Ngrep - Revision history

Christoph at 17:05, 11 June 2015

2015-06-11T17:05:30Z

Christoph at 16:59, 11 June 2015

2015-06-11T16:59:30Z

Christoph at 16:31, 11 June 2015

2015-06-11T16:31:13Z

Christoph: /* See also */

2015-06-11T16:12:05Z

‎See also

Christoph: /* Usage */

2014-05-08T02:28:32Z

‎Usage

Christoph: /* Usage */

2014-05-07T19:15:42Z

‎Usage

Christoph: /* See also */

2012-04-20T08:40:49Z

‎See also

Christoph: /* See also */

2007-03-24T03:48:33Z

‎See also

Christoph: /* See also */

2007-03-24T03:26:50Z

‎See also

Christoph at 03:11, 24 March 2007

2007-03-24T03:11:20Z

New page

'''ngrep''' strives to provide most of GNU [[grep]]'s common features, applying them to the network layer. ngrep is a [http://www.tcpdump.org/ pcap-aware] tool that will allow you to specify extended [[regular expression|regular]] or hexadecimal expressions to match against data payloads of packets. It currently recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as [[tcpdump]] and [[snoop]]. It was written by Jordan Ritter.

==Usage==
''Note: See [http://ngrep.sourceforge.net/usage.html here] for detailed examples.''
*Example: Basic Packet Sniffing
ngrep -d any port 25
ngrep -d any 'error' port syslog
ngrep -wi -d any 'user|pass' port 21
*Example: Debugging HTTP interactions
ngrep port 80
ngrep -W byline port 80
*Example: Processing PCAP dump files, looking for patterns
ngrep -O /tmp/dns.dump -d any -T port domain
ngrep -w 'm' -I /tmp/dns.dump
ngrep -tD ns3 -I /tmp/dns.dump
ngrep -I /tmp/dns.dump port 80

==See also==
*[[tcpdump]]
*[[snoop]]
*[[netcat]] (aka <tt>nc</tt>)
*[http://logi.cc/linux/netfilter-log-format.php3 Netfilter]
*[http://logi.cc/nw/NetCalc.php3 NetCalc]
*[http://logi.cc/nw/whois.php3 Whois]

==External links==
*[http://ngrep.sourceforge.net/ Official ngrep website]

[[Category:Linux Command Line Tools]]

@@ Line 4: / Line 4: @@
 ''Note: See [http://ngrep.sourceforge.net/usage.html here] for detailed examples.''
-In the following examples, it is assumed that <code>eth0</code> is the used network interface.
+In the following examples, it is assumed that <code>eth0</code> is the used network interface (unless otherwise stated).
 * Example: Basic Packet Sniffing

@@ Line 48: / Line 48: @@
 </pre>
 Watch the traffic via `ngrep`:
-  $ ngrep -W byline -d lo -i "" port 3306
+  $ ngrep -d lo -wi "" port 3306
 <pre>
 interface: lo (127.0.0.0/255.0.0.0)
 filter: (ip or ip6) and ( port 3306 )
 ####
 T 127.0.0.1:3306 -> 127.0.0.1:55741 [AP]
@@ Line 77: / Line 78: @@
 T 127.0.0.1:55741 -> 127.0.0.1:3306 [AP]
 .....
 ###
 </pre>

@@ Line 3: / Line 3: @@
 ==Usage==
 ''Note: See [http://ngrep.sourceforge.net/usage.html here] for detailed examples.''
 *Example: Basic Packet Sniffing
-  ngrep -d any port 25
+In the following examples, it is assumed that <code>eth0</code> is the used network interface.
   ngrep -d any 'error' port syslog
-  ngrep -wi -d any 'user|pass' port 21
+* Example: Basic Packet Sniffing
-*Example: Debugging HTTP interactions
+  $ ngrep -d any port 25
-  ngrep port 80
+  $ ngrep -d any 'error' port syslog
-  ngrep -W byline port 80
+  $ ngrep -wi -d any 'user|pass' port 21
 *Example: Processing PCAP dump files, looking for patterns
-  ngrep -O /tmp/dns.dump -d any -T port domain
+* Example: Debugging HTTP interactions
-  ngrep -w 'm' -I /tmp/dns.dump
+  $ ngrep port 80
-  ngrep -tD ns3 -I /tmp/dns.dump
+  $ ngrep -W byline port 80
   ngrep -I /tmp/dns.dump port 80
-*Monitor all traffic not going over port 22 (i.e., SSH):
+* Example: Processing PCAP dump files, looking for patterns
-  ngrep not port 22 | strings 8
+  $ ngrep -O /tmp/dns.dump -d any -T port domain
-*Monitor all traffic coming from a certain host:
+  $ ngrep -w 'm' -I /tmp/dns.dump
-  ngrep host 192.168.0.103
+  $ ngrep -tD ns3 -I /tmp/dns.dump
-*Show the query and results of <code>SELECT</code> queries going to your [[MySQL]] server:
+  $ ngrep -I /tmp/dns.dump port 80
   ngrep -d eth0 -i 'select' port 3306
 ==See also==

@@ Line 33: / Line 33: @@
 *[http://www.wireshark.org/ Wireshark] &mdash; network protocol analyser
 *[http://monkey.org/~jose/software/flowgrep/ flowgrep] &mdash; a basic IDS/IPS tool written in [[Python]] as a way to help you investigate and manage your network.
 ==External links==

@@ Line 19: / Line 19: @@
 *Monitor all traffic coming from a certain host:
   ngrep host 192.168.0.103
 ==See also==

@@ Line 24: / Line 24: @@
 *[http://logi.cc/nw/NetCalc.php3 NetCalc]
 *[http://logi.cc/nw/whois.php3 Whois]
 ==External links==

@@ Line 17: / Line 17: @@
 ==See also==
-*[[tcpdump]]
+*[[nmap]] &mdash; network exploration tool and security scanner[http://www.insecure.org/nmap/]
-*[[snoop]]
+*[[tcpdump]] &mdash; dump traffic on a network[http://www.tcpdump.org/]
-*[[netcat]] (aka <tt>nc</tt>)
+*[[snoop]] &mdash; capture and inspect network packets
 *[http://logi.cc/linux/netfilter-log-format.php3 Netfilter]
 *[http://logi.cc/nw/NetCalc.php3 NetCalc]