nDPI
Open and Extensible LGPLv3 Deep Packet Inspection Library
Layer-7 protocols
open source
metadata and fingerprints
The recommendation
Who should choose nDPI
nDPI is the open source (LGPLv3) deep packet inspection library behind the ntop tools. Choose it when you build your own application and need to identify the protocol and application of each flow, including encrypted traffic, without implementing the analysis yourself.
- You develop software that must detect applications regardless of the port.
- You need metadata such as URL, TLS certificate and fingerprints, and flow risks.
- You want a free, cross-platform library you can extend and contribute to.
metadata extraction
In addition to detecting the application protocol, nDPI also extracts and report relevant metadata associated with the layer-7 application such as URL, TLS certificate, Operating System etc.
Furthermore, since the trend of Internet traffic is going towards encrypted content often using TLS/QUIC, nDPI allows you to extract metadata from encrypted communications and also classify encrypted traffic, implementing the so called ETA (Encrypted Traffic Analysis).
Below you can find an example of metadata extracted from a real flow.
The ideal use case
Ideal use case for nDPI
- Environment: traffic monitoring, filtering, QoS and security products on Unix and Windows.
- Team: developers using the C API, plus operators of ntop tools that already embed it.
- Technical requirements: a C application. Protocol, host and port rules can be extended through configuration files.
- Problem solved: classification (450+ protocols), 56+ cybersecurity flow risks and Encrypted Traffic Analysis without decrypting.
Ideal for Every Environment
Deployment scenarios
Network Traffic Classification
Identify the application or service behind each network flow (e.g., Skype, BitTorrent, Facebook, YouTube).
ntop applications (e.g. ntopng) and probes (nProbe and nProbe Cento) used by Enterprises and ISPs use nDPI to classify traffic and understand usage patterns.
nDPI not only offers DPI features, but it includes various features for traffic classification and analysis that enable you to create your application without having to implement complex analysis capabilities as they are already provided by nDPI
Content Filtering and Parental Control
Block access to certain categories of websites or applications.
ISPs or schools may integrate applications powered by nDPI to filter traffic for adult content, social media, or gaming platforms based on DPI detection.
Anomaly Detection
Identify unusual traffic patterns that may signal attacks, malware activity, or misconfigured devices.
nDPI is able to identify specific “risks” in network traffic. Also, combined with machine learning, can help detect zero-day threats or early signs of compromise by analyzing deviations in normal traffic patterns.
QoS and Bandwidth Management
Prioritize or limit traffic based on application type (e.g., throttle streaming services during work hours).
Network administrators use applications powered by nDPI for granular control, enabling fair bandwidth usage or prioritization of VoIP/video calls over P2P traffic.
Intrusion Detection and Prevention (IDS/IPS)
Detect potentially malicious activity within network traffic based on application-layer behavior.
Security applications and appliances embed nDPI to flag or block suspicious protocols or malformed packets that could indicate exploits or exfiltration, or to augment logs with Layer-7 metadata.
The alternatives
nDPI alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
ntopng, nProbe, nEdge
- Role: Ready applications that already use nDPI.
- Choose it when: You want a product, not a library.
- Limits: Commercial editions for most features.
- Cost: See each product page
PF_RING FT
- Role: Flow table library with nDPI built in.
- Choose it when: You build a high-speed flow application.
- Limits: Licensed, x86 64-bit only.
- Cost: 199.95 euro
The tradeoffs
When nDPI is not the right choice
- nDPI does not decrypt traffic. It identifies the application and extracts metadata.
- It is a library, not a monitoring tool: there is no interface or storage.
- Protocols change often, so updates and contributions are needed to stay current.
- Packet capture is outside nDPI: use libpcap or PF_RING.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
at a glance
Key Features
- Layer-7 application protocol detection (450+ supported protocols)
- Traffic categorization
- Flow risks detection
- Extensibility by means of configuration files (host, BPF, protocol, port, ...)
- ETA support (Encrypted Traffic Analysis)
- FPC support (First Packet Classification)
- TLV support network data serialization in binary format
models
Choose Your Model
Already included in all ntop applications.
Open Source
- nDPI is included in the ntop tools, however nothing prevents you from using it as a standalone DPI library. The source code can be downloaded from GitHub.
- DPI is a time-consuming activity as protocols change quite often. This means that it’s necessary to constantly update the code and add extensions. We would encourage anyone out there to help us adding or enhancing new protocols by sending contributions on GitHub and make them available to everyone free of charge.
- Source Code available on GitHub at github.com/ntop/ndpi
Specifications
Tech Specs
- Linux
- FreeBSD
- Windows x64 (including Windows 10/11)
- macOS
- RaspbianOS
- C API
- Extensible via configuration file
FAQ
Frequently Asked Questions
Is nDPI free?
Yes. nDPI is open source and released under the LGPL license.
Which platforms does nDPI support?
Unix platforms and Windows, so you get a cross-platform DPI library.
Can nDPI inspect encrypted traffic?
nDPI does not decrypt traffic. It identifies the application and extracts metadata such as TLS certificates and fingerprints.
Where is nDPI used?
In ntopng, nProbe, nEdge and in many third-party products.
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition, compare editions and buy in the shop, or talk to the ntop team about your requirements.
