### Python Usage Example

Source: https://github.com/ntop/ndpi/blob/dev/python/DEV_GUIDE.md

Example of how to call the newly added API from Python.

```python
from ndpi import lib, ffi

des = ffi.new("struct ndpi_des_struct *")
alpha = 0.9
beta = 0.5
lib.ndpi_des_init(des, alpha, beta, 0.05)
```

--------------------------------

### Monitoring Configuration Example

Source: https://github.com/ntop/ndpi/blob/dev/tests/cfgs/monitoring/config.txt

Example of configuration parameters for monitoring and flow limits.

```shell
--cfg=packets_limit_per_flow,64 --cfg=all,monitoring,1 --cfg=stun,max_packets_extra_dissection,32 -U 0 -T 0
```

--------------------------------

### Example Protocol Definition File

Source: https://github.com/ntop/ndpi/blob/dev/doc/FAQ.md

An example file demonstrating how to define new protocols for nDPI.

```text
example/protos.txt
```

--------------------------------

### Example with Skype capture file

Source: https://github.com/ntop/ndpi/blob/dev/python/README.md

How to run the example script with a Skype capture file.

```bash
python3 ndpi_example.py -u ../tests/pcap/skype.pcap
```

--------------------------------

### perf Example

Source: https://github.com/ntop/ndpi/blob/dev/doc/usdt.md

Example of using perf to record and report probe hits.

```bash
perf probe -x ./src/lib/.libs/libndpi.so sdt_ndpi:flow_classified
perf record -e sdt_ndpi:flow_classified -p $(pidof ndpiReader) -- sleep 10
perf report
```

--------------------------------

### Protocol Definition Examples

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of how to define protocols using TCP/UDP ports and protocol names.

```config
tcp:81,tcp:8181@HTTP
udp:5062@SIP
tcp:860,udp:860,tcp:3260,udp:3260@iSCSI
tcp:9200@Elasticsearch
tcp:5601@Kibana
tcp:65535@TestProto
```

--------------------------------

### Setting DYLD_LIBRARY_PATH and running ndpiReader

Source: https://github.com/ntop/ndpi/blob/dev/src/lib/plugins/README.md

Example of setting the DYLD_LIBRARY_PATH environment variable and then running the ndpiReader example with specified plugins and input file.

```bash
setenv DYLD_LIBRARY_PATH ./src/lib/
./example/ndpiReader --plugins-dir src/lib/plugins/ -i tests/pcap/plugin.pcapng
```

--------------------------------

### Custom Protocol ID Examples

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of defining custom protocols with specific IDs.

```config
ip:3.3.3.3:443@CustomProtocolA
ip:3.3.3.3:444@CustomProtocolB
ip:3.3.3.3:446@CustomProtocolC=800
```

--------------------------------

### hostname_set Examples

Source: https://github.com/ntop/ndpi/blob/dev/doc/usdt.md

Examples of using bpftrace with the ndpi:hostname_set USDT probe for hostname monitoring.

```bash
bpftrace -e 'usdt:/path/to/ndpiReader:ndpi:hostname_set {
  $flow = (struct ndpi_flow_struct *)arg1;
  printf("%s (master=%d app=%d)\n",
         str(arg0),
         $flow->detected_protocol_stack[0],
         $flow->detected_protocol_stack[1]);
}'
```

```bash
bpftrace -e 'usdt::ndpi:hostname_set {
  @top[str(arg0)] = count();
}'
```

```bash
bpftrace -e 'usdt::ndpi:hostname_set /strcontains(str(arg0), "google.com")/ {
  @google[str(arg0)] = count();
}'
```

```bash
bpftrace -e 'usdt:/path/to/ndpiReader:ndpi:hostname_set {
  $flow = (struct ndpi_flow_struct *)arg1;
  if ($flow->detected_protocol_stack[0] == 5) {
    @dns[str(arg0)] = count();
  }
}'
```

```bash
bpftrace -e 'usdt:/path/to/ndpiReader:ndpi:hostname_set {
  $flow = (struct ndpi_flow_struct *)arg1;
  if ($flow->detected_protocol_stack[0] == 91) {
    printf("TLS SNI: %s\n", str(arg0));
  }
}'
```

```bash
bpftrace -e 'usdt:/path/to/ndpiReader:ndpi:hostname_set {
  $flow = (struct ndpi_flow_struct *)arg1;
  @host_app[str(arg0), $flow->detected_protocol_stack[1]] = count();
}'
```

```bash
bpftrace -e 'usdt::ndpi:hostname_set {
  @ = count();
} interval:s:1 { print(@); clear(@); }'
```

```bash
bpftrace -e 'usdt:/path/to/ndpiReader:ndpi:hostname_set {
  $flow = (struct ndpi_flow_struct *)arg1;
  if ($flow->detected_protocol_stack[0] == 5) {
    @unique_dns = count();
  }
} interval:s:10 {
  printf("Unique DNS hostnames in last 10s: %d\n", @unique_dns);
  clear(@unique_dns);
}'
```

--------------------------------

### nDPI Configuration Parameters

Source: https://github.com/ntop/ndpi/blob/dev/example/config.txt

This snippet shows basic examples of setting nDPI configuration parameters in a file format. It includes setting packet limits per flow, DPI aggressiveness, TLS metadata fingerprinting, and LRU TTL for bittorrent.

```config
packets_limit_per_flow,32
ookla,dpi.aggressiveness,0x1
tls,metadata.sha1_fingerprint,1
lru.bittorrent.ttl,300
```

--------------------------------

### Install Development Headers

Source: https://github.com/ntop/ndpi/blob/dev/doc/usdt.md

Installs the necessary development headers for USDT probes on Debian/Ubuntu and RHEL/CentOS/Fedora systems.

```bash
# Debian/Ubuntu
sudo apt-get install systemtap-sdt-dev dwarves

# RHEL/CentOS/Fedora
sudo dnf install systemtap-sdt-devel dwarves
```

--------------------------------

### Install dwarves and configure nDPI

Source: https://github.com/ntop/ndpi/blob/dev/doc/usdt.md

Installs the 'dwarves' package and configures nDPI with USDT probes and debug build enabled.

```bash
sudo dnf install dwarves

./configure --enable-usdt-probes --enable-debug-build
make
```

--------------------------------

### IPv6 Subprotocol Definition Examples

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of defining subprotocols using IPv6 addresses and ports.

```config
ipv6:[3ffe:507:0:1:200:86ff:fe05:80da]@CustomProtocolD=1024
ipv6:[247f:855b:5e16:3caf::]/64:100@CustomProtocolE=2048
ipv6:[247f:855b:5e16:3caf::]/64@CustomProtocolF=2049
ipv6:[fe80::76ac:b9ff:fe6c:c124]:12717@CustomProtocolG=2050
ipv6:[fe80::76ac:b9ff:fe6c:c124]:12718@CustomProtocolH=65535
ipv6:[fe80::76ac:b9ff:fe6c:c124]:12719@CustomProtocolI=65534
```

--------------------------------

### FreeBSD prerequisites

Source: https://github.com/ntop/ndpi/blob/dev/README.md

Command to install nDPI compilation prerequisites on FreeBSD.

```bash
sudo pkg install gcc git gettext flex bison libtool autoconf automake devel/pkgconf gmake libpcap json-c pcre2 libmaxminddb rrdtool
```

--------------------------------

### Enable monitoring for STUN

Source: https://github.com/ntop/ndpi/blob/dev/doc/monitoring.md

Example of how to enable monitoring specifically for STUN protocol.

```bash
--cfg=stun,monitoring,1
```

--------------------------------

### Debian/Ubuntu prerequisites

Source: https://github.com/ntop/ndpi/blob/dev/README.md

Command to install nDPI compilation prerequisites on Debian/Ubuntu.

```bash
sudo apt-get install build-essential git gettext flex bison libtool autoconf automake pkg-config libpcap-dev libjson-c-dev libnuma-dev libpcre2-dev libmaxminddb-dev librrd-dev
```

--------------------------------

### Install required Python libraries

Source: https://github.com/ntop/ndpi/blob/dev/tests/dga/README.md

Commands to install pandas and scikit-learn for data manipulation and model selection.

```shell
python3 -m pip install pandas
python3 -m pip install sklearn
```

--------------------------------

### MacOS prerequisites

Source: https://github.com/ntop/ndpi/blob/dev/README.md

Command to install nDPI compilation prerequisites on MacOS.

```bash
brew install coreutils gcc git gettext flex bison libtool autoconf automake pkg-config libpcap json-c pcre2 libmaxminddb rrdtool
```

--------------------------------

### STUN Configuration

Source: https://github.com/ntop/ndpi/blob/dev/tests/cfgs/stun_only_peer_address_enabled/config.txt

This configuration enables STUN and related metadata attributes for peer address discovery.

```bash
--cfg=stun,metadata.attribute.mapped_address,0 --cfg=stun,metadata.attribute.relayed_address,0 --cfg=stun,metadata.attribute.response_origin,0 --cfg=stun,metadata.attribute.other_address,0
```

--------------------------------

### Install ndpi package

Source: https://github.com/ntop/ndpi/blob/dev/python/README.md

Steps to install the ndpi Python package, including upgrading pip and installing development requirements.

```bash
cd python
# IMPORTANT: nDPI Bindings requires Python version >= 3.7
python3 -m pip install --upgrade pip
python3 -m pip install -r dev_requirements.txt
python3 -m pip install .
```

--------------------------------

### nBPF Filter Example

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Example of an nBPF filter for network traffic.

```config
nbpf:"host 192.168.1.1 and port 80"@HomeRouter
```

--------------------------------

### Complex Library Initialization with Global Context

Source: https://github.com/ntop/ndpi/blob/dev/doc/library_initialization.md

An example showing initialization with a global context and a shared Oookla LRU cache, handling multiple local contexts.

```c
struct ndpi_global_context *g_ctx;
struct ndpi_detection_module_struct *ndpi_structs[num_local_contexts];
ndpi_cfg_error rc;
int i, ret;

g_ctx = ndpi_global_init();
if(!g_ctx) {
        ERROR;
}

for(i = 0; i < num_local_contexts; i++) {
        ndpi_structs[i] = ndpi_init_detection_module(g_ctx);
        if(!ndpi_struct[i]) {
                ERROR;
        }

        rc = ndpi_set_config(ndpi_structs[i], NULL, "lru.ookla.scope", "1");
        if(rc != NDPI_CFG_OK) {
                ERROR;
        }

        ret = ndpi_finalize_initialization(ndpi_structs[i]);
        if(ret != 0) {
                ERROR;
        }
}

/* Initialization done */

/* Cleanup */

for(i = 0; i < num_local_contexts; i++) {
        ndpi_exit_detection_module(ndpi_structs[i]);
}

ndpi_global_deinit(g_ctx);
```

--------------------------------

### Simple Library Initialization

Source: https://github.com/ntop/ndpi/blob/dev/doc/library_initialization.md

A basic example demonstrating the initialization, configuration, and finalization of the nDPI detection module.

```c
struct ndpi_detection_module_struct *ndpi_struct;
ndpi_cfg_error rc;
int ret;

ndpi_struct = ndpi_init_detection_module(NULL);
if(!ndpi_struct) {
        ERROR;
}

/* Configuration */

rc = ndpi_set_config(ndpi_struct, "tls", "certificate_expiration_threshold", "10");
if(rc != NDPI_CFG_OK) {
        ERROR;
}

/* Finalization */
ret = ndpi_finalize_initialization(ndpi_struct);
if(ret != 0) {
        ERROR;
}


/* Initialization done, now you can feed packets to the library */



/* Cleanup */

ndpi_exit_detection_module(ndpi_struct);
```

--------------------------------

### Subprotocol Definition Examples (Host-based)

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of defining subprotocols based on hostnames.

```config
host:"disneyplus.com",host:"cdn.registerdisney.go.com",host:"disney-portal.my.onetrust.com",host:"disney-plus.net",host:"disney-plus.net"@DisneyPlus
host:"*.lvlt.dash.us.aiv-cdn.net.c.footprint.net"@AmazonVideo
host:"api-global.netflix.com"@Netflix
```

--------------------------------

### Library Initialization with Custom Memory Allocator

Source: https://github.com/ntop/ndpi/blob/dev/doc/library_initialization.md

An example demonstrating how to set custom memory allocation functions before initializing the nDPI library.

```c
struct ndpi_detection_module_struct *ndpi_struct;
ndpi_cfg_error rc;
int ret;

/* If you want to set a custom allocator for all memory allocations performed by
   the library, you must call `ndpi_set_memory_alloction_functions() ONCE,
   BEFORE ANY nDPI functions */

ndpi_set_memory_alloction_functions(malloc_wrapper,
                                    free_wrapper,
                                    calloc_wrapper,
                                    realloc_wrapper,
                                    aligned_malloc_wrapper,
                                    aligned_free_wrapper,
                                    flow_malloc_wrapper,
                                    flow_free_wrapper);

ndpi_struct = ndpi_init_detection_module(NULL);
if(!ndpi_struct) {
        ERROR;
}

/* Continue as the previous examples */
```

--------------------------------

### Install Dependencies

Source: https://github.com/ntop/ndpi/blob/dev/dga/README.md

Installs the necessary Python dependencies for the DGA detection scripts.

```bash
pip install -r requirements.txt
```

--------------------------------

### bpftrace predicate example

Source: https://github.com/ntop/ndpi/blob/dev/doc/usdt.md

Example of using a bpftrace predicate to filter on scalar arguments.

```bash
bpftrace -e 'usdt::ndpi:flow_classified /arg0 == 91/ { ... }'
```

--------------------------------

### Build Documentation

Source: https://github.com/ntop/ndpi/blob/dev/README.md

Steps to build nDPI documentation.

```bash
pip install --upgrade pip
pip install -r doc/requirements.txt
make doc
```

--------------------------------

### Enable monitoring for any protocol (currently STUN and S7COMM)

Source: https://github.com/ntop/ndpi/blob/dev/doc/monitoring.md

Example of how to enable monitoring for any protocol, with current support for STUN and S7COMM.

```bash
--cfg=any,monitoring,1
```

--------------------------------

### Symbolic IP Address Examples

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of using symbolic IP addresses for protocol definitions.

```config
ip:www.ntop.org@ntop
ipv6:www.ntop.org@ntop
```

--------------------------------

### ndpi_example.py Usage

Source: https://github.com/ntop/ndpi/blob/dev/python/README.md

Command-line arguments for the ndpi_example.py script.

```bash
Using nDPI 4.3.0-3532-8dd70b70
usage: ndpi_example.py [-h] [-u] input

positional arguments:
  input                 input pcap file path

optional arguments:
  -h, --help            show this help message and exit
  -u, --include-unknowns
```

--------------------------------

### Subprotocol Definition Examples (IP-based)

Source: https://github.com/ntop/ndpi/blob/dev/fuzz/corpus/fuzz_filecfg_protocols/protos.txt

Examples of defining subprotocols using IP addresses and ports.

```config
ip:213.75.170.11/32:443@CustomProtocol
ip:8.248.73.247:443@AmazonPrime
ip:54.80.47.130@AmazonPrime
```