nDPI is a deep packet inspection library that identifies network protocols and applications by analyzing packet contents.
The tool addresses the need to classify network traffic beyond basic port-based identification. It works by implementing protocol dissectors that examine packet payloads to recognize specific applications and services, including support for encrypted traffic analysis. The library provides both C APIs for integration into other tools and command-line utilities for direct packet analysis. It includes capabilities for DGA (Domain Generation Algorithm) detection and geolocation lookups via MaxMind databases.
Teams building network monitoring, security, or traffic analysis systems should consider nDPI if they need accurate protocol identification across a wide range of applications. It suits projects requiring deep inspection of live traffic or PCAP file analysis. The tool compiles on Linux, macOS, FreeBSD, and Windows, with straightforward build procedures using standard GNU autotools. The library can be built standalone without additional tools or tests, making it easy to integrate into minimal deployments.
The project maintains active development with regular protocol dissector additions and updates. The test suite includes PCAP-based regression tests, unit tests, and specialized DGA detection validation. The codebase supports out-of-tree builds and provides configuration options for compatibility with different versions of dependencies. Documentation is generated from source and includes a detailed FAQ addressing common questions about the library's capabilities and usage.
