nDPI Archives

Every TCP connection starts with a SYN, and that first packet says a lot about the machine that sent it. The Linux, Windows, macOS and Android stacks each set different flags, choose…

Announce

September 21, 2026

Introducing nDPI TLS Fingerprint: A Stable, Collision-Resistant Successor to JA4

TLS client fingerprinting has become one of the workhorse techniques in network security, and JA4 (FoxIO) has been the de facto standard for identifying TLS clients from their ClientHello messages. But recent…

nDPI

August 28, 2026

Introducing nDPI 6.0: Licensing Update, Slow DoS Detection and Smarter Fingerprints

We are proud to announce the release of nDPI 6.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release brings an important licensing update, a brand-new detection…

nDPI

August 23, 2026

Announcing nDPI Dual License Change

A License Change for nDPI: Protecting the Project We Started in 2012 When we began nDPI back in 2012, the idea was simple: build an open source, high-performance Deep Packet Inspection engine…

cento

May 18, 2026

Post-Quantum Cryptography (PQC) Analysis

Modern digital security relies on public-key encryption (like RSA and ECC) to protect global data. The future arrival of a Cryptographically Relevant Quantum Computer (CRQC) will completely break these mathematical foundations. To…

nDPI

March 17, 2026

Observing nDPI from the Inside: Introducing USDT Tracepoints

by Ivan Nardi One of the recurring challenges when embedding the nDPI library into a production application is answering a deceptively simple question: what is nDPI actually doing right now? You know…

Cybersecurity

January 27, 2026

Slow DoS Detection and Prevention

A slow DoS (Denial of Service) attack is a type of cyberattack designed to overwhelm a server or web application by exploiting protocol weaknesses—not through high-volume traffic, but by sending requests very…

nDPI

January 2, 2026

Is JA4 Now Obsolete?

JA4 is a modern network fingerprinting standard used to identify and profile clients initiating encrypted TLS (Transport Layer Security) connections. JA4 it is the successor to the widely used but now deprecated…

nDPI

November 17, 2025

nDPI 5.0: Enhanced Traffic Fingerprinting and FPC, Many new Protocols

We are proud to announce the release of nDPI 5.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release introduces a powerful new fingerprinting system, unlimited protocol…

Cybersecurity

October 7, 2025

When SNIs Cannot be Trusted

SNI (Server Name Indication) is an optional extension in TLS/QUIC that contains the symbolic host name we're connecting to. For instance, during the TLS handshake, the SNI allows the server to identify…

nDPI

August 25, 2025

Beyond JA3/JA4: Introducing nDPI Traffic Fingerprint

Traffic fingerprinting is a hot topic and we have discussed it several times both in this blog and at conferences. There are various fingerprints techniques and probably most of you know JA3/JA4.…

nDPI

April 28, 2025

Introducing nDPI 4.14: Added QoE (Quality of Experience) and New Protocols, Several Fixes

We're excited to announce the release of nDPI 4.14, a maintenance release that also includes some cool new protocol dissectors and fixes. As you know, maintaining a DPI library is no easy…

Introducing the nDPI TCP Fingerprint: A Stable, Patent-Free Way to Fingerprint TCP Stacks

Introducing nDPI TLS Fingerprint: A Stable, Collision-Resistant Successor to JA4

Introducing nDPI 6.0: Licensing Update, Slow DoS Detection and Smarter Fingerprints

Announcing nDPI Dual License Change

Post-Quantum Cryptography (PQC) Analysis

Observing nDPI from the Inside: Introducing USDT Tracepoints

Slow DoS Detection and Prevention

Is JA4 Now Obsolete?

nDPI 5.0: Enhanced Traffic Fingerprinting and FPC, Many new Protocols

When SNIs Cannot be Trusted

Beyond JA3/JA4: Introducing nDPI Traffic Fingerprint

Introducing nDPI 4.14: Added QoE (Quality of Experience) and New Protocols, Several Fixes