View Image

ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets.

It currently recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

How to use ngrep:

ngrep has traditionally been used to debug plaintext protocol interactions such as HTTP, SMTP, FTP, etc., to identify and analyze anomalous network communications such as those between worms, viruses and/or zombies, and to store, read and reprocess pcap dump files while looking for specific data patterns. On the other hand, it can be used to do the more mundane plaintext credential collection as with HTTP Basic Authentication, FTP or POP3 authentication, and so forth. Like all useful tools, it can be used for good and bad.

Visit the Usage Section and learn more about how ngrep works and can be leveraged to see all sorts of neat things.

Operating System Architecture
Linux 2.0 - 2.6 x86, SPARC, alpha, MIPS
MacOS X + PowerPC
Solaris 2.5.1 + x86, SPARC
FreeBSD 2.2.5 + x86
OpenSBD 2.4 + x86, SPARC
NetBSD 1.5 + x86
Digital UNIX V4.0D (OSF/1),
Tru64 UNIX 5.0 & 5.1A alpha?
HPUX 11 PA-RISC
IRIX MIPS
AIX 4.3.3.0 PowerPC
BeOS Release 5 x86
Windows 95, 98, NT, 2000, XP, 2003 x86