NDPIREADER(1)

📦 version 4.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ NDPIREADER(1) ✨

okay so bestie, welcome to the manual page for ndpiReader — it lives in section 1 of the General Commands Manual, and it's basically the little demo bestie that ships with libndpi. 💖

🌸 NAME 🌸

ndpiReader — the example tool for libndpi, no cap 🫶

🎀 SYNOPSIS 🎀

ndpiReader -i file.pcap|device [options]

🦋 DESCRIPTION 🦋

So like, ndpiReader is an example tool that uses libndpi. Periodt.

It can read from a pcap file or capture traffic straight off a network interface, and then it runs all of that through libndpi to process it. ✨

And yes, she only implements some basic features — literally just enough to show you what can be done with libndpi. It's giving demo energy, not production-app energy, and honestly? That's the point. 💅

💅 OPTIONS 💅

  • -i file.pcap|device — tell her where the packets are coming from. Either a pcap file / playlist to read packets out of, or a device for live capture. And yes, you can hand her a comma-separated list, she can multitask. 👑
  • -f bpf_filter — drop a BPF filter in here so she only deals with the traffic you actually care about. Filtered, focused, iconic. 🎯
  • -s duration — max capture duration, measured in seconds. Heads up: this one's for live traffic capture only. ⏳
  • -p file.protos — point her at a protocol file (like, for example, protos.txt). 📄
  • -l num_loops — how many detection loops to run. Test only, bestie — this is a lab thing, not a vibe. 🧪
  • -n num_threads — number of threads. Default is the number of interfaces in -i. And just so you know, she ignores this entirely when you're working with pcap files. 🙈
  • -j file.json — name a file and she'll write the content of the packets out in .json format. Structured, cute, shareable. 🍓
  • -g id:id... — thread affinity mask, aka one core id per thread. Pin those babies down. 📌
  • -d — disables protocol guessing and uses only DPI. No guessing games, just vibes and deep packet inspection. 🔍
  • -t — dissect GTP tunnels. Dig in there. 🕳️
  • -h — display a usage message. Your friendly little help me out moment. 🫶
  • -v 1|2 — verbose printing of unknown protocol packets. 1 = verbose, 2 = very verbose. She will yap. 😭
  • -V 1|2 — verbose libndpi trace log print. 1 = trace, 2 = debug. Turn this on when you need to see everything she's thinking. 🔥

and that's the whole page, bestie!! 🌈 This one came from the General Commands Manual source, dated 2014-08-15 — so yeah, she's been serving libndpi realness since way back. mwah 💋 💖✨🦋

📦 where this page comes from