nDPI Protocols List¶

This page provides the list of the protocols/applications supported by nDPI. For each protocol there is a brief description, some links to further, more detailed information and, optionally, some notes that might be useful when handling such a protocol (from the application/integrator point of view)

Work in progress!

NDPI_PROTOCOL_FTP_CONTROL¶

FTP Control protocol used for managing file transfers between client and server.

References: RFC959:

NDPI_PROTOCOL_MAIL_POP¶

POP (Post Office Protocol) is used by email clients to retrieve messages from a mail server.

References: RFC1939:

NDPI_PROTOCOL_MAIL_SMTP¶

SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending email across the Internet.

References: RFC5321:

NDPI_PROTOCOL_MAIL_IMAP¶

IMAP (Internet Message Access Protocol) allows email clients to access and manipulate messages on a mail server.

References: RFC3501:

NDPI_PROTOCOL_DNS¶

DNS (Domain Name System) translates human-friendly domain names to IP addresses.

References: RFC1035:

NDPI_PROTOCOL_IPP¶

IPP (Internet Printing Protocol) is used for managing print jobs and queues over a network.

References: RFC8010:

NDPI_PROTOCOL_HTTP¶

HTTP (Hypertext Transfer Protocol) is the foundation of data communication for the World Wide Web.

References: RFC2616:, RFC7230:

NDPI_PROTOCOL_MDNS¶

mDNS (Multicast DNS) resolves hostnames to IP addresses within small networks without a local DNS server.

References: RFC6762:

NDPI_PROTOCOL_NTP¶

NTP (Network Time Protocol) synchronizes clocks of computer systems over packet-switched datalinks.

References: RFC5905:

NDPI_PROTOCOL_NETBIOS¶

NetBIOS (Network Basic Input/Output System) provides services related to the session layer allowing applications on separate computers to communicate.

References: Microsoft NetBIOS documentation:

NDPI_PROTOCOL_NFS¶

NFS (Network File System) allows a user on a client computer to access files over a network much like local storage.

References: RFC7530:

NDPI_PROTOCOL_SSDP¶

SSDP (Simple Service Discovery Protocol) is used for advertising and discovering network services and presence information.

References: RFC4861:

NDPI_PROTOCOL_BGP¶

BGP (Border Gateway Protocol) manages how packets are routed across the internet through the exchange of routing information.

References: RFC4271:

NDPI_PROTOCOL_SNMP¶

SNMP (Simple Network Management Protocol) is used for collecting and organizing information about managed devices on IP networks.

References: RFC1157:

NDPI_PROTOCOL_XDMCP¶

XDMCP (X Display Manager Control Protocol) enables remote graphical logins to Unix/Linux systems.

References: RFC1076:

NDPI_PROTOCOL_SMBV1¶

SMBv1 (Server Message Block version 1) is a network file sharing protocol used for providing shared access to files and printers.

References: Protocol Specs:

NDPI_PROTOCOL_SYSLOG¶

Syslog is a standard protocol used for message logging in an IP network.

References: RFC5424:

NDPI_PROTOCOL_DHCP¶

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices in a network.

References: RFC2131:

NDPI_PROTOCOL_POSTGRES¶

PostgreSQL is an advanced open-source relational database management system.

References: PostgreSQL official site:

NDPI_PROTOCOL_MYSQL¶

MySQL is a popular open-source relational database management system.

References: MySQL official site:

NDPI_PROTOCOL_MS_OUTLOOK¶

Microsoft Outlook is an email client and personal information manager by Microsoft.

References: Outlook official site:

NDPI_PROTOCOL_VK¶

VK (VKontakte) is a Russian online social media and social networking service.

References: VK official site:

NDPI_PROTOCOL_MAIL_POPS¶

POPS (POP Secure) is POP protocol used over SSL/TLS for secure email retrieval.

References: RFC2595:

NDPI_PROTOCOL_TAILSCALE¶

Tailscale is a zero-config VPN based on WireGuard, simplifying secure network connectivity.

References: Tailscale official site:

NDPI_PROTOCOL_YANDEX¶

Yandex is a Russian internet company providing multiple online services including search.

References: Yandex official site:

NDPI_PROTOCOL_NTOP¶

ntop is a network traffic probe that shows network usage.

References: ntop official site:

NDPI_PROTOCOL_COAP¶

CoAP (Constrained Application Protocol) is a specialized web transfer protocol for use with constrained devices.

References: RFC7252:

NDPI_PROTOCOL_VMWARE¶

VMware protocol used for management and data exchange in VMware virtualization platforms.

References: VMware official site:

NDPI_PROTOCOL_MAIL_SMTPS¶

SMTPS (SMTP Secure) is SMTP protocol for sending emails over SSL/TLS encrypted connections.

References: RFC2487:

NDPI_PROTOCOL_DTLS¶

DTLS (Datagram Transport Layer Security) provides communications privacy for datagram protocols.

References: RFC6347:

NDPI_PROTOCOL_UBNTAC2¶

AirControl network management application by Ubiquiti Networks.

References: Ubiquiti AirControl community post:

NDPI_PROTOCOL_BFCP¶

BFCP (Binary Floor Control Protocol) is used for controlling and coordinating real-time data sharing and collaboration during video conferencing sessions.

References: RFC8855:

NDPI_PROTOCOL_YANDEX_MAIL¶

Yandex.Mail is a free email service provided by the Russian internet company Yandex.

References: Yandex.Mail official site:

NDPI_PROTOCOL_YANDEX_MUSIC¶

Yandex.Music is a music streaming service offering a large library of tracks and personalized recommendations.

References: Yandex.Music official site:

NDPI_PROTOCOL_GNUTELLA¶

Gnutella is a decentralized peer-to-peer network protocol used for file sharing.

References: Gnutella Wikipedia article:

NDPI_PROTOCOL_EDONKEY¶

eDonkey is a peer-to-peer file sharing network popular in the early 2000s, supporting large file transfers.

References: eDonkey Wikipedia article:

NDPI_PROTOCOL_BITTORRENT¶

BitTorrent is a widely used peer-to-peer protocol for distributing large amounts of data efficiently.

References: BitTorrent Wikipedia article:

NDPI_PROTOCOL_MSTEAMS_CALL¶

Audio/video calls made by Microsoft applications, mainly MS Teams and Skype.

References: Microsoft Teams official site:

NDPI_PROTOCOL_SIGNAL¶

Signal is a secure messaging protocol known for end-to-end encryption of texts and calls.

References: Signal:

NDPI_PROTOCOL_MEMCACHED¶

Memcached is a distributed memory caching system used to speed up dynamic web applications.

References: Memcached official site:

NDPI_PROTOCOL_SMBV23¶

SMB version 2 and 3 are protocols for shared access to files, printers, and serial ports over a network.

References: Server Message Block Wikipedia article:

NDPI_PROTOCOL_MINING¶

Mining protocols enable communication with blockchain networks like Ethereum, ZCash, and Monero during cryptocurrency mining.

References: Cryptocurrency Wikipedia article:

NDPI_PROTOCOL_NEST_LOG_SINK¶

Nest Log Sink protocol used by Nest Protect and other Nest devices (particularly smoke detectors) to send logging data.

References: Nest Protect overview:

NDPI_PROTOCOL_MODBUS¶

Modbus is a serial communication protocol for connecting industrial electronic devices.

References: Modbus Wikipedia article:

NDPI_PROTOCOL_WHATSAPP_CALL¶

WhatsApp Call protocol handles both audio and video calls within the WhatsApp messaging app.

References: WhatsApp official site:

NDPI_PROTOCOL_DATASAVER¶

Data Saver (Lite Mode) is a Google Chrome feature designed to reduce mobile data usage by compressing web traffic.

References: Google Chromium Blog:

NDPI_PROTOCOL_XBOX¶

Xbox protocol covers network traffic associated with Microsoft’s Xbox gaming consoles.

References: Xbox official site:

NDPI_PROTOCOL_QQ¶

QQ is an instant messaging platform developed by Tencent popular in China.

References: QQ official site:

NDPI_PROTOCOL_TIKTOK¶

TikTok is a video-sharing social networking service for short-format videos.

References: TikTok official site:

NDPI_PROTOCOL_RTSP¶

RTSP (Real Time Streaming Protocol) controls streaming media servers.

References: RFC2326:

NDPI_PROTOCOL_MAIL_IMAPS¶

IMAPS (IMAP over SSL) is the secure version of the Internet Message Access Protocol for email retrieval.

References: RFC3501: and RFC8314 (IMAPS):

NDPI_PROTOCOL_ICECAST¶

Icecast is a streaming media project that supports audio/video streaming and broadcast.

References: Icecast official site:

NDPI_PROTOCOL_CPHA¶

Check Point High Availability (CPHA) Protocol provides firewall redundancy and failover.

References: Check Point HA:

NDPI_PROTOCOL_IQIYI¶

iQIYI is a Chinese online video platform with original and licensed movies, dramas, variety shows, and anime.

References: iQIYI official site:

NDPI_PROTOCOL_ADOBE_CONNECT¶

Adobe Connect is a web conferencing platform for online meetings, webinars, and virtual classrooms.

References: Adobe Connect official site:

NDPI_PROTOCOL_MONGODB¶

MongoDB is a popular NoSQL database system designed for scalability and flexibility.

References: MongoDB official site:

NDPI_PROTOCOL_PLURALSIGHT¶

Pluralsight is an online education platform offering tech skill development courses.

References: Pluralsight official site:

NDPI_PROTOCOL_YANDEX_CLOUD¶

Yandex.Cloud is a public cloud platform providing computing and storage services.

References: Yandex.Cloud official site:

NDPI_PROTOCOL_OCSP¶

OCSP (Online Certificate Status Protocol) checks the revocation status of digital certificates in real-time.

References: RFC6960:

NDPI_PROTOCOL_VXLAN¶

VXLAN (Virtual Extensible LAN) extends layer 2 networks over layer 3 infrastructure.

References: RFC7348:

NDPI_PROTOCOL_IRC¶

IRC (Internet Relay Chat) is a text-based chat system for instant messaging.

References: IRC Wikipedia article: and IRC statistics:

NDPI_PROTOCOL_MERAKI_CLOUD¶

Meraki Cloud is a cloud-based network management platform by Cisco Meraki.

References: Meraki official site:

NDPI_PROTOCOL_JABBER¶

Jabber is an open instant messaging protocol based on XMPP for real-time communication.

References: XMPP standards:

NDPI_PROTOCOL_NATS¶

NATS is a high-performance messaging system for cloud-native applications and IoT.

References: NATS official site:

NDPI_PROTOCOL_AMONG_US¶

Among Us is a multiplayer social deduction game developed by InnerSloth.

References: InnerSloth official site:

NDPI_PROTOCOL_YAHOO¶

Yahoo is a web services provider known for its email, news, and search engine products.

References: Yahoo official site:

NDPI_PROTOCOL_DISNEYPLUS¶

Disney+ is a streaming service offering movies and TV series from Disney franchises.

References: Disney+ official site:

NDPI_PROTOCOL_HART_IP¶

Highway Addressable Remote Transducer over IP.

References: HART-IP Protocol Specs:

NDPI_PROTOCOL_IP_VRRP¶

Virtual Router Redundancy Protocol (VRRP) provides automatic assignment of available IP routers to hosts.

References: RFC5798:

NDPI_PROTOCOL_STEAM¶

Steam is a digital distribution platform developed by Valve Corporation for games.

References: Steam official site:

NDPI_PROTOCOL_MELSEC¶

MELSEC is a proprietary industrial protocol used by Mitsubishi Electric PLCs for communication and control.

References: MELSEC Communication Protocol Manual:

NDPI_PROTOCOL_WORLDOFWARCRAFT¶

World of Warcraft (WoW) is a massively multiplayer online role-playing game (MMORPG).

References: WoW official site:

NDPI_PROTOCOL_TELNET¶

Telnet is a network protocol for interactive text communication.

References: RFC854:

NDPI_PROTOCOL_STUN¶

STUN (Session Traversal Utilities for NAT) helps devices discover public IP addresses.

References: RFC5389:

NDPI_PROTOCOL_IPSEC¶

IPsec authenticates and encrypts IP packets for secure communication over IP networks.

References: RFC4301:

NDPI_PROTOCOL_IP_GRE¶

GRE (Generic Routing Encapsulation) tunnels packets to encapsulate various network protocols.

References: RFC2784:

NDPI_PROTOCOL_IP_ICMP¶

ICMP (Internet Control Message Protocol) sends error messages and operational information.

References: RFC792:

NDPI_PROTOCOL_IP_IGMP¶

IGMP (Internet Group Management Protocol) manages membership of IP multicast groups.

References: RFC2236:

NDPI_PROTOCOL_IP_EGP¶

EGP (Exterior Gateway Protocol) is an obsolete protocol for exchanging routing info.

References: RFC904:

NDPI_PROTOCOL_IP_SCTP¶

SCTP (Stream Control Transmission Protocol) is a reliable transport layer protocol.

References: RFC4960:

NDPI_PROTOCOL_IP_OSPF¶

OSPF (Open Shortest Path First) is a routing protocol for IP networks.

References: RFC2328:

NDPI_PROTOCOL_IP_IP_IN_IP¶

IP-in-IP encapsulation allows an IP packet to be wrapped inside another IP packet.

References: RFC2003:

NDPI_PROTOCOL_RTP¶

RTP (Real-time Transport Protocol) provides end-to-end delivery services for real-time data.

References: RFC3550:

NDPI_PROTOCOL_RDP¶

RDP (Remote Desktop Protocol) is Microsoft’s protocol for remote graphical desktop access.

References: Remote Desktop Protocol Wikipedia article:

NDPI_PROTOCOL_VNC¶

VNC (Virtual Network Computing) allows remote control of other computers’ desktops.

References: VNC Wikipedia article:

NDPI_PROTOCOL_TUMBLR¶

Tumblr is a microblogging and social networking platform.

References: Tumblr official site:

NDPI_PROTOCOL_TLS¶

TLS (Transport Layer Security) provides encryption for network communications.

References: RFC8446:

NDPI_PROTOCOL_SSH¶

SSH (Secure Shell) is a protocol for secure remote login and other network services.

References: RFC4251:

NDPI_PROTOCOL_USENET¶

Usenet is a distributed discussion system for newsgroups.

References: Usenet Wikipedia article:

NDPI_PROTOCOL_MGCP¶

MGCP (Media Gateway Control Protocol) controls media gateways on IP networks.

References: RFC3435:

NDPI_PROTOCOL_IAX¶

IAX (Inter-Asterisk eXchange protocol) is used for VoIP sessions, originally for Asterisk PBX.

References: RFC5456:

NDPI_PROTOCOL_TFTP¶

TFTP (Trivial File Transfer Protocol) is a simple file transfer protocol.

References: RFC1350:, RFC2347:, RFC2349:

NDPI_PROTOCOL_AFP¶

AFP (Apple Filing Protocol) is a network protocol for file services on macOS.

References: AFP Wikipedia article:

NDPI_PROTOCOL_YANDEX_METRIKA¶

Yandex Metrika is a web analytics service by Yandex to track website traffic.

References: Yandex Metrika official site:

NDPI_PROTOCOL_YANDEX_DIRECT¶

Yandex.Direct is an online advertising platform for contextual ads.

References: Yandex.Direct official site:

NDPI_PROTOCOL_SIP¶

SIP (Session Initiation Protocol) is used for real-time communication session control.

References: RFC3261:

NDPI_PROTOCOL_TRUPHONE¶

Truphone is a global mobile network provider using eSIM and VoIP.

References: Truphone official site:

NDPI_PROTOCOL_IP_ICMPV6¶

ICMPv6 is integral to IPv6 for diagnostics and error reporting.

References: RFC4443:

NDPI_PROTOCOL_DHCPV6¶

DHCPv6 dynamically assigns IPv6 addresses and settings.

References: RFC8415:

NDPI_PROTOCOL_ARMAGETRON¶

Armagetron Advanced is a 3D multiplayer game inspired by Tron light cycles.

References: Armagetron official site:

NDPI_PROTOCOL_CROSSFIRE¶

Crossfire is an online FPS game with team combat and various modes.

References: Crossfire official site:

NDPI_PROTOCOL_DOFUS¶

Dofus is a tactical MMORPG with turn-based combat.

References: Dofus official site:

NDPI_PROTOCOL_GUILDWARS2¶

Guild Wars is an online RPG known for dynamic events and PvP.

References: Guild Wars 2 official site:

NDPI_PROTOCOL_AMAZON_ALEXA¶

Amazon Alexa voice service protocol for smart devices.

References: Amazon Alexa developer site:

NDPI_PROTOCOL_KERBEROS¶

Kerberos is a protocol for secure network authentication.

References: RFC4120:

NDPI_PROTOCOL_LDAP¶

LDAP is a protocol for accessing directory services.

References: RFC4510:

NDPI_PROTOCOL_NEXON¶

Nexon is a South Korean video game developer and publisher.

References: Nexon official site:

NDPI_PROTOCOL_IP_AH¶

An Authentication Header (AH) is a security protocol in IPSec that ensures the integrity of packet headers and data, provides user authentication, and offers optional replay protection and access protection. It does not encrypt any part of the packets.

References: RFC4302:

NDPI_PROTOCOL_IP_ESP¶

Encapsulating Security Payload (ESP) is a crucial protocol within the IPsec framework, designed to protect the confidentiality, integrity, and authentication of IP packets. It achieves this by encrypting the payload (the data being transmitted) and potentially authenticating the sender and validating the data’s integrityencrypt any part of the packets.

References: RFC4303:

NDPI_PROTOCOL_MOZILLA¶

Mozilla-related traffic, especially Firefox browser.

References: Mozilla official site:

NDPI_PROTOCOL_GOOGLE¶

Google’s internet services and products traffic.

References: Google official site:

NDPI_PROTOCOL_MS_RPCH¶

Microsoft RPC protocol over HTTP.

References: Microsoft RPCH specs:

NDPI_PROTOCOL_NETFLOW¶

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic flow.

References: RFC3954:

NDPI_PROTOCOL_SFLOW¶

sFlow is a packet sampling technology for monitoring traffic in data networks in real time.

References: sFlow Wikipedia article:

NDPI_PROTOCOL_HTTP_CONNECT¶

HTTP CONNECT method is used to establish a tunnel to the server, typically for SSL traffic through proxies.

References: RFC7231:

NDPI_PROTOCOL_CITRIX¶

Citrix provides remote access and virtualization solutions for secure delivery of applications and desktops.

References: Citrix official site:

NDPI_PROTOCOL_NETFLIX¶

Netflix is a leading streaming entertainment service delivering movies, TV shows, and original content.

References: Netflix official site:

NDPI_PROTOCOL_LASTFM¶

Last.fm is a music recommendation and streaming service that provides personalized music charts and discovery.

References: Last.fm official site:

NDPI_PROTOCOL_WAZE¶

Waze is a GPS navigation app providing real-time traffic and road info.

References: Waze official site:

NDPI_PROTOCOL_HULU¶

Hulu is a streaming platform offering live and on-demand TV and movies.

References: Hulu official site:

NDPI_PROTOCOL_CHECKMK¶

Checkmk is an IT monitoring system for servers, apps, networks, and cloud.

References: Checkmk official site:

NDPI_PROTOCOL_AJP¶

Apache JServ Protocol (AJP) proxies web server requests to application servers.

References: AJP Protocol Specs:

NDPI_PROTOCOL_APPLE¶

Apple protocol includes various services related to Apple devices and ecosystem.

References: Apple official site:

NDPI_PROTOCOL_WEBEX¶

Webex is a video conferencing and online meeting application by Cisco.

References: Webex official site:

NDPI_PROTOCOL_WHATSAPP¶

WhatsApp is a messaging app by Meta, offering encrypted messaging and calls.

References: WhatsApp official site:

NDPI_PROTOCOL_APPLE_ICLOUD¶

iCloud is Apple’s cloud storage and computing service.

References: iCloud official site:

NDPI_PROTOCOL_VIBER¶

Viber is a cross-platform messaging and VoIP app.

References: Viber official site:

NDPI_PROTOCOL_APPLE_ITUNES¶

Apple iTunes is a media player and content store.

References: iTunes official site:

NDPI_PROTOCOL_RADIUS¶

RADIUS protocol provides centralized Authentication, Authorization, and Accounting.

References: RFC2865:

NDPI_PROTOCOL_TEAMVIEWER¶

TeamViewer is remote access software for desktop sharing and file transfer.

References: TeamViewer official site:

NDPI_PROTOCOL_EGD¶

Ethernet Global Data (EGD) protocol for real-time data exchange in industrial automation.

References: EGD Wikipedia article:

Notes:

This dissector only works for data packets, not configuration commands.
IPv6 is not supported.

NDPI_PROTOCOL_HCL_NOTES¶

HCL Notes (formerly Lotus Notes) is a collaborative client-server application.

References: HCL Notes official site:

NDPI_PROTOCOL_SAP¶

Session Announcement Protocol (SAP) announces multicast session info.

References: RFC2974:

NDPI_PROTOCOL_GTP¶

GPRS Tunneling Protocol (GTP) carries mobile data within GSM and UMTS.

References: GTP Wikipedia article:

NDPI_PROTOCOL_WSD¶

Web Services Dynamic Discovery (WS-Discovery) locates services on local networks.

References: WS-Discovery Wikipedia article:

NDPI_PROTOCOL_LLMNR¶

Link-Local Multicast Name Resolution (LLMNR) resolves names on local links.

References: RFC4795:

NDPI_PROTOCOL_TOCA_BOCA¶

Toca Boca produces creative mobile games for children.

References: Toca Boca official site:

NDPI_PROTOCOL_SPOTIFY¶

Spotify is a music streaming service offering millions of tracks and podcasts.

References: Spotify official site:

NDPI_PROTOCOL_FACEBOOK_MESSENGER¶

Facebook Messenger is an instant messaging service by Meta.

References: Messenger official site:

NDPI_PROTOCOL_H323¶

H.323 is a standard for real-time voice, video, and data communications.

References: ITU-T H.323:

NDPI_PROTOCOL_OPENVPN¶

OpenVPN is an open-source VPN protocol for secure connections.

References: OpenVPN official site:

NDPI_PROTOCOL_NOE¶

NOE is a VoIP protocol for Alcatel-Lucent compatible telephone systems.

References: Teldat Manual:

NDPI_PROTOCOL_CISCOVPN¶

Cisco VPN protocols secure virtual private network connections.

References: Cisco VPN site:

NDPI_PROTOCOL_TEAMSPEAK¶

TeamSpeak is a voice-over-IP app for gamer communication.

References: TeamSpeak official site:

NDPI_PROTOCOL_TOR¶

Tor enables anonymous communication via onion routing.

References: Tor Project site:

NDPI_PROTOCOL_SKINNY¶

Skinny Client Control Protocol (SCCP) is a Cisco VoIP signaling protocol.

References: SCCP Wikipedia article:

NDPI_PROTOCOL_RTCP¶

RTCP (Real-time Transport Control Protocol) works alongside RTP.

References: RFC3550 Section 6:

NDPI_PROTOCOL_RSYNC¶

Rsync is a fast incremental file transfer utility.

References: Rsync homepage:

NDPI_PROTOCOL_ORACLE¶

Oracle database communication protocol.

References: Oracle Net Services docs:

NDPI_PROTOCOL_CORBA¶

CORBA enables software components to communicate over a network.

References: OMG CORBA:

NDPI_PROTOCOL_CANONICAL¶

Canonical Ltd., developer of Ubuntu Linux and related services.

References: Canonical official site:

NDPI_PROTOCOL_WHOIS_DAS¶

WHOIS DAS queries databases storing Internet resource assignments.

References: WHOIS Wikipedia article:

NDPI_PROTOCOL_SD_RTN¶

Agora SD-RTN is a global, private, secure real-time network for low-latency streaming.

References: Agora platform info:

NDPI_PROTOCOL_SOCKS¶

SOCKS routes network packets through proxy servers.

References: RFC1928:

NDPI_PROTOCOL_NINTENDO¶

Nintendo network communication protocols for consoles and services.

References: Nintendo official site:

NDPI_PROTOCOL_RTMP¶

RTMP (Real-Time Messaging Protocol) streams audio, video, and data.

References: RTMP Wikipedia article:

NDPI_PROTOCOL_FTP_DATA¶

FTP Data Protocol transfers data separately from control connections.

References: FTP Wikipedia article:

NDPI_PROTOCOL_WIKIPEDIA¶

Wikipedia is a free, collaborative, multilingual online encyclopedia.

References: Wikipedia official site:

NDPI_PROTOCOL_ZMQ¶

ZeroMQ (ZMQ) is a high-performance asynchronous messaging library.

References: ZeroMQ official site:

NDPI_PROTOCOL_AMAZON¶

Amazon network traffic including retail, AWS, and content delivery.

References: Amazon official site:

NDPI_PROTOCOL_EBAY¶

eBay is an online marketplace for quality goods and services.

References: eBay official site:

NDPI_PROTOCOL_CNN¶

CNN is an American news television channel providing 24-hour news coverage.

References: CNN official site:

NDPI_PROTOCOL_MEGACO¶

Megaco (H.248) protocol for controlling media gateways in VoIP.

References: ITU-T H.248:

NDPI_PROTOCOL_RESP¶

Redis Serialization Protocol.

References: Redis Protocol Specs:

NDPI_PROTOCOL_PINTEREST¶

Pinterest is a social media platform for sharing images and ideas.

References: Pinterest official site:

NDPI_PROTOCOL_OSPF¶

OSPF (Open Shortest Path First) is a routing protocol for IP networks.

References: RFC2328:

NDPI_PROTOCOL_TELEGRAM¶

Telegram is a cloud-based instant messaging app focusing on speed and security.

References: Telegram official site:

NDPI_PROTOCOL_COD_MOBILE¶

Call of Duty: Mobile is a popular shooter game for iOS and Android.

References: COD Mobile official site:

NDPI_PROTOCOL_PANDORA¶

Pandora is an Internet radio and streaming music service.

References: Pandora official site:

NDPI_PROTOCOL_QUIC¶

QUIC is a transport layer protocol by Google improving web app performance.

References: RFC9000:

NDPI_PROTOCOL_ZOOM¶

Zoom is a popular video conferencing platform.

References: Zoom official site:

NDPI_PROTOCOL_EAQ¶

EAQ is a Brazilian organization measuring broadband quality.

References: EAQ official site:

NDPI_PROTOCOL_OOKLA¶

Ookla operates Speedtest.net for network performance testing.

References: Speedtest.net:

NDPI_PROTOCOL_AMQP¶

AMQP is an open standard application layer protocol for messaging middleware.

References: AMQP official site:

NDPI_PROTOCOL_KAKAOTALK¶

KakaoTalk is a South Korean mobile messaging app (text only).

References: Kakao official site:

NDPI_PROTOCOL_KAKAOTALK_VOICE¶

KakaoTalk Voice adds voice call functionality within KakaoTalk.

References: Kakao official site:

NDPI_PROTOCOL_TWITCH¶

Twitch is a live streaming platform for gaming and esports.

References: Twitch official site:

NDPI_PROTOCOL_DOH_DOT¶

DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) encrypt DNS queries.

References: DoH RFC8484:, DoT RFC7858:

NDPI_PROTOCOL_WECHAT¶

WeChat is a Chinese messaging, social media, and payment app.

References: WeChat official site:

NDPI_PROTOCOL_MPEGTS¶

MPEG Transport Stream (TS) is a standard for transmission/storage of audio, video, data.

References: MPEG-TS Wikipedia article:

NDPI_PROTOCOL_SNAPCHAT¶

Snapchat is a multimedia messaging app known for ephemeral messages.

References: Snapchat official site:

NDPI_PROTOCOL_SINA¶

Sina is a Chinese company operating web services including Sina Weibo.

References: Sina official site:

NDPI_PROTOCOL_GOOGLE_MEET¶

Google Meet is Google’s video conferencing service.

References: Google Meet official site:

NDPI_PROTOCOL_IFLIX¶

iflix is a video on demand service for emerging markets.

References: iflix official site:

NDPI_PROTOCOL_GITHUB¶

GitHub is a platform for version control and collaborative development.

References: GitHub official site:

NDPI_PROTOCOL_BJNP¶

BJNP is a proprietary USB-over-IP network printing discovery protocol by Canon.

References: Canon proprietary, no public specs available.

NDPI_PROTOCOL_REDDIT¶

Reddit is a social news and discussion website.

References: Reddit official site:

NDPI_PROTOCOL_WIREGUARD¶

WireGuard is a modern VPN protocol noted for simplicity and speed.

References: WireGuard official site:

NDPI_PROTOCOL_SMPP¶

SMPP is a protocol for exchanging SMS messages.

References: SMPP official site:

NDPI_PROTOCOL_DNSCRYPT¶

DNSCrypt authenticates and encrypts DNS traffic.

References: DNSCrypt official site:

NDPI_PROTOCOL_TINC¶

Tinc is an open-source VPN daemon creating secure private networks.

References: Tinc official site:

NDPI_PROTOCOL_DEEZER¶

Deezer is a music streaming service.

References: Deezer official site:

NDPI_PROTOCOL_INSTAGRAM¶

Instagram is a social app for photo and video sharing.

References: Instagram official site:

NDPI_PROTOCOL_MICROSOFT¶

Microsoft protocol includes various proprietary communications.

References: Microsoft official site:

NDPI_PROTOCOL_BLIZZARD¶

Blizzard Entertainment is a game developer known for WoW, Diablo, StarCraft.

References: Blizzard official site:

NDPI_PROTOCOL_VALVE_SDR¶

Steam Datagram Relay (SDR) is Valve’s virtual private gaming network.

References: Steamworks partner doc:

NDPI_PROTOCOL_LISP¶

LISP separates IP addresses into Endpoint IDs and Routing Locators.

References: RFC6830:

NDPI_PROTOCOL_DIAMETER¶

Diameter is an AAA network protocol, successor to RADIUS.

References: RFC6733:

NDPI_PROTOCOL_APPLE_PUSH¶

Apple Push Notification Service (APNs) delivers notifications to Apple devices.

References: Apple Developer APNs:

NDPI_PROTOCOL_GOOGLE_SERVICES¶

Google Services cover various APIs and endpoints used by Google.

References: No single official site; includes googleapis.com, googletagmanager.com.

NDPI_PROTOCOL_AMAZON_VIDEO¶

Amazon Video is Amazon’s video streaming service.

References: Amazon Video site:

NDPI_PROTOCOL_GOOGLE_DOCS¶

Google Docs allows collaborative online document editing.

References: Google Docs official site:

NDPI_PROTOCOL_WHATSAPP_FILES¶

WhatsApp media files such as videos, pictures, and voice messages.

References: WhatsApp FAQ:

NDPI_PROTOCOL_TARGUS_GETDATA¶

Targus GetData is a proprietary protocol for Targus device data transfer.

References: Proprietary, no public documentation.

NDPI_PROTOCOL_DNP3¶

DNP3 is a communication protocol for process automation systems.

References: DNP3 Wikipedia article:

NDPI_PROTOCOL_IEC60870¶

IEC 60870-5-104 network protocol used in power system telecontrol and supervision.

References: IEC 60870 Wikipedia:

NDPI_PROTOCOL_BLOOMBERG¶

Bloomberg services traffic identified by domains and ASN registrations.

References: Bloomberg official site:

NDPI_PROTOCOL_CAPWAP¶

CAPWAP protocol manages wireless access points centrally.

References: RFC5415:

NDPI_PROTOCOL_ZABBIX¶

Zabbix protocol supports agent-server communication for monitoring.

References: Zabbix Documentation:

NDPI_PROTOCOL_S7COMM¶

S7Comm is Siemens PLC communication protocol.

References: Wireshark S7comm wiki:

NDPI_PROTOCOL_MSTEAMS¶

Microsoft Teams collaboration app protocol.

References: Microsoft Teams official site:

Notes:

This ID is also used for Skype traffic.

NDPI_PROTOCOL_WEBSOCKET¶

WebSocket provides full-duplex communication channels over TCP.

References: RFC6455:

NDPI_PROTOCOL_ANYDESK¶

AnyDesk is a platform-independent remote desktop app.

References: AnyDesk official site:

NDPI_PROTOCOL_SOAP¶

SOAP is a protocol for exchanging structured info in web services using XML.

References: W3C SOAP spec:

NDPI_PROTOCOL_APPLE_SIRI¶

Apple Siri is a voice assistant integrated into Apple devices.

References: Apple Siri official:

NDPI_PROTOCOL_SNAPCHAT_CALL¶

Snapchat Call provides voice and video communication between users.

References: Snapchat official site:

NDPI_PROTOCOL_HPVIRTGRP¶

HP Virtual Group is HP’s proprietary virtualization protocol.

References: Proprietary, no public documentation.

NDPI_PROTOCOL_GENSHIN_IMPACT¶

Genshin Impact is an action RPG game with live data exchanges.

References: Genshin Impact official site:

NDPI_PROTOCOL_ACTIVISION¶

Activision network traffic, including Call of Duty games.

References: Activision official site:

NDPI_PROTOCOL_FORTICLIENT¶

FortiClient security suite with VPN and endpoint protection.

References: FortiClient official site:

NDPI_PROTOCOL_Z3950¶

Z39.50 protocol for searching and retrieving info from remote databases, often library systems.

References: Library of Congress Z39.50:

NDPI_PROTOCOL_LIKEE¶

Likee is a short-video creation and sharing platform.

References: Likee official site:

NDPI_PROTOCOL_GITLAB¶

GitLab is a DevOps platform with Git repository management and CI/CD.

References: GitLab official site:

NDPI_PROTOCOL_AVAST_SECUREDNS¶

Avast Secure DNS provides safer browsing by blocking unsafe websites.

References: Avast Secure DNS site:

NDPI_PROTOCOL_CASSANDRA¶

Apache Cassandra is a distributed NoSQL database system for big data.

References: Cassandra official site:

NDPI_PROTOCOL_AMAZON_AWS¶

Amazon Web Services (AWS) cloud computing platform.

References: AWS official site:

NDPI_PROTOCOL_SALESFORCE¶

Salesforce is a cloud-based CRM platform.

References: Salesforce official site:

NDPI_PROTOCOL_VIMEO¶

Vimeo is a video hosting and sharing platform.

References: Vimeo official site:

NDPI_PROTOCOL_FACEBOOK_VOIP¶

Facebook’s voice over IP communications within Messenger.

References: Facebook Messenger:

NDPI_PROTOCOL_SIGNAL_VOIP¶

Signal’s encrypted voice calling feature.

References: Signal official site:

NDPI_PROTOCOL_FUZE¶

Fuze is a unified communications platform.

References: Fuze official site:

NDPI_PROTOCOL_GTP_U¶

GTP-U carries user data within mobile networks.

References: 3GPP TS 29.060:

NDPI_PROTOCOL_GTP_C¶

GTP-C controls tunnel establishment in mobile networks.

References: 3GPP TS 29.060:

NDPI_PROTOCOL_GTP_PRIME¶

GTP Prime is a signaling protocol used in LTE for billing and charging.

References: 3GPP TS 32.295:

NDPI_PROTOCOL_ALIBABA¶

Alibaba is a major Chinese conglomerate specializing in e-commerce and technology.

References: Alibaba official site:

NDPI_PROTOCOL_CRASHLYSTICS¶

Crashlytics is a crash reporting tool by Google Firebase.

References: Crashlytics on Firebase:

NDPI_PROTOCOL_MICROSOFT_AZURE¶

Microsoft Azure cloud computing platform.

References: Azure official site:

NDPI_PROTOCOL_ICLOUD_PRIVATE_RELAY¶

iCloud Private Relay increases privacy by routing traffic through multiple relays.

References: Apple iCloud Private Relay:

NDPI_PROTOCOL_ETHERNET_IP¶

Ethernet/IP adapts the Common Industrial Protocol to Ethernet.

References: ODVA Ethernet/IP:

NDPI_PROTOCOL_BADOO¶

Badoo is a social networking and dating service.

References: Badoo official site:

NDPI_PROTOCOL_ACCUWEATHER¶

AccuWeather provides real-time weather forecasts and alerts.

References: AccuWeather official site:

NDPI_PROTOCOL_GOOGLE_CLASSROOM¶

Google Classroom simplifies school assignment management.

References: Google Classroom:

NDPI_PROTOCOL_HSRP¶

HSRP provides IP network failover and redundancy.

References: Cisco HSRP guide:

NDPI_PROTOCOL_GOOGLE_CLOUD¶

Google Cloud provides cloud computing services.

References: Google Cloud official site:

NDPI_PROTOCOL_TENCENT¶

Tencent network services and applications.

References: Tencent official site:

NDPI_PROTOCOL_RAKNET¶

RakNet is a C++ game networking engine.

References: RakNet on GitHub:

NDPI_PROTOCOL_XIAOMI¶

Xiaomi communication protocols for devices and IoT.

References: Xiaomi official site:

NDPI_PROTOCOL_CACHEFLY¶

CacheFly is a content delivery network focused on video streaming.

References: CacheFly official site:

NDPI_PROTOCOL_SOFTETHER¶

SoftEther VPN supports multiple protocols including SSL-VPN and L2TP.

References: SoftEther official site:

NDPI_PROTOCOL_MPEGDASH¶

MPEG-DASH enables adaptive bitrate streaming over the Internet.

References: MPEG-DASH specs:

NDPI_PROTOCOL_DAZN¶

DAZN is a sports subscription video streaming service.

References: DAZN official site:

NDPI_PROTOCOL_GOTO¶

GoTo includes services like GoToMeeting for online collaboration.

References: GoTo official site:

NDPI_PROTOCOL_RSH¶

Remote Shell (rsh) executes shell commands remotely.

References: rsh man page:

NDPI_PROTOCOL_1KXUN¶

1Kxun is a Chinese internet company offering web services.

References: 1Kxun official site:

NDPI_PROTOCOL_IP_PGM¶

PGM is a reliable multicast transport protocol.

References: RFC3208:

NDPI_PROTOCOL_IP_PIM¶

PIM is a multicast routing protocol family for IP packets.

References: RFC7761:

NDPI_PROTOCOL_COLLECTD¶

Collectd gathers system and application metrics periodically.

References: Collectd official site:

NDPI_PROTOCOL_TUNNELBEAR¶

TunnelBear is a consumer VPN service.

References: TunnelBear official site:

NDPI_PROTOCOL_CLOUDFLARE_WARP¶

Cloudflare Warp offers secure VPN and DNS resolution.

References: Cloudflare Warp:

NDPI_PROTOCOL_I3D¶

i3d.net provides dedicated and cloud game servers.

References: i3d.net official site:

NDPI_PROTOCOL_RIOTGAMES¶

Riot Games develops games like League of Legends and Valorant.

References: Riot Games official site:

NDPI_PROTOCOL_PSIPHON¶

Psiphon circumvents internet censorship using VPN and proxy tech.

References: Psiphon official site:

NDPI_PROTOCOL_ULTRASURF¶

UltraSurf bypasses firewalls and protects privacy via proxy.

References: UltraSurf official site:

NDPI_PROTOCOL_THREEMA¶

Threema is a privacy-focused instant messaging app.

References: Threema official site:

NDPI_PROTOCOL_ALICLOUD¶

Alibaba Cloud offers cloud computing services.

References: Alibaba Cloud official site:

NDPI_PROTOCOL_AVAST¶

Avast provides antivirus and internet security software.

References: Avast official site:

NDPI_PROTOCOL_TIVOCONNECT¶

TiVo Connect enables streaming to TiVo set-top boxes.

References: TiVo official site:

NDPI_PROTOCOL_KISMET¶

Kismet detects and monitors wireless networks.

References: Kismet official site:

NDPI_PROTOCOL_FASTCGI¶

FastCGI interfaces programs with web servers to boost dynamic web app performance.

References: FastCGI Archives:

NDPI_PROTOCOL_FTPS¶

FTPS extends FTP with TLS/SSL for security.

References: RFC4217:

NDPI_PROTOCOL_NATPMP¶

NAT-PMP auto-configures port forwarding on NAT gateways.

References: RFC6886:

NDPI_PROTOCOL_SYNCTHING¶

Syncthing synchronizes files continuously between devices.

References: Syncthing official site:

NDPI_PROTOCOL_CRYNET¶

CryNetwork is CryEngine 5’s proprietary multiplayer protocol.

References: CryEngine docs:

NDPI_PROTOCOL_LINE¶

LINE is a messaging app with voice/video calls and social features.

References: LINE official site:

NDPI_PROTOCOL_LINE_CALL¶

LINE Call offers free voice calls within LINE app.

References: LINE official site:

NDPI_PROTOCOL_APPLETVPLUS¶

Apple TV+ streams original shows and movies.

References: Apple TV+ official site:

NDPI_PROTOCOL_DIRECTV¶

DirecTV offers satellite TV and interactive services.

References: DirecTV official site:

NDPI_PROTOCOL_HBO¶

HBO provides premium TV series, movies, and docs.

References: HBO official site:

NDPI_PROTOCOL_VUDU¶

Vudu offers digital movies and TV rentals/purchases.

References: Vudu official site:

NDPI_PROTOCOL_SHOWTIME¶

Showtime offers original series, movies, and sports programming.

References: Showtime official site:

NDPI_PROTOCOL_DAILYMOTION¶

Dailymotion is a video-sharing platform.

References: Dailymotion official site:

NDPI_PROTOCOL_LIVESTREAM¶

Livestream enables live event broadcasting.

References: Livestream official site:

NDPI_PROTOCOL_TENCENTVIDEO¶

Tencent Video streams movies, TV, and variety shows.

References: Tencent Video official site:

NDPI_PROTOCOL_IHEARTRADIO¶

iHeartRadio streams music and radio stations.

References: iHeartRadio official site:

NDPI_PROTOCOL_TIDAL¶

Tidal offers high-fidelity music streaming.

References: Tidal official site:

NDPI_PROTOCOL_TUNEIN¶

TuneIn streams live news, radio, and podcasts.

References: TuneIn official site:

NDPI_PROTOCOL_SIRIUSXMRADIO¶

SiriusXM offers satellite and online radio services.

References: SiriusXM official site:

NDPI_PROTOCOL_MUNIN¶

Munin visualizes network and system resource metrics.

References: Munin official site:

NDPI_PROTOCOL_ELASTICSEARCH¶

Elasticsearch is a distributed search and analytics engine.

References: Elastic official site:

NDPI_PROTOCOL_TUYA_LP¶

TUYA LAN Protocol enables local IoT device communication.

References: GitHub - Tuya SDK:

NDPI_PROTOCOL_TPLINK_SHP¶

TP-LINK Smart Home Protocol for local device control.

References: Home Assistant TP-Link Integration:

NDPI_PROTOCOL_SOURCE_ENGINE¶

Source Engine protocol (A2S) is Valve’s UDP-based game server query protocol.

References: Valve Developer Wiki:

Notes:

Modern Valve games use Steam Datagram Relay (SDR) instead.

NDPI_PROTOCOL_BACNET¶

BACnet provides building automation and control communications.

References: ASHRAE Standard 135-2016:

NDPI_PROTOCOL_OICQ¶

OICQ is an early name for Tencent’s QQ instant messaging protocol.

References: Tencent QQ Wikipedia:

NDPI_PROTOCOL_HOTS¶

Heroes of the Storm (HOTS) is a MOBA game by Blizzard.

References: HOTS official site:

NDPI_PROTOCOL_FACEBOOK_REEL_STORY¶

Facebook Reel Story relates to story clip streaming on Facebook.

References: Facebook help:

NDPI_PROTOCOL_SRTP¶

SRTP provides encryption and authentication for RTP streams.

References: RFC3711:

Notes:

SRTP is essentially “encrypted RTP”, similar to HTTPS vs HTTP.
Differentiating RTP from SRTP is often difficult; nDPI uses SRTP only when confident.

NDPI_PROTOCOL_OPERA_VPN¶

Opera VPN is a free VPN bundled with Opera Browser.

References: Opera VPN feature:

NDPI_PROTOCOL_EPICGAMES¶

Epic Games develops Unreal Engine and games like Fortnite.

References: Epic Games Store:, Fortnite:

NDPI_PROTOCOL_GEFORCENOW¶

GeForce Now is Nvidia’s cloud gaming service.

References: GeForce Now official site:

NDPI_PROTOCOL_NVIDIA¶

Generic traffic from Nvidia sites.

References: Nvidia official site:

NDPI_PROTOCOL_BITCOIN¶

Bitcoin is a prominent cryptocurrency.

References: Bitcoin Protocol documentation:

Notes:

Crypto exchanges are not always mining; could be transactions or blockchain exploration.
Bitcoin protocol governs node communication and block synchronization.

NDPI_PROTOCOL_PROTONVPN¶

Proton VPN is a VPN service by Proton AG.

References: ProtonVPN official site:

NDPI_PROTOCOL_THRIFT¶

Apache Thrift is a cross-language data interchange framework.

References: Thrift official site:, Thrift Github:

NDPI_PROTOCOL_ROBLOX¶

Roblox is an online game platform and creation system.

References: Roblox official site:

Notes:

Roblox traffic may appear as RakNet since it uses a custom version.

NDPI_PROTOCOL_SERVICE_LOCATION¶

Service Location Protocol enables device service discovery on local networks.

References: SLPv1:, SLPv2:

NDPI_PROTOCOL_MULLVAD¶

Mullvad VPN service operated by Mullvad VPN AB, Sweden.

References: Mullvad official site:

NDPI_PROTOCOL_HTTP2¶

HTTP/2 is a major revision of the HTTP protocol.

References: RFC9113:

Notes:

HTTP/2 is almost always transported over TLS (encrypted).

NDPI_PROTOCOL_HAPROXY¶

HAProxy is a high availability load balancer and reverse proxy.

References: HAProxy official site:

NDPI_PROTOCOL_RMCP¶

Intelligent Platform Management Interface (IPMI) RMCP protocol.

References: IPMI specs:

NDPI_PROTOCOL_CAN¶

Controller Area Network (CAN) for automotive applications.

References: ISO CAN standard:

NDPI_PROTOCOL_PROTOBUF¶

Protocol Buffers is a structured data serialization format.

References: Protobuf encoding guide:

NDPI_PROTOCOL_ETHEREUM¶

Ethereum is a decentralized blockchain with smart contract support.

References: Ethereum docs:

Notes:

Similar to Bitcoin, not all exchanges represent mining; may be transactions or blockchain queries.

NDPI_PROTOCOL_TELEGRAM_VOIP¶

Telegram audio/video call protocol.

References: Telegram Wikipedia:

NDPI_PROTOCOL_SINA_WEIBO¶

Chinese microblogging site Sina Weibo.

References: Sina Weibo Wikipedia:

NDPI_PROTOCOL_PTPV2¶

IEEE 1588-2008 Precision Time Protocol Version 2.

References: IEEE PTP specs:

NDPI_PROTOCOL_RTPS¶

Real-Time Publish Subscribe Protocol.

References: RTPS specs:

NDPI_PROTOCOL_OPC_UA¶

IEC62541 OPC Unified Architecture protocol.

References: OPC Foundation:

NDPI_PROTOCOL_S7COMM_PLUS¶

Siemens proprietary protocol for PLC data exchange (different from classic S7Comm).

References: Protocol description:

NDPI_PROTOCOL_FINS¶

Factory Interface Network Service (FINS) protocol used by Omron PLCs.

References: Omron FINS docs:

NDPI_PROTOCOL_ETHERSIO¶

Ether-S-I/O protocol used by Saia-Burgess PLCs.

References: Wireshark EtherSIO wiki:

NDPI_PROTOCOL_UMAS¶

UMAS is Schneider Electric’s proprietary protocol based on Modbus.

References: Analysis:

NDPI_PROTOCOL_BECKHOFF_ADS¶

Automation Device Specification protocol for Beckhoff PLCs.

References: Beckhoff ADS docs:

NDPI_PROTOCOL_ISO9506_1_MMS¶

Manufacturing Message Specification (MMS) protocol for device remote control.

References: ISO 9506-1:2003 standard (paid):

NDPI_PROTOCOL_IEEE_C37118¶

IEEE standard for Synchrophasor Data Transfer.

References: IEEE C37.118.1-2011 standard (paid):

NDPI_PROTOCOL_ETHERSBUS¶

Ether-S-Bus protocol for Saia-Burgess PLC communication.

References: Wireshark EtherSBus wiki:

NDPI_PROTOCOL_MONERO¶

Monero is a privacy-focused cryptocurrency.

(No references)

NDPI_PROTOCOL_DCERPC¶

DCE/RPC is a remote procedure call mechanism specification.

References: Wireshark DCE/RPC wiki:

NDPI_PROTOCOL_PROFINET_IO¶

PROFINET/IO is a field bus protocol based on connectionless DCE/RPC.

References: PROFINET specs:

NDPI_PROTOCOL_HISLIP¶

HiSLIP is for remote control of LAN-based test and measurement instruments.

References: HiSLIP specs:

NDPI_PROTOCOL_UFTP¶

Encrypted UDP based FTP with multicast.

References: UFTP protocol:

NDPI_PROTOCOL_OPENFLOW¶

OpenFlow is a network protocol associated with Software-Defined Networking.

References: OpenFlow specs:

NDPI_PROTOCOL_JSON_RPC¶

JSON-RPC is a remote procedure call protocol encoded in JSON.

References: JSON-RPC specs:

NDPI_PROTOCOL_WEBDAV¶

WebDAV extends HTTP to collaboratively edit and manage files on Web servers.

References: RFC4918:

Notes:

WebDAV is mostly transported over TLS (encrypted).

NDPI_PROTOCOL_APACHE_KAFKA¶

Apache Kafka is a distributed event streaming platform.

References: Kafka official site:, Kafka Github:

NDPI_PROTOCOL_NOMACHINE¶

NoMachine is a proprietary remote desktop software.

References: NoMachine official site:

NDPI_PROTOCOL_IEC62056¶

IEC 62056-4-7 DLMS/COSEM transport layer for IP.

References: IEC paid specs:

Notes:

Wireshark does not support this protocol; some old code available at: <https://github.com/bearxiong99/wireshark-dlms>, <https://github.com/matousp/dlms-analysis/tree/master>

NDPI_PROTOCOL_HL7¶

HL7 standards for clinical and administrative health data exchange.

References: HL7 official site:

NDPI_PROTOCOL_CEPH¶

Ceph is a scalable distributed storage system.

References: Ceph official site:

NDPI_PROTOCOL_GOOGLE_CHAT¶

Google Chat is Google’s instant messaging service, successor to Hangouts.

References: Google Chat official site:

NDPI_PROTOCOL_ROUGHTIME¶

Protocol for rough time sync with cryptographic server verification.

References: IETF Draft:

NDPI_PROTOCOL_PIA¶

Private Internet Access (PIA) VPN service.

References: PIA official site:

NDPI_PROTOCOL_KCP¶

KCP is a fast, reliable protocol supporting TCP-like streams with low latency.

References: KCP protocol spec:

NDPI_PROTOCOL_DOTA2¶

Dota 2 is a popular multiplayer MOBA game by Valve.

References: Dota 2 official site:

NDPI_PROTOCOL_MUMBLE¶

Mumble is a free, low-latency, high-quality voice chat app.

References: Mumble official site:

NDPI_PROTOCOL_YOJIMBO¶

Yojimbo is a secure client/server UDP-based protocol.

References: Protocol spec:

NDPI_PROTOCOL_ELECTRONICARTS¶

Electronic Arts is a major game publisher and producer.

References: EA official site:

Notes:

Much of the traffic relates to EA Origin game store.

NDPI_PROTOCOL_STOMP¶

STOMP is an interoperable protocol for asynchronous message passing.

References: STOMP specification:

NDPI_PROTOCOL_RADMIN¶

Radmin is remote access software for Windows.

References: Radmin official site:

NDPI_PROTOCOL_RAFT¶

Raft is a consensus protocol for distributed logs.

References: Raft C implementation:, Raft paper:

NDPI_PROTOCOL_GEARMAN¶

Gearman is a network job-queuing system.

References: Gearman official site:

NDPI_PROTOCOL_TENCENTGAMES¶

Protocol used by Tencent’s various games (mostly mobile).

References: Tencent Games official site:

NDPI_PROTOCOL_GAIJIN¶

Gaijin Entertainment games protocols.

References: Gaijin official site:

NDPI_PROTOCOL_C1222¶

ANSI C12.22 protocol for communication with electric meters.

References: NEMA standard (paid):

NDPI_PROTOCOL_HUAWEI¶

Generic traffic related to Huawei.

References: Huawei official site:

NDPI_PROTOCOL_HUAWEI_CLOUD¶

Huawei Mobile Cloud services.

References: Huawei Cloud:

NDPI_PROTOCOL_DLEP¶

Dynamic Link Exchange Protocol (DLEP) supports radio-aware routing.

References: RFC8175:

NDPI_PROTOCOL_BFD¶

Bidirectional Forwarding Detection detects faults between routers or switches.

References: RFC5880:

NDPI_PROTOCOL_NETEASE_GAMES¶

Traffic from NetEase games.

References: NetEase Games official site:

NDPI_PROTOCOL_PATHOFEXILE¶

Path of Exile is a free online action RPG.

References: Path of Exile official site:

NDPI_PROTOCOL_GOOGLE_CALL¶

Google audio/video call applications (e.g., Google Meet).

References: Google Meet official site:

Notes:

nDPI uses different IDs for generic and realtime traffic (e.g., NDPI_PROTOCOL_MEET vs NDPI_PROTOCOL_GOOGLE_CALL).

NDPI_PROTOCOL_PFCP¶

PFCP protocol communicates between control and user planes in 4G/5G.

References: PFCP specs:

NDPI_PROTOCOL_FLUTE¶

File Delivery over Unidirectional Transport protocol.

References: RFC6726:

NDPI_PROTOCOL_LOLWILDRIFT¶

League of Legends: Wild Rift mobile MOBA game.

References: Wild Rift official site:

NDPI_PROTOCOL_TESO¶

The Elder Scrolls Online MMORPG.

References: ESO official site:

NDPI_PROTOCOL_LDP¶

Label Distribution Protocol establishes label paths in MPLS.

References: RFC5036:

NDPI_PROTOCOL_KNXNET_IP¶

KNXnet/IP extends KNX home/building automation over IP.

References: Standard docs (paid):

NDPI_PROTOCOL_BLUESKY¶

Bluesky decentralized microblogging platform.

References: Bluesky official site:

NDPI_PROTOCOL_MASTODON¶

Mastodon is open-source software for self-hosted social networking.

References: Mastodon official site:

NDPI_PROTOCOL_THREADS¶

Threads is a social media service by Meta.

References: Threads official site:

NDPI_PROTOCOL_VIBER_VOIP¶

Viber audio/video call protocol.

References: Viber Wikipedia:

NDPI_PROTOCOL_ZUG¶

ZUG protocol is part of Casper 2.0 blockchain consensus.

References: Casper Labs site: <https://casperlabs.io>, Casper blog:

NDPI_PROTOCOL_JRMI¶

Java Remote Method Invocation protocol.

References: Oracle JRMI docs:

NDPI_PROTOCOL_RIPE_ATLAS¶

RIPE Atlas probe protocol for Internet measurement.

References: RIPE Atlas site:, RIPE Atlas docs:

NDPI_PROTOCOL_HLS¶

HTTP Live Streaming (HLS) segments media for adaptive streaming.

References: RFC8216:

NDPI_PROTOCOL_CLICKHOUSE¶

ClickHouse is a columnar database for OLAP.

References: ClickHouse official site:

NDPI_PROTOCOL_NANO¶

Nano is a fast, fee-less, eco-friendly cryptocurrency.

References: Nano official site:

NDPI_PROTOCOL_OPENWIRE¶

OpenWire is Apache ActiveMQ’s wire protocol.

References: OpenWire docs:

NDPI_PROTOCOL_CNP_IP¶

Encapsulation of LonWorks control network over IP.

References: ISO/IEC 14908-4:2012 standard (paid):

NDPI_PROTOCOL_ATG¶

Automatic Tank Gauge system data transfer protocol.

References: ATG protocol specs:

NDPI_PROTOCOL_TRDP¶

Train Real Time Data Protocol standardized by IEC.

References: TRDP specs:

NDPI_PROTOCOL_LUSTRE¶

Lustre is a parallel distributed file system for supercomputing.

References: Lustre official site:

NDPI_PROTOCOL_NORDVPN¶

NordVPN is a VPN service.

References: NordVPN official site:

NDPI_PROTOCOL_SURFSHARK¶

Surfshark VPN service.

References: Surfshark official site:

NDPI_PROTOCOL_CACTUSVPN¶

CactusVPN service.

References: CactusVPN official site:

NDPI_PROTOCOL_WINDSCRIBE¶

Windscribe VPN service.

References: Windscribe official site:

NDPI_PROTOCOL_SONOS¶

Sonos provides high-quality wireless sound systems.

References: Sonos official site:

NDPI_PROTOCOL_DINGTALK¶

DingTalk is a collaboration platform by Alibaba.

References: DingTalk official site:

NDPI_PROTOCOL_PALTALK¶

Paltalk is a video chat and messaging app.

References: Paltalk official site:

NDPI_PROTOCOL_NAVER¶

Naver is South Korea’s top search engine and platform.

References: Naver official site:

NDPI_PROTOCOL_SHEIN¶

Shein is a fast fashion retailer.

References: Shein official site:

NDPI_PROTOCOL_TEMU¶

Temu is an online marketplace by PDD Holdings.

References: Temu official site:

NDPI_PROTOCOL_TAOBAO¶

Taobao is a Chinese online shopping platform.

References: Taobao official site:

NDPI_PROTOCOL_MIKROTIK¶

MikroTik Neighbor Discovery Protocol (MNDP) finds compatible neighbor routers/switches.

References: MikroTik official docs:

NDPI_PROTOCOL_DICOM¶

DICOM is a standard for medical image storage and transmission.

References: DICOM Wikipedia article:

NDPI_PROTOCOL_PARAMOUNTPLUS¶

Paramount+ is a subscription video streaming service.

References: Paramount+ official site:

NDPI_PROTOCOL_YANDEX_ALICE¶

Yandex Alice voice assistant, similar to Alexa.

References: Yandex Alice protocol:

NDPI_PROTOCOL_VIVOX¶

Vivox provides real-time voice and text chat for games.

References: Vivox official site:

NDPI_PROTOCOL_DIGITALOCEAN¶

DigitalOcean cloud service provider.

References: DigitalOcean official site:

NDPI_PROTOCOL_RUTUBE¶

RUTUBE is a Russian video streaming platform.

References: Rutube official site:

NDPI_PROTOCOL_LAGOFAST¶

LagoFast Game Booster improves gaming performance by reducing lag.

References: LagoFast official site:

NDPI_PROTOCOL_GEARUP_BOOSTER¶

GearUp Booster reduces game lag.

References: GearUp Booster official site:

NDPI_PROTOCOL_UBIQUITY¶

Traffic from Ubiquity sites and services.

References: Ubiquity official site:

NDPI_PROTOCOL_MSDO¶

Microsoft Delivery Optimization distributes Windows updates and content.

References: Microsoft DO docs:

NDPI_PROTOCOL_ROCKSTAR_GAMES¶

Traffic related to Rockstar Games services and launcher.

References: Rockstar Games official site:

NDPI_PROTOCOL_KICK¶

Kick.com live streaming platform.

References: Kick official site:

NDPI_PROTOCOL_HAMACHI¶

LogMeIn Hamachi VPN service (primarily used for gaming and remote access). Unlike anonymity VPNs, Hamachi creates virtual LAN networks between devices.

References: LogMeIn Hamachi official site:

NDPI_PROTOCOL_GLBP¶

Gateway Load Balancing Protocol (GLBP) - Cisco proprietary protocol that provides first-hop redundancy and load balancing for IPv4 and IPv6 networks.

References: Cisco GLBP Configuration Guide