diff --git a/package/ntlf9t/ndpi-netfilter/patches/001-main.patch b/package/ntlf9t/ndpi-netfilter/patches/001-main.patch
index 6ba0dd402c..c099fe7dce 100644
--- a/package/ntlf9t/ndpi-netfilter/patches/001-main.patch
+++ b/package/ntlf9t/ndpi-netfilter/patches/001-main.patch
@@ -1,11 +1,56 @@
-diff --git a/src/main.c b/src/main.c
-index 6a9c97a..a499327 100644
+--- a/nDPI-patch/src/lib/protocols/netflow.c
++++ b/nDPI-patch/src/lib/protocols/netflow.c
+@@ -21,6 +21,7 @@
+  */
+ 
+ 
++#include <linux/version.h>
+ #include "ndpi_api.h"
+ 
+ #ifdef NDPI_PROTOCOL_NETFLOW
+@@ -29,7 +30,11 @@
+ #ifdef WIN32
+ extern int gettimeofday(struct timeval * tp, struct timezone * tzp);
+ #endif
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
+ #define do_gettimeofday(a) gettimeofday(a, NULL)
++#else
++#define ktime_get_real_ts64(a) gettimeofday(a, NULL)
++#endif
+ #endif
+ 
+ struct flow_ver1_rec {
+@@ -105,7 +110,11 @@ static void ndpi_check_netflow(struct ndpi_detection_module_struct *ndpi_struct,
+   // const u_int8_t *packet_payload = packet->payload;
+   u_int32_t payload_len = packet->payload_packet_len;
+   time_t now;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
+   struct timeval now_tv;
++#else
++  struct timespec64 now_tv;
++#endif
+ 
+   if((packet->udp != NULL) && (payload_len >= 24)) {
+     u_int16_t version = (packet->payload[0] << 8) + packet->payload[1], uptime_offset;
+@@ -158,7 +167,11 @@ static void ndpi_check_netflow(struct ndpi_detection_module_struct *ndpi_struct,
+     _when = (u_int32_t*)&packet->payload[uptime_offset]; /* Sysuptime */
+     when = ntohl(*_when);
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
+     do_gettimeofday(&now_tv);
++#else
++    ktime_get_real_ts64(&now_tv);
++#endif
+     now = now_tv.tv_sec;
+ 
+     if(((version == 1) && (when == 0))
 --- a/src/main.c
 +++ b/src/main.c
-@@ -383,9 +383,15 @@ static void ndpi_gc_flow(void)
+@@ -383,9 +383,16 @@ static void ndpi_gc_flow(void)
  	union nf_inet_addr *ipdst;
  
          u64 t1;
++
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
          struct timeval tv;
  
@@ -18,7 +63,7 @@ index 6a9c97a..a499327 100644
          t1 = (uint64_t) tv.tv_sec;
          
  	if (debug_dpi) pr_info ("xt_ndpi: call garbage collector.\n");
-@@ -418,7 +424,11 @@ ndpi_process_packet(struct nf_conn * ct, const uint64_t time,
+@@ -418,7 +425,11 @@ ndpi_process_packet(struct nf_conn * ct, const uint64_t time,
  
  	u8 exist_flow=0;
          u64 t1;
@@ -30,7 +75,7 @@ index 6a9c97a..a499327 100644
  
  	spin_lock_bh (&flow_lock);
          ipsrc = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3;
-@@ -449,7 +459,11 @@ ndpi_process_packet(struct nf_conn * ct, const uint64_t time,
+@@ -449,7 +460,11 @@ ndpi_process_packet(struct nf_conn * ct, const uint64_t time,
  		}
  	}
  
@@ -42,7 +87,7 @@ index 6a9c97a..a499327 100644
          t1 = (uint64_t) tv.tv_sec;
  
          if (flow == NULL) {
-@@ -602,7 +616,11 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
+@@ -602,7 +617,11 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
  
  	enum ip_conntrack_info ctinfo;
  	struct nf_conn * ct;
@@ -54,7 +99,7 @@ index 6a9c97a..a499327 100644
  	struct sk_buff *linearized_skb = NULL;
  	const struct sk_buff *skb_use = NULL;
  
-@@ -630,7 +648,7 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
+@@ -630,7 +649,7 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
  #if LINUX_VERSION_CODE < KERNEL_VERSION(3,0,0)
  	} else if (nf_ct_is_untracked(skb)){
  #else
@@ -63,7 +108,7 @@ index 6a9c97a..a499327 100644
  #endif
  		pr_info ("xt_ndpi: ignoring untracked sk_buff.\n");
  		return false;               
-@@ -641,9 +659,16 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
+@@ -641,9 +660,15 @@ ndpi_mt(const struct sk_buff *skb, struct xt_action_param *par)
          ip = ip_hdr(skb_use);
          tcph = (const void *)ip + ip_hdrlen(skb_use);
  
@@ -73,7 +118,6 @@ index 6a9c97a..a499327 100644
  		tv.tv_usec / (1000000 / detection_tick_resolution);
 +#else
 +	ktime_get_real_ts64(&tv);
-+	// refs: [tv_nsec and u_sec](https://github.com/torvalds/linux/blob/51a198e89a96c34b3944034b2ebda9002ff57827/fs/utimes.c#L183)
 +	time = ((uint64_t) tv.tv_sec) * detection_tick_resolution +
 +		(tv.tv_nsec / 1000 )/ (1000000 / detection_tick_resolution);
 +#endif