{"id":2410,"date":"2026-09-16T14:30:23","date_gmt":"2026-09-16T13:30:23","guid":{"rendered":"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/dpi-for-network-operators\/"},"modified":"2026-09-16T14:47:46","modified_gmt":"2026-09-16T13:47:46","slug":"dpi-for-network-operators","status":"publish","type":"page","link":"https:\/\/ic-services.io\/es\/solutions\/deep-packet-inspection\/dpi-for-network-operators\/","title":{"rendered":"DPI para operadores de red"},"content":{"rendered":"\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-1 is-layout-constrained wp-container-core-group-is-layout-b07bb602 wp-block-group-is-layout-constrained\" style=\"color:#ffffff;background:linear-gradient(135deg,#071426 0%,#0b2240 60%,#0e3b4f 100%);padding-top:80px;padding-right:24px;padding-bottom:80px;padding-left:24px\">\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-1f0287b6 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:54%\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#3DD6D0;font-size:14px;font-weight:700;letter-spacing:2px;text-transform:uppercase\">PROVIDER-SIDE DPI<\/p>\n\n\n\n<h1 class=\"wp-block-heading has-text-color\" style=\"color:#ffffff;font-size:clamp(32px, 3.6vw, 46px);line-height:1.2\">DPI for Network Operators: Enriched Lawful Interception Data<\/h1>\n\n\n\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#c9d8e6;font-size:19px;line-height:1.6\">Extract and enrich metadata for the ordered target at the point of interception. Deliver it in addition to the complete copy, strictly separated from commercial DPI.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-container-core-buttons-is-layout-184438a2 wp-block-buttons-is-layout-flex\" style=\"margin-top:28px\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-text-color has-background wp-element-button\" href=\"https:\/\/ic-services.io\/contact\/\" style=\"border-radius:6px;color:#ffffff;background-color:#258e6f;padding-top:14px;padding-right:26px;padding-bottom:14px;padding-left:26px;font-weight:700\">Talk to an expert<\/a><\/div>\n\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link has-text-color has-border-color wp-element-button\" href=\"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/\" style=\"border-color:#ffffff;border-width:2px;border-radius:6px;color:#ffffff;padding-top:12px;padding-right:24px;padding-bottom:12px;padding-left:24px;font-weight:700\">DPI overview<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:46%\">\n<figure class=\"wp-block-image size-full has-custom-border\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"900\" src=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata.jpg\" alt=\"DPI for network operators: target-specific DPI node at the point of interception enriching metadata and delivering it with the full copy to the LEA\" class=\"wp-image-2388\" style=\"border-radius:14px\" srcset=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata.jpg 1200w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-300x225.jpg 300w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-1024x768.jpg 1024w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-768x576.jpg 768w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-16x12.jpg 16w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-d0fb4031 wp-block-group-is-layout-constrained\" style=\"background-color:#ffffff;padding-top:56px;padding-right:24px;padding-bottom:8px;padding-left:24px\">\n<div class=\"wp-block-group has-background is-layout-flow wp-container-core-group-is-layout-95f3ba79 wp-block-group-is-layout-flow\" style=\"border-radius:10px;border-left-color:#258e6f;border-left-width:5px;background-color:#ecf3f1;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:19px;line-height:1.7\">DPI for network operators is target-specific deep packet inspection at the point of interception. The operator extracts metadata from the ordered target&#8217;s traffic, enriches it with network context and delivers it in addition to the complete, unaltered copy. The result is enriched IRI that agencies could not rebuild on their own.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-2 is-layout-constrained wp-container-core-group-is-layout-a1ce3644 wp-block-group-is-layout-constrained\" id=\"key-facts\" style=\"color:#e8f3fa;background-color:#0b2240;padding-top:48px;padding-right:24px;padding-bottom:48px;padding-left:24px\">\n<h2 id=\"key-facts\" class=\"wp-block-heading has-text-color\" style=\"color:#ffffff;font-size:30px;line-height:1.2\">Key facts<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-d5ff150a wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul style=\"font-size:17px;line-height:1.8\" class=\"wp-block-list\">\n<li><strong>Addition, not replacement:<\/strong> the full copy is always delivered.<\/li>\n\n\n\n<li><strong>Target-only:<\/strong> DPI processes only the traffic of ordered targets, triggered by the LIMS.<\/li>\n\n\n\n<li><strong>Network context:<\/strong> LIID, subscriber, NAT mapping, cell and IMEI attached to each flow.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<ul style=\"font-size:17px;line-height:1.8\" class=\"wp-block-list\">\n<li><strong>Strict separation<\/strong> from commercial DPI, in line with Regulation (EU) 2015\/2120.<\/li>\n\n\n\n<li><strong>Acceptance-ready:<\/strong> enrichment and formats are documented in the operator&#8217;s acceptance concept.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"why-provider-side-deep-packet-inspection\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"why-provider-side-deep-packet-inspection\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">Why provider-side deep packet inspection?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">The operator holds context that never reaches the agency in raw packets. Provider-side deep packet inspection attaches this context where it exists, close to the traffic.<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li><strong>Correct attribution:<\/strong> subscriber identity and NAT mappings stay linked to each flow, even behind CGNAT.<\/li>\n\n\n\n<li><strong>Location and device:<\/strong> cell IDs and IMEIs show where and with which device an activity took place.<\/li>\n\n\n\n<li><strong>Speed:<\/strong> metadata is available in near real time, even while the full copy is still being analyzed.<\/li>\n\n\n\n<li><strong>Encrypted traffic:<\/strong> pre-classified sessions and fingerprints help analysts focus.<\/li>\n\n\n\n<li><strong>Fewer follow-up requests<\/strong> for basic context, where the order allows it.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"where-is-the-legal-line-for-dpi-for-network-operators\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"where-is-the-legal-line-for-dpi-for-network-operators\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">Where is the legal line for DPI for network operators?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Provider-side DPI is lawful only within clear limits. ICS designs every project around them.<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li><strong>Full copy first.<\/strong> The operator must deliver a complete, unaltered copy of the target&#8217;s communication. In Germany this follows from \u00a7 170 TKG and the TK\u00dcV. Filtering is allowed only where the order limits the scope.<\/li>\n\n\n\n<li><strong>Only ordered targets.<\/strong> Processing covers only the target&#8217;s traffic and only for the purpose of the interception. Untargeted analysis is not permitted.<\/li>\n\n\n\n<li><strong>Separation from commercial DPI.<\/strong> <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2015\/2120\/oj\" target=\"_blank\" rel=\"noopener noreferrer\">Regulation (EU) 2015\/2120<\/a> restricts DPI for traffic management but allows measures required by law. LI processing runs in a separate, access-controlled environment.<\/li>\n\n\n\n<li><strong>Confidentiality.<\/strong> Staff and systems are bound by telecommunications secrecy, and the subscriber must not notice the measure.<\/li>\n\n\n\n<li><strong>Acceptance concept.<\/strong> Everything the operator delivers must be part of the technical concept accepted by the BNetzA, following the TR TK\u00dcV.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"reference-architecture\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"reference-architecture\" style=\"font-size:34px;line-height:1.2\">Reference architecture<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#4a4a4d;font-size:18px;line-height:1.6\">A target-specific DPI chain has six stages, built on the <a href=\"https:\/\/ic-services.io\/resources\/blog\/x1-x2-x3-interfaces-5g-li\/\">X1, X2 and X3 interfaces<\/a> and a mediation function.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">1<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Traffic access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Optical TAPs, router or BNG mirroring, or virtual mirror ports in cloud cores feed a packet broker.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">2<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Target triggering<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">The LIMS activates the target. RADIUS, Diameter, DHCP or packet gateway events tell the DPI node which IP addresses currently belong to it.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">3<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Target-specific DPI node<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Only the target&#8217;s packets are processed, using high-performance packet processing such as DPDK or FPGA-based network cards.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">4<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Enrichment<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Each flow receives the LIID, subscriber and line identifiers, NAT mapping, cell ID or location, and the IMEI where available.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">5<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Mediation and delivery<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">The full copy goes out as CC via HI3, for example per ETSI TS 102 232-3 or -7. The enriched metadata follows via HI2 or an agreed channel.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:34px;font-weight:800;line-height:1\">6<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:19px;line-height:1.2\">Audit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.6\">Outputs are kept only as long as delivery requires, and every configuration and signature version is logged.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"what-metadata-can-dpi-for-network-operators-extract\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"what-metadata-can-dpi-for-network-operators-extract\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">What metadata can DPI for network operators extract?<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\" style=\"font-size:16px\"><table><thead><tr><th>Metadata<\/th><th>Source<\/th><th>Investigative value<\/th><\/tr><\/thead><tbody><tr><td>Flow records (5-tuple, start, end, bytes, packets)<\/td><td>Packet headers<\/td><td>Complete activity overview<\/td><\/tr><tr><td>DNS queries and responses<\/td><td>Unencrypted DNS<\/td><td>Domains and services used<\/td><\/tr><tr><td>TLS SNI, ALPN, JA4 fingerprints<\/td><td>TLS and QUIC handshakes<\/td><td>Application and device identification<\/td><\/tr><tr><td>Application classification<\/td><td>DPI signatures and behavior<\/td><td>Messenger, VoIP, streaming, VPN, Tor<\/td><\/tr><tr><td>Activity type<\/td><td>Packet size and timing<\/td><td>Message, call or file transfer<\/td><\/tr><tr><td>SIP and RTP parameters<\/td><td>Unencrypted VoIP<\/td><td>Third-party calls with participants and duration<\/td><\/tr><tr><td>HTTP host and user agent<\/td><td>Unencrypted HTTP<\/td><td>Services and client software<\/td><\/tr><tr><td>NAT mapping<\/td><td>CGNAT logs<\/td><td>Public IP and port linked to the target<\/td><\/tr><tr><td>Cell ID, IMEI, access line<\/td><td>Network and device data<\/td><td>Where and with which device an activity happened<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">JA4 is licensed under BSD 3-Clause, while JA4S and the other JA4+ methods fall under the FoxIO License 1.1 and need an OEM license in commercial products. The operator removes only encryption it applied itself. End-to-end encrypted content stays encrypted, and DPI works on headers, handshakes and patterns.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"how-is-enriched-data-handed-over\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"how-is-enriched-data-handed-over\" style=\"font-size:34px;line-height:1.2\">How is enriched data handed over?<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#4a4a4d;font-size:18px;line-height:1.6\">There is no universal ETSI record type for DPI results, so three handover models are used in practice.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">01<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Additional IRI records<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Detected events, such as a VoIP call or an app session, are sent via HI2. Standard fields are used where possible, with agreed national extensions where needed.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">02<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Separate analytics stream<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Structured flow or event records travel over a secured channel. They are clearly labeled and correlated with the LIID and the CC.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">03<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Service-level records<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Where explicitly required, events are delivered at service level, similar to the service-specific parts of ETSI TS 102 232.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"evidence-quality\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-1f0287b6 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:56%\">\n<h2 id=\"evidence-quality\" class=\"wp-block-heading\" style=\"font-size:32px;line-height:1.2\">Evidence quality<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Enriched IRI is only useful if agencies can trust and verify it. Whatever the handover model, the format must be documented, versioned and agreed with the agencies and the regulator.<\/p>\n\n\n\n<ul style=\"font-size:17px;line-height:1.7\" class=\"wp-block-list\">\n<li>Record the <strong>DPI engine and signature version<\/strong> for every result.<\/li>\n\n\n\n<li>Use <strong>synchronized, high-precision timestamps<\/strong> that align with HI2 and HI3.<\/li>\n\n\n\n<li>Provide <strong>confidence indicators<\/strong> for behavioral classifications.<\/li>\n\n\n\n<li>Keep a <strong>complete audit trail<\/strong> of activation, configuration changes and deliveries.<\/li>\n\n\n\n<li>Test with <strong>reference traffic<\/strong> after every signature update.<\/li>\n\n\n\n<li>Keep enriched data <strong>verifiable against the full copy<\/strong> at all times.<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:44%\">\n<figure class=\"wp-block-image size-full has-custom-border\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception.jpg\" alt=\"Provider-side deep packet inspection delivering the full copy plus enriched metadata to law enforcement\" class=\"wp-image-2370\" style=\"border-radius:14px\" srcset=\"https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception.jpg 1600w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception-300x169.jpg 300w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception-1024x576.jpg 1024w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception-768x432.jpg 768w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception-1536x864.jpg 1536w, https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/provider-side-deep-packet-inspection-lawful-interception-18x10.jpg 18w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><\/figure>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"ics-services-for-dpi-for-network-operators\" style=\"background-color:#ffffff;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"ics-services-for-dpi-for-network-operators\" style=\"font-size:34px;line-height:1.2\">ICS services for DPI for network operators<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#4a4a4d;font-size:18px;line-height:1.6\">ICS supports operators from the first design to daily operation.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">01<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Architecture and legal-technical design<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We design provider-side DPI that fits your national framework, your network and your acceptance concept.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">02<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Target-triggered enrichment<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We integrate DPI with RADIUS, Diameter, DHCP, CGNAT logging and packet core events.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">03<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Passive probes and cloud mirroring<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We deploy passive probes and virtual mirror ports, including in hosted and cloud cores.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">04<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Mediation and ETSI handover<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Enriched data and the full copy are delivered through our <a href=\"https:\/\/ic-services.io\/products\/software-solutions\/li-mediation-platform\/\">LI Mediation Platform<\/a> and <a href=\"https:\/\/ic-services.io\/products\/software-solutions\/lawful-interception-management-system\/\">LIMS<\/a>.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">05<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Managed operations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Our team monitors and operates your LI chain around the clock. <a href=\"https:\/\/ic-services.io\/services\/managed-li-operations\/\">Learn more<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#f3f7f9;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">06<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Custom development<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We build extractors, classifiers and delivery formats to your requirements. <a href=\"https:\/\/ic-services.io\/services\/integration-custom-development\/\">Learn more<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-4c47aa0f wp-block-group-is-layout-constrained\" id=\"why-ics\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"why-ics\" style=\"font-size:34px;line-height:1.2\">Why ICS<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">01<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Operator and agency view<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">We run passive probes and mediation for providers and build ICS LEMF for agencies.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">02<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Acceptance experience<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">More than 20 years in lawful interception and multiple BNetzA acceptances for interception solutions.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"has-text-color wp-block-paragraph\" style=\"color:#258e6f;font-size:14px;font-weight:800;letter-spacing:2px\">03<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" style=\"font-size:21px;line-height:1.2\">Security-cleared staff<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px;line-height:1.7\">Our team is security-cleared by the German Federal Ministry of the Interior and may handle classified information.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-2b068b25 wp-block-group-is-layout-constrained\" id=\"frequently-asked-questions\" style=\"background-color:#f3f7f9;padding-top:64px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center\" id=\"frequently-asked-questions\" style=\"font-size:34px;line-height:1.2\">Frequently Asked Questions<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\" open><summary><strong>What is DPI for network operators?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">DPI for network operators is target-specific deep packet inspection at the point of interception. The operator extracts metadata such as flows, DNS, TLS fingerprints and application types from the ordered target&#8217;s traffic. It enriches this data with subscriber, NAT, cell and device context and delivers it to the agency in addition to the complete, unaltered copy.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>Is provider-side deep packet inspection allowed for lawful interception?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Yes, when it is limited to the ordered target, serves the purpose of the interception order and is covered by national technical rules and the operator&#8217;s accepted concept. In Germany this means the TK\u00dcV, the TR TK\u00dcV and the BNetzA acceptance. Untargeted processing or commercial use of lawful interception data is not allowed.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>Does DPI replace the full copy of the communication?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">No. The operator must deliver a complete, unaltered copy of the target&#8217;s communication, unless the order explicitly limits the scope. DPI-based metadata is only delivered in addition. Agencies can therefore always verify enriched IRI against the original traffic, which matters for evidence in court.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>What is enriched IRI?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">Enriched IRI is intercept-related information with additional context extracted or attached at the provider. Examples are the NAT mapping behind a flow, the cell ID, the IMEI, a detected application or a TLS fingerprint. It is delivered via HI2 or an agreed analytics channel and linked to the measure through the LIID.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>Can an operator decrypt a target&#8217;s HTTPS or messenger traffic?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">No. The operator removes only encryption it applied itself in its own network. End-to-end and application-level encryption remain intact. Provider-side DPI works on unencrypted headers, handshakes and traffic patterns, which still reveal the application, the timing and often the type of activity.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\" style=\"border-bottom-color:#dde6ec;border-bottom-width:1px;padding-top:18px;padding-right:4px;padding-bottom:18px;padding-left:4px;font-size:18px\"><summary><strong>How does provider-side DPI stay separate from commercial DPI?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;line-height:1.7\">LI processing runs on dedicated, access-controlled systems that handle only traffic of ordered targets. Results flow only into the mediation and handover chain, never into traffic management, analytics or marketing systems. This separation reflects Regulation (EU) 2015\/2120 and telecommunications secrecy, and it is documented in the acceptance concept.<\/p>\n<\/details>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-background is-layout-constrained wp-container-core-group-is-layout-055a8e8f wp-block-group-is-layout-constrained\" id=\"related-resources\" style=\"background-color:#ffffff;padding-top:56px;padding-right:24px;padding-bottom:64px;padding-left:24px\">\n<h2 id=\"related-resources\" class=\"wp-block-heading\" style=\"font-size:28px;line-height:1.2\">Related Resources<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/\">Deep packet inspection for lawful interception \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/deep-packet-inspection\/dpi-for-law-enforcement\/\">DPI for law enforcement \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/products\/software-solutions\/li-mediation-platform\/\">LI Mediation Platform \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/products\/software-solutions\/lawful-interception-management-system\/\">Lawful Interception Management System (LIMS) \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/resources\/blog\/mediation-function-lawful-interception\/\">How a mediation function works \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/services\/managed-li-operations\/\">Managed LI Operations \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-99eb1867 wp-block-columns-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-column is-vertically-aligned-stretch is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group has-border-color has-background is-layout-flow wp-container-core-group-is-layout-6d712e01 wp-block-group-is-layout-flow\" style=\"border-color:#dde6ec;border-width:1px;border-radius:12px;background-color:#ffffff;min-height:100%;padding-top:28px;padding-right:28px;padding-bottom:28px;padding-left:28px\">\n<p class=\"wp-block-paragraph\" style=\"font-size:17px;font-weight:700;line-height:1.4\"><a href=\"https:\/\/ic-services.io\/solutions\/lawful-interception\/\">Lawful interception solutions \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\"><\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\"><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group alignfull has-text-color has-background has-link-color wp-elements-3 is-layout-constrained wp-container-core-group-is-layout-cb2c7f92 wp-block-group-is-layout-constrained\" style=\"color:#ffffff;background:linear-gradient(135deg,#258e6f 0%,#0b2240 100%);padding-top:72px;padding-right:24px;padding-bottom:72px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-text-align-center has-text-color\" style=\"color:#ffffff;font-size:34px;line-height:1.2\">Is provider-side enrichment right for your network?<\/h2>\n\n\n\n<p class=\"has-text-align-center has-text-color wp-block-paragraph\" style=\"color:#d6ece5;font-size:18px;line-height:1.6\">Our experts review your legal framework, architecture and acceptance concept and recommend a practical design.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-c2e726be wp-block-buttons-is-layout-flex\" style=\"margin-top:24px\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-text-color has-background wp-element-button\" href=\"https:\/\/ic-services.io\/contact\/\" style=\"border-radius:6px;color:#0b2240;background-color:#ffffff;padding-top:14px;padding-right:28px;padding-bottom:14px;padding-left:28px;font-weight:700\">Talk to an expert<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"What is DPI for network operators?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"DPI for network operators is target-specific deep packet inspection at the point of interception. The operator extracts metadata such as flows, DNS, TLS fingerprints and application types from the ordered target's traffic. It enriches this data with subscriber, NAT, cell and device context and delivers it to the agency in addition to the complete, unaltered copy.\"}}, {\"@type\": \"Question\", \"name\": \"Is provider-side deep packet inspection allowed for lawful interception?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, when it is limited to the ordered target, serves the purpose of the interception order and is covered by national technical rules and the operator's accepted concept. In Germany this means the TK\u00dcV, the TR TK\u00dcV and the BNetzA acceptance. Untargeted processing or commercial use of lawful interception data is not allowed.\"}}, {\"@type\": \"Question\", \"name\": \"Does DPI replace the full copy of the communication?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The operator must deliver a complete, unaltered copy of the target's communication, unless the order explicitly limits the scope. DPI-based metadata is only delivered in addition. Agencies can therefore always verify enriched IRI against the original traffic, which matters for evidence in court.\"}}, {\"@type\": \"Question\", \"name\": \"What is enriched IRI?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Enriched IRI is intercept-related information with additional context extracted or attached at the provider. Examples are the NAT mapping behind a flow, the cell ID, the IMEI, a detected application or a TLS fingerprint. It is delivered via HI2 or an agreed analytics channel and linked to the measure through the LIID.\"}}, {\"@type\": \"Question\", \"name\": \"Can an operator decrypt a target's HTTPS or messenger traffic?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The operator removes only encryption it applied itself in its own network. End-to-end and application-level encryption remain intact. Provider-side DPI works on unencrypted headers, handshakes and traffic patterns, which still reveal the application, the timing and often the type of activity.\"}}, {\"@type\": \"Question\", \"name\": \"How does provider-side DPI stay separate from commercial DPI?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"LI processing runs on dedicated, access-controlled systems that handle only traffic of ordered targets. Results flow only into the mediation and handover chain, never into traffic management, analytics or marketing systems. This separation reflects Regulation (EU) 2015\/2120 and telecommunications secrecy, and it is documented in the acceptance concept.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>DPI for network operators: target-specific, provider-side deep packet inspection that adds enriched IRI to the full interception copy, within legal limits.<\/p>","protected":false},"author":7,"featured_media":2388,"parent":2408,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"unboxed","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-2410","page","type-page","status-publish","has-post-thumbnail","hentry"],"uagb_featured_image_src":{"full":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata.jpg",1200,900,false],"thumbnail":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-150x150.jpg",150,150,true],"medium":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-300x225.jpg",300,225,true],"medium_large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-768x576.jpg",768,576,true],"large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-1024x768.jpg",1024,768,true],"1536x1536":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata.jpg",1200,900,false],"2048x2048":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata.jpg",1200,900,false],"trp-custom-language-flag":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/dpi-for-network-operators-enriched-metadata-16x12.jpg",16,12,true]},"uagb_author_info":{"display_name":"David Son","author_link":"https:\/\/ic-services.io\/es\/author\/david\/"},"uagb_comment_info":0,"uagb_excerpt":"DPI for network operators: target-specific, provider-side deep packet inspection that adds enriched IRI to the full interception copy, within legal limits.","_links":{"self":[{"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/pages\/2410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/comments?post=2410"}],"version-history":[{"count":2,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/pages\/2410\/revisions"}],"predecessor-version":[{"id":2452,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/pages\/2410\/revisions\/2452"}],"up":[{"embeddable":true,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/pages\/2408"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/media\/2388"}],"wp:attachment":[{"href":"https:\/\/ic-services.io\/es\/wp-json\/wp\/v2\/media?parent=2410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}