Linux Networking Cookbook

19.10. Using ngrep for Advanced Packet Sniffing

Problem

You know and love both tcpdump and Wireshark, and are pretty good at finding the information you want. But sometimes, you still end up dumping the output to a text file and using grep to look for strings or regular expressions that tcpdump and Wire-shark can't filter on. If only there were something like tcpdump and grep combined.

Solution

There is: ngrep, or "network grep." ngrep is a packet sniffer that is similar to tcpdump, with the added facility of being able to search on any text string or regular expression just like grep. Suppose you're snooping to see what your employees are saying about you on IRC. You want to get straight to the juicy stuff, so try this command:

	# ngrep -qpd eth0 host ircserver -i carla
	interface: eth0 (192.168.1.0/255.255.255.0)
	match: carla
	##
	T 192.168.1.10:33116 -> 140.222.222.107:6667 [AP]
	PRIVMSG #authors :that carla is truly wonderful and everyone loves her
	##
	T 192.168.1.32:39422 -> 140.222.222.107:6667 [AP]
	PRIVMSG #authors :yes, carla is great, the world would be dust and ashes without her

It looks promising, and you want some more context, so you add the -A 5 switch to include the five lines that follow your match:

	# ngrep -qpd eth0 -A5 host ircserver -i carla T 192.168.1.10:33116 -> 140.222.222.107:6667 [AP] PRIVMSG #authors :LOL thanks, I haven't laughed that hard in ages ## T 192.168.1.32:39422 -> 140.222.222.107:6667 [AP] PRIVMSG #authors :NP, it's a good thing the bossy little dope can't ...