FEBRUARY 10, 2021
By (Mitrasingh) Danny Chetlall, Product Manager, Enea Qosmos
What is First Packet Processing?
First packet processing is a technique for identifying applications and services in network traffic from the very first packet in a flow. This enables the instantaneous execution of application-specific rules, such as those related to unique bandwidth, latency, or security requirements.
The Challenge with First Packet Processing
First packet processing is beneficial for high-throughput networking and security solutions like SD-WAN and SASE. However, most first packet processing techniques score poorly on accuracy and granularity. This leaves vendors with an unfortunate choice between passing more traffic through DPI – limiting the performance advantage of first packet processing, or executing immediate traffic steering or security policies based on limited – or even erroneous – information.
The Enea Solution
Enea’s First Packet Advantage addresses these accuracy, granularity and performance challenges to unleash the full power of first packet processing. It improves on conventional cache-based first packet processing through two innovative features:
In addition, First Packet Advantage applies service categories to Office 365 traffic based on first packet data alone, enabling ultra-efficient, category-based management of this widely used software suite.
First Packet Advantage is available as a standard feature in Enea’s Qosmos ixEngine and Qosmos Probe (a software sensor which embeds ixEngine). It delivers an immediate performance advantage for SD-WAN and for Secure Access Service Edge (SASE) solutions, which provide integrated SD-WAN and security functions as a cloud service. It also enables vendors of these solutions to better position themselves for major industry changes, including fully encrypted environments and Artificial Intelligence (AI)-driven orchestration and analytics.
Performance + Innovation for SD-WAN & SASE
Paving the Way for Artificial Intelligence
This new approach translates to an immediate performance boost for today’s SD-WAN and SASE solutions. Beyond this performance boost, First Packet Advantage also delivers the data precision and lightning-fast processing required for AI-powered orchestration in the SD-WAN market, and AI-based security operations management and threat analytics in SASE solutions.
Supporting the SD-WAN to SASE Evolution
First Packet Advantage is also unique in its ability to deliver robust security-related information in addition to application and service classification. This enhances existing security capabilities for SASE vendors and supports product evolution for SD-WAN vendors. Specifically, the security-related data enables SD-WAN vendors to enhance their offer with new security rules, to develop firewalls and other key security components as part of a Secure SD-WAN solution, or to evolve their offer into complete, cloud-based SASE solutions.
Providing a Visibility Safeguard for Fully Encrypted Environments
In addition, the unique IP-based traffic classification system (IPDB) within Qosmos ixEngine will be especially valuable as stronger, more rigorous encryption standards are adopted. This change in encryption practices will expand the situations in which proxies cannot be deployed to decrypt and inspect traffic, or in which doing so will become undesirable for performance.
In such environments, IPDB will provide an important alternative method of accurately identifying protocols, applications and services. Furthermore, Enea Labs research has shown that machine learning combined with IP-based classification can help restore some of the vital granularity that is typically lost with IP-based classification.
About the Author
(Mitrasingh) Danny Chetlall is Product Manager at Enea Qosmos. He has over 15 years’ experience in the architecture, design and development of IP technologies with specific expertise in Deep Packet Inspection and networking applications. His responsibilities include the Qosmos ixEngine® DPI engine, protocol signatures and protocol bundle updates.