Netify Integrates with Netfilter Conntrack for High-Performance DPI and Flow Offloading

April 10, 2025

Netify’s DPI engine now includes native support for Netfilter’s conntrack and NFQUEUE subsystems, offering a streamlined alternative to traditional capture methods like PCAP and TPACKETv3 for early flow classification and fastpath handling.

Netify and Netfilter

Netify Integrates with Netfilter Conntrack for High-Performance DPI and Flow Offloading

Netify's DPI engine now includes native support for Netfilter's conntrack and NFQUEUE subsystems, offering a streamlined alternative to traditional capture methods like PCAP and TPACKETv3 for early flow classification and fastpath handling. This isn't just an incremental improvement - it's a fundamental shift in how Netify processes and classifies traffic.

Smarter Capture, Faster Processing

NFQ Performance

With this new approach, only the first N packets (up to 32, configurable) of a flow are sent to Netify's DPI engine for classification. Once identified, all subsequent packets are handled by Netfilter's conntrack system, bypassing Netify entirely. This "fastpath" dramatically reduces the load on the system by avoiding redundant analysis, while still ensuring complete flow visibility through conntrack statistics.

This model delivers over 90% reduction in CPU usage on typical networks - a staggering improvement that pushes Netify into a whole new performance class.

DPI on Commodity Hardware

By shifting away from full packet inspection and embracing NFQUEUE's lightweight handoff model, we've unlocked a surprising new capability: Layer 7 classification on commodity network interfaces. Combined with modern NICs that support hardware offload and acceleration, Netify now opens the door to software-based DPI at wire speed - no expensive specialized hardware required.

Introducing Flow Action 'marks': Policy-Based Power

Alongside the NFQUEUE integration, we've expanded the capabilities of the Netify Flow Action plugin with a new target: marks.

This feature allows Netify to apply custom policy marks to flows based on L2–L7 metadata - directly from within the plugin itself. No firewall rules, no handoff to iptables or nftables - just clean, efficient tagging at the DPI layer. Whether it's identifying video streams, blocking certain apps, or prioritizing specific traffic classes, you now have the flexibility to act instantly and precisely on what Netify sees.

What This Means

This is more than a technical enhancement. It's a redefinition of what's possible with software-based DPI. We're now looking at:

  • Wire-speed Layer 7 classification
  • Massive performance gains on existing hardware
  • Lower barriers for deploying intelligent traffic policy
  • Simplified architecture with smarter integration

Learn More

To find out more about Netify's DPI Agent, click here or contact hello@netify.ai.

Recent Articles