# n2disk's open source repository is the extension point for ntop's traffic recorder > The ntop/n2disk repository is not the recorder itself but the place where add-ons, Wireshark integration and example applications live, with C as the primary language. What the documentation and the wireshark directory point to is a product with a file format worth dissecting, and a licence that the repository listing does not identify. **ntop/n2disk** — Open source components and extensions for n2disk - Repository: https://github.com/ntop/n2disk - Stars: 557 · Forks: 15 - Language: C - License: not declared - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/ntop-n2disk ## A companion repository, not the recorder The n2disk repository holds open source components and extensions for n2disk, and the README points at the product page for the tool itself. That distinction is the first thing to understand about this project. n2disk is ntop's traffic recording and replay product, and the README describes this repository as containing two things: add-ons and extensions, and code examples of applications that can interact with n2disk. So the code that runs the recorder is not here. What is here is the code that plugs into it and the code that talks to it. That distinction matters for anyone looking for a traffic capture tool. The product is commercial, sold by ntop and documented in a separate User's Guide linked from the README. This repository is the extension surface around it. The repository layout is thin enough to read in one line: a README, a doc/ directory and a wireshark/ directory. There is no build system, no package manifest, no test suite and no release history. The repository listing records no GitHub releases, so there is no tagged version to pin against either. The primary language is C, which fits the shape of the contents. Extensions for a network appliance are conventionally written in C, and the wireshark directory is the giveaway that at least part of what lives here is a dissector, which is C by requirement rather than by preference. ## The wireshark directory points at a file format worth dissecting A wireshark/ directory inside a network appliance repository usually means one thing: a dissector for the appliance's own file format, so that captured traffic can be opened in a standard analyser. n2disk records traffic to disk so it can be replayed or inspected later, and the value of recording at all is that you can examine the bytes at leisure rather than under the pressure of a live capture. A proprietary recording format is therefore the thing that limits that value: you can record with n2disk, but if you cannot open the file in Wireshark, the recording is only readable by the tool that made it. A dissector in this repository removes that limit, and the Wireshark ecosystem is the natural place for it because Wireshark already reads hundreds of protocol formats and adds new ones through dissectors. The dissector is what makes an n2disk recording file legible in a tool that most network engineers already have open. The mechanics of how that dissector works are not described in the README, and the repository listing gives no file level detail beyond the directory names. Whether it is a standalone plugin, a Lua dissector or a built-in Wireshark component is not something the README establishes. That is a gap worth closing by reading the directory before you rely on it. The reason to care is worth stating plainly: interoperability between a commercial capture tool and a standard analysis tool is the feature that turns a recording appliance into part of a normal workflow. The ntop product page and the separate User's Guide linked from the README are where the product's own behaviour is documented, and this repository is where the interoperability work is. ## doc/ and the code examples are the two ways in The remaining two top level entries describe the two ways to use the repository. The doc/ directory is documentation that ships alongside the code rather than on a separate site, which is the pattern for extensions whose behaviour needs explaining to the person writing them: what the add-on does, what configuration it expects, what it writes and where. The code examples are the other half, and the README describes them as applications that can interact with n2disk. That is a different job from extending the recorder itself. An add-on runs inside n2disk and participates in its processing. An application that interacts with n2disk runs outside it and talks to it, which is how you would build automation around recording: start a capture, wait for it to finish, fetch the result, or drive the recording policy from your own scheduler. That distinction is the useful one for an integrator, and the examples are the reference for it. An add-on answers the question of how to change what n2disk does while it is recording. An interaction example answers the question of how to get work out of n2disk and into your own pipeline. Neither category is described in detail in the README. It gives the categories and leaves the specifics to the directories, so anyone assessing this repository for a real integration needs to read the source, and the README's own framing, a short list pointing at ntop's product page and User's Guide, is not going to answer it. ## The licence is the thing to resolve first The repository listing records the licence as unknown, and there is no licence file in the top level entries, which are only the README, doc/ and wireshark/. That is a meaningful gap for a repository whose entire contents are C source code intended to be compiled and linked with other things. The default position when no licence is granted is that the copyright holder retains all rights, so the safe reading is that you may read the code and follow it, but you should not copy it into a product you distribute or sell without permission from ntop. This is worth separating from the product's own licence. n2disk itself is a commercial product from ntop, and what the vendor licenses for the recorder and what it publishes in this repository are two different grants. Code offered as open source components and extensions, and code offered as an example, may well carry different terms in the vendor's mind, and the absence of a file in the repository means the answer is not written down anywhere you can point at. The practical step is narrow and specific: ask ntop, in whatever form their support channel takes, what terms apply to the files in doc/ and wireshark/ before you build on them. That is a licensing question rather than legal advice, and it is the kind of question that is easy to ask and awkward to discover the answer to after shipping. For context, the README links the product page at http://ntop.org/products/traffic-recording-replay/n2disk/ and the User's Guide at https://www.ntop.org/guides/n2disk/, and both are where the vendor's own documentation of usage and licensing terms lives. ## Where to get n2disk and where to read about it The README points at two places, and they answer two different questions. The product itself is at http://ntop.org/products/traffic-recording-replay/n2disk/, which is the sales page for the traffic recording and replay tool. The README's Details section points there for more information about n2disk itself. The How-to documentation is a separate document, the User's Guide at https://www.ntop.org/guides/n2disk/. The README's Documentation section says that if you want to learn more about n2disk you should visit that guide. The split is worth noting because the guide is where the product's behaviour is described and this repository is not. Anyone setting up a capture for the first time needs the guide for configuration, retention and replay behaviour, and needs this repository only once they want to extend the product or read its output in another tool. There is no install command to copy, because there is nothing here to install. n2disk is delivered as a commercial appliance or software package by ntop, and the files in this repository are source code for extensions and for reading n2disk output. The examples of applications that interact with n2disk are the closest thing to a starting point, and reading one is the fastest way to see what an integration against the product looks like. ## Where the repository is not enough The first limit is the obvious one. If you need to record traffic, n2disk is a commercial product from ntop and this repository does not replace it. Nothing here captures packets. The second limit is that the contents are described by category rather than by function. A repository whose README says it holds add-ons and extensions, and which lists three top level entries, gives you no way to tell from the outside whether an add-on for your use case exists, whether the Wireshark dissector handles the file format your version of n2disk writes, or whether the example applications cover the interaction you need. Each of those questions requires reading the source. The third limit is the release story. The repository listing records no GitHub releases, and the last push was on 2026-10-02 with the repository not archived. So there is code being touched and no tagged version to reference, which means a project that depends on a dissector or an example here is tracking the default branch rather than a known good point. The topics in the repository metadata are 10gbit, packet-capture and packet-sniffer, which describes the product domain rather than the code. n2disk sits in the high speed packet capture world, where the recording path runs at line rate and the format on disk is a product of that design. The alternative to weigh is the Wireshark ecosystem itself, which has its own set of capture and analysis tools, including the ability to read pcap files directly. The difference in approach is the hardware and the sustained throughput. A general purpose analyser reads what a host interface can capture, which on a busy 10 gigabit link means dropped packets, and it holds a bounded amount in memory. A dedicated recording appliance writes to disk at line rate and keeps the data for later, which is the workload where a proprietary file format appears in the first place, and where a dissector in this repository is what makes the result usable in a tool you already know. ## Conclusion Adopt this repository if you need to extend n2disk with your own add-on, or to read n2disk capture files outside ntop's own tools, since the wireshark directory and the example applications are the parts that exist here. Do not treat it as the n2disk product itself, because the recorder and its user guide live on ntop.org, and do not copy the C sources into your own project until you have resolved the licence, which the repository listing records as unknown. Verify first which n2disk version your files come from and whether the Wireshark dissector in the wireshark directory matches it. ## FAQ ### What is the ntop/n2disk repository? It contains open source components and extensions for n2disk, ntop's commercial traffic recording and replay product. The README says it holds add-ons and extensions along with code examples of applications that can interact with n2disk, and the repository itself is primary language C. ### What is in the wireshark directory of the n2disk repository? The directory name indicates Wireshark integration for n2disk recording files, which lets captured traffic be opened in a standard analyser rather than only in ntop's own tools. The README does not describe how the dissector is packaged or which file format versions it handles. ### How do I install n2disk? n2disk is a commercial product from ntop, not something this repository installs. The README points to the product page at http://ntop.org/products/traffic-recording-replay/n2disk/ and to the User's Guide at https://www.ntop.org/guides/n2disk/ for documentation, and this repository holds only the add-ons, extensions and example applications. ### What licence applies to the code in the n2disk repository? The repository listing records the licence as unknown, and there is no licence file among the top level entries, which are the README, a doc directory and a wireshark directory. You need to ask ntop what terms apply before copying the code into something you distribute. ### Are there released versions of the n2disk open source components? The repository has no GitHub releases, so there is no tagged version to pin a dependency to. The last push was on 2026-10-02 and the repository is not archived, so the code is being modified on the default branch. ## Sources - [Issues](https://github.com/ntop/n2disk/issues) - [ntop/n2disk on GitHub](https://github.com/ntop/n2disk) - [README](https://github.com/ntop/n2disk/blob/master/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/ntop-n2disk