Automic VaultAutomic Vault

brew

Install ndpi with Homebrew, apk, apt, Nix, zypper

Deep Packet Inspection (DPI) library. Version 5.0 via Homebrew; verified from local package data.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install ndpi

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%
sudo apk add ndpi

Alpine Linux edge package indexes · ndpi · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install libndpi-bin

Debian stable package indexes · libndpi-bin · source: deb.debian.org

Nixverified · 92%
nix profile install nixpkgs#ndpi

nixpkgs package indexes · pkgs/by-name/nd/ndpi/package.nix · source: api.github.com

openSUSE zypperverified · 92%
sudo zypper install libndpi-devel

openSUSE Tumbleweed package metadata · libndpi-devel · source: download.opensuse.org

overview

Package summary

Deep Packet Inspection (DPI) library

Commands and aliases

  • ndpiReader

history

Project history and usage

nDPI is ntop's open source deep packet inspection library for classifying application-layer traffic, extracting selected metadata, analyzing encrypted traffic, and exposing APIs for traffic analysis.

Project history

ntop describes nDPI as a maintained DPI toolkit released under LGPL, created to extend the original OpenDPI library with protocols that were otherwise available only in the paid OpenDPI version. The project was also modified for traffic-monitoring workloads by disabling features that slowed down the DPI engine without helping monitoring use cases.

The nDPI README cites the 2014 IWCMC paper `nDPI: Open-source high-speed deep packet inspection`, anchoring the project in academic and operational network-monitoring history. The GitHub API reports the ntop/nDPI repository was created on April 19, 2015.

Adoption history

nDPI has the strongest adoption signal in this batch. ntop says it is used in ntop tools and third-party applications, including ntopng and nProbe Cento, to detect application protocols independently of ports. The official product page lists enterprise and ISP use cases such as traffic classification, content filtering, anomaly detection, QoS, bandwidth management, and IDS/IPS enrichment.

The repository had about 4.5k GitHub stars and 993 forks on July 1, 2026. Homebrew Formulae listed stable 5.0, 739 installs, and 142 installs-on-request in its 365-day analytics window on the same date.

How it is used

Developers embed the C library into probes, firewalls, monitoring agents, or security tools, then feed it packets or flows to classify protocols, risks, and metadata. The README also documents `ndpiReader`, build steps, test scripts, and the process for adding a new protocol dissector.

Operational users tend to encounter nDPI indirectly through ntopng, nProbe, nProbe Cento, Wireshark-related packaging, or distro packages such as Debian's libndpi-bin/libndpi-dev.

Why package nerds care

nDPI is package-significant because it is both a library and a CLI/tooling package. It sits at the boundary between observability, security, packet capture, and policy enforcement, and its protocol database needs continuing updates as applications move ports, encrypt traffic, or change signatures.

Timeline

  • {'date': '2014', 'event': 'The nDPI README cites the IWCMC paper on open-source high-speed deep packet inspection.'}
  • {'date': '2015-04-19', 'event': 'ntop/nDPI repository creation date reported by the GitHub API.'}
  • {'date': '2025-11-17', 'event': 'GitHub release listing showed nDPI 5.0 Stable as the latest release.'}
  • {'date': '2026-07-01', 'event': 'Homebrew Formulae listed stable 5.0 and 739 installs in the 365-day analytics window.'}

Related projects

  • OpenDPI
  • ntopng
  • nProbe
  • nProbe Cento
  • PF_RING
  • nfstream
  • nDPId
  • Wireshark

security posture

Risk level: green

library-like package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • library-like package without higher-risk signals

Signals

  • metadata:library-like

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Installs with 1 runtime dependencies.
  • Build metadata lists 4 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
ndpiReadercliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version5.0
manager updated
local dataok
upstreamcurrent
latest detected5.0

https://github.com/ntop/nDPI

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:ndpi
Version5.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/ndpi
Homepagehttps://www.ntop.org/products/deep-packet-inspection/ndpi/
Repositoryhttps://github.com/ntop/nDPI
Upstream docshttps://github.com/ntop/nDPI#readme
LicenseLGPL-3.0-or-later
Source archivehttps://github.com/ntop/nDPI/archive/refs/tags/5.0.tar.gz
Dependenciesjson-c
Build dependenciesautoconf, automake, libtool, pkgconf
Uses from macOSlibpcap
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namendpi
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

libndpi-bin 4.2-2.1+b3

extensible deep packet inspection library - ndpiReader

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-bin
  • Section: libs
  • Architecture: amd64
  • Source Package: ndpi
  • 3 dependencies
  • normalized package name match
  • Matched by: Ndpi
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libndpi-bin from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

libndpi-dev 4.2-2.1+b3

extensible deep packet inspection library - development files

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-dev
  • Section: libdevel
  • Architecture: amd64
  • Source Package: ndpi
  • 2 dependencies
  • normalized package name match
  • Matched by: Ndpi
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libndpi-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

libndpi-wireshark 4.2-2.1+b3

extensible deep packet inspection library - wireshark dissector

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-wireshark
  • Section: libs
  • Architecture: amd64
  • Source Package: ndpi
  • 1 dependencies
  • normalized package name match
  • Matched by: Ndpi
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libndpi-wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

libndpi4.2t64 4.2-2.1+b3

extensible deep packet inspection library - shared library

http://www.ntop.org/products/ndpi/

sudo apt install libndpi4.2t64
  • Section: libs
  • Architecture: amd64
  • Source Package: ndpi
  • 2 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libndpi4.2t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

ndpi

nix profile install nixpkgs#ndpi
  • normalized package name match
  • Matched by: Ndpi
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/nd/ndpi/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

libndpi-bin 4.2-2.1build1

extensible deep packet inspection library - ndpiReader

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-bin
  • Section: universe/libs
  • Architecture: amd64
  • Source Package: ndpi
  • 3 dependencies
  • normalized package name match
  • Matched by: Ndpi
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libndpi-bin from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
Ubuntu apt95%

libndpi-dev 4.2-2.1build1

extensible deep packet inspection library - development files

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-dev
  • Section: universe/libdevel
  • Architecture: amd64
  • Source Package: ndpi
  • 2 dependencies
  • normalized package name match
  • Matched by: Ndpi
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libndpi-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
Ubuntu apt95%

libndpi-wireshark 4.2-2.1build1

extensible deep packet inspection library - wireshark dissector

http://www.ntop.org/products/ndpi/

sudo apt install libndpi-wireshark
  • Section: universe/libs
  • Architecture: amd64
  • Source Package: ndpi
  • 1 dependencies
  • normalized package name match
  • Matched by: Ndpi
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libndpi-wireshark from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
Ubuntu apt95%

libndpi4.2t64 4.2-2.1build1

extensible deep packet inspection library - shared library

http://www.ntop.org/products/ndpi/

sudo apt install libndpi4.2t64
  • Section: universe/libs
  • Architecture: amd64
  • Source Package: ndpi
  • 2 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libndpi4.2t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
apk95%

ndpi 4.10-r0

Open Source Deep Packet Inspection Software Toolkit

https://github.com/ntop/nDPI

sudo apk add ndpi
  • License: GPL-3.0-only
  • Architecture: x86_64
  • Source Package: ndpi
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: ndpi from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

ndpi-dev 4.10-r0

Open Source Deep Packet Inspection Software Toolkit (development files)

https://github.com/ntop/nDPI

sudo apk add ndpi-dev
  • License: GPL-3.0-only
  • Architecture: x86_64
  • Source Package: ndpi
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: ndpi-dev from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
zypper95%

libndpi-devel 4.12-1.4

Development headers for nNDPI

https://github.com/ntop/nDPI

sudo zypper install libndpi-devel
  • License: LGPL-3.0-only
  • Category: Development/Libraries/C and C++
  • Architecture: x86_64
  • Source Package: ndpi
  • 3 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Ndpi
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: libndpi-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

libndpi4 4.12-1.4

Extensible deep packet inspection library

https://github.com/ntop/nDPI

sudo zypper install libndpi4
  • License: LGPL-3.0-only
  • Category: System/Libraries
  • Architecture: x86_64
  • Source Package: ndpi
  • 4 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Ndpi
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: libndpi4 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

ndpi-common 4.12-1.4

Common files used by nDPI

https://github.com/ntop/nDPI

sudo zypper install ndpi-common
  • License: LGPL-3.0-only
  • Category: Development/Libraries/C and C++
  • Architecture: x86_64
  • Source Package: ndpi
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: ndpi-common from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

ndpi-tools 4.12-1.4

Tools for nNDPI

https://github.com/ntop/nDPI

sudo zypper install ndpi-tools
  • License: LGPL-3.0-only
  • Category: Development/Libraries/C and C++
  • Architecture: x86_64
  • Source Package: ndpi
  • 3 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Ndpi
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: ndpi-tools from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • autoconfBuild dependency declared by Homebrew.
  • automakeBuild dependency declared by Homebrew.
  • libtoolBuild dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.
  • ntopngPopular package that depends on this formula.

Same workflow

  • flow-toolsShares av.db curated category or tags: cli, networking, traffic-analysis.
  • libprotoidentShares av.db curated category or tags: cli, deep-packet-inspection, networking, traffic-analysis.
  • yconalyzerShares av.db curated category or tags: cli, networking, traffic-analysis.
  • gensioShares av.db curated category or tags: c-library, cli, networking.
  • gsaslShares av.db curated category or tags: c-library, cli, networking.
  • ldnsShares av.db curated category or tags: c-library, cli, networking.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment