nDPI is a ntop-maintained superset of the popular OpenDPI library.
Released under the LGPL license, its goal is to extend the original library
by adding new protocols that are otherwise available only on the paid version
of OpenDPI.
Furthermore, we have modified nDPI to be more suitable for traffic monitoring
applications, by disabling specific features that slow down the DPI engine
while being them un-necessary for network traffic monitoring.
nDPI is used in ntop tools and various third party applications for adding
application-layer detection of protocols, regardless of the port being used.
This means that it is possible to both detect known protocols on non-standard
ports (e.g. detect http on ports other than 80), and also the opposite
(e.g. detect Skype traffic on port 80).
This is because nowadays the concept of port=application no longer holds. | 
libjson-c 
libpcap