- ngrep
-
ngrep Developer(s) Jordan Ritter Stable release 1.45 / November 28, 2006 Written in C Operating system Linux, Solaris, FreeBSD, NetBSD, OpenBSD, Mac OS X, additional *NIX systems, Windows Type Packet analyzer License Other Website ngrep.sourceforge.net
ngrep (network grep) is a network packet analyzer written by Jordan Ritter[1]. It runs under the command line, and relies upon the pcap library and the GNU regex library.ngrep support Berkeley Packet Filter (BPF) logic to select network sources or destinations or protocols, and also allow to match patterns or regular expressions in the data payload of packets using GNU grep syntax, showing packet data in a human-friendly way.
ngrep is an open source application, and the source code is available to download from the ngrep site at SourceForge. It can be compiled and ported to multiple platforms, it works in many UNIX-like operating systems: Linux, Solaris, BSD, AIX, and also works on Microsoft Windows.[2]
Contents
Functionality
ngrep is similar to tcpdump, but it has the ability to look for a regular expression in the payload of the packet, and show the matching packets on a screen or console. It allows users to see all unencrypted traffic being passed over the network, by putting the network interface into promiscuous mode.
ngrep with an appropriate BPF filter syntax, can be used to debug plain text protocols interactions like HTTP, SMTP, FTP, DNS, among others, or to search for a specific string or pattern, using a grep regular expression syntax.[3][4]
ngrep also can be used to capture traffic on the wire and store pcap dump files, or to read files generated by other sniffer applications, like tcpdump, or wireshark.
ngrep has various options or command line arguments. The ngrep man page in UNIX-like operating systems show a list of available options.
Using ngrep
Typical use of ngrep.
# Capture network traffic incoming to eth0 interface and show parameters following HTTP GET or POST methods ngrep -l -q -d eth0 "^GET |^POST " tcp and port 80
# Capture network traffic incoming to eth0 interface and show the HTTP User-Agent string ngrep -l -q -d eth0 "User-Agent: " tcp and port 80
Security
Capturing raw network traffic from an interface requires special privileges or superuser privileges on some platforms, especially on Unix-like systems. ngrep default behavior is to drop privileges in those platforms, running under a specific unprivileged user.
Like tcpdump, it is also possible to use ngrep for the specific purpose of intercepting and displaying the communications of another user or computer, or an entire network.
A privileged user running ngrep in a server o workstation connected to a device configured with port mirroring on a switch, router, or gateway, or connected to any other device used for network traffic capture on a LAN, MAN, or WAN, can watch all unencrypted information related to login ID's, passwords, or URLs and content of websites being viewed in that network.[5]
Supported Platforms
- Linux: Operating system running the linux kernel
- Solaris: Unix operating system developed by Sun Microsystems
- BSD: Unix operating system family (FreeBSD, NetBSD, OpenBSD)
- Mac OS X: Unix operating system developed by Apple Inc.
- AIX, Unix operating system developed by IBM
- Windows, Operating system developed by Microsoft
Supported Protocols
- IPv4 and IPv6, Internet Protocol version 4 and version 6
- TCP, Transmission Control Protocol
- UDP, User Datagram Protocol
- ICMPv4 and ICMPv6, Internet Control Message Protocol version 4 and version 6
- IGMP, Internet Group Management Protocol
- Ethernet, IEEE 802.3
- PPP, Point to Point Protocol
- SLIP, Serial Line Internet Protocol
- FDDI, Fiber Data Distribution Protocol
- Token Ring, IEEE 802.5
See also
- tcpdump, a common packet analyzer that runs under the command line
- pcap, an application programming interface (API) for capturing network traffic
- snoop, a command line packet analyzer included with Solaris
- wireshark, a network packet analyzer featuring a GUI and a command line interface
- dsniff, a packet sniffer and set of traffic analysis tools
- flowgrep, a tool written in python similar to ngrep
References
- ^ Jordan Ritter at CrunchBase
- ^ ngrep supported platforms
- ^ ngrep and regular expressions
- ^ ngrep usage
- ^ Network monitoring with ngrep
External links
Categories:- Network analyzers
- Unix network-related software
- Windows software
- Free software programmed in C
- Open source network management software
Wikimedia Foundation. 2010.
