macOS
Homebrewverified · 100%
brew install libprotoidentlocal Homebrew formula metadata
brew / rank 13473
Install libprotoident with Homebrew, Nix
Performs application layer protocol identification for flows. Version 2.0.15-2 via Homebrew; verified from local package data. Also installable with nix: nix profile install nixpkgs#libprotoident.
install
Additional install commands
Linux
Nixverified · 92%
nix profile install nixpkgs#libprotoidentnixpkgs package indexes · pkgs/by-name/li/libprotoident/package.nix · source: api.github.com
overview
Package summary
Performs application layer protocol identification for flows
Project links
Commands and aliases
- lpi_arff
- lpi_find_unknown
- lpi_protoident
history
Project history and usage
libprotoident is a lightweight network-traffic classification library from the University of Waikato WAND research group. Its niche is application protocol identification using only a small amount of payload from each direction of a flow.
Project history
The source headers credit the University of Waikato WAND research group and carry copyright years beginning in 2011. The public GitHub repository was created on 2014-03-20, and the README identifies Shane Alcock as author with additional contributors.
The project frames itself as a deliberately limited form of deep packet inspection: it uses the first four bytes of application payload sent in each direction, plus flow metadata, instead of requiring complete packet payload capture.
Adoption history
libprotoident's adoption is concentrated in packet-trace and traffic-analysis circles rather than broad application development. Its README ties it to `libtrace` and `libflowmanager`, and its bundled tools operate on libtrace trace URIs, including live network-interface sources.
How it is used
The package provides a library API plus command-line tools: `lpi_protoident` identifies flows, `lpi_find_unknown` reports unidentified flows to aid new rule development, and `lpi_arff` emits ARFF output for Weka workflows.
Why package nerds care
For package maintainers, libprotoident is interesting because it sits between academic network measurement and practical CLI tooling. It pulls in the LibtraceTeam stack and gives users a packaged way to run protocol classification experiments without building the WAND tools by hand.
Timeline
- 2011: Source headers identify University of Waikato WAND work beginning in this period.
- 2014-03-20: The public GitHub repository was created.
- 2017-06-28: Version 2.0.11 added many protocols and moved tools to parallel libtrace and libflowmanager 3 compatibility.
- 2020-11-12: Version 2.0.15 added protocols, an industrial-control-systems category, and category lookup APIs.
Related projects
- libtrace, libflowmanager, Weka, packet-trace analysis tools, and other traffic-classification projects such as nDPI and Zeek occupy adjacent space.
Sources
- https://api.github.com/repos/LibtraceTeam/libprotoident
- https://api.github.com/repos/LibtraceTeam/libprotoident/releases
- https://github.com/LibtraceTeam/libprotoident
- https://raw.githubusercontent.com/LibtraceTeam/libprotoident/master/README
- https://raw.githubusercontent.com/LibtraceTeam/libprotoident/master/lib/libprotoident.h
security posture
Risk level: green
library-like package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- library-like package without higher-risk signals
Signals
- metadata:library-like
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
lpi_arff | executable | indexed executable | Discovered from the local executable index. |
lpi_find_unknown | executable | indexed executable | Discovered from the local executable index. |
lpi_protoident | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version2.0.15-2
manager updated
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:libprotoident |
|---|---|
| Version | 2.0.15-2 |
| Package manager | Homebrew |
| Homepage | https://github.com/LibtraceTeam/libprotoident |
| Repository | https://github.com/LibtraceTeam/libprotoident |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
libprotoident
nix profile install nixpkgs#libprotoident- normalized package name match
- Matched by: Libprotoident
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation