libprotoident is described as 'Libprotoident is a library that performs application layer protocol identification for flows. Unlike many techniques that require capturing the entire packet payload, only the first four bytes of payload sent in each direction, the size of the first payload-bearing packet in' and is an app. There are 2 alternatives to libprotoident for a variety of platforms, including Linux, BSD, OPNsense, OpenWrt and pfSense apps. The best libprotoident alternative is nDPI, which is both free and Open Source.
nDPI is a ntop-maintained superset of the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available only on the paid version of OpenDPI.
The Netify Agent uses a modified version of the open-source nDPI deep packet inspection library.
