A License Change for nDPI: Protecting the Project We Started in 2012
When we began nDPI back in 2012, the idea was simple: build an open source, high-performance Deep Packet Inspection engine that anyone could use as a foundation layer for network applications. No gatekeeping or strings attached, but just a solid piece of infrastructure that the community could build on, improve, and share back. In order to protect this idea, we have registered the nDPI trademark both in the US and EU to prevent people from using the word nDPI without ntop permission. We have tried to involve companies in nDPI, ask for their support and feedback, but unfortunately beside rare exceptions, companies used nDPI but did not return anything.
Fourteen years later, nDPI is used everywhere including commercial security appliances, network monitoring platforms, cloud services, and countless proprietary products we’ve never even heard of. In many ways, that’s exactly the outcome we hoped for. But it has also exposed a problem we can no longer ignore.
The Pattern We Keep Seeing
Over the years, a recurring pattern has emerged. Commercial companies build proprietary products on top of nDPI, sometimes shipping it as a core detection engine inside a paid appliance or SaaS platform, and then, when they hit a wall (a crash, a misclassification, a new protocol that needs support), they reach out to ntop for help. We’re generally happy to help the open source community and to make nDPI better as this is a tool the ntop uses too. The trouble is that many of these same companies never contribute anything back: no code, no bug fixes, not even a heads-up about the issues they’ve found and patched internally. They take, they profit, and the project sees nothing in return, and the funny thing is that often they ask us to sign an NDA (that we didn’t sign of course) before talking about the library. Yes, for talking about the library we develop and maintain with the help of the whole community.
That’s not how open source under LGPL is supposed to work, and it’s not sustainable. DPI is a moving target as protocols evolve, TLS fingerprints shift, new obfuscation and tunnelling techniques show up constantly. For keeping nDPI accurate and current takes real, continuous engineering effort. When companies build revenue on top of that effort while contributing nothing back, they are quietly eroding the very thing they depend on.
What We’re Changing
To address this, we’ve introduced a dual-license model for a subset of nDPI components, described in detail in README.license.md. Here’s the short version:
- The core nDPI library stays exactly as it was: open source, under LGPLv3, free for anyone to use.
- A small number of dissectors we’ve written and maintained ourselves (as of today, DNS, QUIC, and TLS) move to a dual-license model:
- If your project is not-for-profit (nDPI generates no direct or indirect revenue for you), nothing changes. You can keep using these components freely.
- If your project is for-profit — meaning nDPI helps generate direct or indirect revenue, whether that’s a product you sell or a service you charge for — you have two options: stick to the LGPLv3 core only, or sign a commercial license with ntop to keep using the dual-licensed dissectors.
Everything is still open source. Everything is still on GitHub. We’re not hiding the code or locking it behind a paywall but we’re asking commercial users who profit from it to have an honest conversation with us about giving back, whether through a license fee, a contribution, or active involvement in the project. In order to make this change clear, we have modified the API call used to initialize nDPI ndpi_init_detection_module() so that you need to pass a new mandatory parameter that specifies the intended use of nDPI: you cannot use the dual-licensed plugins in a for-revenue project without licensing those components from ntop.
It’s worth being candid about something: from a purely technical standpoint, this change doesn’t prevent anyone determined to ignore the license from doing so the code is still there to read and use however you’d like. What it does is remove the ambiguity. Companies that were previously able to plead ignorance about LGPL obligations no longer have that excuse. The terms are explicit, and continuing to build for-profit products on these components without a license is now a clear, unambiguous violation rather than a gray area.
Where the Money Will Go
Revenues collected from commercial nDPI licenses goes straight back into the project: funding development time to keep pace with new protocols, harden the codebase, and expand detection coverage. This isn’t about turning nDPI into a commercial product; it’s about making sure the people who put in the hours to keep it excellent can keep doing so.
We also want to be clear that we value the people who do give back. If you’re an active contributor, submitting quality code, fixing bugs, extending protocol support ntop reserves the right to waive commercial licensing fees for you entirely. Contribution, not just payment, is a valid way to stay square with the project.
Why This Matters
We still believe deeply in open source. nDPI’s core will remain LGPLv3 (the legacy code is now less than 5% and we could like to remove it completely when time allows), and we intend to keep publishing our engineering work openly, the way we always have. But belief in open source has to be a two-way street. When companies quietly extract value from a project for years without ever reinvesting, financially, or through code, they’re not participating in open source, they’re just consuming it.
This change is our way of drawing a clear line: use nDPI, build on it, even profit from it, but if you do, come talk to us. Contribute code, report bugs, or get a commercial license. That’s not too much to ask from companies that have been happy to take advantage of over a decade of unpaid engineering work.
If you have questions about how this affects your project, reach out to us at license@ntop.org.