NNTP is Network News Transfer Protocol, as defined in RFC 977 and RFC 2980. It is used for Internet "news", such as read by Pan, Newsleecher and others, including many e-mail clients.
NNTP servers usually run on TCP port 119. NNTPS (NNTP over SSL) servers run on port 563.
l7-filter uses the nntp pattern. It is tested and is believed to work well.