nDPI Protocols List

This page provides the list of the protocols/applications supported by nDPI. For each protocol there is a brief description, some links to further, more detailed information and, optionally, some notes that might be useful when handling such a protocol (from the application/integrator point of view)

Work in progress!

NDPI_PROTOCOL_FTP_CONTROL

FTP Control protocol used for managing file transfers between client and server.

References: RFC959:

NDPI_PROTOCOL_MAIL_POP

POP (Post Office Protocol) is used by email clients to retrieve messages from a mail server.

References: RFC1939:

NDPI_PROTOCOL_MAIL_SMTP

SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending email across the Internet.

References: RFC5321:

NDPI_PROTOCOL_MAIL_IMAP

IMAP (Internet Message Access Protocol) allows email clients to access and manipulate messages on a mail server.

References: RFC3501:

NDPI_PROTOCOL_DNS

DNS (Domain Name System) translates human-friendly domain names to IP addresses.

References: RFC1035:

NDPI_PROTOCOL_IPP

IPP (Internet Printing Protocol) is used for managing print jobs and queues over a network.

References: RFC8010:

NDPI_PROTOCOL_HTTP

HTTP (Hypertext Transfer Protocol) is the foundation of data communication for the World Wide Web.

References: RFC2616:, RFC7230:

NDPI_PROTOCOL_MDNS

mDNS (Multicast DNS) resolves hostnames to IP addresses within small networks without a local DNS server.

References: RFC6762:

NDPI_PROTOCOL_NTP

NTP (Network Time Protocol) synchronizes clocks of computer systems over packet-switched datalinks.

References: RFC5905:

NDPI_PROTOCOL_NETBIOS

NetBIOS (Network Basic Input/Output System) provides services related to the session layer allowing applications on separate computers to communicate.

References: Microsoft NetBIOS documentation:

NDPI_PROTOCOL_NFS

NFS (Network File System) allows a user on a client computer to access files over a network much like local storage.

References: RFC7530:

NDPI_PROTOCOL_SSDP

SSDP (Simple Service Discovery Protocol) is used for advertising and discovering network services and presence information.

References: RFC4861:

NDPI_PROTOCOL_BGP

BGP (Border Gateway Protocol) manages how packets are routed across the internet through the exchange of routing information.

References: RFC4271:

NDPI_PROTOCOL_SNMP

SNMP (Simple Network Management Protocol) is used for collecting and organizing information about managed devices on IP networks.

References: RFC1157:

NDPI_PROTOCOL_XDMCP

XDMCP (X Display Manager Control Protocol) enables remote graphical logins to Unix/Linux systems.

References: RFC1076:

NDPI_PROTOCOL_SMBV1

SMBv1 (Server Message Block version 1) is a network file sharing protocol used for providing shared access to files and printers.

References: Protocol Specs:

NDPI_PROTOCOL_SYSLOG

Syslog is a standard protocol used for message logging in an IP network.

References: RFC5424:

NDPI_PROTOCOL_DHCP

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices in a network.

References: RFC2131:

NDPI_PROTOCOL_POSTGRES

PostgreSQL is an advanced open-source relational database management system.

References: PostgreSQL official site:

NDPI_PROTOCOL_MYSQL

MySQL is a popular open-source relational database management system.

References: MySQL official site:

NDPI_PROTOCOL_MS_OUTLOOK

Microsoft Outlook is an email client and personal information manager by Microsoft.

References: Outlook official site:

NDPI_PROTOCOL_VK

VK (VKontakte) is a Russian online social media and social networking service.

References: VK official site:

NDPI_PROTOCOL_MAIL_POPS

POPS (POP Secure) is POP protocol used over SSL/TLS for secure email retrieval.

References: RFC2595:

NDPI_PROTOCOL_TAILSCALE

Tailscale is a zero-config VPN based on WireGuard, simplifying secure network connectivity.

References: Tailscale official site:

NDPI_PROTOCOL_YANDEX

Yandex is a Russian internet company providing multiple online services including search.

References: Yandex official site:

NDPI_PROTOCOL_NTOP

ntop is a network traffic probe that shows network usage.

References: ntop official site:

NDPI_PROTOCOL_COAP

CoAP (Constrained Application Protocol) is a specialized web transfer protocol for use with constrained devices.

References: RFC7252:

NDPI_PROTOCOL_VMWARE

VMware protocol used for management and data exchange in VMware virtualization platforms.

References: VMware official site:

NDPI_PROTOCOL_MAIL_SMTPS

SMTPS (SMTP Secure) is SMTP protocol for sending emails over SSL/TLS encrypted connections.

References: RFC2487:

NDPI_PROTOCOL_DTLS

DTLS (Datagram Transport Layer Security) provides communications privacy for datagram protocols.

References: RFC6347:

NDPI_PROTOCOL_UBNTAC2

AirControl network management application by Ubiquiti Networks.

References: Ubiquiti AirControl community post:

NDPI_PROTOCOL_BFCP

BFCP (Binary Floor Control Protocol) is used for controlling and coordinating real-time data sharing and collaboration during video conferencing sessions.

References: RFC8855:

NDPI_PROTOCOL_YANDEX_MAIL

Yandex.Mail is a free email service provided by the Russian internet company Yandex.

References: Yandex.Mail official site:

NDPI_PROTOCOL_YANDEX_MUSIC

Yandex.Music is a music streaming service offering a large library of tracks and personalized recommendations.

References: Yandex.Music official site:

NDPI_PROTOCOL_GNUTELLA

Gnutella is a decentralized peer-to-peer network protocol used for file sharing.

References: Gnutella Wikipedia article:

NDPI_PROTOCOL_EDONKEY

eDonkey is a peer-to-peer file sharing network popular in the early 2000s, supporting large file transfers.

References: eDonkey Wikipedia article:

NDPI_PROTOCOL_BITTORRENT

BitTorrent is a widely used peer-to-peer protocol for distributing large amounts of data efficiently.

References: BitTorrent Wikipedia article:

NDPI_PROTOCOL_MSTEAMS_CALL

Audio/video calls made by Microsoft applications, mainly MS Teams and Skype.

References: Microsoft Teams official site:

NDPI_PROTOCOL_SIGNAL

Signal is a secure messaging protocol known for end-to-end encryption of texts and calls.

References: Signal:

NDPI_PROTOCOL_MEMCACHED

Memcached is a distributed memory caching system used to speed up dynamic web applications.

References: Memcached official site:

NDPI_PROTOCOL_SMBV23

SMB version 2 and 3 are protocols for shared access to files, printers, and serial ports over a network.

References: Server Message Block Wikipedia article:

NDPI_PROTOCOL_MINING

Mining protocols enable communication with blockchain networks like Ethereum, ZCash, and Monero during cryptocurrency mining.

References: Cryptocurrency Wikipedia article:

NDPI_PROTOCOL_NEST_LOG_SINK

Nest Log Sink protocol used by Nest Protect and other Nest devices (particularly smoke detectors) to send logging data.

References: Nest Protect overview:

NDPI_PROTOCOL_MODBUS

Modbus is a serial communication protocol for connecting industrial electronic devices.

References: Modbus Wikipedia article:

NDPI_PROTOCOL_WHATSAPP_CALL

WhatsApp Call protocol handles both audio and video calls within the WhatsApp messaging app.

References: WhatsApp official site:

NDPI_PROTOCOL_DATASAVER

Data Saver (Lite Mode) is a Google Chrome feature designed to reduce mobile data usage by compressing web traffic.

References: Google Chromium Blog:

NDPI_PROTOCOL_XBOX

Xbox protocol covers network traffic associated with Microsoft’s Xbox gaming consoles.

References: Xbox official site:

NDPI_PROTOCOL_QQ

QQ is an instant messaging platform developed by Tencent popular in China.

References: QQ official site:

NDPI_PROTOCOL_TIKTOK

TikTok is a video-sharing social networking service for short-format videos.

References: TikTok official site:

NDPI_PROTOCOL_RTSP

RTSP (Real Time Streaming Protocol) controls streaming media servers.

References: RFC2326:

NDPI_PROTOCOL_MAIL_IMAPS

IMAPS (IMAP over SSL) is the secure version of the Internet Message Access Protocol for email retrieval.

References: RFC3501: and RFC8314 (IMAPS):

NDPI_PROTOCOL_ICECAST

Icecast is a streaming media project that supports audio/video streaming and broadcast.

References: Icecast official site:

NDPI_PROTOCOL_CPHA

Check Point High Availability (CPHA) Protocol provides firewall redundancy and failover.

References: Check Point HA:

NDPI_PROTOCOL_IQIYI

iQIYI is a Chinese online video platform with original and licensed movies, dramas, variety shows, and anime.

References: iQIYI official site:

NDPI_PROTOCOL_ADOBE_CONNECT

Adobe Connect is a web conferencing platform for online meetings, webinars, and virtual classrooms.

References: Adobe Connect official site:

NDPI_PROTOCOL_MONGODB

MongoDB is a popular NoSQL database system designed for scalability and flexibility.

References: MongoDB official site:

NDPI_PROTOCOL_PLURALSIGHT

Pluralsight is an online education platform offering tech skill development courses.

References: Pluralsight official site:

NDPI_PROTOCOL_YANDEX_CLOUD

Yandex.Cloud is a public cloud platform providing computing and storage services.

References: Yandex.Cloud official site:

NDPI_PROTOCOL_OCSP

OCSP (Online Certificate Status Protocol) checks the revocation status of digital certificates in real-time.

References: RFC6960:

NDPI_PROTOCOL_VXLAN

VXLAN (Virtual Extensible LAN) extends layer 2 networks over layer 3 infrastructure.

References: RFC7348:

NDPI_PROTOCOL_IRC

IRC (Internet Relay Chat) is a text-based chat system for instant messaging.

References: IRC Wikipedia article: and IRC statistics:

NDPI_PROTOCOL_MERAKI_CLOUD

Meraki Cloud is a cloud-based network management platform by Cisco Meraki.

References: Meraki official site:

NDPI_PROTOCOL_JABBER

Jabber is an open instant messaging protocol based on XMPP for real-time communication.

References: XMPP standards:

NDPI_PROTOCOL_NATS

NATS is a high-performance messaging system for cloud-native applications and IoT.

References: NATS official site:

NDPI_PROTOCOL_AMONG_US

Among Us is a multiplayer social deduction game developed by InnerSloth.

References: InnerSloth official site:

NDPI_PROTOCOL_YAHOO

Yahoo is a web services provider known for its email, news, and search engine products.

References: Yahoo official site:

NDPI_PROTOCOL_DISNEYPLUS

Disney+ is a streaming service offering movies and TV series from Disney franchises.

References: Disney+ official site:

NDPI_PROTOCOL_HART_IP

Highway Addressable Remote Transducer over IP.

References: HART-IP Protocol Specs:

NDPI_PROTOCOL_IP_VRRP

Virtual Router Redundancy Protocol (VRRP) provides automatic assignment of available IP routers to hosts.

References: RFC5798:

NDPI_PROTOCOL_STEAM

Steam is a digital distribution platform developed by Valve Corporation for games.

References: Steam official site:

NDPI_PROTOCOL_MELSEC

MELSEC is a proprietary industrial protocol used by Mitsubishi Electric PLCs for communication and control.

References: MELSEC Communication Protocol Manual:

NDPI_PROTOCOL_WORLDOFWARCRAFT

World of Warcraft (WoW) is a massively multiplayer online role-playing game (MMORPG).

References: WoW official site:

NDPI_PROTOCOL_TELNET

Telnet is a network protocol for interactive text communication.

References: RFC854:

NDPI_PROTOCOL_STUN

STUN (Session Traversal Utilities for NAT) helps devices discover public IP addresses.

References: RFC5389:

NDPI_PROTOCOL_IPSEC

IPsec authenticates and encrypts IP packets for secure communication over IP networks.

References: RFC4301:

NDPI_PROTOCOL_IP_GRE

GRE (Generic Routing Encapsulation) tunnels packets to encapsulate various network protocols.

References: RFC2784:

NDPI_PROTOCOL_IP_ICMP

ICMP (Internet Control Message Protocol) sends error messages and operational information.

References: RFC792:

NDPI_PROTOCOL_IP_IGMP

IGMP (Internet Group Management Protocol) manages membership of IP multicast groups.

References: RFC2236:

NDPI_PROTOCOL_IP_EGP

EGP (Exterior Gateway Protocol) is an obsolete protocol for exchanging routing info.

References: RFC904:

NDPI_PROTOCOL_IP_SCTP

SCTP (Stream Control Transmission Protocol) is a reliable transport layer protocol.

References: RFC4960:

NDPI_PROTOCOL_IP_OSPF

OSPF (Open Shortest Path First) is a routing protocol for IP networks.

References: RFC2328:

NDPI_PROTOCOL_IP_IP_IN_IP

IP-in-IP encapsulation allows an IP packet to be wrapped inside another IP packet.

References: RFC2003:

NDPI_PROTOCOL_RTP

RTP (Real-time Transport Protocol) provides end-to-end delivery services for real-time data.

References: RFC3550:

NDPI_PROTOCOL_RDP

RDP (Remote Desktop Protocol) is Microsoft’s protocol for remote graphical desktop access.

References: Remote Desktop Protocol Wikipedia article:

NDPI_PROTOCOL_VNC

VNC (Virtual Network Computing) allows remote control of other computers’ desktops.

References: VNC Wikipedia article:

NDPI_PROTOCOL_TUMBLR

Tumblr is a microblogging and social networking platform.

References: Tumblr official site:

NDPI_PROTOCOL_TLS

TLS (Transport Layer Security) provides encryption for network communications.

References: RFC8446:

NDPI_PROTOCOL_SSH

SSH (Secure Shell) is a protocol for secure remote login and other network services.

References: RFC4251:

NDPI_PROTOCOL_USENET

Usenet is a distributed discussion system for newsgroups.

References: Usenet Wikipedia article:

NDPI_PROTOCOL_MGCP

MGCP (Media Gateway Control Protocol) controls media gateways on IP networks.

References: RFC3435:

NDPI_PROTOCOL_IAX

IAX (Inter-Asterisk eXchange protocol) is used for VoIP sessions, originally for Asterisk PBX.

References: RFC5456:

NDPI_PROTOCOL_TFTP

TFTP (Trivial File Transfer Protocol) is a simple file transfer protocol.

References: RFC1350:, RFC2347:, RFC2349:

NDPI_PROTOCOL_AFP

AFP (Apple Filing Protocol) is a network protocol for file services on macOS.

References: AFP Wikipedia article:

NDPI_PROTOCOL_YANDEX_METRIKA

Yandex Metrika is a web analytics service by Yandex to track website traffic.

References: Yandex Metrika official site:

NDPI_PROTOCOL_YANDEX_DIRECT

Yandex.Direct is an online advertising platform for contextual ads.

References: Yandex.Direct official site:

NDPI_PROTOCOL_SIP

SIP (Session Initiation Protocol) is used for real-time communication session control.

References: RFC3261:

NDPI_PROTOCOL_TRUPHONE

Truphone is a global mobile network provider using eSIM and VoIP.

References: Truphone official site:

NDPI_PROTOCOL_IP_ICMPV6

ICMPv6 is integral to IPv6 for diagnostics and error reporting.

References: RFC4443:

NDPI_PROTOCOL_DHCPV6

DHCPv6 dynamically assigns IPv6 addresses and settings.

References: RFC8415:

NDPI_PROTOCOL_ARMAGETRON

Armagetron Advanced is a 3D multiplayer game inspired by Tron light cycles.

References: Armagetron official site:

NDPI_PROTOCOL_CROSSFIRE

Crossfire is an online FPS game with team combat and various modes.

References: Crossfire official site:

NDPI_PROTOCOL_DOFUS

Dofus is a tactical MMORPG with turn-based combat.

References: Dofus official site:

NDPI_PROTOCOL_GUILDWARS2

Guild Wars is an online RPG known for dynamic events and PvP.

References: Guild Wars 2 official site:

NDPI_PROTOCOL_AMAZON_ALEXA

Amazon Alexa voice service protocol for smart devices.

References: Amazon Alexa developer site:

NDPI_PROTOCOL_KERBEROS

Kerberos is a protocol for secure network authentication.

References: RFC4120:

NDPI_PROTOCOL_LDAP

LDAP is a protocol for accessing directory services.

References: RFC4510:

NDPI_PROTOCOL_NEXON

Nexon is a South Korean video game developer and publisher.

References: Nexon official site:

NDPI_PROTOCOL_IP_AH

An Authentication Header (AH) is a security protocol in IPSec that ensures the integrity of packet headers and data, provides user authentication, and offers optional replay protection and access protection. It does not encrypt any part of the packets.

References: RFC4302:

NDPI_PROTOCOL_IP_ESP

Encapsulating Security Payload (ESP) is a crucial protocol within the IPsec framework, designed to protect the confidentiality, integrity, and authentication of IP packets. It achieves this by encrypting the payload (the data being transmitted) and potentially authenticating the sender and validating the data’s integrityencrypt any part of the packets.

References: RFC4303:

NDPI_PROTOCOL_MOZILLA

Mozilla-related traffic, especially Firefox browser.

References: Mozilla official site:

NDPI_PROTOCOL_GOOGLE

Google’s internet services and products traffic.

References: Google official site:

NDPI_PROTOCOL_MS_RPCH

Microsoft RPC protocol over HTTP.

References: Microsoft RPCH specs:

NDPI_PROTOCOL_NETFLOW

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic flow.

References: RFC3954:

NDPI_PROTOCOL_SFLOW

sFlow is a packet sampling technology for monitoring traffic in data networks in real time.

References: sFlow Wikipedia article:

NDPI_PROTOCOL_HTTP_CONNECT

HTTP CONNECT method is used to establish a tunnel to the server, typically for SSL traffic through proxies.

References: RFC7231:

NDPI_PROTOCOL_CITRIX

Citrix provides remote access and virtualization solutions for secure delivery of applications and desktops.

References: Citrix official site:

NDPI_PROTOCOL_NETFLIX

Netflix is a leading streaming entertainment service delivering movies, TV shows, and original content.

References: Netflix official site:

NDPI_PROTOCOL_LASTFM

Last.fm is a music recommendation and streaming service that provides personalized music charts and discovery.

References: Last.fm official site:

NDPI_PROTOCOL_WAZE

Waze is a GPS navigation app providing real-time traffic and road info.

References: Waze official site:

NDPI_PROTOCOL_HULU

Hulu is a streaming platform offering live and on-demand TV and movies.

References: Hulu official site:

NDPI_PROTOCOL_CHECKMK

Checkmk is an IT monitoring system for servers, apps, networks, and cloud.

References: Checkmk official site:

NDPI_PROTOCOL_AJP

Apache JServ Protocol (AJP) proxies web server requests to application servers.

References: AJP Protocol Specs:

NDPI_PROTOCOL_APPLE

Apple protocol includes various services related to Apple devices and ecosystem.

References: Apple official site:

NDPI_PROTOCOL_WEBEX

Webex is a video conferencing and online meeting application by Cisco.

References: Webex official site:

NDPI_PROTOCOL_WHATSAPP

WhatsApp is a messaging app by Meta, offering encrypted messaging and calls.

References: WhatsApp official site:

NDPI_PROTOCOL_APPLE_ICLOUD

iCloud is Apple’s cloud storage and computing service.

References: iCloud official site:

NDPI_PROTOCOL_VIBER

Viber is a cross-platform messaging and VoIP app.

References: Viber official site:

NDPI_PROTOCOL_APPLE_ITUNES

Apple iTunes is a media player and content store.

References: iTunes official site:

NDPI_PROTOCOL_RADIUS

RADIUS protocol provides centralized Authentication, Authorization, and Accounting.

References: RFC2865:

NDPI_PROTOCOL_TEAMVIEWER

TeamViewer is remote access software for desktop sharing and file transfer.

References: TeamViewer official site:

NDPI_PROTOCOL_EGD

Ethernet Global Data (EGD) protocol for real-time data exchange in industrial automation.

References: EGD Wikipedia article:

Notes:

  • This dissector only works for data packets, not configuration commands.
  • IPv6 is not supported.

NDPI_PROTOCOL_HCL_NOTES

HCL Notes (formerly Lotus Notes) is a collaborative client-server application.

References: HCL Notes official site:

NDPI_PROTOCOL_SAP

Session Announcement Protocol (SAP) announces multicast session info.

References: RFC2974:

NDPI_PROTOCOL_GTP

GPRS Tunneling Protocol (GTP) carries mobile data within GSM and UMTS.

References: GTP Wikipedia article:

NDPI_PROTOCOL_WSD

Web Services Dynamic Discovery (WS-Discovery) locates services on local networks.

References: WS-Discovery Wikipedia article:

NDPI_PROTOCOL_LLMNR

Link-Local Multicast Name Resolution (LLMNR) resolves names on local links.

References: RFC4795:

NDPI_PROTOCOL_TOCA_BOCA

Toca Boca produces creative mobile games for children.

References: Toca Boca official site:

NDPI_PROTOCOL_SPOTIFY

Spotify is a music streaming service offering millions of tracks and podcasts.

References: Spotify official site:

NDPI_PROTOCOL_FACEBOOK_MESSENGER

Facebook Messenger is an instant messaging service by Meta.

References: Messenger official site:

NDPI_PROTOCOL_H323

H.323 is a standard for real-time voice, video, and data communications.

References: ITU-T H.323:

NDPI_PROTOCOL_OPENVPN

OpenVPN is an open-source VPN protocol for secure connections.

References: OpenVPN official site:

NDPI_PROTOCOL_NOE

NOE is a VoIP protocol for Alcatel-Lucent compatible telephone systems.

References: Teldat Manual:

NDPI_PROTOCOL_CISCOVPN

Cisco VPN protocols secure virtual private network connections.

References: Cisco VPN site:

NDPI_PROTOCOL_TEAMSPEAK

TeamSpeak is a voice-over-IP app for gamer communication.

References: TeamSpeak official site:

NDPI_PROTOCOL_TOR

Tor enables anonymous communication via onion routing.

References: Tor Project site:

NDPI_PROTOCOL_SKINNY

Skinny Client Control Protocol (SCCP) is a Cisco VoIP signaling protocol.

References: SCCP Wikipedia article:

NDPI_PROTOCOL_RTCP

RTCP (Real-time Transport Control Protocol) works alongside RTP.

References: RFC3550 Section 6:

NDPI_PROTOCOL_RSYNC

Rsync is a fast incremental file transfer utility.

References: Rsync homepage:

NDPI_PROTOCOL_ORACLE

Oracle database communication protocol.

References: Oracle Net Services docs:

NDPI_PROTOCOL_CORBA

CORBA enables software components to communicate over a network.

References: OMG CORBA:

NDPI_PROTOCOL_CANONICAL

Canonical Ltd., developer of Ubuntu Linux and related services.

References: Canonical official site:

NDPI_PROTOCOL_WHOIS_DAS

WHOIS DAS queries databases storing Internet resource assignments.

References: WHOIS Wikipedia article:

NDPI_PROTOCOL_SD_RTN

Agora SD-RTN is a global, private, secure real-time network for low-latency streaming.

References: Agora platform info:

NDPI_PROTOCOL_SOCKS

SOCKS routes network packets through proxy servers.

References: RFC1928:

NDPI_PROTOCOL_NINTENDO

Nintendo network communication protocols for consoles and services.

References: Nintendo official site:

NDPI_PROTOCOL_RTMP

RTMP (Real-Time Messaging Protocol) streams audio, video, and data.

References: RTMP Wikipedia article:

NDPI_PROTOCOL_FTP_DATA

FTP Data Protocol transfers data separately from control connections.

References: FTP Wikipedia article:

NDPI_PROTOCOL_WIKIPEDIA

Wikipedia is a free, collaborative, multilingual online encyclopedia.

References: Wikipedia official site:

NDPI_PROTOCOL_ZMQ

ZeroMQ (ZMQ) is a high-performance asynchronous messaging library.

References: ZeroMQ official site:

NDPI_PROTOCOL_AMAZON

Amazon network traffic including retail, AWS, and content delivery.

References: Amazon official site:

NDPI_PROTOCOL_EBAY

eBay is an online marketplace for quality goods and services.

References: eBay official site:

NDPI_PROTOCOL_CNN

CNN is an American news television channel providing 24-hour news coverage.

References: CNN official site:

NDPI_PROTOCOL_MEGACO

Megaco (H.248) protocol for controlling media gateways in VoIP.

References: ITU-T H.248:

NDPI_PROTOCOL_RESP

Redis Serialization Protocol.

References: Redis Protocol Specs:

NDPI_PROTOCOL_PINTEREST

Pinterest is a social media platform for sharing images and ideas.

References: Pinterest official site:

NDPI_PROTOCOL_OSPF

OSPF (Open Shortest Path First) is a routing protocol for IP networks.

References: RFC2328:

NDPI_PROTOCOL_TELEGRAM

Telegram is a cloud-based instant messaging app focusing on speed and security.

References: Telegram official site:

NDPI_PROTOCOL_COD_MOBILE

Call of Duty: Mobile is a popular shooter game for iOS and Android.

References: COD Mobile official site:

NDPI_PROTOCOL_PANDORA

Pandora is an Internet radio and streaming music service.

References: Pandora official site:

NDPI_PROTOCOL_QUIC

QUIC is a transport layer protocol by Google improving web app performance.

References: RFC9000:

NDPI_PROTOCOL_ZOOM

Zoom is a popular video conferencing platform.

References: Zoom official site:

NDPI_PROTOCOL_EAQ

EAQ is a Brazilian organization measuring broadband quality.

References: EAQ official site:

NDPI_PROTOCOL_OOKLA

Ookla operates Speedtest.net for network performance testing.

References: Speedtest.net:

NDPI_PROTOCOL_AMQP

AMQP is an open standard application layer protocol for messaging middleware.

References: AMQP official site:

NDPI_PROTOCOL_KAKAOTALK

KakaoTalk is a South Korean mobile messaging app (text only).

References: Kakao official site:

NDPI_PROTOCOL_KAKAOTALK_VOICE

KakaoTalk Voice adds voice call functionality within KakaoTalk.

References: Kakao official site:

NDPI_PROTOCOL_TWITCH

Twitch is a live streaming platform for gaming and esports.

References: Twitch official site:

NDPI_PROTOCOL_DOH_DOT

DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) encrypt DNS queries.

References: DoH RFC8484:, DoT RFC7858:

NDPI_PROTOCOL_WECHAT

WeChat is a Chinese messaging, social media, and payment app.

References: WeChat official site:

NDPI_PROTOCOL_MPEGTS

MPEG Transport Stream (TS) is a standard for transmission/storage of audio, video, data.

References: MPEG-TS Wikipedia article:

NDPI_PROTOCOL_SNAPCHAT

Snapchat is a multimedia messaging app known for ephemeral messages.

References: Snapchat official site:

NDPI_PROTOCOL_SINA

Sina is a Chinese company operating web services including Sina Weibo.

References: Sina official site:

NDPI_PROTOCOL_GOOGLE_MEET

Google Meet is Google’s video conferencing service.

References: Google Meet official site:

NDPI_PROTOCOL_IFLIX

iflix is a video on demand service for emerging markets.

References: iflix official site:

NDPI_PROTOCOL_GITHUB

GitHub is a platform for version control and collaborative development.

References: GitHub official site:

NDPI_PROTOCOL_BJNP

BJNP is a proprietary USB-over-IP network printing discovery protocol by Canon.

References: Canon proprietary, no public specs available.

NDPI_PROTOCOL_REDDIT

Reddit is a social news and discussion website.

References: Reddit official site:

NDPI_PROTOCOL_WIREGUARD

WireGuard is a modern VPN protocol noted for simplicity and speed.

References: WireGuard official site:

NDPI_PROTOCOL_SMPP

SMPP is a protocol for exchanging SMS messages.

References: SMPP official site:

NDPI_PROTOCOL_DNSCRYPT

DNSCrypt authenticates and encrypts DNS traffic.

References: DNSCrypt official site:

NDPI_PROTOCOL_TINC

Tinc is an open-source VPN daemon creating secure private networks.

References: Tinc official site:

NDPI_PROTOCOL_DEEZER

Deezer is a music streaming service.

References: Deezer official site:

NDPI_PROTOCOL_INSTAGRAM

Instagram is a social app for photo and video sharing.

References: Instagram official site:

NDPI_PROTOCOL_MICROSOFT

Microsoft protocol includes various proprietary communications.

References: Microsoft official site:

NDPI_PROTOCOL_BLIZZARD

Blizzard Entertainment is a game developer known for WoW, Diablo, StarCraft.

References: Blizzard official site:

NDPI_PROTOCOL_VALVE_SDR

Steam Datagram Relay (SDR) is Valve’s virtual private gaming network.

References: Steamworks partner doc:

NDPI_PROTOCOL_LISP

LISP separates IP addresses into Endpoint IDs and Routing Locators.

References: RFC6830:

NDPI_PROTOCOL_DIAMETER

Diameter is an AAA network protocol, successor to RADIUS.

References: RFC6733:

NDPI_PROTOCOL_APPLE_PUSH

Apple Push Notification Service (APNs) delivers notifications to Apple devices.

References: Apple Developer APNs:

NDPI_PROTOCOL_GOOGLE_SERVICES

Google Services cover various APIs and endpoints used by Google.

References: No single official site; includes googleapis.com, googletagmanager.com.

NDPI_PROTOCOL_AMAZON_VIDEO

Amazon Video is Amazon’s video streaming service.

References: Amazon Video site:

NDPI_PROTOCOL_GOOGLE_DOCS

Google Docs allows collaborative online document editing.

References: Google Docs official site:

NDPI_PROTOCOL_WHATSAPP_FILES

WhatsApp media files such as videos, pictures, and voice messages.

References: WhatsApp FAQ:

NDPI_PROTOCOL_TARGUS_GETDATA

Targus GetData is a proprietary protocol for Targus device data transfer.

References: Proprietary, no public documentation.

NDPI_PROTOCOL_DNP3

DNP3 is a communication protocol for process automation systems.

References: DNP3 Wikipedia article:

NDPI_PROTOCOL_IEC60870

IEC 60870-5-104 network protocol used in power system telecontrol and supervision.

References: IEC 60870 Wikipedia:

NDPI_PROTOCOL_BLOOMBERG

Bloomberg services traffic identified by domains and ASN registrations.

References: Bloomberg official site:

NDPI_PROTOCOL_CAPWAP

CAPWAP protocol manages wireless access points centrally.

References: RFC5415:

NDPI_PROTOCOL_ZABBIX

Zabbix protocol supports agent-server communication for monitoring.

References: Zabbix Documentation:

NDPI_PROTOCOL_S7COMM

S7Comm is Siemens PLC communication protocol.

References: Wireshark S7comm wiki:

NDPI_PROTOCOL_MSTEAMS

Microsoft Teams collaboration app protocol.

References: Microsoft Teams official site:

Notes:

  • This ID is also used for Skype traffic.

NDPI_PROTOCOL_WEBSOCKET

WebSocket provides full-duplex communication channels over TCP.

References: RFC6455:

NDPI_PROTOCOL_ANYDESK

AnyDesk is a platform-independent remote desktop app.

References: AnyDesk official site:

NDPI_PROTOCOL_SOAP

SOAP is a protocol for exchanging structured info in web services using XML.

References: W3C SOAP spec:

NDPI_PROTOCOL_APPLE_SIRI

Apple Siri is a voice assistant integrated into Apple devices.

References: Apple Siri official:

NDPI_PROTOCOL_SNAPCHAT_CALL

Snapchat Call provides voice and video communication between users.

References: Snapchat official site:

NDPI_PROTOCOL_HPVIRTGRP

HP Virtual Group is HP’s proprietary virtualization protocol.

References: Proprietary, no public documentation.

NDPI_PROTOCOL_GENSHIN_IMPACT

Genshin Impact is an action RPG game with live data exchanges.

References: Genshin Impact official site:

NDPI_PROTOCOL_ACTIVISION

Activision network traffic, including Call of Duty games.

References: Activision official site:

NDPI_PROTOCOL_FORTICLIENT

FortiClient security suite with VPN and endpoint protection.

References: FortiClient official site:

NDPI_PROTOCOL_Z3950

Z39.50 protocol for searching and retrieving info from remote databases, often library systems.

References: Library of Congress Z39.50:

NDPI_PROTOCOL_LIKEE

Likee is a short-video creation and sharing platform.

References: Likee official site:

NDPI_PROTOCOL_GITLAB

GitLab is a DevOps platform with Git repository management and CI/CD.

References: GitLab official site:

NDPI_PROTOCOL_AVAST_SECUREDNS

Avast Secure DNS provides safer browsing by blocking unsafe websites.

References: Avast Secure DNS site:

NDPI_PROTOCOL_CASSANDRA

Apache Cassandra is a distributed NoSQL database system for big data.

References: Cassandra official site:

NDPI_PROTOCOL_AMAZON_AWS

Amazon Web Services (AWS) cloud computing platform.

References: AWS official site:

NDPI_PROTOCOL_SALESFORCE

Salesforce is a cloud-based CRM platform.

References: Salesforce official site:

NDPI_PROTOCOL_VIMEO

Vimeo is a video hosting and sharing platform.

References: Vimeo official site:

NDPI_PROTOCOL_FACEBOOK_VOIP

Facebook’s voice over IP communications within Messenger.

References: Facebook Messenger:

NDPI_PROTOCOL_SIGNAL_VOIP

Signal’s encrypted voice calling feature.

References: Signal official site:

NDPI_PROTOCOL_FUZE

Fuze is a unified communications platform.

References: Fuze official site:

NDPI_PROTOCOL_GTP_U

GTP-U carries user data within mobile networks.

References: 3GPP TS 29.060:

NDPI_PROTOCOL_GTP_C

GTP-C controls tunnel establishment in mobile networks.

References: 3GPP TS 29.060:

NDPI_PROTOCOL_GTP_PRIME

GTP Prime is a signaling protocol used in LTE for billing and charging.

References: 3GPP TS 32.295:

NDPI_PROTOCOL_ALIBABA

Alibaba is a major Chinese conglomerate specializing in e-commerce and technology.

References: Alibaba official site:

NDPI_PROTOCOL_CRASHLYSTICS

Crashlytics is a crash reporting tool by Google Firebase.

References: Crashlytics on Firebase:

NDPI_PROTOCOL_MICROSOFT_AZURE

Microsoft Azure cloud computing platform.

References: Azure official site:

NDPI_PROTOCOL_ICLOUD_PRIVATE_RELAY

iCloud Private Relay increases privacy by routing traffic through multiple relays.

References: Apple iCloud Private Relay:

NDPI_PROTOCOL_ETHERNET_IP

Ethernet/IP adapts the Common Industrial Protocol to Ethernet.

References: ODVA Ethernet/IP:

NDPI_PROTOCOL_BADOO

Badoo is a social networking and dating service.

References: Badoo official site:

NDPI_PROTOCOL_ACCUWEATHER

AccuWeather provides real-time weather forecasts and alerts.

References: AccuWeather official site:

NDPI_PROTOCOL_GOOGLE_CLASSROOM

Google Classroom simplifies school assignment management.

References: Google Classroom:

NDPI_PROTOCOL_HSRP

HSRP provides IP network failover and redundancy.

References: Cisco HSRP guide:

NDPI_PROTOCOL_GOOGLE_CLOUD

Google Cloud provides cloud computing services.

References: Google Cloud official site:

NDPI_PROTOCOL_TENCENT

Tencent network services and applications.

References: Tencent official site:

NDPI_PROTOCOL_RAKNET

RakNet is a C++ game networking engine.

References: RakNet on GitHub:

NDPI_PROTOCOL_XIAOMI

Xiaomi communication protocols for devices and IoT.

References: Xiaomi official site:

NDPI_PROTOCOL_CACHEFLY

CacheFly is a content delivery network focused on video streaming.

References: CacheFly official site:

NDPI_PROTOCOL_SOFTETHER

SoftEther VPN supports multiple protocols including SSL-VPN and L2TP.

References: SoftEther official site:

NDPI_PROTOCOL_MPEGDASH

MPEG-DASH enables adaptive bitrate streaming over the Internet.

References: MPEG-DASH specs:

NDPI_PROTOCOL_DAZN

DAZN is a sports subscription video streaming service.

References: DAZN official site:

NDPI_PROTOCOL_GOTO

GoTo includes services like GoToMeeting for online collaboration.

References: GoTo official site:

NDPI_PROTOCOL_RSH

Remote Shell (rsh) executes shell commands remotely.

References: rsh man page:

NDPI_PROTOCOL_1KXUN

1Kxun is a Chinese internet company offering web services.

References: 1Kxun official site:

NDPI_PROTOCOL_IP_PGM

PGM is a reliable multicast transport protocol.

References: RFC3208:

NDPI_PROTOCOL_IP_PIM

PIM is a multicast routing protocol family for IP packets.

References: RFC7761:

NDPI_PROTOCOL_COLLECTD

Collectd gathers system and application metrics periodically.

References: Collectd official site:

NDPI_PROTOCOL_TUNNELBEAR

TunnelBear is a consumer VPN service.

References: TunnelBear official site:

NDPI_PROTOCOL_CLOUDFLARE_WARP

Cloudflare Warp offers secure VPN and DNS resolution.

References: Cloudflare Warp:

NDPI_PROTOCOL_I3D

i3d.net provides dedicated and cloud game servers.

References: i3d.net official site:

NDPI_PROTOCOL_RIOTGAMES

Riot Games develops games like League of Legends and Valorant.

References: Riot Games official site:

NDPI_PROTOCOL_PSIPHON

Psiphon circumvents internet censorship using VPN and proxy tech.

References: Psiphon official site:

NDPI_PROTOCOL_ULTRASURF

UltraSurf bypasses firewalls and protects privacy via proxy.

References: UltraSurf official site:

NDPI_PROTOCOL_THREEMA

Threema is a privacy-focused instant messaging app.

References: Threema official site:

NDPI_PROTOCOL_ALICLOUD

Alibaba Cloud offers cloud computing services.

References: Alibaba Cloud official site:

NDPI_PROTOCOL_AVAST

Avast provides antivirus and internet security software.

References: Avast official site:

NDPI_PROTOCOL_TIVOCONNECT

TiVo Connect enables streaming to TiVo set-top boxes.

References: TiVo official site:

NDPI_PROTOCOL_KISMET

Kismet detects and monitors wireless networks.

References: Kismet official site:

NDPI_PROTOCOL_FASTCGI

FastCGI interfaces programs with web servers to boost dynamic web app performance.

References: FastCGI Archives:

NDPI_PROTOCOL_FTPS

FTPS extends FTP with TLS/SSL for security.

References: RFC4217:

NDPI_PROTOCOL_NATPMP

NAT-PMP auto-configures port forwarding on NAT gateways.

References: RFC6886:

NDPI_PROTOCOL_SYNCTHING

Syncthing synchronizes files continuously between devices.

References: Syncthing official site:

NDPI_PROTOCOL_CRYNET

CryNetwork is CryEngine 5’s proprietary multiplayer protocol.

References: CryEngine docs:

NDPI_PROTOCOL_LINE

LINE is a messaging app with voice/video calls and social features.

References: LINE official site:

NDPI_PROTOCOL_LINE_CALL

LINE Call offers free voice calls within LINE app.

References: LINE official site:

NDPI_PROTOCOL_APPLETVPLUS

Apple TV+ streams original shows and movies.

References: Apple TV+ official site:

NDPI_PROTOCOL_DIRECTV

DirecTV offers satellite TV and interactive services.

References: DirecTV official site:

NDPI_PROTOCOL_HBO

HBO provides premium TV series, movies, and docs.

References: HBO official site:

NDPI_PROTOCOL_VUDU

Vudu offers digital movies and TV rentals/purchases.

References: Vudu official site:

NDPI_PROTOCOL_SHOWTIME

Showtime offers original series, movies, and sports programming.

References: Showtime official site:

NDPI_PROTOCOL_DAILYMOTION

Dailymotion is a video-sharing platform.

References: Dailymotion official site:

NDPI_PROTOCOL_LIVESTREAM

Livestream enables live event broadcasting.

References: Livestream official site:

NDPI_PROTOCOL_TENCENTVIDEO

Tencent Video streams movies, TV, and variety shows.

References: Tencent Video official site:

NDPI_PROTOCOL_IHEARTRADIO

iHeartRadio streams music and radio stations.

References: iHeartRadio official site:

NDPI_PROTOCOL_TIDAL

Tidal offers high-fidelity music streaming.

References: Tidal official site:

NDPI_PROTOCOL_TUNEIN

TuneIn streams live news, radio, and podcasts.

References: TuneIn official site:

NDPI_PROTOCOL_SIRIUSXMRADIO

SiriusXM offers satellite and online radio services.

References: SiriusXM official site:

NDPI_PROTOCOL_MUNIN

Munin visualizes network and system resource metrics.

References: Munin official site:

NDPI_PROTOCOL_ELASTICSEARCH

Elasticsearch is a distributed search and analytics engine.

References: Elastic official site:

NDPI_PROTOCOL_TUYA_LP

TUYA LAN Protocol enables local IoT device communication.

References: GitHub - Tuya SDK:

NDPI_PROTOCOL_SOURCE_ENGINE

Source Engine protocol (A2S) is Valve’s UDP-based game server query protocol.

References: Valve Developer Wiki:

Notes:

  • Modern Valve games use Steam Datagram Relay (SDR) instead.

NDPI_PROTOCOL_BACNET

BACnet provides building automation and control communications.

References: ASHRAE Standard 135-2016:

NDPI_PROTOCOL_OICQ

OICQ is an early name for Tencent’s QQ instant messaging protocol.

References: Tencent QQ Wikipedia:

NDPI_PROTOCOL_HOTS

Heroes of the Storm (HOTS) is a MOBA game by Blizzard.

References: HOTS official site:

NDPI_PROTOCOL_FACEBOOK_REEL_STORY

Facebook Reel Story relates to story clip streaming on Facebook.

References: Facebook help:

NDPI_PROTOCOL_SRTP

SRTP provides encryption and authentication for RTP streams.

References: RFC3711:

Notes:

  • SRTP is essentially “encrypted RTP”, similar to HTTPS vs HTTP.
  • Differentiating RTP from SRTP is often difficult; nDPI uses SRTP only when confident.

NDPI_PROTOCOL_OPERA_VPN

Opera VPN is a free VPN bundled with Opera Browser.

References: Opera VPN feature:

NDPI_PROTOCOL_EPICGAMES

Epic Games develops Unreal Engine and games like Fortnite.

References: Epic Games Store:, Fortnite:

NDPI_PROTOCOL_GEFORCENOW

GeForce Now is Nvidia’s cloud gaming service.

References: GeForce Now official site:

NDPI_PROTOCOL_NVIDIA

Generic traffic from Nvidia sites.

References: Nvidia official site:

NDPI_PROTOCOL_BITCOIN

Bitcoin is a prominent cryptocurrency.

References: Bitcoin Protocol documentation:

Notes:

  • Crypto exchanges are not always mining; could be transactions or blockchain exploration.
  • Bitcoin protocol governs node communication and block synchronization.

NDPI_PROTOCOL_PROTONVPN

Proton VPN is a VPN service by Proton AG.

References: ProtonVPN official site:

NDPI_PROTOCOL_THRIFT

Apache Thrift is a cross-language data interchange framework.

References: Thrift official site:, Thrift Github:

NDPI_PROTOCOL_ROBLOX

Roblox is an online game platform and creation system.

References: Roblox official site:

Notes:

  • Roblox traffic may appear as RakNet since it uses a custom version.

NDPI_PROTOCOL_SERVICE_LOCATION

Service Location Protocol enables device service discovery on local networks.

References: SLPv1:, SLPv2:

NDPI_PROTOCOL_MULLVAD

Mullvad VPN service operated by Mullvad VPN AB, Sweden.

References: Mullvad official site:

NDPI_PROTOCOL_HTTP2

HTTP/2 is a major revision of the HTTP protocol.

References: RFC9113:

Notes:

  • HTTP/2 is almost always transported over TLS (encrypted).

NDPI_PROTOCOL_HAPROXY

HAProxy is a high availability load balancer and reverse proxy.

References: HAProxy official site:

NDPI_PROTOCOL_RMCP

Intelligent Platform Management Interface (IPMI) RMCP protocol.

References: IPMI specs:

NDPI_PROTOCOL_CAN

Controller Area Network (CAN) for automotive applications.

References: ISO CAN standard:

NDPI_PROTOCOL_PROTOBUF

Protocol Buffers is a structured data serialization format.

References: Protobuf encoding guide:

NDPI_PROTOCOL_ETHEREUM

Ethereum is a decentralized blockchain with smart contract support.

References: Ethereum docs:

Notes:

  • Similar to Bitcoin, not all exchanges represent mining; may be transactions or blockchain queries.

NDPI_PROTOCOL_TELEGRAM_VOIP

Telegram audio/video call protocol.

References: Telegram Wikipedia:

NDPI_PROTOCOL_SINA_WEIBO

Chinese microblogging site Sina Weibo.

References: Sina Weibo Wikipedia:

NDPI_PROTOCOL_PTPV2

IEEE 1588-2008 Precision Time Protocol Version 2.

References: IEEE PTP specs:

NDPI_PROTOCOL_RTPS

Real-Time Publish Subscribe Protocol.

References: RTPS specs:

NDPI_PROTOCOL_OPC_UA

IEC62541 OPC Unified Architecture protocol.

References: OPC Foundation:

NDPI_PROTOCOL_S7COMM_PLUS

Siemens proprietary protocol for PLC data exchange (different from classic S7Comm).

References: Protocol description:

NDPI_PROTOCOL_FINS

Factory Interface Network Service (FINS) protocol used by Omron PLCs.

References: Omron FINS docs:

NDPI_PROTOCOL_ETHERSIO

Ether-S-I/O protocol used by Saia-Burgess PLCs.

References: Wireshark EtherSIO wiki:

NDPI_PROTOCOL_UMAS

UMAS is Schneider Electric’s proprietary protocol based on Modbus.

References: Analysis:

NDPI_PROTOCOL_BECKHOFF_ADS

Automation Device Specification protocol for Beckhoff PLCs.

References: Beckhoff ADS docs:

NDPI_PROTOCOL_ISO9506_1_MMS

Manufacturing Message Specification (MMS) protocol for device remote control.

References: ISO 9506-1:2003 standard (paid):

NDPI_PROTOCOL_IEEE_C37118

IEEE standard for Synchrophasor Data Transfer.

References: IEEE C37.118.1-2011 standard (paid):

NDPI_PROTOCOL_ETHERSBUS

Ether-S-Bus protocol for Saia-Burgess PLC communication.

References: Wireshark EtherSBus wiki:

NDPI_PROTOCOL_MONERO

Monero is a privacy-focused cryptocurrency.

(No references)

NDPI_PROTOCOL_DCERPC

DCE/RPC is a remote procedure call mechanism specification.

References: Wireshark DCE/RPC wiki:

NDPI_PROTOCOL_PROFINET_IO

PROFINET/IO is a field bus protocol based on connectionless DCE/RPC.

References: PROFINET specs:

NDPI_PROTOCOL_HISLIP

HiSLIP is for remote control of LAN-based test and measurement instruments.

References: HiSLIP specs:

NDPI_PROTOCOL_UFTP

Encrypted UDP based FTP with multicast.

References: UFTP protocol:

NDPI_PROTOCOL_OPENFLOW

OpenFlow is a network protocol associated with Software-Defined Networking.

References: OpenFlow specs:

NDPI_PROTOCOL_JSON_RPC

JSON-RPC is a remote procedure call protocol encoded in JSON.

References: JSON-RPC specs:

NDPI_PROTOCOL_WEBDAV

WebDAV extends HTTP to collaboratively edit and manage files on Web servers.

References: RFC4918:

Notes:

  • WebDAV is mostly transported over TLS (encrypted).

NDPI_PROTOCOL_APACHE_KAFKA

Apache Kafka is a distributed event streaming platform.

References: Kafka official site:, Kafka Github:

NDPI_PROTOCOL_NOMACHINE

NoMachine is a proprietary remote desktop software.

References: NoMachine official site:

NDPI_PROTOCOL_IEC62056

IEC 62056-4-7 DLMS/COSEM transport layer for IP.

References: IEC paid specs:

Notes:

  • Wireshark does not support this protocol; some old code available at: <https://github.com/bearxiong99/wireshark-dlms>, <https://github.com/matousp/dlms-analysis/tree/master>

NDPI_PROTOCOL_HL7

HL7 standards for clinical and administrative health data exchange.

References: HL7 official site:

NDPI_PROTOCOL_CEPH

Ceph is a scalable distributed storage system.

References: Ceph official site:

NDPI_PROTOCOL_GOOGLE_CHAT

Google Chat is Google’s instant messaging service, successor to Hangouts.

References: Google Chat official site:

NDPI_PROTOCOL_ROUGHTIME

Protocol for rough time sync with cryptographic server verification.

References: IETF Draft:

NDPI_PROTOCOL_PIA

Private Internet Access (PIA) VPN service.

References: PIA official site:

NDPI_PROTOCOL_KCP

KCP is a fast, reliable protocol supporting TCP-like streams with low latency.

References: KCP protocol spec:

NDPI_PROTOCOL_DOTA2

Dota 2 is a popular multiplayer MOBA game by Valve.

References: Dota 2 official site:

NDPI_PROTOCOL_MUMBLE

Mumble is a free, low-latency, high-quality voice chat app.

References: Mumble official site:

NDPI_PROTOCOL_YOJIMBO

Yojimbo is a secure client/server UDP-based protocol.

References: Protocol spec:

NDPI_PROTOCOL_ELECTRONICARTS

Electronic Arts is a major game publisher and producer.

References: EA official site:

Notes:

  • Much of the traffic relates to EA Origin game store.

NDPI_PROTOCOL_STOMP

STOMP is an interoperable protocol for asynchronous message passing.

References: STOMP specification:

NDPI_PROTOCOL_RADMIN

Radmin is remote access software for Windows.

References: Radmin official site:

NDPI_PROTOCOL_RAFT

Raft is a consensus protocol for distributed logs.

References: Raft C implementation:, Raft paper:

NDPI_PROTOCOL_GEARMAN

Gearman is a network job-queuing system.

References: Gearman official site:

NDPI_PROTOCOL_TENCENTGAMES

Protocol used by Tencent’s various games (mostly mobile).

References: Tencent Games official site:

NDPI_PROTOCOL_GAIJIN

Gaijin Entertainment games protocols.

References: Gaijin official site:

NDPI_PROTOCOL_C1222

ANSI C12.22 protocol for communication with electric meters.

References: NEMA standard (paid):

NDPI_PROTOCOL_HUAWEI

Generic traffic related to Huawei.

References: Huawei official site:

NDPI_PROTOCOL_HUAWEI_CLOUD

Huawei Mobile Cloud services.

References: Huawei Cloud:

NDPI_PROTOCOL_DLEP

Dynamic Link Exchange Protocol (DLEP) supports radio-aware routing.

References: RFC8175:

NDPI_PROTOCOL_BFD

Bidirectional Forwarding Detection detects faults between routers or switches.

References: RFC5880:

NDPI_PROTOCOL_NETEASE_GAMES

Traffic from NetEase games.

References: NetEase Games official site:

NDPI_PROTOCOL_PATHOFEXILE

Path of Exile is a free online action RPG.

References: Path of Exile official site:

NDPI_PROTOCOL_GOOGLE_CALL

Google audio/video call applications (e.g., Google Meet).

References: Google Meet official site:

Notes:

  • nDPI uses different IDs for generic and realtime traffic (e.g., NDPI_PROTOCOL_MEET vs NDPI_PROTOCOL_GOOGLE_CALL).

NDPI_PROTOCOL_PFCP

PFCP protocol communicates between control and user planes in 4G/5G.

References: PFCP specs:

NDPI_PROTOCOL_FLUTE

File Delivery over Unidirectional Transport protocol.

References: RFC6726:

NDPI_PROTOCOL_LOLWILDRIFT

League of Legends: Wild Rift mobile MOBA game.

References: Wild Rift official site:

NDPI_PROTOCOL_TESO

The Elder Scrolls Online MMORPG.

References: ESO official site:

NDPI_PROTOCOL_LDP

Label Distribution Protocol establishes label paths in MPLS.

References: RFC5036:

NDPI_PROTOCOL_KNXNET_IP

KNXnet/IP extends KNX home/building automation over IP.

References: Standard docs (paid):

NDPI_PROTOCOL_BLUESKY

Bluesky decentralized microblogging platform.

References: Bluesky official site:

NDPI_PROTOCOL_MASTODON

Mastodon is open-source software for self-hosted social networking.

References: Mastodon official site:

NDPI_PROTOCOL_THREADS

Threads is a social media service by Meta.

References: Threads official site:

NDPI_PROTOCOL_VIBER_VOIP

Viber audio/video call protocol.

References: Viber Wikipedia:

NDPI_PROTOCOL_ZUG

ZUG protocol is part of Casper 2.0 blockchain consensus.

References: Casper Labs site: <https://casperlabs.io>, Casper blog:

NDPI_PROTOCOL_JRMI

Java Remote Method Invocation protocol.

References: Oracle JRMI docs:

NDPI_PROTOCOL_RIPE_ATLAS

RIPE Atlas probe protocol for Internet measurement.

References: RIPE Atlas site:, RIPE Atlas docs:

NDPI_PROTOCOL_HLS

HTTP Live Streaming (HLS) segments media for adaptive streaming.

References: RFC8216:

NDPI_PROTOCOL_CLICKHOUSE

ClickHouse is a columnar database for OLAP.

References: ClickHouse official site:

NDPI_PROTOCOL_NANO

Nano is a fast, fee-less, eco-friendly cryptocurrency.

References: Nano official site:

NDPI_PROTOCOL_OPENWIRE

OpenWire is Apache ActiveMQ’s wire protocol.

References: OpenWire docs:

NDPI_PROTOCOL_CNP_IP

Encapsulation of LonWorks control network over IP.

References: ISO/IEC 14908-4:2012 standard (paid):

NDPI_PROTOCOL_ATG

Automatic Tank Gauge system data transfer protocol.

References: ATG protocol specs:

NDPI_PROTOCOL_TRDP

Train Real Time Data Protocol standardized by IEC.

References: TRDP specs:

NDPI_PROTOCOL_LUSTRE

Lustre is a parallel distributed file system for supercomputing.

References: Lustre official site:

NDPI_PROTOCOL_NORDVPN

NordVPN is a VPN service.

References: NordVPN official site:

NDPI_PROTOCOL_SURFSHARK

Surfshark VPN service.

References: Surfshark official site:

NDPI_PROTOCOL_CACTUSVPN

CactusVPN service.

References: CactusVPN official site:

NDPI_PROTOCOL_WINDSCRIBE

Windscribe VPN service.

References: Windscribe official site:

NDPI_PROTOCOL_SONOS

Sonos provides high-quality wireless sound systems.

References: Sonos official site:

NDPI_PROTOCOL_DINGTALK

DingTalk is a collaboration platform by Alibaba.

References: DingTalk official site:

NDPI_PROTOCOL_PALTALK

Paltalk is a video chat and messaging app.

References: Paltalk official site:

NDPI_PROTOCOL_NAVER

Naver is South Korea’s top search engine and platform.

References: Naver official site:

NDPI_PROTOCOL_SHEIN

Shein is a fast fashion retailer.

References: Shein official site:

NDPI_PROTOCOL_TEMU

Temu is an online marketplace by PDD Holdings.

References: Temu official site:

NDPI_PROTOCOL_TAOBAO

Taobao is a Chinese online shopping platform.

References: Taobao official site:

NDPI_PROTOCOL_MIKROTIK

MikroTik Neighbor Discovery Protocol (MNDP) finds compatible neighbor routers/switches.

References: MikroTik official docs:

NDPI_PROTOCOL_DICOM

DICOM is a standard for medical image storage and transmission.

References: DICOM Wikipedia article:

NDPI_PROTOCOL_PARAMOUNTPLUS

Paramount+ is a subscription video streaming service.

References: Paramount+ official site:

NDPI_PROTOCOL_YANDEX_ALICE

Yandex Alice voice assistant, similar to Alexa.

References: Yandex Alice protocol:

NDPI_PROTOCOL_VIVOX

Vivox provides real-time voice and text chat for games.

References: Vivox official site:

NDPI_PROTOCOL_DIGITALOCEAN

DigitalOcean cloud service provider.

References: DigitalOcean official site:

NDPI_PROTOCOL_RUTUBE

RUTUBE is a Russian video streaming platform.

References: Rutube official site:

NDPI_PROTOCOL_LAGOFAST

LagoFast Game Booster improves gaming performance by reducing lag.

References: LagoFast official site:

NDPI_PROTOCOL_GEARUP_BOOSTER

GearUp Booster reduces game lag.

References: GearUp Booster official site:

NDPI_PROTOCOL_LLM

Traffic related to various Large Language Models (ChatGPT, DeepSeek, Gemini, etc.)

References: OpenAI:, DeepSeek:

NDPI_PROTOCOL_UBIQUITY

Traffic from Ubiquity sites and services.

References: Ubiquity official site:

NDPI_PROTOCOL_MSDO

Microsoft Delivery Optimization distributes Windows updates and content.

References: Microsoft DO docs:

NDPI_PROTOCOL_ROCKSTAR_GAMES

Traffic related to Rockstar Games services and launcher.

References: Rockstar Games official site:

NDPI_PROTOCOL_KICK

Kick.com live streaming platform.

References: Kick official site:

NDPI_PROTOCOL_HAMACHI

LogMeIn Hamachi VPN service (primarily used for gaming and remote access). Unlike anonymity VPNs, Hamachi creates virtual LAN networks between devices.

References: LogMeIn Hamachi official site: