====== Using DPI for Lawful Interception ======
{{indexmenu_n>2}}

The additional LI licenses purchase is needed eventually to serve increasing number of subscribers and increase of speed in billing plans.\\
Stingray Service Gateway (SSG) allows reduction of traffic that is mirrored to LI. This is achieved by filtering of components that LI does not analyze. For example: p2p (torrent), video traffic, etc. The expected traffic reduction is from 40% to 70%, depending on the traffic's structure and filtering list.\\

Pre-filter license purchase peculiarities:\\
  * A FLTR, BASE or COMPLETE license is sufficient to perform traffic filtering.
  * The bandwidth of the license is determined by the total traffic, the rules are described in the [[dpi:licensing:start|]] section.

The usage diagram:\\
{{ dpi:qoe:use_cases:dpi_prefilter:sorm_scheme1_en.png?600 |}}

**Example 1: One interface per input and one per output (01-00.0 --> 01-00.1)**

Define interface parameters in the configuration file ///etc/dpi/fastdpi.conf//
<code bash>
in_dev=01-00.0
out_dev=01-00.1
only_tcp=0
mem_preset=1
</code>

Create the file protocols.dscp:
<code bash>
echo "bittorrent drop" > protocols.txt
cat protocols.txt|lst2dscp /etc/dpi/protocols.dscp
</code>

<note important>[[dpi:dpi_options:opt_statistics:statistics_info:start|Full list of protocols.]]</note> 

**Check filtering results:**

Execute
<code bash>tail -200 /var/log/dpi/fastdpi_stat.log</code>

In the statistics lines we find the percentage and volume of filtered traffic
<code bash>
  IF 01-00.0 :
  ...
     Drop: [8054507798 bytes][68.92 %]
           [9406449 pkts ][67.16 %]
  ...
</code>  

**Example 2: Two input interfaces and one to output (01-00.0 and 01-00.1) --> 01-00.2)**

Define interface parameters in the configuration file ///etc/dpi/fastdpi.conf//
<code bash> 
in_dev=01-00.0:01-00.1 
out_dev=01-00.2 
only_tcp=0 
mem_preset=1 
</code> 

**Check filtering results:**

Execute
<code bash>tail -200 /var/log/dpi/fastdpi_stat.log</code>

In the statistics lines we find the percentage and volume of filtered traffic

On 01-00.0
<code bash>Drop: [29472283528 bytes] [69.20%]</code>

On 01-00.1
<code bash>Drop: [31027588123 bytes] [68.27%]</code>

Configuration:
<code bash>root@dpi dpi]# dscp2lst / etc / protocols.dscp | grep drop
https drop
oob-ws-https drop
llsurfup-https drop
compaq-https drop
jpegmpeg drop
wap-push-https drop
appserv-https drop
wbem-https drop
wbem-exp-https drop
sun-sr-https drop
plysrv-https drop
pcsync-https drop
https-wmap drop
armcenterhttps drop
tungsten-https drop
amt-soap-https drop
commtact-https drop
Bittorrent drop
AVI drop
Flash drop
MPEG drop
QuickTime drop
smc-https drop
oracleas-https drop
sun-user-https drop
synapse-nhttps drop
</code>