3 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
nDPI is a library for deep packet inspection, allowing developers to analyze network traffic and identify protocols. The article covers installation instructions, prerequisites for various operating systems, and guidelines for adding new protocols. It emphasizes the importance of respecting user privacy during traffic inspection.
If you do, here's more
nDPI is an open source library for deep packet inspection, released under the LGPLv3 license. To compile nDPI, users can follow a straightforward process. The basic steps involve running `./autogen.sh` and `./configure`, followed by `make`. If issues arise during compilation, particularly with the `croaring.c` file, using the flag `--enable-old-croaring` may resolve them. For those looking to compile the library without tests or additional tools, the command `--with-only-libndpi` can be used during configuration.
The article provides specific instructions for various operating systems, including Debian/Ubuntu, Arch Linux, FreeBSD, MacOS, and Windows. Debian users should install a set of packages using `apt-get`, while Windows users have multiple options for building nDPI, including MSYS2 and Visual Studio. Notably, all Windows setups require npcap with WinPcap compatibility mode enabled. The article also outlines the prerequisites for compilation, which include GNU tools and either GCC or Clang.
For developers interested in extending nDPI, the article details the steps required to add new protocols. This involves modifying specific header files and ensuring that state variables are correctly defined for TCP and UDP flows. The nDPI library allows for selective blocking of internet traffic when embedded in applications, and tools like ntopng and nProbe can leverage this capability. The article emphasizes the importance of respecting user privacy and obtaining proper authorization for network traffic inspection.
Questions about this article
No questions yet.