We are proud to announce the release of nDPI 6.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release brings an important licensing update, a brand-new detection logic for Slow DoS attacks, more flexible and reliable traffic fingerprints, and zero-overhead runtime observability via USDT tracepoints — on top of new protocols and dozens of improvements and fixes.
Updated Licensing Terms
With nDPI 6.0 we have updated the licensing terms of the project, introducing a distinction between for-profit and not-for-profit usage of some components. Full details are available in our dedicated post: Announcing nDPI Dual License Change.
Detecting Slow DoS Attacks
Slow DoS attacks — such as Slowloris, Slow POST and Slow GET — don’t rely on volumetric floods. Instead, they exhaust a server’s pool of available connections by opening many requests and completing them as slowly as possible, denying service to legitimate users with very little bandwidth. nDPI 6.0 adds detection of Slow DoS, SlowDoS 3-Way-Handshake and Slowloris attacks, exposed as a new flow risk that any application (for example, ntopng, nProbe and nEdge) can use to detect and possibly block this class of attacks. More details are available in Slow DoS Detection and Prevention.
More Flexible and Reliable Fingerprints
Traffic fingerprints such as JA4 are extremely useful for spotting malware and correlating traffic patterns, but they are not immune to false positives: TLS extensions such as session resumption via Pre-Shared Keys can make JA4 far less unique than expected. nDPI 6.0 makes fingerprint computation more flexible, allowing “ephemeral” TLS extensions to be excluded from JA4 computation so that fingerprints remain meaningful even in the presence of these edge cases. See Is JA4 Now Obsolete? for the full story.
Zero-Overhead Runtime Observability with USDT
Understanding what nDPI is doing while it is dissecting live traffic has historically meant adding debug prints or attaching a debugger. nDPI 6.0 introduces USDT (Userland Statically Defined Tracing) probes, static tracepoints that can be observed with tools such as bpftrace or perf with effectively zero overhead when not in use. This gives developers and integrators an easy, production-safe way to look inside nDPI’s classification pipeline. Read more in Observing nDPI From the Inside: Introducing USDT Tracepoints.
New Supported Protocols and Services
This release extends protocol coverage with, among others:
- Meshtastic, libp2p, YGGDRASIL and Nebula mesh/overlay networking protocols
- Generic JSON and MsgPack classification
- Sub-classification for several GitHub services (Copilot, Packages, Actions)
- Sub-classification for Proton services (Mail, Pass, Drive, Calendar, Docs, Wallet, Lumo, Meet)
- Detection of Discord audio/video calls
- New content-control categories: Children, Violence, Drugs, Weapons
The full, up-to-date protocol list is available in the protocol documentation.
nDPI 6.0 is available now, and the complete, unabridged changelog — including all the protocol dissector work, API changes, and fixes that came before this release — is available on GitHub.
We would like to thank all the contributors, old and new, who helped shape this release with code, bug reports, and testing. As always, we recommend upgrading to the latest release to benefit from all the features and fixes packed into this release.
Enjoy!