See every application flowing through VPP.
FlowLens is an open-source DPI plugin suite for FD.io VPP. It classifies 300+ applications in real time — inside the data plane, at line rate, with zero hardware changes.
What FlowLens does
Classifies traffic
Identifies YouTube, Zoom, Netflix, BitTorrent, TLS clients, DNS, and 300+ more — using nDPI, the same engine behind ntopng and Suricata. No decryption. No separate box.
Enforces policy
Drop, rate-limit, or DSCP-mark traffic by application class. Policy rules installed at runtime via CLI or binary API. No restarts.
Exports telemetry
IPFIX flow records enriched with application name and TLS SNI. Prometheus metrics from VPP's stats segment. Grafana dashboard included.
Steers traffic
Application-aware WAN path selection for SD-WAN CPE. BGP FlowSpec enforcement for carrier-grade DDoS reaction at the upstream PE.
Inside the data plane, not next to it
Commercial DPI appliances sit next to your router on a mirror port. They cost $80K–$300K per chassis, require dedicated hardware, and add an extra hop to your management plane.
FlowLens runs inside VPP itself, as a feature arc node on ip4-unicast. Classification happens in nanoseconds, on the same CPU core as your forwarding path. No mirror port. No extra server. No per-Gbps license.
$200K
+ ndpi-observe
Live application visibility in Grafana
The included Grafana dashboard shows real-time application traffic — throughput, flow rates, and engine metrics — scraped from VPP's stats segment via Prometheus.
Top apps by throughput
Current throughput ranking
Active flows count
Real CLI output
From a lab replay of TLS ClientHello flows. Classification happens in the first 3 packets — nDPI reads the SNI before the handshake completes.
Composable plugin stack
Each plugin registers on the same VPP feature arc. Enable only what you need — the data plane cost is proportional to the plugins you activate.
vpp-ndpi and vpp-exporter are open-source (Apache 2.0). Other plugins are available as PacketFlow commercial products.
Performance
| Metric | Value | Condition |
|---|---|---|
| Overhead per packet (classifying) | ~150 ns | 10G link, 64B packets |
| Overhead per packet (cached flow) | ~8 ns | bihash lookup only |
| Flow table lookup | O(1) | per-worker, no locks |
| Max flows per worker | 1M | configurable |
| Classification convergence | 3–8 pkts | 95th pct, TCP/TLS |
| Protocols classified | 300+ | nDPI 4.2.0 |
Built on proven open-source foundations
FD.io VPP
Packet processing framework — 100+ Gbps forwarding, used by Cisco, Ericsson, Nokia, and scores of network vendors. Apache 2.0.
ntop nDPI
Deep packet inspection — 300+ protocols, used by ntopng, Suricata, Zeek, pfSense, and Arkime. LGPL-3.0.
Prometheus + Grafana
Industry-standard metrics and dashboards. Zero-code integration via VPP's stats segment shared memory. Apache 2.0.