Squid is mainly a web caching proxy. Zorp is a next generation firewall. The architecture is modular, and you can write plug-ins that analyse the structure of

Squid is mainly a web caching proxy. Zorp is a next generation firewall. The architecture is modular, and you can write plug-ins that analyse the structure of communications beyond packet headers: the content is inspected. The open source version includes out of the box support for inspecting HTTP, FTP, SMTP, POP3, Finger, Whois, Telnet (+TLS). But you can write plugins that couple the engine with anything, from an IDS such as Snort, Bro or Suricata, to something like nDPI or AssemblyLine. https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://bitbucket.org/cse-assemblyline/assemblyline https://bitbucket.org/cse-assemblyline/assemblyline Based on the results of the analysis, you can choose to apply firewall rules.