nDPI - Open source deep packet inspection

Distribution: Fedora 25
Repository: CERT Forensics Tools i386
Package name: nDPI
Package version: 1.8
Package release: 1.fc25
Package architecture: i686
Package type: rpm
Installed size: 3.93 MB
Download size: 422.73 KB
Official Mirror: forensics.cert.org
nDPI is a ntop-maintained superset of the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience. Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while being them un-necessary for network traffic monitoring. nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic on port 80). This is because nowadays the concept of port=application no longer holds.



  • libndpi.so.1
  • nDPI = 1.8-1.fc25
  • nDPI(x86-32) = 1.8-1.fc25
  • pkgconfig(libndpi) = 1.8.0


    Binary package: nDPI-1.8-1.fc25.i686.rpm
    Source package: nDPI-1.8-1.fc25.src.rpm

    Install Howto

    1. Download cert-forensics-tools-release-25 rpm:
    2. Install cert-forensics-tools-release-25 rpm:
      # rpm -Uvh cert-forensics-tools-release*rpm
    3. Install nDPI rpm package:
      # dnf --enablerepo=forensics install nDPI


    • /usr/bin/ndpiReader
    • /usr/lib/libndpi.so.1
    • /usr/lib/libndpi.so.1.0.0
    • /usr/lib/pkgconfig/libndpi.pc
    • /usr/share/doc/nDPI/COPYING
    • /usr/share/doc/nDPI/ChangeLog
    • /usr/share/doc/nDPI/INSTALL
    • /usr/share/doc/nDPI/README.md
    • /usr/share/doc/nDPI/README.nDPI
    • /usr/share/doc/nDPI/README.protocols


    2016-06-29 - Lawrence R. Rogers <lrr@cert.org> 1.8-1 * Release 1.8-1 Version 1.8

    2016-01-06 - Lawrence R. Rogers <lrr@cert.org> 1.7.1-1 * Release 1.7.1-1 Version 1.7.1

    2015-08-17 - Lawrence R. Rogers <lrr@cert.org> 1.7-1 * Release 1.7-1 Version 1.7

    2015-05-31 - Lawrence R. Rogers <lrr@cert.org> 1.6-1 * Release 1.6-1 Version 1.6

    2014-05-13 - Lawrence R. Rogers <lrr@cert.org> * Release 2014-03-21: - improved support for eDonkey/eMule/Kademlia - improved support for PPLive 2014-03-20: - code optimizations - consistency improvements - added support for new applications: Pando Media Booster - improved support for Steam - added support for new web services: Wikipedia, MSN, Amazon, eBay, CNN 2014-03-19: - added new protocols: FTP, code improvements 2014-03-17: - added new protocols: SOCKSv4, SOCKSv5, RTMP

    2011-10-18 - Lawrence R. Rogers <lrr@cert.org> 1.4.0-1 * Release 1.4.0-1 * Unknown changes

    2011-06-09 - Lawrence R. Rogers <lrr@cert.org> 1.3-1 * Release 1.3-1 * added IPv6 support * new protocols: DHCPv6, ICMPv6, Activesync, Armagetron, Crossfire, Dofus, Fiesta Online, Florensia, Guildwars, Kerberos, LDAP, Maplestory, MSSQL, PPTP, Warcraft 3, World of Kung Fu * improved protocols: Aimini, Battlefield, Bittorrent, DirectDownloadLink, eDonkey, FTP, GaduGadu, Gnutella, HTTP, Icecast, Imesh, IRC, Jabber, IMAP, POP, SMTP, MDNS, Meebo, MSN, Netbios, Oscar, PPLive, QQ, Quake, RTP, Secondlive, Shoutcast, SIP, SSL, STUN, Syslog, TVUplayer, Veohtv, World of Warcraft, Yahoo * added protocol history/real protocol feature * various improvements and fixes

    2010-04-07 - Lawrence R. Rogers <lrr@cert.org> 1.2-1 * Release 1.2-1 * added new protocol Meebo * various improvements and fixes

    2009-11-11 - Lawrence R. Rogers <lrr@cert.org> 1.1.1-1 * Release 1.1.1-1 * fixed a compilation error that occurred when debug messages were enabled

    2009-11-10 - Lawrence R. Rogers <lrr@cert.org> 1.1-1 * Release 1.1-1 * OpenDPI is now built using autotools * OpenDPI now compiles on BSD-like systems * added 4 new protocols (AFP, Aimini, Stealthnet, TFTP) * Bittorrent detection has been fixed * FTP detection has been fixed * various small improvements and fixes