ntop/nDPI

Health v2 · maintenance only

Adoption not part of the score

4566 stars · 1007 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

nDPI is an open source LGPLv3 C library for deep packet inspection that detects 450+ layer-7 application protocols from network traffic. It is part of the ntop suite and powers tools like ntopng and nProbe for traffic monitoring and threat detection.

Use cases

• identify application protocols in pcap files or live traffic
• build network monitoring or IDS/IPS tools with layer-7 visibility
• detect DGA domains and encrypted traffic patterns
• classify traffic by application instead of port numbers
• analyze network flows for security and threat detection
• embed protocol detection into firewalls or routers

When to choose

• you need a fast, embeddable C library for protocol classification
• you want broad layer-7 protocol coverage with active maintenance
• you're building network monitoring, security, or traffic analysis tooling

When to avoid

• you need a ready-made GUI monitoring console rather than a library (use ntopng)
• you only need simple port-based traffic stats
• your project cannot accept LGPL-3.0 or dual-license terms for some dissectors

Facets

library · maturity stable

parser security monitoring networking analytics networking security developer-tools windows bsd cross-platform c deep-packet-inspection dpi traffic-analysis protocol-detection libpcap ids c-library linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ntop/nDPI")