# ntop/nDPI

Open Source Deep Packet Inspection Software Toolkit

Repository: https://github.com/ntop/nDPI
Canonical: https://ross.abutalabs.com/products/ndpi
Homepage: http://www.ntop.org
Language: C
License: LGPL-3.0
License Family: copyleft
Topics: ndpi, dpi, deep-packet-inspection, traffic-analysis, network, cybersecurity
Last push: 2026-08-26T21:33:15+00:00

## Health v2 (maintenance only)
Score: 76/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 33, longevity 100
- inputs: {"age_days": 4154, "days_push": 7, "days_rel": 289, "gap_med": 166.5, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4566, forks 1007 (observed 2026-08-28T04:08:53.521852+00:00)

## What it is
nDPI is an open source LGPLv3 C library for deep packet inspection that detects 450+ layer-7 application protocols from network traffic. It is part of the ntop suite and powers tools like ntopng and nProbe for traffic monitoring and threat detection.

## Use cases
- identify application protocols in pcap files or live traffic
- build network monitoring or IDS/IPS tools with layer-7 visibility
- detect DGA domains and encrypted traffic patterns
- classify traffic by application instead of port numbers
- analyze network flows for security and threat detection
- embed protocol detection into firewalls or routers

## When to choose
- you need a fast, embeddable C library for protocol classification
- you want broad layer-7 protocol coverage with active maintenance
- you're building network monitoring, security, or traffic analysis tooling

## When to avoid
- you need a ready-made GUI monitoring console rather than a library (use ntopng)
- you only need simple port-based traffic stats
- your project cannot accept LGPL-3.0 or dual-license terms for some dissectors

## Facets
- artifact type: library
- maturity: stable
- function: parser, security, monitoring, networking, analytics
- domain: networking, security, developer-tools
- platform: windows, bsd, cross-platform, c
- tags: deep-packet-inspection, dpi, traffic-analysis, protocol-detection, libpcap, ids, c-library, linux, macos

## Member repositories
- ntop/nDPI (main) score 76

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:53.521852+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:19:58.662092+00:00, confidence not recorded.
  - readme: https://github.com/ntop/nDPI (fetched 2026-08-28T04:08:53.521852+00:00, sha fc887d6dc312)
  - homepage: http://www.ntop.org (fetched 2026-08-29T09:05:38.856404+00:00, sha da40264de79d)
  - site_page: https://www.ntop.org/support/documentation/users-guides (fetched 2026-08-29T09:05:38.868047+00:00, sha 35f046d18d07)
  - site_page: https://www.ntop.org/support/documentation/software-installation (fetched 2026-08-29T09:05:38.865736+00:00, sha 7d1b7c3958ce)
  - site_page: https://www.ntop.org/support/documentation/brochures (fetched 2026-08-29T09:05:38.869870+00:00, sha f13f68b2c2d2)
  - site_page: https://www.ntop.org/about-us/the-company (fetched 2026-08-29T09:05:38.875143+00:00, sha 1096e2064018)
  - site_page: https://www.ntop.org/about-us/meet-the-ntop-team (fetched 2026-08-29T09:05:38.877442+00:00, sha 9c6286c5a7e6)
  - site_page: https://www.ntop.org/about-us/partners-and-resellers (fetched 2026-08-29T09:05:38.879307+00:00, sha 70e93c13b971)
  - site_page: https://www.ntop.org/about-us/resellers (fetched 2026-08-29T09:05:38.881193+00:00, sha ff57374c6dc0)
  - site_page: https://www.ntop.org/support/need-help/faq (fetched 2026-08-29T09:05:38.871641+00:00, sha 522b8efa44e7)
- Data as of 2026-08-30T08:39:29.467469+00:00.