Network traffic inspection

1. A method, comprising:

executing an application on a mobile device, wherein the application was previously installed as an operating system extension that uses a virtual private network (VPN) stack of the operating system to create a VPN tunnel that starts and ends on the mobile device to intercept Internet Protocol (IP) packets for delivery to a remote computer system, wherein the operating system extension extends the operating system's functionality, and wherein the operating system extension is initiated by the operating system;

intercepting, by the application, a first IP packet in the VPN tunnel, using the VPN stack;

determining an action to take in response to intercepting the first IP packet, wherein the determination is based at least in part on analyzing the packet; and

taking the determined action.

2. The method of claim 1 wherein determining the action to take includes detecting a tracker.

3. The method of claim 2 wherein the tracker comprises SDK-based mobile tracking software.

4. The method of claim 1 wherein taking the determined action includes preventing tracking.

5. The method of claim 1 wherein determining the action to take includes collecting usage statistics.

6. The method of claim 5 wherein the usage statistics are collected based on network traffic patterns.

7. The method of claim 6 wherein the usage statistics include statistics on one or more applications used.

8. The method of claim 7 wherein the usage statistics include statistics on how long the one or more applications are used.

9. The method of claim 1 wherein determining the action to take includes detecting an in-app purchase generated by an application.

10. The method of claim 1 wherein determining the action to take includes detecting an ad impression associated with an application.

11. The method of claim 1 wherein determining the action to take includes detecting an ad network used by an application.

12. The method of claim 1 wherein determining the action to take includes detecting a software development kit used by an application.

13. The method of claim 1 wherein determining the action to take includes tracking bandwidth usage.

14. The method of claim 13 wherein the bandwidth is associated with a shared data plan.

15. The method of claim 13 wherein taking the determined action includes limiting usage of an application.

16. The method of claim 1 wherein determining the action to take includes determining a reputation score for a site.

17. The method of claim 16 wherein determining the action to take includes evaluating an SSL certificate reputation.

18. The method of claim 16 wherein determining the action to take includes evaluating an X.509 certificate.

19. The method of claim 16 wherein determining the action to take includes evaluating an IP address reputation.

20. The method of claim 16 wherein determining the action to take includes inspecting a DNS request and providing a reputation score for a domain.

21. A system comprising:

a processor configured to:

execute an application on a mobile device, wherein the application was previously installed as an operating system extension that uses a virtual private network (VPN) stack of the operating system to create a VPN tunnel that starts and ends on the mobile device to intercept Internet Protocol (IP) packets for delivery to a remote computer system, wherein the operating system extension extends the operating system's functionality, and wherein the operating system extension is initiated by the operating system;

intercept, by the application, a first IP packet in the VPN tunnel, using the VPN stack;

determine an action to take in response to intercepting the first IP packet, wherein the determination is based at least in part on analyzing the packet; and

taking the determined action; and

a memory coupled to the processor and configured to provide the processor with instructions.

22. The system of claim 21 wherein determining the action to take includes detecting a tracker.

23. The system of claim 22 wherein the tracker comprises SDK-based mobile tracking software.

24. The system of claim 21 wherein taking the determined action includes preventing tracking.

25. The system of claim 21 wherein determining the action to take includes collecting usage statistics.

26. The system of claim 25 wherein the usage statistics are collected based on network traffic patterns.

27. The system of claim 26 wherein the usage statistics include statistics on one or more applications used.

28. The system of claim 27 wherein the usage statistics include statistics on how long the one or more applications are used.

29. The system of claim 21 wherein determining the action to take includes detecting an in-app purchase generated by an application.

30. The system of claim 21 wherein determining the action to take includes detecting an ad impression associated with an application.

31. The system of claim 21 wherein determining the action to take includes detecting an ad network used by an application.

32. The system of claim 21 wherein determining the action to take includes detecting a software development kit used by an application.

33. The system of claim 21 wherein determining the action to take includes tracking bandwidth usage.

34. The system of claim 33 wherein the bandwidth is associated with a shared data plan.

35. The system of claim 33 wherein taking the determined action includes limiting usage of an application.

36. The system of claim 21 wherein determining the action to take includes determining a reputation score for a site.

37. The system of claim 36 wherein determining the action to take includes evaluating an SSL certificate reputation.

38. The system of claim 36 wherein determining the action to take includes evaluating an X.509 certificate.

39. The system of claim 36 wherein determining the action to take includes evaluating an IP address reputation.

40. The system of claim 36 wherein determining the action to take includes inspecting a DNS request and providing a reputation score for a domain.