nDPI Deep Packet Inspection

nDPI is an open-source deep packet inspection library, developed by ntop (founded by Luca Deri). With over 4,200 stars as of 2026, nDPI provides network protocol detection and classification by analyzing packet payloads without relying on port numbers. Originally derived from the OpenDPI project, nDPI has been extensively extended with custom protocol dissectors and heuristics. Key features include: protocol detection (identifying over 350 network protocols and applications including HTTP, HTTPS/TLS, DNS, QUIC, SSH, BitTorrent, Netflix, YouTube, WhatsApp, Telegram, Zoom, Microsoft Teams, and many others via deep packet inspection), application-level classification (distinguishing between different applications using the same protocol, such as identifying specific streaming services, social media apps, and cloud services), TLS/SSL analysis (extracting SNI, certificate information, JA3/JA4 fingerprints, and detected application from encrypted TLS traffic without decryption), QUIC support (parsing QUIC and HTTP/3 connections including Google QUIC and IETF QUIC), DPI engine (stateful tracking of TCP, UDP, and ICMP flows with bidirectional analysis), custom protocol definitions (adding custom protocol detection via nDPI's API), performance optimization (SIMD-accelerated pattern matching and multi-threaded analysis for high-throughput environments), metadata extraction (extracting flow metadata like HTTP URLs, DNS queries, SMTP recipients, and BitTorrent info hashes), risk assessment (flagging potentially malicious or anomalous flows based on heuristic rules), and integration with ntopng, Suricata, Zeek, and other network monitoring tools.