Network traffic inspection

1. A method, comprising:

executing an application on a mobile device, wherein the application was previously installed as an operating system extension that uses a virtual private network (VPN) stack of the operating system to create a VPN tunnel that starts and ends on the mobile device to intercept Internet Protocol (IP) packets for delivery to a remote computer system, wherein the operating system extension extends the operating system's functionality, and wherein the operating system extension is initiated by the operating system;

intercepting, by the application, a first IP packet in the VPN tunnel, using the VPN stack;

determining an alteration action to take in response to intercepting the first IP packet; and

taking the determined alteration action.

2. The method of claim 1 , wherein the alteration action comprises modifying the first IP packet.

3. The method of claim 1 , wherein the alteration action comprises replacing the first IP packet with a replacement packet.

4. The method of claim 1 , wherein determining the alteration action includes determining whether the first IP packet comprises sensitive data.

5. The method of claim 1 , wherein the alteration action comprises removing an identifier.

6. The method of claim 1 , wherein the alteration action comprises removing a password.

7. The method of claim 1 , wherein determining the alteration action to take includes detecting a tracker.

8. The method of claim 1 , wherein determining the alteration action to take includes detecting an in-app purchase generated by an application.

9. The method of claim 1 , wherein determining the alteration action to take includes detecting an ad impression associated with an application.

10. The method of claim 1 , wherein determining the alteration action to take includes detecting an ad network used by an application.

11. The method of claim 1 , wherein determining the alteration action to take includes detecting a software development kit used by an application.

12. The method of claim 1 , wherein determining the alteration action to take includes tracking bandwidth usage.

13. The method of claim 1 wherein determining the alteration action to take includes determining a reputation score for a site.

14. A system comprising:

a processor configured to:

execute an application on a mobile device, wherein the application was previously installed as an operating system extension that uses a virtual private network (VPN) stack of the operating system to create a VPN tunnel that starts and ends on the mobile device to intercept Internet Protocol (IP) packets for delivery to a remote computer system, wherein the operating system extension extends the operating system's functionality, and wherein the operating system extension is initiated by the operating system;

intercept, by the application, a first IP packet in the VPN tunnel, using the VPN stack;

determine an alteration action to take in response to intercepting the first IP packet; and

take the determined alteration action; and

a memory coupled to the processor and configured to provide the processor with instructions.

15. The system of claim 14 , wherein the alteration action comprises modifying the first IP packet.

16. The system of claim 14 , wherein the alteration action comprises replacing the first IP packet with a replacement packet.

17. The system of claim 14 , wherein determining the alteration action includes determining whether the first IP packet comprises sensitive data.

18. The system of claim 14 , wherein the alteration action comprises removing an identifier.

19. The system of claim 14 , wherein the alteration action comprises removing a password.