ngrep

network grep

ngrep strives to provide most of GNU grep’s common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets.

usage: ngrep <-hNXViwqpevxlDtTRM> <-IO pcap_dump> <-n num> <-d dev> <-A num>
             <-s snaplen> <-S limitlen> <-W normal|byline|single|none> <-c cols>
             <-P char> <-F file> <match expression> <bpf filter>
   -h  is help/usage
   -V  is version information
   -q  is be quiet (don't print packet reception hash marks)
   -e  is show empty packets
   -i  is ignore case
   -v  is invert match
   -R  is don't do privilege revocation logic
   -x  is print in alternate hexdump format
   -X  is interpret match expression as hexadecimal
   -w  is word-regex (expression must match as a word)
   -p  is don't go into promiscuous mode
   -l  is make stdout line buffered
   -D  is replay pcap_dumps with their recorded time intervals
   -t  is print timestamp every time a packet is matched
   -T  is print delta timestamp every time a packet is matched
   -M  is don't do multi-line match (do single-line match instead)
   -I  is read packet stream from pcap format file pcap_dump
   -O  is dump matched packets in pcap format to pcap_dump
   -n  is look at only num packets
   -A  is dump num packets after a match
   -s  is set the bpf caplen
   -S  is set the limitlen on matched packets
   -W  is set the dump format (normal, byline, single, none)
   -c  is force the column width to the specified size
   -P  is set the non-printable display char to what is specified
   -F  is read the bpf filter from the specified file
   -N  is show sub protocol number
   -d  is use specified device instead of the pcap default
   -K  is kill matching TCP connections

Examples

ngrep -d any host 192.168.1.10
ngrep -d any port 8080
ngrep -d any host 192.168.1.10 and port 22
ngrep -d any id=\"1234567\" port 3456

ngrep -d1 -x PASS
ngrep -d1 -e -x PASS

ngrep -d1 -q "^GET .* HTTP/1.[01]" "host www.google.es"

ngrep -l -q -d eth0 udp and port 514

ngrep -q 'HTTP'

ngrep -d any -q “abcd” icmp

ngrep -d any -i -q “user-agent” tcp port 80 

More examples

List interfaces

ngrep -L

Syslog

ngrep -d any 'archiveServerUnreachable' port syslog
ngrep -d any 'error' port syslog

Looking case-insensitively words user or pass

ngrep -wi -d any 'user|pass' port 21

Byline mode used to see all headers and aspects of the HTTP transmission

ngrep -W byline port 80

Save a PCAP dump file

ngrep -O /tmp/dns.dump -d any -T port domain

Search in a pcap file

ngrep -w 'm'  -I /tmp/dns.dump

Observing binary being transferred, let’s assume we have a GIF on a web server that has the data pattern ``0xc5d5e5f55666768696a6b6c6d6e6’’

ngrep -xX '0xc5d5e5f55666768696a6b6c6d6e6' port 80