Quickstart

Run VPP with application classification in 5 minutes using Docker.

Get from zero to show ndpi applications output in under 5 minutes. Everything runs in containers — no VPP installation required.

Prerequisites

  • Docker 24+ (or Docker Engine 23+ with Compose v2)
  • 4 GB RAM, 10 GB free disk

Step 1 — Get the source

Contact PacketFlow to receive the FlowLens source package, then:

cd vpp-ndpi

Step 2 — Build the CI image

# Pull the pre-built base image (VPP 25.06 + libndpi already compiled)
docker pull ghcr.io/packetflow/vpp-ndpi-dev:base

# Build the plugin
docker build -f Dockerfile.ci \
  --build-arg BASE_IMAGE=ghcr.io/packetflow/vpp-ndpi-dev:base \
  -t vpp-ndpi-ci .

Build time: ~2 minutes on a 4-core machine.

Step 3 — Run the classification lab

docker run --rm --privileged vpp-ndpi-ci \
  bash labs/sw/lab-apps.sh

This starts a VPP instance, replays TLS ClientHello packets for 12 well-known applications (YouTube, Netflix, Zoom, Teams, Spotify…), and prints the classification results.

Expected output

Application         Flows  Packets       Bytes
YouTube                 1       24      18496
NetFlix                 1       24      18496
Zoom                    1       24      18554
Microsoft               1       24      18577
Github                  1       24      18421
...

Classification happens in the first 3 packets — nDPI reads the TLS SNI from the ClientHello before the handshake completes.

Step 4 — Run the Grafana lab

For live Prometheus metrics and Grafana dashboards:

cd labs/sw

# Build the Prometheus exporter
docker build -f ../../exporter/Dockerfile -t vpp-exporter ../../exporter/

# Start VPP + exporter + Prometheus + Grafana
docker compose up -d

# Open Grafana (admin / admin)
xdg-open http://localhost:3000

The lab continuously injects traffic so Grafana shows live time-series data. Each 3-second cycle creates 12 new flows across 12 well-known applications.

Step 5 — Connect to the VPP CLI

docker exec -it lab-vpp vppctl -s /tmp/lab-dut-cli.sock

vpp# show ndpi stats
 flows created:            720
 flows classified:         720
 flows active:             720
 packets scanned:         3600
 packets cached:         10440

vpp# show ndpi applications
Application         Flows  Packets       Bytes
YouTube                60     1440    1105920
NetFlix                60     1440    1105920
Google                 60     1440    1105920
...

Next steps