nDPI Protocols List
This page provides the list of the protocols/applications supported by nDPI. For each protocol there is a brief description, some links to further, more detailed information and, optionally, some notes that might be useful when handling such a protocol (from the application/integrator point of view)
Work in progress!
NDPI_PROTOCOL_FTP_CONTROL
FTP Control protocol used for managing file transfers between client and server.
References: RFC959:
NDPI_PROTOCOL_MAIL_POP
POP (Post Office Protocol) is used by email clients to retrieve messages from a mail server.
References: RFC1939:
NDPI_PROTOCOL_MAIL_SMTP
SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending email across the Internet.
References: RFC5321:
NDPI_PROTOCOL_MAIL_IMAP
IMAP (Internet Message Access Protocol) allows email clients to access and manipulate messages on a mail server.
References: RFC3501:
NDPI_PROTOCOL_DNS
DNS (Domain Name System) translates human-friendly domain names to IP addresses.
References: RFC1035:
NDPI_PROTOCOL_IPP
IPP (Internet Printing Protocol) is used for managing print jobs and queues over a network.
References: RFC8010:
NDPI_PROTOCOL_HTTP
HTTP (Hypertext Transfer Protocol) is the foundation of data communication for the World Wide Web.
NDPI_PROTOCOL_MDNS
mDNS (Multicast DNS) resolves hostnames to IP addresses within small networks without a local DNS server.
References: RFC6762:
NDPI_PROTOCOL_NTP
NTP (Network Time Protocol) synchronizes clocks of computer systems over packet-switched datalinks.
References: RFC5905:
NDPI_PROTOCOL_NETBIOS
NetBIOS (Network Basic Input/Output System) provides services related to the session layer allowing applications on separate computers to communicate.
References: Microsoft NetBIOS documentation:
NDPI_PROTOCOL_NFS
NFS (Network File System) allows a user on a client computer to access files over a network much like local storage.
References: RFC7530:
NDPI_PROTOCOL_SSDP
SSDP (Simple Service Discovery Protocol) is used for advertising and discovering network services and presence information.
References: RFC4861:
NDPI_PROTOCOL_BGP
BGP (Border Gateway Protocol) manages how packets are routed across the internet through the exchange of routing information.
References: RFC4271:
NDPI_PROTOCOL_SNMP
SNMP (Simple Network Management Protocol) is used for collecting and organizing information about managed devices on IP networks.
References: RFC1157:
NDPI_PROTOCOL_XDMCP
XDMCP (X Display Manager Control Protocol) enables remote graphical logins to Unix/Linux systems.
References: RFC1076:
NDPI_PROTOCOL_SMBV1
SMBv1 (Server Message Block version 1) is a network file sharing protocol used for providing shared access to files and printers.
References: Protocol Specs:
NDPI_PROTOCOL_SYSLOG
Syslog is a standard protocol used for message logging in an IP network.
References: RFC5424:
NDPI_PROTOCOL_DHCP
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices in a network.
References: RFC2131:
NDPI_PROTOCOL_POSTGRES
PostgreSQL is an advanced open-source relational database management system.
References: PostgreSQL official site:
NDPI_PROTOCOL_MYSQL
MySQL is a popular open-source relational database management system.
References: MySQL official site:
NDPI_PROTOCOL_MS_OUTLOOK
Microsoft Outlook is an email client and personal information manager by Microsoft.
References: Outlook official site:
NDPI_PROTOCOL_VK
VK (VKontakte) is a Russian online social media and social networking service.
References: VK official site:
NDPI_PROTOCOL_MAIL_POPS
POPS (POP Secure) is POP protocol used over SSL/TLS for secure email retrieval.
References: RFC2595:
NDPI_PROTOCOL_TAILSCALE
Tailscale is a zero-config VPN based on WireGuard, simplifying secure network connectivity.
References: Tailscale official site:
NDPI_PROTOCOL_YANDEX
Yandex is a Russian internet company providing multiple online services including search.
References: Yandex official site:
NDPI_PROTOCOL_NTOP
ntop is a network traffic probe that shows network usage.
References: ntop official site:
NDPI_PROTOCOL_COAP
CoAP (Constrained Application Protocol) is a specialized web transfer protocol for use with constrained devices.
References: RFC7252:
NDPI_PROTOCOL_VMWARE
VMware protocol used for management and data exchange in VMware virtualization platforms.
References: VMware official site:
NDPI_PROTOCOL_MAIL_SMTPS
SMTPS (SMTP Secure) is SMTP protocol for sending emails over SSL/TLS encrypted connections.
References: RFC2487:
NDPI_PROTOCOL_DTLS
DTLS (Datagram Transport Layer Security) provides communications privacy for datagram protocols.
References: RFC6347:
NDPI_PROTOCOL_UBNTAC2
AirControl network management application by Ubiquiti Networks.
References: Ubiquiti AirControl community post:
NDPI_PROTOCOL_BFCP
BFCP (Binary Floor Control Protocol) is used for controlling and coordinating real-time data sharing and collaboration during video conferencing sessions.
References: RFC8855:
NDPI_PROTOCOL_YANDEX_MAIL
Yandex.Mail is a free email service provided by the Russian internet company Yandex.
References: Yandex.Mail official site:
NDPI_PROTOCOL_YANDEX_MUSIC
Yandex.Music is a music streaming service offering a large library of tracks and personalized recommendations.
References: Yandex.Music official site:
NDPI_PROTOCOL_GNUTELLA
Gnutella is a decentralized peer-to-peer network protocol used for file sharing.
References: Gnutella Wikipedia article:
NDPI_PROTOCOL_EDONKEY
eDonkey is a peer-to-peer file sharing network popular in the early 2000s, supporting large file transfers.
References: eDonkey Wikipedia article:
NDPI_PROTOCOL_BITTORRENT
BitTorrent is a widely used peer-to-peer protocol for distributing large amounts of data efficiently.
References: BitTorrent Wikipedia article:
NDPI_PROTOCOL_MSTEAMS_CALL
Audio/video calls made by Microsoft applications, mainly MS Teams and Skype.
References: Microsoft Teams official site:
NDPI_PROTOCOL_SIGNAL
Signal is a secure messaging protocol known for end-to-end encryption of texts and calls.
References: Signal:
NDPI_PROTOCOL_MEMCACHED
Memcached is a distributed memory caching system used to speed up dynamic web applications.
References: Memcached official site:
NDPI_PROTOCOL_SMBV23
SMB version 2 and 3 are protocols for shared access to files, printers, and serial ports over a network.
References: Server Message Block Wikipedia article:
NDPI_PROTOCOL_MINING
Mining protocols enable communication with blockchain networks like Ethereum, ZCash, and Monero during cryptocurrency mining.
References: Cryptocurrency Wikipedia article:
NDPI_PROTOCOL_NEST_LOG_SINK
Nest Log Sink protocol used by Nest Protect and other Nest devices (particularly smoke detectors) to send logging data.
References: Nest Protect overview:
NDPI_PROTOCOL_MODBUS
Modbus is a serial communication protocol for connecting industrial electronic devices.
References: Modbus Wikipedia article:
NDPI_PROTOCOL_WHATSAPP_CALL
WhatsApp Call protocol handles both audio and video calls within the WhatsApp messaging app.
References: WhatsApp official site:
NDPI_PROTOCOL_DATASAVER
Data Saver (Lite Mode) is a Google Chrome feature designed to reduce mobile data usage by compressing web traffic.
References: Google Chromium Blog:
NDPI_PROTOCOL_XBOX
Xbox protocol covers network traffic associated with Microsoft’s Xbox gaming consoles.
References: Xbox official site:
NDPI_PROTOCOL_QQ
QQ is an instant messaging platform developed by Tencent popular in China.
References: QQ official site:
NDPI_PROTOCOL_TIKTOK
TikTok is a video-sharing social networking service for short-format videos.
References: TikTok official site:
NDPI_PROTOCOL_RTSP
RTSP (Real Time Streaming Protocol) controls streaming media servers.
References: RFC2326:
NDPI_PROTOCOL_MAIL_IMAPS
IMAPS (IMAP over SSL) is the secure version of the Internet Message Access Protocol for email retrieval.
References: RFC3501: and RFC8314 (IMAPS):
NDPI_PROTOCOL_ICECAST
Icecast is a streaming media project that supports audio/video streaming and broadcast.
References: Icecast official site:
NDPI_PROTOCOL_CPHA
Check Point High Availability (CPHA) Protocol provides firewall redundancy and failover.
References: Check Point HA:
NDPI_PROTOCOL_IQIYI
iQIYI is a Chinese online video platform with original and licensed movies, dramas, variety shows, and anime.
References: iQIYI official site:
NDPI_PROTOCOL_ADOBE_CONNECT
Adobe Connect is a web conferencing platform for online meetings, webinars, and virtual classrooms.
References: Adobe Connect official site:
NDPI_PROTOCOL_MONGODB
MongoDB is a popular NoSQL database system designed for scalability and flexibility.
References: MongoDB official site:
NDPI_PROTOCOL_PLURALSIGHT
Pluralsight is an online education platform offering tech skill development courses.
References: Pluralsight official site:
NDPI_PROTOCOL_YANDEX_CLOUD
Yandex.Cloud is a public cloud platform providing computing and storage services.
References: Yandex.Cloud official site:
NDPI_PROTOCOL_OCSP
OCSP (Online Certificate Status Protocol) checks the revocation status of digital certificates in real-time.
References: RFC6960:
NDPI_PROTOCOL_VXLAN
VXLAN (Virtual Extensible LAN) extends layer 2 networks over layer 3 infrastructure.
References: RFC7348:
NDPI_PROTOCOL_IRC
IRC (Internet Relay Chat) is a text-based chat system for instant messaging.
References: IRC Wikipedia article: and IRC statistics:
NDPI_PROTOCOL_MERAKI_CLOUD
Meraki Cloud is a cloud-based network management platform by Cisco Meraki.
References: Meraki official site:
NDPI_PROTOCOL_JABBER
Jabber is an open instant messaging protocol based on XMPP for real-time communication.
References: XMPP standards:
NDPI_PROTOCOL_NATS
NATS is a high-performance messaging system for cloud-native applications and IoT.
References: NATS official site:
NDPI_PROTOCOL_AMONG_US
Among Us is a multiplayer social deduction game developed by InnerSloth.
References: InnerSloth official site:
NDPI_PROTOCOL_YAHOO
Yahoo is a web services provider known for its email, news, and search engine products.
References: Yahoo official site:
NDPI_PROTOCOL_DISNEYPLUS
Disney+ is a streaming service offering movies and TV series from Disney franchises.
References: Disney+ official site:
NDPI_PROTOCOL_HART_IP
Highway Addressable Remote Transducer over IP.
References: HART-IP Protocol Specs:
NDPI_PROTOCOL_IP_VRRP
Virtual Router Redundancy Protocol (VRRP) provides automatic assignment of available IP routers to hosts.
References: RFC5798:
NDPI_PROTOCOL_STEAM
Steam is a digital distribution platform developed by Valve Corporation for games.
References: Steam official site:
NDPI_PROTOCOL_MELSEC
MELSEC is a proprietary industrial protocol used by Mitsubishi Electric PLCs for communication and control.
References: MELSEC Communication Protocol Manual:
NDPI_PROTOCOL_WORLDOFWARCRAFT
World of Warcraft (WoW) is a massively multiplayer online role-playing game (MMORPG).
References: WoW official site:
NDPI_PROTOCOL_TELNET
Telnet is a network protocol for interactive text communication.
References: RFC854:
NDPI_PROTOCOL_STUN
STUN (Session Traversal Utilities for NAT) helps devices discover public IP addresses.
References: RFC5389:
NDPI_PROTOCOL_IPSEC
IPsec authenticates and encrypts IP packets for secure communication over IP networks.
References: RFC4301:
NDPI_PROTOCOL_IP_GRE
GRE (Generic Routing Encapsulation) tunnels packets to encapsulate various network protocols.
References: RFC2784:
NDPI_PROTOCOL_IP_ICMP
ICMP (Internet Control Message Protocol) sends error messages and operational information.
References: RFC792:
NDPI_PROTOCOL_IP_IGMP
IGMP (Internet Group Management Protocol) manages membership of IP multicast groups.
References: RFC2236:
NDPI_PROTOCOL_IP_EGP
EGP (Exterior Gateway Protocol) is an obsolete protocol for exchanging routing info.
References: RFC904:
NDPI_PROTOCOL_IP_SCTP
SCTP (Stream Control Transmission Protocol) is a reliable transport layer protocol.
References: RFC4960:
NDPI_PROTOCOL_IP_OSPF
OSPF (Open Shortest Path First) is a routing protocol for IP networks.
References: RFC2328:
NDPI_PROTOCOL_IP_IP_IN_IP
IP-in-IP encapsulation allows an IP packet to be wrapped inside another IP packet.
References: RFC2003:
NDPI_PROTOCOL_RTP
RTP (Real-time Transport Protocol) provides end-to-end delivery services for real-time data.
References: RFC3550:
NDPI_PROTOCOL_RDP
RDP (Remote Desktop Protocol) is Microsoft’s protocol for remote graphical desktop access.
References: Remote Desktop Protocol Wikipedia article:
NDPI_PROTOCOL_VNC
VNC (Virtual Network Computing) allows remote control of other computers’ desktops.
References: VNC Wikipedia article:
NDPI_PROTOCOL_TUMBLR
Tumblr is a microblogging and social networking platform.
References: Tumblr official site:
NDPI_PROTOCOL_TLS
TLS (Transport Layer Security) provides encryption for network communications.
References: RFC8446:
NDPI_PROTOCOL_SSH
SSH (Secure Shell) is a protocol for secure remote login and other network services.
References: RFC4251:
NDPI_PROTOCOL_USENET
Usenet is a distributed discussion system for newsgroups.
References: Usenet Wikipedia article:
NDPI_PROTOCOL_MGCP
MGCP (Media Gateway Control Protocol) controls media gateways on IP networks.
References: RFC3435:
NDPI_PROTOCOL_IAX
IAX (Inter-Asterisk eXchange protocol) is used for VoIP sessions, originally for Asterisk PBX.
References: RFC5456:
NDPI_PROTOCOL_TFTP
TFTP (Trivial File Transfer Protocol) is a simple file transfer protocol.
NDPI_PROTOCOL_AFP
AFP (Apple Filing Protocol) is a network protocol for file services on macOS.
References: AFP Wikipedia article:
NDPI_PROTOCOL_YANDEX_METRIKA
Yandex Metrika is a web analytics service by Yandex to track website traffic.
References: Yandex Metrika official site:
NDPI_PROTOCOL_YANDEX_DIRECT
Yandex.Direct is an online advertising platform for contextual ads.
References: Yandex.Direct official site:
NDPI_PROTOCOL_SIP
SIP (Session Initiation Protocol) is used for real-time communication session control.
References: RFC3261:
NDPI_PROTOCOL_TRUPHONE
Truphone is a global mobile network provider using eSIM and VoIP.
References: Truphone official site:
NDPI_PROTOCOL_IP_ICMPV6
ICMPv6 is integral to IPv6 for diagnostics and error reporting.
References: RFC4443:
NDPI_PROTOCOL_DHCPV6
DHCPv6 dynamically assigns IPv6 addresses and settings.
References: RFC8415:
NDPI_PROTOCOL_ARMAGETRON
Armagetron Advanced is a 3D multiplayer game inspired by Tron light cycles.
References: Armagetron official site:
NDPI_PROTOCOL_CROSSFIRE
Crossfire is an online FPS game with team combat and various modes.
References: Crossfire official site:
NDPI_PROTOCOL_DOFUS
Dofus is a tactical MMORPG with turn-based combat.
References: Dofus official site:
NDPI_PROTOCOL_BLACKNUT
Blacknut is a cloud gaming platform offering access to a catalog of games streamed over the internet.
References: Blacknut official site
NDPI_PROTOCOL_BOOSTEROID
Boosteroid is a cloud gaming service that enables users to play PC games on various devices via game streaming technology.
References: Boosteroid official site
NDPI_PROTOCOL_GUILDWARS2
Guild Wars is an online RPG known for dynamic events and PvP.
References: Guild Wars 2 official site:
NDPI_PROTOCOL_AMAZON_ALEXA
Amazon Alexa voice service protocol for smart devices.
References: Amazon Alexa developer site:
NDPI_PROTOCOL_KERBEROS
Kerberos is a protocol for secure network authentication.
References: RFC4120:
NDPI_PROTOCOL_LDAP
LDAP is a protocol for accessing directory services.
References: RFC4510:
NDPI_PROTOCOL_NEXON
Nexon is a South Korean video game developer and publisher.
References: Nexon official site:
NDPI_PROTOCOL_IP_AH
An Authentication Header (AH) is a security protocol in IPSec that ensures the integrity of packet headers and data, provides user authentication, and offers optional replay protection and access protection. It does not encrypt any part of the packets.
References: RFC4302:
NDPI_PROTOCOL_IP_ESP
Encapsulating Security Payload (ESP) is a crucial protocol within the IPsec framework, designed to protect the confidentiality, integrity, and authentication of IP packets. It achieves this by encrypting the payload (the data being transmitted) and potentially authenticating the sender and validating the data’s integrityencrypt any part of the packets.
References: RFC4303:
NDPI_PROTOCOL_MOZILLA
Mozilla-related traffic, especially Firefox browser.
References: Mozilla official site:
NDPI_PROTOCOL_GOOGLE
Google’s internet services and products traffic.
References: Google official site:
NDPI_PROTOCOL_MS_RPCH
Microsoft RPC protocol over HTTP.
References: Microsoft RPCH specs:
NDPI_PROTOCOL_NETFLOW
NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic flow.
References: RFC3954:
NDPI_PROTOCOL_SFLOW
sFlow is a packet sampling technology for monitoring traffic in data networks in real time.
References: sFlow Wikipedia article:
NDPI_PROTOCOL_HTTP_CONNECT
HTTP CONNECT method is used to establish a tunnel to the server, typically for SSL traffic through proxies.
References: RFC7231:
NDPI_PROTOCOL_CITRIX
Citrix provides remote access and virtualization solutions for secure delivery of applications and desktops.
References: Citrix official site:
NDPI_PROTOCOL_NETFLIX
Netflix is a leading streaming entertainment service delivering movies, TV shows, and original content.
References: Netflix official site:
NDPI_PROTOCOL_LASTFM
Last.fm is a music recommendation and streaming service that provides personalized music charts and discovery.
References: Last.fm official site:
NDPI_PROTOCOL_WAZE
Waze is a GPS navigation app providing real-time traffic and road info.
References: Waze official site:
NDPI_PROTOCOL_HULU
Hulu is a streaming platform offering live and on-demand TV and movies.
References: Hulu official site:
NDPI_PROTOCOL_CHECKMK
Checkmk is an IT monitoring system for servers, apps, networks, and cloud.
References: Checkmk official site:
NDPI_PROTOCOL_AJP
Apache JServ Protocol (AJP) proxies web server requests to application servers.
References: AJP Protocol Specs:
NDPI_PROTOCOL_APPLE
Apple protocol includes various services related to Apple devices and ecosystem.
References: Apple official site:
NDPI_PROTOCOL_WEBEX
Webex is a video conferencing and online meeting application by Cisco.
References: Webex official site:
NDPI_PROTOCOL_WHATSAPP
WhatsApp is a messaging app by Meta, offering encrypted messaging and calls.
References: WhatsApp official site:
NDPI_PROTOCOL_APPLE_ICLOUD
iCloud is Apple’s cloud storage and computing service.
References: iCloud official site:
NDPI_PROTOCOL_VIBER
Viber is a cross-platform messaging and VoIP app.
References: Viber official site:
NDPI_PROTOCOL_APPLE_ITUNES
Apple iTunes is a media player and content store.
References: iTunes official site:
NDPI_PROTOCOL_RADIUS
RADIUS protocol provides centralized Authentication, Authorization, and Accounting.
References: RFC2865:
NDPI_PROTOCOL_TEAMVIEWER
TeamViewer is remote access software for desktop sharing and file transfer.
References: TeamViewer official site:
NDPI_PROTOCOL_EGD
Ethernet Global Data (EGD) protocol for real-time data exchange in industrial automation.
References: EGD Wikipedia article:
Notes:
This dissector only works for data packets, not configuration commands.
IPv6 is not supported.
NDPI_PROTOCOL_HCL_NOTES
HCL Notes (formerly Lotus Notes) is a collaborative client-server application.
References: HCL Notes official site:
NDPI_PROTOCOL_SAP
Session Announcement Protocol (SAP) announces multicast session info.
References: RFC2974:
NDPI_PROTOCOL_GTP
GPRS Tunneling Protocol (GTP) carries mobile data within GSM and UMTS.
References: GTP Wikipedia article:
NDPI_PROTOCOL_WSD
Web Services Dynamic Discovery (WS-Discovery) locates services on local networks.
References: WS-Discovery Wikipedia article:
NDPI_PROTOCOL_LLMNR
Link-Local Multicast Name Resolution (LLMNR) resolves names on local links.
References: RFC4795:
NDPI_PROTOCOL_TOCA_BOCA
Toca Boca produces creative mobile games for children.
References: Toca Boca official site:
NDPI_PROTOCOL_SPOTIFY
Spotify is a music streaming service offering millions of tracks and podcasts.
References: Spotify official site:
NDPI_PROTOCOL_FACEBOOK_MESSENGER
Facebook Messenger is an instant messaging service by Meta.
References: Messenger official site:
NDPI_PROTOCOL_H323
H.323 is a standard for real-time voice, video, and data communications.
References: ITU-T H.323:
NDPI_PROTOCOL_OPENVPN
OpenVPN is an open-source VPN protocol for secure connections.
References: OpenVPN official site:
NDPI_PROTOCOL_NOE
NOE is a VoIP protocol for Alcatel-Lucent compatible telephone systems.
References: Teldat Manual:
NDPI_PROTOCOL_CISCOVPN
Cisco VPN protocols secure virtual private network connections.
References: Cisco VPN site:
NDPI_PROTOCOL_TEAMSPEAK
TeamSpeak is a voice-over-IP app for gamer communication.
References: TeamSpeak official site:
NDPI_PROTOCOL_TOR
Tor enables anonymous communication via onion routing.
References: Tor Project site:
NDPI_PROTOCOL_SKINNY
Skinny Client Control Protocol (SCCP) is a Cisco VoIP signaling protocol.
References: SCCP Wikipedia article:
NDPI_PROTOCOL_RTCP
RTCP (Real-time Transport Control Protocol) works alongside RTP.
References: RFC3550 Section 6:
NDPI_PROTOCOL_RSYNC
Rsync is a fast incremental file transfer utility.
References: Rsync homepage:
NDPI_PROTOCOL_ORACLE
Oracle database communication protocol.
References: Oracle Net Services docs:
NDPI_PROTOCOL_CORBA
CORBA enables software components to communicate over a network.
References: OMG CORBA:
NDPI_PROTOCOL_CANONICAL
Canonical Ltd., developer of Ubuntu Linux and related services.
References: Canonical official site:
NDPI_PROTOCOL_WHOIS_DAS
WHOIS DAS queries databases storing Internet resource assignments.
References: WHOIS Wikipedia article:
NDPI_PROTOCOL_SD_RTN
Agora SD-RTN is a global, private, secure real-time network for low-latency streaming.
References: Agora platform info:
NDPI_PROTOCOL_SOCKS
SOCKS routes network packets through proxy servers.
References: RFC1928:
NDPI_PROTOCOL_NINTENDO
Nintendo network communication protocols for consoles and services.
References: Nintendo official site:
NDPI_PROTOCOL_RTMP
RTMP (Real-Time Messaging Protocol) streams audio, video, and data.
References: RTMP Wikipedia article:
NDPI_PROTOCOL_FTP_DATA
FTP Data Protocol transfers data separately from control connections.
References: FTP Wikipedia article:
NDPI_PROTOCOL_WIKIPEDIA
Wikipedia is a free, collaborative, multilingual online encyclopedia.
References: Wikipedia official site:
NDPI_PROTOCOL_ZMQ
ZeroMQ (ZMQ) is a high-performance asynchronous messaging library.
References: ZeroMQ official site:
NDPI_PROTOCOL_AMAZON
Amazon network traffic including retail, AWS, and content delivery.
References: Amazon official site:
NDPI_PROTOCOL_EBAY
eBay is an online marketplace for quality goods and services.
References: eBay official site:
NDPI_PROTOCOL_CNN
CNN is an American news television channel providing 24-hour news coverage.
References: CNN official site:
NDPI_PROTOCOL_MEGACO
Megaco (H.248) protocol for controlling media gateways in VoIP.
References: ITU-T H.248:
NDPI_PROTOCOL_RESP
Redis Serialization Protocol.
References: Redis Protocol Specs:
NDPI_PROTOCOL_PINTEREST
Pinterest is a social media platform for sharing images and ideas.
References: Pinterest official site:
NDPI_PROTOCOL_OSPF
OSPF (Open Shortest Path First) is a routing protocol for IP networks.
References: RFC2328:
NDPI_PROTOCOL_TELEGRAM
Telegram is a cloud-based instant messaging app focusing on speed and security.
References: Telegram official site:
NDPI_PROTOCOL_COD_MOBILE
Call of Duty: Mobile is a popular shooter game for iOS and Android.
References: COD Mobile official site:
NDPI_PROTOCOL_PANDORA
Pandora is an Internet radio and streaming music service.
References: Pandora official site:
NDPI_PROTOCOL_QUIC
QUIC is a transport layer protocol by Google improving web app performance.
References: RFC9000:
NDPI_PROTOCOL_ZOOM
Zoom is a popular video conferencing platform.
References: Zoom official site:
NDPI_PROTOCOL_EAQ
EAQ is a Brazilian organization measuring broadband quality.
References: EAQ official site:
NDPI_PROTOCOL_OOKLA
Ookla operates Speedtest.net for network performance testing.
References: Speedtest.net:
NDPI_PROTOCOL_AMQP
AMQP is an open standard application layer protocol for messaging middleware.
References: AMQP official site:
NDPI_PROTOCOL_KAKAOTALK
KakaoTalk is a South Korean mobile messaging app (text only).
References: Kakao official site:
NDPI_PROTOCOL_KAKAOTALK_VOICE
KakaoTalk Voice adds voice call functionality within KakaoTalk.
References: Kakao official site:
NDPI_PROTOCOL_TWITCH
Twitch is a live streaming platform for gaming and esports.
References: Twitch official site:
NDPI_PROTOCOL_DOH_DOT
DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) encrypt DNS queries.
References: DoH RFC8484:, DoT RFC7858:
NDPI_PROTOCOL_WECHAT
WeChat is a Chinese messaging, social media, and payment app.
References: WeChat official site:
NDPI_PROTOCOL_MPEGTS
MPEG Transport Stream (TS) is a standard for transmission/storage of audio, video, data.
References: MPEG-TS Wikipedia article:
NDPI_PROTOCOL_SNAPCHAT
Snapchat is a multimedia messaging app known for ephemeral messages.
References: Snapchat official site:
NDPI_PROTOCOL_SINA
Sina is a Chinese company operating web services including Sina Weibo.
References: Sina official site:
NDPI_PROTOCOL_GOOGLE_MEET
Google Meet is Google’s video conferencing service.
References: Google Meet official site:
NDPI_PROTOCOL_IFLIX
iflix is a video on demand service for emerging markets.
References: iflix official site:
NDPI_PROTOCOL_GITHUB
GitHub is a platform for version control and collaborative development.
References: GitHub official site:
NDPI_PROTOCOL_BJNP
BJNP is a proprietary USB-over-IP network printing discovery protocol by Canon.
References: Canon proprietary, no public specs available.
NDPI_PROTOCOL_REDDIT
Reddit is a social news and discussion website.
References: Reddit official site:
NDPI_PROTOCOL_WIREGUARD
WireGuard is a modern VPN protocol noted for simplicity and speed.
References: WireGuard official site:
NDPI_PROTOCOL_SMPP
SMPP is a protocol for exchanging SMS messages.
References: SMPP official site:
NDPI_PROTOCOL_DNSCRYPT
DNSCrypt authenticates and encrypts DNS traffic.
References: DNSCrypt official site:
NDPI_PROTOCOL_TINC
Tinc is an open-source VPN daemon creating secure private networks.
References: Tinc official site:
NDPI_PROTOCOL_DEEZER
Deezer is a music streaming service.
References: Deezer official site:
NDPI_PROTOCOL_INSTAGRAM
Instagram is a social app for photo and video sharing.
References: Instagram official site:
NDPI_PROTOCOL_MICROSOFT
Microsoft protocol includes various proprietary communications.
References: Microsoft official site:
NDPI_PROTOCOL_BLIZZARD
Blizzard Entertainment is a game developer known for WoW, Diablo, StarCraft.
References: Blizzard official site:
NDPI_PROTOCOL_VALVE_SDR
Steam Datagram Relay (SDR) is Valve’s virtual private gaming network.
References: Steamworks partner doc:
NDPI_PROTOCOL_LISP
LISP separates IP addresses into Endpoint IDs and Routing Locators.
References: RFC6830:
NDPI_PROTOCOL_DIAMETER
Diameter is an AAA network protocol, successor to RADIUS.
References: RFC6733:
NDPI_PROTOCOL_APPLE_PUSH
Apple Push Notification Service (APNs) delivers notifications to Apple devices.
References: Apple Developer APNs:
NDPI_PROTOCOL_GOOGLE_SERVICES
Google Services cover various APIs and endpoints used by Google.
References: No single official site; includes googleapis.com, googletagmanager.com.
NDPI_PROTOCOL_AMAZON_VIDEO
Amazon Video is Amazon’s video streaming service.
References: Amazon Video site:
NDPI_PROTOCOL_GOOGLE_DOCS
Google Docs allows collaborative online document editing.
References: Google Docs official site:
NDPI_PROTOCOL_WHATSAPP_FILES
WhatsApp media files such as videos, pictures, and voice messages.
References: WhatsApp FAQ:
NDPI_PROTOCOL_TARGUS_GETDATA
Targus GetData is a proprietary protocol for Targus device data transfer.
References: Proprietary, no public documentation.
NDPI_PROTOCOL_DNP3
DNP3 is a communication protocol for process automation systems.
References: DNP3 Wikipedia article:
NDPI_PROTOCOL_IEC60870
IEC 60870-5-104 network protocol used in power system telecontrol and supervision.
References: IEC 60870 Wikipedia:
NDPI_PROTOCOL_BLOOMBERG
Bloomberg services traffic identified by domains and ASN registrations.
References: Bloomberg official site:
NDPI_PROTOCOL_CAPWAP
CAPWAP protocol manages wireless access points centrally.
References: RFC5415:
NDPI_PROTOCOL_ZABBIX
Zabbix protocol supports agent-server communication for monitoring.
References: Zabbix Documentation:
NDPI_PROTOCOL_S7COMM
S7Comm is Siemens PLC communication protocol.
References: Wireshark S7comm wiki:
NDPI_PROTOCOL_MSTEAMS
Microsoft Teams collaboration app protocol.
References: Microsoft Teams official site:
Notes:
This ID is also used for Skype traffic.
NDPI_PROTOCOL_WEBSOCKET
WebSocket provides full-duplex communication channels over TCP.
References: RFC6455:
NDPI_PROTOCOL_ANYDESK
AnyDesk is a platform-independent remote desktop app.
References: AnyDesk official site:
NDPI_PROTOCOL_SOAP
SOAP is a protocol for exchanging structured info in web services using XML.
References: W3C SOAP spec:
NDPI_PROTOCOL_APPLE_SIRI
Apple Siri is a voice assistant integrated into Apple devices.
References: Apple Siri official:
NDPI_PROTOCOL_SNAPCHAT_CALL
Snapchat Call provides voice and video communication between users.
References: Snapchat official site:
NDPI_PROTOCOL_HPVIRTGRP
HP Virtual Group is HP’s proprietary virtualization protocol.
References: Proprietary, no public documentation.
NDPI_PROTOCOL_GENSHIN_IMPACT
Genshin Impact is an action RPG game with live data exchanges.
References: Genshin Impact official site:
NDPI_PROTOCOL_ACTIVISION
Activision network traffic, including Call of Duty games.
References: Activision official site:
NDPI_PROTOCOL_FORTICLIENT
FortiClient security suite with VPN and endpoint protection.
References: FortiClient official site:
NDPI_PROTOCOL_Z3950
Z39.50 protocol for searching and retrieving info from remote databases, often library systems.
References: Library of Congress Z39.50:
NDPI_PROTOCOL_LIKEE
Likee is a short-video creation and sharing platform.
References: Likee official site:
NDPI_PROTOCOL_GITLAB
GitLab is a DevOps platform with Git repository management and CI/CD.
References: GitLab official site:
NDPI_PROTOCOL_AVAST_SECUREDNS
Avast Secure DNS provides safer browsing by blocking unsafe websites.
References: Avast Secure DNS site:
NDPI_PROTOCOL_CASSANDRA
Apache Cassandra is a distributed NoSQL database system for big data.
References: Cassandra official site:
NDPI_PROTOCOL_AMAZON_AWS
Amazon Web Services (AWS) cloud computing platform.
References: AWS official site:
NDPI_PROTOCOL_SALESFORCE
Salesforce is a cloud-based CRM platform.
References: Salesforce official site:
NDPI_PROTOCOL_VIMEO
Vimeo is a video hosting and sharing platform.
References: Vimeo official site:
NDPI_PROTOCOL_FACEBOOK_VOIP
Facebook’s voice over IP communications within Messenger.
References: Facebook Messenger:
NDPI_PROTOCOL_SIGNAL_VOIP
Signal’s encrypted voice calling feature.
References: Signal official site:
NDPI_PROTOCOL_FUZE
Fuze is a unified communications platform.
References: Fuze official site:
NDPI_PROTOCOL_GTP_U
GTP-U carries user data within mobile networks.
References: 3GPP TS 29.060:
NDPI_PROTOCOL_GTP_C
GTP-C controls tunnel establishment in mobile networks.
References: 3GPP TS 29.060:
NDPI_PROTOCOL_GTP_PRIME
GTP Prime is a signaling protocol used in LTE for billing and charging.
References: 3GPP TS 32.295:
NDPI_PROTOCOL_ALIBABA
Alibaba is a major Chinese conglomerate specializing in e-commerce and technology.
References: Alibaba official site:
NDPI_PROTOCOL_CRASHLYSTICS
Crashlytics is a crash reporting tool by Google Firebase.
References: Crashlytics on Firebase:
NDPI_PROTOCOL_MICROSOFT_AZURE
Microsoft Azure cloud computing platform.
References: Azure official site:
NDPI_PROTOCOL_ICLOUD_PRIVATE_RELAY
iCloud Private Relay increases privacy by routing traffic through multiple relays.
References: Apple iCloud Private Relay:
NDPI_PROTOCOL_ETHERNET_IP
Ethernet/IP adapts the Common Industrial Protocol to Ethernet.
References: ODVA Ethernet/IP:
NDPI_PROTOCOL_BADOO
Badoo is a social networking and dating service.
References: Badoo official site:
NDPI_PROTOCOL_ACCUWEATHER
AccuWeather provides real-time weather forecasts and alerts.
References: AccuWeather official site:
NDPI_PROTOCOL_GOOGLE_CLASSROOM
Google Classroom simplifies school assignment management.
References: Google Classroom:
NDPI_PROTOCOL_HSRP
HSRP provides IP network failover and redundancy.
References: Cisco HSRP guide:
NDPI_PROTOCOL_GOOGLE_CLOUD
Google Cloud provides cloud computing services.
References: Google Cloud official site:
NDPI_PROTOCOL_TENCENT
Tencent network services and applications.
References: Tencent official site:
NDPI_PROTOCOL_RAKNET
RakNet is a C++ game networking engine.
References: RakNet on GitHub:
NDPI_PROTOCOL_XIAOMI
Xiaomi communication protocols for devices and IoT.
References: Xiaomi official site:
NDPI_PROTOCOL_CACHEFLY
CacheFly is a content delivery network focused on video streaming.
References: CacheFly official site:
NDPI_PROTOCOL_SOFTETHER
SoftEther VPN supports multiple protocols including SSL-VPN and L2TP.
References: SoftEther official site:
NDPI_PROTOCOL_MPEGDASH
MPEG-DASH enables adaptive bitrate streaming over the Internet.
References: MPEG-DASH specs:
NDPI_PROTOCOL_DAZN
DAZN is a sports subscription video streaming service.
References: DAZN official site:
NDPI_PROTOCOL_GOTO
GoTo includes services like GoToMeeting for online collaboration.
References: GoTo official site:
NDPI_PROTOCOL_RSH
Remote Shell (rsh) executes shell commands remotely.
References: rsh man page:
NDPI_PROTOCOL_1KXUN
1Kxun is a Chinese internet company offering web services.
References: 1Kxun official site:
NDPI_PROTOCOL_IP_PGM
PGM is a reliable multicast transport protocol.
References: RFC3208:
NDPI_PROTOCOL_IP_PIM
PIM is a multicast routing protocol family for IP packets.
References: RFC7761:
NDPI_PROTOCOL_COLLECTD
Collectd gathers system and application metrics periodically.
References: Collectd official site:
NDPI_PROTOCOL_TUNNELBEAR
TunnelBear is a consumer VPN service.
References: TunnelBear official site:
NDPI_PROTOCOL_CLOUDFLARE_WARP
Cloudflare Warp offers secure VPN and DNS resolution.
References: Cloudflare Warp:
NDPI_PROTOCOL_I3D
i3d.net provides dedicated and cloud game servers.
References: i3d.net official site:
NDPI_PROTOCOL_RIOTGAMES
Riot Games develops games like League of Legends and Valorant.
References: Riot Games official site:
NDPI_PROTOCOL_PSIPHON
Psiphon circumvents internet censorship using VPN and proxy tech.
References: Psiphon official site:
NDPI_PROTOCOL_ULTRASURF
UltraSurf bypasses firewalls and protects privacy via proxy.
References: UltraSurf official site:
NDPI_PROTOCOL_THREEMA
Threema is a privacy-focused instant messaging app.
References: Threema official site:
NDPI_PROTOCOL_ALICLOUD
Alibaba Cloud offers cloud computing services.
References: Alibaba Cloud official site:
NDPI_PROTOCOL_AVAST
Avast provides antivirus and internet security software.
References: Avast official site:
NDPI_PROTOCOL_TIVOCONNECT
TiVo Connect enables streaming to TiVo set-top boxes.
References: TiVo official site:
NDPI_PROTOCOL_KISMET
Kismet detects and monitors wireless networks.
References: Kismet official site:
NDPI_PROTOCOL_FASTCGI
FastCGI interfaces programs with web servers to boost dynamic web app performance.
References: FastCGI Archives:
NDPI_PROTOCOL_FTPS
FTPS extends FTP with TLS/SSL for security.
References: RFC4217:
NDPI_PROTOCOL_NATPMP
NAT-PMP auto-configures port forwarding on NAT gateways.
References: RFC6886:
NDPI_PROTOCOL_SYNCTHING
Syncthing synchronizes files continuously between devices.
References: Syncthing official site:
NDPI_PROTOCOL_CRYNET
CryNetwork is CryEngine 5’s proprietary multiplayer protocol.
References: CryEngine docs:
NDPI_PROTOCOL_LINE
LINE is a messaging app with voice/video calls and social features.
References: LINE official site:
NDPI_PROTOCOL_LINE_CALL
LINE Call offers free voice calls within LINE app.
References: LINE official site:
NDPI_PROTOCOL_APPLETVPLUS
Apple TV+ streams original shows and movies.
References: Apple TV+ official site:
NDPI_PROTOCOL_DIRECTV
DirecTV offers satellite TV and interactive services.
References: DirecTV official site:
NDPI_PROTOCOL_HBO
HBO provides premium TV series, movies, and docs.
References: HBO official site:
NDPI_PROTOCOL_VUDU
Vudu offers digital movies and TV rentals/purchases.
References: Vudu official site:
NDPI_PROTOCOL_SHOWTIME
Showtime offers original series, movies, and sports programming.
References: Showtime official site:
NDPI_PROTOCOL_DAILYMOTION
Dailymotion is a video-sharing platform.
References: Dailymotion official site:
NDPI_PROTOCOL_LIVESTREAM
Livestream enables live event broadcasting.
References: Livestream official site:
NDPI_PROTOCOL_TENCENTVIDEO
Tencent Video streams movies, TV, and variety shows.
References: Tencent Video official site:
NDPI_PROTOCOL_IHEARTRADIO
iHeartRadio streams music and radio stations.
References: iHeartRadio official site:
NDPI_PROTOCOL_TIDAL
Tidal offers high-fidelity music streaming.
References: Tidal official site:
NDPI_PROTOCOL_TUNEIN
TuneIn streams live news, radio, and podcasts.
References: TuneIn official site:
NDPI_PROTOCOL_SIRIUSXMRADIO
SiriusXM offers satellite and online radio services.
References: SiriusXM official site:
NDPI_PROTOCOL_MUNIN
Munin visualizes network and system resource metrics.
References: Munin official site:
NDPI_PROTOCOL_ELASTICSEARCH
Elasticsearch is a distributed search and analytics engine.
References: Elastic official site:
NDPI_PROTOCOL_TUYA_LP
TUYA LAN Protocol enables local IoT device communication.
References: GitHub - Tuya SDK:
NDPI_PROTOCOL_TPLINK_SHP
TP-LINK Smart Home Protocol for local device control.
References: Home Assistant TP-Link Integration:
NDPI_PROTOCOL_SOURCE_ENGINE
Source Engine protocol (A2S) is Valve’s UDP-based game server query protocol.
References: Valve Developer Wiki:
Notes:
Modern Valve games use Steam Datagram Relay (SDR) instead.
NDPI_PROTOCOL_BACNET
BACnet provides building automation and control communications.
References: ASHRAE Standard 135-2016:
NDPI_PROTOCOL_OICQ
OICQ is an early name for Tencent’s QQ instant messaging protocol.
References: Tencent QQ Wikipedia:
NDPI_PROTOCOL_HOTS
Heroes of the Storm (HOTS) is a MOBA game by Blizzard.
References: HOTS official site:
NDPI_PROTOCOL_FACEBOOK_REEL_STORY
Facebook Reel Story relates to story clip streaming on Facebook.
References: Facebook help:
NDPI_PROTOCOL_SRTP
SRTP provides encryption and authentication for RTP streams.
References: RFC3711:
Notes:
SRTP is essentially “encrypted RTP”, similar to HTTPS vs HTTP.
Differentiating RTP from SRTP is often difficult; nDPI uses SRTP only when confident.
NDPI_PROTOCOL_OPERA_VPN
Opera VPN is a free VPN bundled with Opera Browser.
References: Opera VPN feature:
NDPI_PROTOCOL_EPICGAMES
Epic Games develops Unreal Engine and games like Fortnite.
References: Epic Games Store:, Fortnite:
NDPI_PROTOCOL_GEFORCENOW
GeForce Now is Nvidia’s cloud gaming service.
References: GeForce Now official site:
NDPI_PROTOCOL_NVIDIA
Generic traffic from Nvidia sites.
References: Nvidia official site:
NDPI_PROTOCOL_BITCOIN
Bitcoin is a prominent cryptocurrency.
References: Bitcoin Protocol documentation:
Notes:
Crypto exchanges are not always mining; could be transactions or blockchain exploration.
Bitcoin protocol governs node communication and block synchronization.
NDPI_PROTOCOL_PROTONVPN
Proton VPN is a VPN service by Proton AG.
References: ProtonVPN official site:
NDPI_PROTOCOL_THRIFT
Apache Thrift is a cross-language data interchange framework.
References: Thrift official site:, Thrift Github:
NDPI_PROTOCOL_ROBLOX
Roblox is an online game platform and creation system.
References: Roblox official site:
Notes:
Roblox traffic may appear as RakNet since it uses a custom version.
NDPI_PROTOCOL_SERVICE_LOCATION
Service Location Protocol enables device service discovery on local networks.
NDPI_PROTOCOL_MULLVAD
Mullvad VPN service operated by Mullvad VPN AB, Sweden.
References: Mullvad official site:
NDPI_PROTOCOL_HTTP2
HTTP/2 is a major revision of the HTTP protocol.
References: RFC9113:
Notes:
HTTP/2 is almost always transported over TLS (encrypted).
NDPI_PROTOCOL_HAPROXY
HAProxy is a high availability load balancer and reverse proxy.
References: HAProxy official site:
NDPI_PROTOCOL_RMCP
Intelligent Platform Management Interface (IPMI) RMCP protocol.
References: IPMI specs:
NDPI_PROTOCOL_CAN
Controller Area Network (CAN) for automotive applications.
References: ISO CAN standard:
NDPI_PROTOCOL_PROTOBUF
Protocol Buffers is a structured data serialization format.
References: Protobuf encoding guide:
NDPI_PROTOCOL_ETHEREUM
Ethereum is a decentralized blockchain with smart contract support.
References: Ethereum docs:
Notes:
Similar to Bitcoin, not all exchanges represent mining; may be transactions or blockchain queries.
NDPI_PROTOCOL_TELEGRAM_VOIP
Telegram audio/video call protocol.
References: Telegram Wikipedia:
NDPI_PROTOCOL_SINA_WEIBO
Chinese microblogging site Sina Weibo.
References: Sina Weibo Wikipedia:
NDPI_PROTOCOL_PTPV2
IEEE 1588-2008 Precision Time Protocol Version 2.
References: IEEE PTP specs:
NDPI_PROTOCOL_RTPS
Real-Time Publish Subscribe Protocol.
References: RTPS specs:
NDPI_PROTOCOL_OPC_UA
IEC62541 OPC Unified Architecture protocol.
References: OPC Foundation:
NDPI_PROTOCOL_S7COMM_PLUS
Siemens proprietary protocol for PLC data exchange (different from classic S7Comm).
References: Protocol description:
NDPI_PROTOCOL_FINS
Factory Interface Network Service (FINS) protocol used by Omron PLCs.
References: Omron FINS docs:
NDPI_PROTOCOL_ETHERSIO
Ether-S-I/O protocol used by Saia-Burgess PLCs.
References: Wireshark EtherSIO wiki:
NDPI_PROTOCOL_UMAS
UMAS is Schneider Electric’s proprietary protocol based on Modbus.
References: Analysis:
NDPI_PROTOCOL_BECKHOFF_ADS
Automation Device Specification protocol for Beckhoff PLCs.
References: Beckhoff ADS docs:
NDPI_PROTOCOL_ISO9506_1_MMS
Manufacturing Message Specification (MMS) protocol for device remote control.
References: ISO 9506-1:2003 standard (paid):
NDPI_PROTOCOL_IEEE_C37118
IEEE standard for Synchrophasor Data Transfer.
References: IEEE C37.118.1-2011 standard (paid):
NDPI_PROTOCOL_ETHERSBUS
Ether-S-Bus protocol for Saia-Burgess PLC communication.
References: Wireshark EtherSBus wiki:
NDPI_PROTOCOL_MONERO
Monero is a privacy-focused cryptocurrency.
(No references)
NDPI_PROTOCOL_DCERPC
DCE/RPC is a remote procedure call mechanism specification.
References: Wireshark DCE/RPC wiki:
NDPI_PROTOCOL_PROFINET_IO
PROFINET/IO is a field bus protocol based on connectionless DCE/RPC.
References: PROFINET specs:
NDPI_PROTOCOL_HISLIP
HiSLIP is for remote control of LAN-based test and measurement instruments.
References: HiSLIP specs:
NDPI_PROTOCOL_UFTP
Encrypted UDP based FTP with multicast.
References: UFTP protocol:
NDPI_PROTOCOL_OPENFLOW
OpenFlow is a network protocol associated with Software-Defined Networking.
References: OpenFlow specs:
NDPI_PROTOCOL_JSON_RPC
JSON-RPC is a remote procedure call protocol encoded in JSON.
References: JSON-RPC specs:
NDPI_PROTOCOL_WEBDAV
WebDAV extends HTTP to collaboratively edit and manage files on Web servers.
References: RFC4918:
Notes:
WebDAV is mostly transported over TLS (encrypted).
NDPI_PROTOCOL_APACHE_KAFKA
Apache Kafka is a distributed event streaming platform.
References: Kafka official site:, Kafka Github:
NDPI_PROTOCOL_NOMACHINE
NoMachine is a proprietary remote desktop software.
References: NoMachine official site:
NDPI_PROTOCOL_IEC62056
IEC 62056-4-7 DLMS/COSEM transport layer for IP.
References: IEC paid specs:
Notes:
Wireshark does not support this protocol; some old code available at: <https://github.com/bearxiong99/wireshark-dlms>, <https://github.com/matousp/dlms-analysis/tree/master>
NDPI_PROTOCOL_HL7
HL7 standards for clinical and administrative health data exchange.
References: HL7 official site:
NDPI_PROTOCOL_CEPH
Ceph is a scalable distributed storage system.
References: Ceph official site:
NDPI_PROTOCOL_GOOGLE_CHAT
Google Chat is Google’s instant messaging service, successor to Hangouts.
References: Google Chat official site:
NDPI_PROTOCOL_ROUGHTIME
Protocol for rough time sync with cryptographic server verification.
References: IETF Draft:
NDPI_PROTOCOL_PIA
Private Internet Access (PIA) VPN service.
References: PIA official site:
NDPI_PROTOCOL_KCP
KCP is a fast, reliable protocol supporting TCP-like streams with low latency.
References: KCP protocol spec:
NDPI_PROTOCOL_DOTA2
Dota 2 is a popular multiplayer MOBA game by Valve.
References: Dota 2 official site:
NDPI_PROTOCOL_MUMBLE
Mumble is a free, low-latency, high-quality voice chat app.
References: Mumble official site:
NDPI_PROTOCOL_YOJIMBO
Yojimbo is a secure client/server UDP-based protocol.
References: Protocol spec:
NDPI_PROTOCOL_ELECTRONICARTS
Electronic Arts is a major game publisher and producer.
References: EA official site:
Notes:
Much of the traffic relates to EA Origin game store.
NDPI_PROTOCOL_STOMP
STOMP is an interoperable protocol for asynchronous message passing.
References: STOMP specification:
NDPI_PROTOCOL_RADMIN
Radmin is remote access software for Windows.
References: Radmin official site:
NDPI_PROTOCOL_RAFT
Raft is a consensus protocol for distributed logs.
References: Raft C implementation:, Raft paper:
NDPI_PROTOCOL_GEARMAN
Gearman is a network job-queuing system.
References: Gearman official site:
NDPI_PROTOCOL_TENCENTGAMES
Protocol used by Tencent’s various games (mostly mobile).
References: Tencent Games official site:
NDPI_PROTOCOL_GAIJIN
Gaijin Entertainment games protocols.
References: Gaijin official site:
NDPI_PROTOCOL_C1222
ANSI C12.22 protocol for communication with electric meters.
References: NEMA standard (paid):
NDPI_PROTOCOL_HUAWEI
Generic traffic related to Huawei.
References: Huawei official site:
NDPI_PROTOCOL_HUAWEI_CLOUD
Huawei Mobile Cloud services.
References: Huawei Cloud:
NDPI_PROTOCOL_DLEP
Dynamic Link Exchange Protocol (DLEP) supports radio-aware routing.
References: RFC8175:
NDPI_PROTOCOL_BFD
Bidirectional Forwarding Detection detects faults between routers or switches.
References: RFC5880:
NDPI_PROTOCOL_NETEASE_GAMES
Traffic from NetEase games.
References: NetEase Games official site:
NDPI_PROTOCOL_PATHOFEXILE
Path of Exile is a free online action RPG.
References: Path of Exile official site:
NDPI_PROTOCOL_GOOGLE_CALL
Google audio/video call applications (e.g., Google Meet).
References: Google Meet official site:
Notes:
nDPI uses different IDs for generic and realtime traffic (e.g., NDPI_PROTOCOL_MEET vs NDPI_PROTOCOL_GOOGLE_CALL).
NDPI_PROTOCOL_PFCP
PFCP protocol communicates between control and user planes in 4G/5G.
References: PFCP specs:
NDPI_PROTOCOL_FLUTE
File Delivery over Unidirectional Transport protocol.
References: RFC6726:
NDPI_PROTOCOL_LOLWILDRIFT
League of Legends: Wild Rift mobile MOBA game.
References: Wild Rift official site:
NDPI_PROTOCOL_TESO
The Elder Scrolls Online MMORPG.
References: ESO official site:
NDPI_PROTOCOL_LDP
Label Distribution Protocol establishes label paths in MPLS.
References: RFC5036:
NDPI_PROTOCOL_KNXNET_IP
KNXnet/IP extends KNX home/building automation over IP.
References: Standard docs (paid):
NDPI_PROTOCOL_BLUESKY
Bluesky decentralized microblogging platform.
References: Bluesky official site:
NDPI_PROTOCOL_MASTODON
Mastodon is open-source software for self-hosted social networking.
References: Mastodon official site:
NDPI_PROTOCOL_THREADS
Threads is a social media service by Meta.
References: Threads official site:
NDPI_PROTOCOL_VIBER_VOIP
Viber audio/video call protocol.
References: Viber Wikipedia:
NDPI_PROTOCOL_ZUG
ZUG protocol is part of Casper 2.0 blockchain consensus.
References: Casper Labs site: <https://casperlabs.io>, Casper blog:
NDPI_PROTOCOL_JRMI
Java Remote Method Invocation protocol.
References: Oracle JRMI docs:
NDPI_PROTOCOL_RIPE_ATLAS
RIPE Atlas probe protocol for Internet measurement.
References: RIPE Atlas site:, RIPE Atlas docs:
NDPI_PROTOCOL_HLS
HTTP Live Streaming (HLS) segments media for adaptive streaming.
References: RFC8216:
NDPI_PROTOCOL_CLICKHOUSE
ClickHouse is a columnar database for OLAP.
References: ClickHouse official site:
NDPI_PROTOCOL_NANO
Nano is a fast, fee-less, eco-friendly cryptocurrency.
References: Nano official site:
NDPI_PROTOCOL_OPENWIRE
OpenWire is Apache ActiveMQ’s wire protocol.
References: OpenWire docs:
NDPI_PROTOCOL_CNP_IP
Encapsulation of LonWorks control network over IP.
References: ISO/IEC 14908-4:2012 standard (paid):
NDPI_PROTOCOL_ATG
Automatic Tank Gauge system data transfer protocol.
References: ATG protocol specs:
NDPI_PROTOCOL_TRDP
Train Real Time Data Protocol standardized by IEC.
References: TRDP specs:
NDPI_PROTOCOL_LUSTRE
Lustre is a parallel distributed file system for supercomputing.
References: Lustre official site:
NDPI_PROTOCOL_NORDVPN
NordVPN is a VPN service.
References: NordVPN official site:
NDPI_PROTOCOL_SURFSHARK
Surfshark VPN service.
References: Surfshark official site:
NDPI_PROTOCOL_CACTUSVPN
CactusVPN service.
References: CactusVPN official site:
NDPI_PROTOCOL_WINDSCRIBE
Windscribe VPN service.
References: Windscribe official site:
NDPI_PROTOCOL_SONOS
Sonos provides high-quality wireless sound systems.
References: Sonos official site:
NDPI_PROTOCOL_DINGTALK
DingTalk is a collaboration platform by Alibaba.
References: DingTalk official site:
NDPI_PROTOCOL_PALTALK
Paltalk is a video chat and messaging app.
References: Paltalk official site:
NDPI_PROTOCOL_SHEIN
Shein is a fast fashion retailer.
References: Shein official site:
NDPI_PROTOCOL_TEMU
Temu is an online marketplace by PDD Holdings.
References: Temu official site:
NDPI_PROTOCOL_TAOBAO
Taobao is a Chinese online shopping platform.
References: Taobao official site:
NDPI_PROTOCOL_MIKROTIK
MikroTik Neighbor Discovery Protocol (MNDP) finds compatible neighbor routers/switches.
References: MikroTik official docs:
NDPI_PROTOCOL_DICOM
DICOM is a standard for medical image storage and transmission.
References: DICOM Wikipedia article:
NDPI_PROTOCOL_PARAMOUNTPLUS
Paramount+ is a subscription video streaming service.
References: Paramount+ official site:
NDPI_PROTOCOL_YANDEX_ALICE
Yandex Alice voice assistant, similar to Alexa.
References: Yandex Alice protocol:
NDPI_PROTOCOL_VIVOX
Vivox provides real-time voice and text chat for games.
References: Vivox official site:
NDPI_PROTOCOL_DIGITALOCEAN
DigitalOcean cloud service provider.
References: DigitalOcean official site:
NDPI_PROTOCOL_RUTUBE
RUTUBE is a Russian video streaming platform.
References: Rutube official site:
NDPI_PROTOCOL_LAGOFAST
LagoFast Game Booster improves gaming performance by reducing lag.
References: LagoFast official site:
NDPI_PROTOCOL_GEARUP_BOOSTER
GearUp Booster reduces game lag.
References: GearUp Booster official site:
NDPI_PROTOCOL_RUMBLE
Rumble is a video sharing and streaming platform known for hosting live streams and video content.
References: Rumble official site
NDPI_PROTOCOL_UBIQUITY
Traffic from Ubiquity sites and services.
References: Ubiquity official site:
NDPI_PROTOCOL_MSDO
Microsoft Delivery Optimization distributes Windows updates and content.
References: Microsoft DO docs:
NDPI_PROTOCOL_ROCKSTAR_GAMES
Traffic related to Rockstar Games services and launcher.
References: Rockstar Games official site:
NDPI_PROTOCOL_KICK
Kick.com live streaming platform.
References: Kick official site:
NDPI_PROTOCOL_HAMACHI
LogMeIn Hamachi VPN service (primarily used for gaming and remote access). Unlike anonymity VPNs, Hamachi creates virtual LAN networks between devices.
References: LogMeIn Hamachi official site:
NDPI_PROTOCOL_GLBP
Gateway Load Balancing Protocol (GLBP) - Cisco proprietary protocol that provides first-hop redundancy and load balancing for IPv4 and IPv6 networks.
References: Cisco GLBP Configuration Guide
NDPI_PROTOCOL_EASYWEATHER
The EasyWeather protocol is a proprietary UDP based protocool used by some weather stations to announce and export weather data over a network.