diff --git a/pkgs/by-name/ne/netcap/ndpi_4_0.nix b/pkgs/by-name/ne/netcap/ndpi_4_0.nix
new file mode 100644
index 000000000000..8f63ddcc337a
--- /dev/null
+++ b/pkgs/by-name/ne/netcap/ndpi_4_0.nix
@@ -0,0 +1,32 @@
+{
+  ndpi,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  autoreconfHook,
+  autoconf,
+  automake,
+  fixDarwinDylibNames,
+}:
+
+ndpi.overrideAttrs (
+  finalAttrs: prevAttrs: {
+    version = "4.0";
+
+    src = fetchFromGitHub {
+      inherit (prevAttrs.src) owner repo;
+      tag = finalAttrs.version;
+      hash = "sha256-vWx6IVyxPJBgOkXpHdnvstvDGJbAtndFPtowpjLd32o=";
+    };
+
+    configureScript = "./autogen.sh";
+
+    nativeBuildInputs =
+      lib.remove autoreconfHook prevAttrs.nativeBuildInputs
+      ++ [
+        autoconf
+        automake
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  }
+)
diff --git a/pkgs/by-name/ne/netcap/package.nix b/pkgs/by-name/ne/netcap/package.nix
new file mode 100644
index 000000000000..04e4ff6fce22
--- /dev/null
+++ b/pkgs/by-name/ne/netcap/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  callPackage,
+  buildGoModule,
+  fetchFromGitHub,
+  withDpi ? true,
+  libpcap,
+  libprotoident,
+  libflowmanager,
+  libtrace,
+  versionCheckHook,
+  nix-update-script,
+}:
+let
+  ndpi = callPackage ./ndpi_4_0.nix { };
+in
+buildGoModule (finalAttrs: {
+  pname = "netcap";
+  version = "0.6.11";
+
+  src = fetchFromGitHub {
+    owner = "dreadl0ck";
+    repo = "netcap";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SCBKOIC/s+rfrVWmryp9EBp7ARpZZcxymsnZWtEHrhk=";
+  };
+
+  vendorHash = "sha256-MvHrJLhcFA0fEgK+YT0rwI6wIwTGMcLWQt6AYkx1eZM=";
+
+  subPackages = [ "cmd" ];
+
+  buildInputs =
+    [
+      libpcap
+    ]
+    ++ lib.optionals withDpi [
+      ndpi
+      libprotoident
+      libflowmanager
+      libtrace
+    ];
+
+  ldflags = [
+    "-s -w"
+  ];
+
+  tags = lib.optionals (!withDpi) [
+    "nodpi"
+  ];
+
+  CGO_LDFLAGS = lib.optionalString withDpi ''
+    -L${ndpi}/lib -lndpi
+    -L${libprotoident}/lib -lndpi
+  '';
+
+  CGO_CFLAGS = lib.optionalString withDpi ''
+    -I${ndpi}/include
+    -I${libprotoident}/include
+  '';
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/net
+  '';
+
+  checkFlags =
+    let
+      skippedTests = [
+        # couldn't open packet socket: operation not permitted
+        "TestCaptureLive"
+        # requires local test data
+        "TestCapturePCAP"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/net";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Framework for secure and scalable network traffic analysis";
+    homepage = "https://netcap.io";
+    downloadPage = "https://github.com/dreadl0ck/netcap";
+    changelog = "https://github.com/dreadl0ck/netcap/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+    mainProgram = "net";
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 339dc8a399fe..4d49ceab29b3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3826,6 +3826,10 @@ with pkgs;
   # Not in aliases because it wouldn't get picked up by callPackage
   netbox = netbox_4_2;
 
+  netcap-nodpi = callPackage ../by-name/ne/netcap/package.nix {
+    withDpi = false;
+  };
+
   netcat = libressl.nc.overrideAttrs (old: {
     meta = old.meta // {
       description = "Utility which reads and writes data across network connections — LibreSSL implementation";