The ntop project, which develops tools for capturing and analyzing traffic, published tools for deep packet inspection nDPI 6.0, which continues the development of the OpenDPI library. The nDPI project was founded after an unsuccessful attempt to push changes to the repository OpenDPI, which was left unmaintained. The nDPI code is written in C language and is distributed under the LGPLv3 license.
The system allows to determine the application-level protocols used in the traffic, analyzing the nature network activity without being tied to network ports (can detect well-known protocols whose handlers accept connections on non-standard network ports, for example, if http is not sent from port 80, or, conversely, when they try to camouflage some other network activity as http by launching on port 80).
Differences from OpenDPI come down to support for additional protocols, porting for the Windows platform, performance optimization, adaptation for use in traffic monitoring applications in real time (some specific features that slowed down the engine were removed), assembly capabilities in the form of a Linux kernel module and support for identifying subprotocols.
Supports detection of 56 types of network threats (flow risk) and more than 450 protocols and applications (from OpenVPN, Tor, QUIC, SOCKS, BitTorrent and IPsec to Telegram, Viber, WhatsApp, PostgreSQL and calls to Gmail, Office 365, Google Docs and YouTube). There is a server and client SSL certificate decoder that allows you to determine the protocol (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze the contents of pcap dumps or current traffic via the network interface, the nDPIreader utility is supplied.
In new release:
- Changed conditions licensing. The core nDPI library continues to be licensed under LGPLv3, but some traffic parsing modules such as DNS, QUIC and TLS, translated to dual license: LGPLv3 for non-commercial projects and a commercial license for projects used for profit.