The Linux Kernel provides Netfilter as a mechanism for both NAT and firewall functionality. Both of those functionalities require analysis and classification of incoming packets, which is dubbed "stateful packet inspection".
For most traffic, looking at the IP packet headers is sufficient. However, protocols like FTP, IRC, H.323 (and a couple more) have specific modules in the kernel configuration in order to facilitate proper NAT-traversal for those packets. In the kernel those are called 'conntrack modules'.
Now, my understanding is that the payload of those packets is examined in order to enable netfilter to recognize when an external connection arrives and needs to be routed to the respective client. This is because the protocol expects information transmitted on OSI layer 7 which has a direct impact on the actual IP packets being sent on layer 3. In other words, the application code causes the creation of another TCP connection, which has to be routed by the NAT device.
Now to my questions:
- Why is this nowhere (okay, i just did a quick Google search) labelled with the term Deep Packet Inspection?
- Given the massive number of plastic router devices running on GNU/Linux, might this be a legal problem in areas where Deep Packet Inspection is considered unlawful? Possible regulations regarding net neutrality and confidentiality of traffic come to mind, which might impact network service providers, who wish to provide a better service for clients and who need to employ NAT in certain environments.