4.3Comparing inspection methods and sensor placement

Monitoring design entangles three axes: "how deeply to inspect," "insert into the path to block or just take a copy," and "store everything or keep only a summary." Each carries a trade-off between visibility and cost/latency/risk, and unless you choose by goal (block or merely observe, need payload or is a statistic enough, want long-term retention), you either waste performance or lose the evidence you needed. This section compares inspection depth, sensor placement, and data granularity as practical judgments.

4.3.1Depth of inspection

• Packet filtering (stateless) permits/denies each packet individually by 5-tuple (IP, ports, protocol) against an ACL. Holding no connection state, it is fast and cheap but cannot judge "is this return packet part of an established session," so it tends toward looseness like opening ports broadly to allow return traffic.
• Stateful inspection maintains a connection state table and automatically allows return traffic for sessions established from the inside (while new outside-to-inside stays denied by default). Safer and easier to operate than stateless, it uses more resources for state management. It centers on L3/L4 state.
• Deep packet inspection (DPI) inspects the payload up to L7—application identification, IPS signatures, malware detection—reaching into the content. It offers the highest visibility but consumes the most CPU/memory and adds latency. NGFWs and IPS perform it; note that once traffic is encrypted, the content is invisible (unless it is decrypted).