DOKK / manpages / debian 12 / libndpi-bin / ndpiReader.1.en
NDPIREADER(1) General Commands Manual NDPIREADER(1)

ndpiReader - example tool for libndpi

ndpiReader -i file.pcap|device [options]

The ndpiReader command is an example tool that uses libndpi. ndpiReader is able to read from a pcap file or catpure traffic from a network interface and process it with libndpi. It implements only some basic features just to show what can be done with libndpi.

Specify a pcap file/playlist to read packets from or a device for live capture (comma-separated list).
Specify a BPF filter for filtering selected traffic.
Maximum capture duration in seconds (live traffic capture only).
Specify a protocol file (eg. protos.txt).
Number of detection loops (test only).
Number of threads. Default: number of interfaces in -i. Ignored with pcap files.
Specify a file to write the content of packets in .json format.
Thread affinity mask (one core id per thread).
Disable protocol guess and use only DPI.
Dissect GTP tunnels.
Display a usage message.
Verbose 'unknown protocol' packet print. 1=verbose, 2=very verbose.
Verbose libndpi trace log print. 1=trace, 2=debug.
2014-08-15