Let me take advantage of the disabled comment functions and fan the
flames of the Deep Packet Inspection (DPI) argument. Security Focus has
a good explanation of the
shortcomings of DPI. I've said it before and I'll say it again: DPI is
not a substitute for application layer proxies. DPI is what you use
when you're willing to trade a bit of security for larger throughput for
not so much money. Please refer to the article for the arguments.