nDPI is an open-source deep packet inspection (DPI) library written in C, developed by ntop. It identifies and classifies application-layer protocols by inspecting packet payloads, using a combination of signature matching, heuristics, and machine learning. The library provides a clean C API for embedding into network monitoring and security tools, and includes example applications (ndpiReader), Python bindings, Wireshark integration, and extensive fuzz testing. The core consists of hundreds of protocol dissectors in src/lib/protocols/, a statistical/ML analytics module (ndpi_analyze.c), a multi-format serializer (ndpi_serializer.c), and configurable risk and fingerprint detection. Despite some technical drift in vendored dependencies and hardcoded heuristics, the codebase is actively maintained, well-structured, and demonstrates high craftsmanship in its dissector pattern and reusable utility modules.