD 3-Clause license<\/td><\/tr><tr><td>JA4S, JA4H, JA4X, JA4L, JA4SSH<\/td><td>Server, HTTP, certificate, latency and SSH fingerprints<\/td><td>FoxIO License 1.1; commercial products need an OEM license<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">JA4 is widely adopted as the successor to JA3. Vendors and buyers should check the license terms before using other JA4+ methods in a commercial product. A fingerprint is a strong indicator, not proof of identity, because many apps share common libraries.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"how-does-traffic-pattern-recognition-work\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"how-does-traffic-pattern-recognition-work\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">How does traffic pattern recognition work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Even when content and server names are hidden, the shape of the traffic remains visible:<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li><strong>Text messages<\/strong> appear as short bursts of small packets, followed by receipts.<\/li>\n\n\n\n<li><strong>Voice and video calls<\/strong> create steady, evenly spaced UDP streams, often after a STUN\/TURN exchange.<\/li>\n\n\n\n<li><strong>File and media transfers<\/strong> show sustained high-volume uploads or downloads.<\/li>\n\n\n\n<li><strong>Keep-alives and push notifications<\/strong> follow app-specific rhythms.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Classifiers trained on packet lengths, inter-arrival times and burst statistics label these activities. The analyst sees an event timeline, for example a message at 08:14 followed by a voice call at 08:16.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"ip-registry-and-correlation\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-1f0287b6 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:56%\">\n<h2 id=\"ip-registry-and-correlation\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">IP registry and correlation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Classification becomes intelligence once it is correlated. ICS LEMF keeps an IP registry per case and across cases.<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li><strong>IP-to-service resolution<\/strong> with ASN, reverse DNS, certificate data and geolocation.<\/li>\n\n\n\n<li><strong>First seen and last seen<\/strong> for every remote address and fingerprint.<\/li>\n\n\n\n<li><strong>Watch lists<\/strong> of addresses, domains and fingerprints that trigger alerts.<\/li>\n\n\n\n<li><strong>Common contact points<\/strong> between targets, such as the same rare server or VPN endpoint.<\/li>\n\n\n\n<li><strong>Temporal correlation<\/strong> of activity that starts and stops at the same time on two lines.<\/li>\n\n\n\n<li><strong>Device continuity<\/strong> when identical fingerprints appear on different SIM cards.<\/li>\n\n\n\n<li><strong>IRI linkage<\/strong> with cell IDs, locations and IMEIs.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Public IP addresses seen in third-party data can lead to a subscriber through a subscriber data request to the access provider under \u00a7 174 TKG. The planned German rules on IP address retention (\u00a7 177 TKG-E, BT-Drs. 21\/6581, currently in parliament) are designed to support this. Learn more about <a href=\"https:\/\/ic-services.io\/solutions\/data-retention\/\">data retention and IP retention<\/a>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:44%\">\n<figure class=\"wp-block-image size-full has-custom-border\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement.jpg\" alt=\"TLS fingerprinting and app classification of encrypted IP intercepts for law enforcement\" class=\"wp-image-2368\" style=\"border-radius:14px\" srcset=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement.jpg 1600w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement-300x169.jpg 300w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement-1024x576.jpg 1024w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement-768x432.jpg 768w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement-1536x864.jpg 1536w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/tls-fingerprinting-deep-packet-inspection-law-enforcement-18x10.jpg 18w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><\/figure>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"how-dpi-for-law-enforcement-works-in-ics-lemf\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"how-dpi-for-law-enforcement-works-in-ics-lemf\" style=\"font-size:34px;line-height:1.2\">How DPI for law enforcement works in ICS LEMF<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#4a4a4d;font-size:18px;line-height:1.6\">Every result follows a documented chain from raw packets to the analyst workbench.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">1<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Ingest<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">HI3 IP deliveries (ETSI TS 102 232-3 for internet access, -7 for mobile) arrive with the matching HI2 records.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">2<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Sessionize<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Packets are grouped into flows and sessions, even across IP address changes.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">3<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Decode<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Web, e-mail, file transfers and VoIP become readable products.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">4<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Classify<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">DPI signatures, JA4 fingerprints and behavioral models label the remaining traffic.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">5<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Enrich<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">The IP registry adds service, geolocation and IRI context.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">6<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Correlate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Activity is linked across targets, cases and time.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">7<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Visualize and alert<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Timelines, maps and graphs, with drill-down to the raw PCAP.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">8<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Document<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Decoder and classifier versions are stored with every result.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"what-are-the-legal-and-evidential-boundaries\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"what-are-the-legal-and-evidential-boundaries\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">What are the legal and evidential boundaries?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">DPI for law enforcement operates under strict limits. ICS LEMF enforces them technically wherever possible.<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li>Analysis stays within the <strong>scope of the warrant<\/strong> and the measures an analyst is authorized for.<\/li>\n\n\n\n<li>Every processing step follows national criminal procedure law and <a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2016\/680\/oj\" target=\"_blank\" rel=\"noopener noreferrer\">Directive (EU) 2016\/680<\/a>.<\/li>\n\n\n\n<li>Classifications are <strong>indicators<\/strong>. Their error rates must be known, documented and explainable in court.<\/li>\n\n\n\n<li><strong>Versioning<\/strong> keeps the original result visible when data is re-analyzed with a newer classifier.<\/li>\n\n\n\n<li><strong>Privileged content<\/strong> can be flagged and locked, subject to administrator approval.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"dpi-capabilities-in-ics-lemf\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"dpi-capabilities-in-ics-lemf\" style=\"font-size:34px;line-height:1.2\">DPI capabilities in ICS LEMF<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#4a4a4d;font-size:18px;line-height:1.6\">All analysis functions work within the analyst&#8217;s authorized measures.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">01<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Protocol decoding<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Web sessions, e-mail (POP3, IMAP, SMTP), VoIP and file transfers are rebuilt as products, with OCR and metadata extraction.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">02<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">App classification<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Continuously updated DPI signatures show which service was used, when and with how much data. Agencies can adjust rules themselves.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">03<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">TLS fingerprinting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">JA4-based client fingerprints identify apps, browsers and tools, with watch lists for fingerprints of interest.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">04<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Activity recognition<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Behavioral models distinguish messages, calls and transfers inside encrypted apps and place them on the case timeline.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">05<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Timelines, maps and graphs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">All events on one second-accurate timeline, locations on maps and relationships in entity graphs, with geofence alerts.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">06<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Open analysis chain<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">PCAP export to Wireshark and a decoder plugin API let your team add protocols and use its own tools.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"why-ics\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"why-ics\" style=\"font-size:34px;line-height:1.2\">Why ICS<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">01<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Provider-side insight<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We run interception for operators, so we know what IP deliveries look like and where they break.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">02<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Standards and regulation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">More than 20 years in lawful interception and multiple BNetzA acceptances for interception solutions.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">03<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Custom classifiers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Our developers build decoders, classifiers and enrichment pipelines to your requirements. <a href=\"https:\/\/ic-services.io\/services\/integration-custom-development\/\">Learn more<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-2b068b25 wp-block-group-is-layout-constrained\" id=\"frequently-asked-questions\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"frequently-asked-questions\" style=\"font-size:34px;line-height:1.2\">Frequently Asked Questions<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\" open><summary><strong>What is DPI for law enforcement?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">DPI for law enforcement is deep packet inspection of IP traffic that an agency receives through lawful interception. Inside the monitoring facility, it decodes readable protocols and classifies encrypted traffic by application, fingerprint and activity type. Results are correlated with IRI, locations and other targets, and every step stays within the scope of the interception order.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>What is TLS fingerprinting?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">TLS fingerprinting derives a compact identifier from the parameters a client or server uses in the TLS handshake, such as version, cipher suites, extensions and ALPN values. It identifies the software behind a connection, for example a specific messenger, browser or tool, without decrypting the traffic. It is an indicator and should be combined with other signals.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>What is the difference between JA3 and JA4?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">JA3 hashes ClientHello fields in the order they appear. Since browsers randomize extension order, the same browser now produces many different JA3 hashes. JA4 sorts the values before hashing and adds a readable prefix, so the fingerprint stays stable. JA4 is published under the BSD 3-Clause license, while the other JA4+ methods use the FoxIO License 1.1.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>Can DPI decrypt WhatsApp or Signal traffic?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">No. DPI does not break end-to-end encryption. It can show that such an app was used, when, for how long and with how much data. Traffic pattern recognition can often tell a text message from a voice call. Access to content requires other legal instruments and is not part of DPI.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>Is encrypted traffic analysis lawful for agencies?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">It is lawful when a valid interception order covers the traffic. The analysis must follow national criminal procedure law and data protection rules, in the EU, Directive (EU) 2016\/680. Analysis must stay within the scope of the order. Results must be documented and versioned, and privileged communications must be protected.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>What is an IP registry?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">An IP registry is a database of remote IP addresses, domains and fingerprints observed in intercepted traffic, kept per case and across cases. It adds service, ASN and geolocation data and records when each item was first and last seen. In ICS LEMF, it is the basis for correlation, watch lists and alerts.<\/p>\n<\/details>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-055a8e8f wp-block-group-is-layout-constrained\" id=\"related-resources\" style=\"background-color:#ffffff;padding-top:56px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"related-resources\" class=\"wp-block-heading\" style=\"font-size:28px;line-height:1.2\">Related Resources<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/\">Deep packet inspection for lawful interception \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/dpi-for-network-operators\/\">DPI for network operators \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/products\/software-solutions\/law-enforcement-monitoring-facility\/\">ICS LEMF: Law Enforcement Monitoring Facility \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/law-enforcement-monitoring\/\">Law enforcement monitoring solution \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/resources\/blog\/iri-vs-cc-intercept-related-information\/\">IRI vs CC: intercept-related information in practice \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/data-retention\/\">Data Retention, Quick Freeze and IP retention \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-3 is-layout-constrained wp-container-core-group-is-layout-cb2c7f92 wp-block-group-is-layout-constrained\" style=\"color:#ffffff;background:linear-gradient(135deg,#258e6f 0%,#0b2240 100%);padding-top:72px;padding-right:24px;padding-bottom:72px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center has-text-color\" style=\"color:#ffffff;font-size:34px;line-height:1.2\">See encrypted traffic analysis in ICS LEMF<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#d6ece5;font-size:18px;line-height:1.6\">Book a demo and see how DPI, TLS fingerprinting and correlation work on intercepted IP data.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-c2e726be wp-block-buttons-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-text-color has-background wp-element-button\" href=\"https:\/\/ic-services.io\/contact\/\" style=\"border-radius:6px;color:#0b2240;background-color:#ffffff;padding-top:14px;padding-right:28px;padding-bottom:14px;padding-left:28px;font-weight:700\">Request a demo<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"What is DPI for law enforcement?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"DPI for law enforcement is deep packet inspection of IP traffic that an agency receives through lawful interception. Inside the monitoring facility, it decodes readable protocols and classifies encrypted traffic by application, fingerprint and activity type. Results are correlated with IRI, locations and other targets, and every step stays within the scope of the interception order.\"}}, {\"@type\": \"Question\", \"name\": \"What is TLS fingerprinting?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"TLS fingerprinting derives a compact identifier from the parameters a client or server uses in the TLS handshake, such as version, cipher suites, extensions and ALPN values. It identifies the software behind a connection, for example a specific messenger, browser or tool, without decrypting the traffic. It is an indicator and should be combined with other signals.\"}}, {\"@type\": \"Question\", \"name\": \"What is the difference between JA3 and JA4?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"JA3 hashes ClientHello fields in the order they appear. Since browsers randomize extension order, the same browser now produces many different JA3 hashes. JA4 sorts the values before hashing and adds a readable prefix, so the fingerprint stays stable. JA4 is published under the BSD 3-Clause license, while the other JA4+ methods use the FoxIO License 1.1.\"}}, {\"@type\": \"Question\", \"name\": \"Can DPI decrypt WhatsApp or Signal traffic?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. DPI does not break end-to-end encryption. It can show that such an app was used, when, for how long and with how much data. Traffic pattern recognition can often tell a text message from a voice call. Access to content requires other legal instruments and is not part of DPI.\"}}, {\"@type\": \"Question\", \"name\": \"Is encrypted traffic analysis lawful for agencies?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"It is lawful when a valid interception order covers the traffic. The analysis must follow national criminal procedure law and data protection rules, in the EU, Directive (EU) 2016\/680. Analysis must stay within the scope of the order. Results must be documented and versioned, and privileged communications must be protected.\"}}, {\"@type\": \"Question\", \"name\": \"What is an IP registry?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"An IP registry is a database of remote IP addresses, domains and fingerprints observed in intercepted traffic, kept per case and across cases. It adds service, ASN and geolocation data and records when each item was first and last seen. In ICS LEMF, it is the basis for correlation, watch lists and alerts.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>DPI for law enforcement: encrypted traffic analysis with TLS fingerprinting (JA4), traffic pattern recognition and IP correlation, built into ICS LEMF.<\/p>","protected":false},"author":7,"featured_media":2387,"parent":2408,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"unboxed","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-2409","page","type-page","status-publish","has-post-thumbnail","hentry"],"uagb_featured_image_src":{"full":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics.jpg",1200,900,false],"thumbnail":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-150x150.jpg",150,150,true],"medium":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-300x225.jpg",300,225,true],"medium_large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-768x576.jpg",768,576,true],"large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-1024x768.jpg",1024,768,true],"1536x1536":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics.jpg",1200,900,false],"2048x2048":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics.jpg",1200,900,false],"trp-custom-language-flag":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-law-enforcement-tls-fingerprinting-analytics-16x12.jpg",16,12,true]},"uagb_author_info":{"display_name":"David Son","author_link":"https:\/\/ic-services.io\/de\/author\/david\/"},"uagb_comment_info":0,"uagb_excerpt":"DPI for law enforcement: encrypted traffic analysis with TLS fingerprinting (JA4), traffic pattern recognition and IP correlation, built into ICS LEMF.","_links":{"self":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/pages\/2409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/comments?post=2409"}],"version-history":[{"count":2,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/pages\/2409\/revisions"}],"predecessor-version":[{"id":2454,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/pages\/2409\/revisions\/2454"}],"up":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/pages\/2408"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/media\/2387"}],"wp:attachment":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/media?parent=2409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}