Deep Packet Inspection (DPI)
Deep packet inspection is the analysis of network traffic beyond addresses and ports, into the content of the application-layer messages. In rail OT it means decoding signaling, train control and SCADA protocols to understand which commands are being sent, by whom, to which device and with what values.
How it works
A monitoring sensor receives a copy of network traffic from a switch mirror port or a network tap. Instead of stopping at the IP and TCP headers, its protocol parsers reconstruct the sessions and decode the messages inside: for example EULYNX SCI commands over RaSTA, Euroradio messages between train and RBC, CBTC vendor protocols, or IEC 60870-5-104 and Modbus in traction power SCADA.
The decoded content is used in several ways: to identify devices and their roles from how they communicate, to build a precise baseline for anomaly detection, to enforce policy (this workstation may read status but not send commands) and to give analysts a readable record of what actually happened during an incident.
Why it matters for security
Firewall rules based on ports and addresses cannot distinguish a legitimate route request from a malicious one, because both use the same protocol between the same endpoints. Only inspection of the message content can reveal that a command is out of sequence, carries an impossible value or comes from a device that should never issue it.
Rail protocols are specialised and often proprietary, so generic DPI engines built for IT or for other industries recognise little of the traffic. Rail-specific parsers are what make monitoring meaningful in signaling and onboard networks, and they are the basis for the detection and reporting requirements in IEC 62443 and IEC 63452.
Related solution
Building a rail security operations center
Protocol-aware inspection of signaling, onboard and SCADA traffic, built for rail.
See the solution →
