Using Network Fingerprints Beyond Cybersecurity
Last week ntop has been invited to give a talk at neacademy in Napoli, Italy. The topic was network fingerprints and nDPI. Network fingerprints such as JA4 have been made popular by…
nDPI
- Home
- nDPI
When Traffic Obfuscation Falls Short: nDPI vs NordWhisper NordVPN
In recent years, numerous virtual private networks (VPNs) have been introduced to the market. Some of these VPNs are standalone applications, while others are integrated into web browsers or other network applications.…
Released nDPI 4.12: Obfuscated/Encrypted/Proxied Traffic and Fingerprints
This is to announce the release of nDPI 4.12, the first version after our 6 months release cycle announced earlier this year. The main changes of this release include support for encrypted/obfuscated/proxied…
A Deep Dive Into Traffic Fingerprints
Last week during SharkFest Europe 2024 we have presented what are network fingerprints and how they work. During the talk we (Luca and Ivan) have described how we have extended nDPI with…
How First Packet Classification (FPC) Works in nDPI
Starting with nDPI 4.10, we have introduced a new feature called First Packet Classification (FPC). Goal of this technique is to address one problem of DPI that detects a protocol only when…
Released nDPI 4.10: 421 Protocols, 55 Flow Risks, Several Improvements, Getting Ready for FPC
This is to announce the release of nDPI 4.10. This release adds many improvements and new detected protocols. For this reason future releases will be scheduled more often on a 4 or…
Positioning ntopng vs nProbe for Traffic Analysis
Recently we have compared the use of nDPI in a realtime application (ntopng) and a near-realtime (nProbe). We have captured a short pcap with some mixed traffic and analysed it with both…
Advancements in Traffic Processing Using Programmable Hardware Flow Offload
This week we have presented at the IEEE HPSR (IEEE International Conference on High Performance Switching and Routing) our latest work that shows how nProbe can benefit of acceleration provided by modern…
nDPI: Internals and Frequent Questions
All ntop tools are based on nDPI but not every use is familiar with nDPI internals. We often receive questions about it, and it's time to answer frequent questions. Q: How nDPI…
nDPI 4.8 is Now Available: Better Performance with Less Memory, Fuzzy Robustness, Many New Protocols
This is to announce the release of nDPI 4.8 that introduces various new protocols (in total 351 protocols and 53 risks), several internal changes to improve packet processing, extension of fuzzing to…
How nDPI Improved Bloom Filters Implementation
A Bloom filter is. probabilistic data-structure used to test whether an element is present in a set. Blooms are affected by false positives, meaning that when a bloom returns true it does…
How nDPI Identifies Fully Encrypted Protocols
In the paper How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic it is described a technique used in censorship to identify and block fully encrypted protocols. This technique,…
