Share by e-mail

Return to the home page of Tomasz Bujlow

nDPI: Open-Source High-Speed Deep Packet Inspection

Luca Deri, Maurizio Martinelli, Tomasz Bujlow, and Alfredo Cardigliano

Proceedings of the 10th International Wireless Communications & Mobile Computing Conference 2014 (IWCMC 2014), pp. 617 - 622, IEEE, Nicosia, Cyprus, August 2014, DOI: 10.1109/IWCMC.2014.6906427.

  Download this publication in PDF (author's version)


Network traffic analysis was traditionally limited to packet header, because the transport protocol and application ports were usually sufficient to identify the application protocol. With the advent of port-independent, peer-to-peer, and encrypted protocols, the task of identifying application protocols became increasingly challenging, thus creating a motivation for creating tools and libraries for network protocol classification. This paper covers the design and implementation of nDPI, an open-source library for protocol classification using both packet header and payload. nDPI was extensively validated in various monitoring projects ranging from Linux kernel protocol classification, to analysis of 10 Gbit traffic, reporting both high protocol detection accuracy and efficiency.

Return to the home page of Tomasz Bujlow