ngrep is a “network grep” utility that can be used to match regular expressions within network packet payloads. This is a very handy utility as many network analysers (“packet sniffers”) can examine the packet header, but either do not display or cannot filter based on packet payload.<\/p>\n
ngrep<\/span> is available from http:\/\/ngrep.sourceforge.net\/<\/a>. The UNIX version requires libpcap<\/span>, installed as part of tcpdump<\/span> (http:\/\/www.tcpdump.org\/<\/a>). The Windows version requires WinPcap<\/a>.<\/p>\n Quick Example:<\/strong><\/p>\n 1. LIST INTERFACES:\u00a0 (or, show the winpcap device list index)<\/p>\n C:\\desktop\\ngrep\\Release>ngrep -L C:\\desktop\\ngrep\\-bin\\Release><\/p>\n 2. SIMPLE CAPTURE OF HTTP (port 80) TRAFFIC with “Cisco” in the text:<\/p>\n C:\\desktop\\ngrep\\Release>ngrep -d 2 “Cisco” port 80 interface: \\Device\\NPF_{A8E544C2-31CB-4957-8C56-B0C814481170} (10.10.0.0\/255.255 (Ctrl-C)<\/p>\n C:\\desktop\\ngrep\\Release><\/p>\n By default behaviour of ngrep is to output a hash (#) for every packet it<\/p>\n received.\u00a0 This may be suppressed with the -q argument.<\/p>\n Another parameter “-W byline” will formats the output into legible text.\u00a0 Options<\/p>\n for -W are: normal, byline, single, none.<\/p>\n ngrep -d 2 -q -W byline “Cisco” port 80<\/p>\n C:\\desktop\\ngrep\\Release>ngrep -d 2 -q -W byline “Cisco” port 80<\/p>\n interface: \\Device\\NPF_{A8E544C2-31CB-4957-8C56-B0C814481170} (10.10.0.0\/255.255 T 10.10.0.100:1953 -> 88.221.208.170:80 [A] <!– ***End Language Selector*** –> <!– ***ENTITLEMENT*** –> <! (Ctrl-C)<\/p>\n C:\\desktop\\ngrep\\Release>ngrep -d 2 -q -W byline “Cisco” port 80 T 10.10.0.100:1977 -> 88.221.208.170:80 [A] (Ctrl-C)<\/p>\n C:\\Documents and Settings\\Daren Matthews\\My Documents\\downloads\\ngrep-1.45-win32 ngrep is a “network grep” utility that can be used to match regular expressions within network packet payloads. This is a very handy utility as many network analysers (“packet sniffers”) can examine the packet header, but either do not display or cannot filter based on packet payload.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[84,10,18],"tags":[4],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/921"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=921"}],"version-history":[{"count":2,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/921\/revisions"}],"predecessor-version":[{"id":972,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/921\/revisions\/972"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=921"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nidx\u00a0\u00a0\u00a0\u00a0 dev
\n—\u00a0\u00a0\u00a0\u00a0 —
\n1:\u00a0\u00a0\u00a0\u00a0 \\Device\\NPF_GenericDialupAdapter (Adapter for generic dialup and VPN capture)
\n2:\u00a0\u00a0\u00a0\u00a0 \\Device\\NPF_{A8E544C2-31CB-4957-8C56-B0C814481170} (Vigor540 Wireless LAN Adapter (Microsoft’s Packet Scheduler) )
\n3:\u00a0\u00a0\u00a0\u00a0 \\Device\\NPF_{8C388944-83DB-46F7-879B-C6D05D50BB55} (SiS NIC SISNIC (Microsoft’s Packet Scheduler) )
\n4:\u00a0\u00a0\u00a0\u00a0 \\Device\\NPF_{24A8FB22-81F4-489A-875E-229E7CAF928C} (MS Tunnel InterfaceDriver)
\nexit<\/p>\n
\n.0.0)
\nfilter: (ip or ip6) and ( port 80 )
\n#################exit
\n20 received, 0 dropped<\/p>\n
\n.0.0)
\nfilter: (ip or ip6) and ( port 80 )
\nmatch: Cisco<\/p>\n
\nGET \/swa\/j\/zag2_vs_log1.asc?Log=1&link=http%3A\/\/www.cisco.com\/en\/US\/netsol\/ns100
\n7\/&lpos=N1&linktext=Collaboration&title=Cisco%20Systems,%20Inc&basepage=http:\/\/w
\nww.cisco.com\/&eventtype=click&cb=1273908654832 HTTP\/1.1.
\nHost: www.cisco.com.
\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.3) Gecko\/20
\n100401 Firefox\/3.6.3.
\nAccept: image\/png,image\/*;q=0.8,*\/*;q=0.5.
\nAccept-Language: en-gb,en;q=0.5.
\nAccept-Encoding: gzip,deflate.
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7.
\nKeep-Alive: 115.
\nConnection: keep-alive.
\nReferer: http:\/\/www.cisco.com\/.
\nCookie: CP_GUTC=80.42.17.87.1257352846721777; trackEvent={‘prevacct’:’cisco-us,c
\nisco-ussolenterprise’,’accesslevel’:’guest’,’ts’:’1273863082299′}; SMIDENTITY=G+
\nLfDvpE+aBEix5gmn\/uRgvufIB5SETOMAY3kC3s7jBgE8kqpeqvIHmPXb+mlTwFmKZ+OvGHbza7\/x3EJQ
\nF5HnCnxpeYYNAoWZqQbje0sb1EzyCZ+B5dqynnn7fxLwJcc94nKwfvnEC6pRuSJzJlg\/qcs1Lmk5KYqX
\nQjObCCCE1zENdqLR5nZ2sirW35iOOiRK9ULKH8ZNViSy\/KjzIpoeu6604ldAaiUwp25HbE2iFJGEyNRz
\nojk4fNI8PQvUwZXx0lkjTRB9sw1MtmwlJl20ZdP2+dz9gEwf8tKxv59hU96qxLFyi03TXsT0EdpMlw29
\nPi3q3kXvJrljszOcnthXu5UmEjI1iJDIWHLgWl\/XrKL+OJZ+7N8s0fSb5OpnToDsF5wLgUKpq7mOq8tG
\nEjKBu2d9voy2YVKfiEJAlZ0nPaJYeXMeDIIgpzap\/wd20XlsmpYNMFuybG2BhYF2N0gAMcoTx69G9VrX
\n8LZPI+CbIE488CnDH988WTB1LNFkdN\/ReXYU7arWtrtcbHqhEqZ4<\/p>\n
\n<!– ***END REGION NAME AND LANGUAGE*** –><\/p>\n
\n<!– ***Guest Secondary Nav*** –>
\n<a href=”http:\/\/www.cisco.com\/cgi-bin\/login”>Log I
\nn<\/A>
\n<span>|<\/SPAN><a href=”http:\/\/tools.cisco
\n.com\/RPF\/register\/register.do”>Register<\/A>
\n<span>|<\/SPAN><\/p>\n
\n<div>
\n<a name=”search”><\/A>
\n<form method=”get” action=”\/pcgi-bin\/search\/search.pl” name=”sit
\newidesearch”>
\n<input onfocus=”checkClear(this,’Search ‘)” value=”Search ” id=”
\nsearchPhrase” name=”searchPhrase” type=”text” tabindex=”1″ \/><input src=”http:\/\/
\nwww.cisco.com\/web\/fw\/i\/btn_go.gif” id=”go” alt=”Go” type=”image”\u00a0 tabindex=”2″ \/
\n><br \/><\/p>\n
\ninterface: \\Device\\NPF_{A8E544C2-31CB-4957-8C56-B0C814481170} (10.10.0.0\/255.255
\n.0.0)
\nfilter: (ip or ip6) and ( port 80 )
\nmatch: Cisco<\/p>\n
\nGET \/now\/poweredby\/flashtag.txt?Log=1&vs_imgsrc=&vs_linktext=Business%20Video&vs
\n_linkname=&vs_event=click&vs_title=Collaboration%20-%20Cisco%20Systems&vs_basepa
\nge=http:\/\/www.cisco.com\/en\/US\/netsol\/ns1007\/&cb=1273908693869 HTTP\/1.1.
\nHost: www.cisco.com.
\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.3) Gecko\/20
\n100401 Firefox\/3.6.3.
\nAccept: image\/png,image\/*;q=0.8,*\/*;q=0.5.
\nAccept-Language: en-gb,en;q=0.5.
\nAccept-Encoding: gzip,deflate.
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7.
\nKeep-Alive: 115.
\nConnection: keep-alive.
\nReferer: http:\/\/www.cisco.com\/en\/US\/netsol\/ns1007\/.
\nCookie: CP_GUTC=80.42.17.87.1257352846721777; trackEvent={‘prevacct’:’cisco-us’,
\n‘accesslevel’:’guest’,’ts’:’1273908659895′}; SMIDENTITY=G+LfDvpE+aBEix5gmn\/uRgvu
\nfIB5SETOMAY3kC3s7jBgE8kqpeqvIHmPXb+mlTwFmKZ+OvGHbza7\/x3EJQF5HnCnxpeYYNAoWZqQbje0
\nsb1EzyCZ+B5dqynnn7fxLwJcc94nKwfvnEC6pRuSJzJlg\/qcs1Lmk5KYqXQjObCCCE1zENdqLR5nZ2si
\nrW35iOOiRK9ULKH8ZNViSy\/KjzIpoeu6604ldAaiUwp25HbE2iFJGEyNRzojk4fNI8PQvUwZXx0lkjTR
\nB9sw1MtmwlJl20ZdP2+dz9gEwf8tKxv59hU96qxLFyi03TXsT0EdpMlw29Pi3q3kXvJrljszOcnthXu5
\nUmEjI1iJDIWHLgWl\/XrKL+OJZ+7N8s0fSb5OpnToDsF5wLgUKpq7mOq8tGEjKBu2d9voy2YVKfiEJAlZ
\n0nPaJYeXMeDIIgpzap\/wd20XlsmpYNMFuybG2BhYF2N0gAMcoTx69G9VrX8LZPI+CbIE488CnDH988WT
\nB1LNFkdN\/ReXYU7ar<\/p>\n
\n-bin\\Release><\/p>\n","protected":false},"excerpt":{"rendered":"