# Install ndpi with Homebrew, apk, apt, Nix, zypper Deep Packet Inspection (DPI) library. Version 5.0 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:ndpi ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install ndpi ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add ndpi ``` Evidence: Alpine Linux edge package indexes: ndpi from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install libndpi-bin ``` Evidence: Debian stable package indexes: libndpi-bin from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#ndpi ``` Evidence: nixpkgs package indexes: pkgs/by-name/nd/ndpi/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install libndpi-devel ``` Evidence: openSUSE Tumbleweed package metadata: libndpi-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:ndpi - **Package manager:** Homebrew - **Package manager page:** - **Version:** 5.0 - **Source summary:** Deep Packet Inspection (DPI) library - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** LGPL-3.0-or-later - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - ndpiReader (cli) - ndpiReader (alias) ## Dependencies - json-c ## Build dependencies - autoconf - automake - libtool - pkgconf ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 5.0 - Local data: ok - Upstream repository: https://github.com/ntop/nDPI - Upstream latest detected: 5.0 (current) - info: No package-manager update timestamp was available. ## Project history and usage nDPI is ntop's open source deep packet inspection library for classifying application-layer traffic, extracting selected metadata, analyzing encrypted traffic, and exposing APIs for traffic analysis. ### Project history ntop describes nDPI as a maintained DPI toolkit released under LGPL, created to extend the original OpenDPI library with protocols that were otherwise available only in the paid OpenDPI version. The project was also modified for traffic-monitoring workloads by disabling features that slowed down the DPI engine without helping monitoring use cases. The nDPI README cites the 2014 IWCMC paper `nDPI: Open-source high-speed deep packet inspection`, anchoring the project in academic and operational network-monitoring history. The GitHub API reports the ntop/nDPI repository was created on April 19, 2015. ### Adoption history nDPI has the strongest adoption signal in this batch. ntop says it is used in ntop tools and third-party applications, including ntopng and nProbe Cento, to detect application protocols independently of ports. The official product page lists enterprise and ISP use cases such as traffic classification, content filtering, anomaly detection, QoS, bandwidth management, and IDS/IPS enrichment. The repository had about 4.5k GitHub stars and 993 forks on July 1, 2026. Homebrew Formulae listed stable 5.0, 739 installs, and 142 installs-on-request in its 365-day analytics window on the same date. ### How it is used Developers embed the C library into probes, firewalls, monitoring agents, or security tools, then feed it packets or flows to classify protocols, risks, and metadata. The README also documents `ndpiReader`, build steps, test scripts, and the process for adding a new protocol dissector. Operational users tend to encounter nDPI indirectly through ntopng, nProbe, nProbe Cento, Wireshark-related packaging, or distro packages such as Debian's libndpi-bin/libndpi-dev. ### Why package nerds care nDPI is package-significant because it is both a library and a CLI/tooling package. It sits at the boundary between observability, security, packet capture, and policy enforcement, and its protocol database needs continuing updates as applications move ports, encrypt traffic, or change signatures. ### Timeline - {'date': '2014', 'event': 'The nDPI README cites the IWCMC paper on open-source high-speed deep packet inspection.'} - {'date': '2015-04-19', 'event': 'ntop/nDPI repository creation date reported by the GitHub API.'} - {'date': '2025-11-17', 'event': 'GitHub release listing showed nDPI 5.0 Stable as the latest release.'} - {'date': '2026-07-01', 'event': 'Homebrew Formulae listed stable 5.0 and 739 installs in the 365-day analytics window.'} ### Related projects - OpenDPI - ntopng - nProbe - nProbe Cento - PF_RING - nfstream - nDPId - Wireshark ### Sources - - - - - - ## Security Notes library-like package without higher-risk signals. - **Geiger risk:** green / low - library-like package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** ndpi - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - libndpi-bin - 4.2-2.1+b3: normalized package name match | Debian stable package indexes: libndpi-bin from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | extensible deep packet inspection library - ndpiReader | http://www.ntop.org/products/ndpi/ - Debian apt - libndpi-dev - 4.2-2.1+b3: normalized package name match | Debian stable package indexes: libndpi-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | extensible deep packet inspection library - development files | http://www.ntop.org/products/ndpi/ - Debian apt - libndpi-wireshark - 4.2-2.1+b3: normalized package name match | Debian stable package indexes: libndpi-wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | extensible deep packet inspection library - wireshark dissector | http://www.ntop.org/products/ndpi/ - Debian apt - libndpi4.2t64 - 4.2-2.1+b3: normalized package name match | Debian stable package indexes: libndpi4.2t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | extensible deep packet inspection library - shared library | http://www.ntop.org/products/ndpi/ - Nix - ndpi: normalized package name match | nixpkgs package indexes: pkgs/by-name/nd/ndpi/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - libndpi-bin - 4.2-2.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libndpi-bin from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | extensible deep packet inspection library - ndpiReader | http://www.ntop.org/products/ndpi/ - Ubuntu apt - libndpi-dev - 4.2-2.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libndpi-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | extensible deep packet inspection library - development files | http://www.ntop.org/products/ndpi/ - Ubuntu apt - libndpi-wireshark - 4.2-2.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libndpi-wireshark from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | extensible deep packet inspection library - wireshark dissector | http://www.ntop.org/products/ndpi/ - Ubuntu apt - libndpi4.2t64 - 4.2-2.1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: libndpi4.2t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | extensible deep packet inspection library - shared library | http://www.ntop.org/products/ndpi/ - apk - ndpi - 4.10-r0: normalized package name match | Alpine Linux edge package indexes: ndpi from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Open Source Deep Packet Inspection Software Toolkit | https://github.com/ntop/nDPI - apk - ndpi-dev - 4.10-r0: normalized package name match | Alpine Linux edge package indexes: ndpi-dev from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Open Source Deep Packet Inspection Software Toolkit (development files) | https://github.com/ntop/nDPI - zypper - libndpi-devel - 4.12-1.4: normalized package name match | openSUSE Tumbleweed package metadata: libndpi-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Development headers for nNDPI | https://github.com/ntop/nDPI - zypper - libndpi4 - 4.12-1.4: normalized package name match | openSUSE Tumbleweed package metadata: libndpi4 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Extensible deep packet inspection library | https://github.com/ntop/nDPI - zypper - ndpi-common - 4.12-1.4: normalized package name match | openSUSE Tumbleweed package metadata: ndpi-common from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Common files used by nDPI | https://github.com/ntop/nDPI - zypper - ndpi-tools - 4.12-1.4: normalized package name match | openSUSE Tumbleweed package metadata: ndpi-tools from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Tools for nNDPI | https://github.com/ntop/nDPI ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [autoconf](https://www.automicvault.com/pkg/brew/autoconf/) - Build dependency declared by Homebrew. - [automake](https://www.automicvault.com/pkg/brew/automake/) - Build dependency declared by Homebrew. - [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [ntopng](https://www.automicvault.com/pkg/brew/ntopng/) - Popular package that depends on this formula. - [flow-tools](https://www.automicvault.com/pkg/brew/flow-tools/) - Shares av.db curated category or tags: cli, networking, traffic-analysis. - [libprotoident](https://www.automicvault.com/pkg/brew/libprotoident/) - Shares av.db curated category or tags: cli, deep-packet-inspection, networking, traffic-analysis. - [yconalyzer](https://www.automicvault.com/pkg/brew/yconalyzer/) - Shares av.db curated category or tags: cli, networking, traffic-analysis. - [gensio](https://www.automicvault.com/pkg/brew/gensio/) - Shares av.db curated category or tags: c-library, cli, networking. - [gsasl](https://www.automicvault.com/pkg/brew/gsasl/) - Shares av.db curated category or tags: c-library, cli, networking. - [ldns](https://www.automicvault.com/pkg/brew/ldns/) - Shares av.db curated category or tags: c-library, cli, networking. - [libdnet](https://www.automicvault.com/pkg/brew/libdnet/) - Shares av.db curated category or tags: c-library, cli, networking. - [libnl](https://www.automicvault.com/pkg/brew/libnl/) - Shares av.db curated category or tags: c-library, cli, networking. - [sniffnet](https://www.automicvault.com/pkg/brew/sniffnet/) - Local package facts share a topical domain. Shared terms: analysis, cli, inspection, networking, packet. ## Combined YAML source View the package source record on GitHub. [combined/ndpi.yml](https://github.com/automic-vault/db/blob/main/combined/ndpi.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph