View source for Ngrep

{{Short description|Packet analyser}}
{{lowercase|title=ngrep}}
{{Infobox software
| name = ngrep
| screenshot = [[Image:Ngrep-console.png|280px|ngrep console output]]
| caption = ngrep console output
| developer = [[Jordan Ritter]]
| latest release version = {{wikidata|property|reference|P348}}
| latest release date = {{start date and age|{{wikidata|qualifier|P348|P577}}}}
| operating_system = [[Linux]], [[Solaris (operating system)|Solaris]], [[illumos]] [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], additional [[Unix-like|*NIX]] systems, [[Microsoft Windows|Windows]]
| programming language = [[C (programming language)|C]]
| genre = [[Packet analyzer]]
| license = BSD-style<ref>LICENSE.txt file in the tarball</ref>
| website = {{wikidata|property|reference|P856}}
}}
'''ngrep''' ([[Computer network|network]] [[grep]]) is a network [[packet analyzer]] written by [[Jordan Ritter]]. It has a [[command-line interface]], and relies upon the [[pcap]] library and the [[GNU]] [[regex]] library.
ngrep supports [[Berkeley Packet Filter]] ([[Berkeley Packet Filter|BPF]]) logic to select network sources or destinations or protocols, and also allows matching patterns or [[regular expressions]] in the data payload of packets using [[GNU]] [[grep]] syntax, showing packet data in a human-friendly way.
ngrep is an open source application, and the source code is available to download from the ngrep site on [[GitHub]]. It can be compiled and ported to multiple platforms, it works in many [[UNIX-like]] [[operating systems]]: [[Linux]], [[Solaris (operating system)|Solaris]], [[illumos]], [[BSD]], [[AIX]], and also works on [[Microsoft Windows]].<ref name="r4">[http://ngrep.sourceforge.net/download.html ngrep supported platforms]</ref>
==Functionality==
ngrep is similar to [[tcpdump]], but it has the ability to look for a [[regular expression]] in the payload of the packet, and show the matching packets on a screen or console. It allows users to see all unencrypted traffic being passed over the network, by putting the network interface into [[promiscuous mode]].
ngrep with an appropriate BPF filter syntax, can be used to debug plain text protocols interactions like [[HTTP]], [[SMTP]], [[FTP]], [[Domain Name System|DNS]], among others, or to search for a specific [[string (computer science)|string]] or pattern, using a {{mono|grep}} regular expression syntax.<ref name="r2">[http://www.stearns.org/doc/ngrep-intro.current.html ngrep and regular expressions]</ref><ref name="r3">[http://ngrep.sourceforge.net/usage.html ngrep usage]</ref>
ngrep also can be used to capture traffic on the wire and store pcap dump files, or to read files generated by other sniffer applications like tcpdump or [[wireshark]].
ngrep has various options or  command line arguments.
The ngrep [[man page]] in [[UNIX-like]] [[operating systems]] show a list of available options.
==Using ngrep==
In these examples, it is assumed that ''eth0'' is the used network interface.
* Capture network traffic incoming/outgoing to/from eth0 interface and show parameters following HTTP (TCP/80) GET or POST methods
ngrep -l -q -d eth0 -i "^GET |^POST " tcp and port 80
* Capture network traffic incoming/outgoing to/from eth0 interface and show the HTTP (TCP/80) User-Agent string
ngrep -l -q -d eth0 -i "User-Agent: " tcp and port 80
* Capture network traffic incoming/outgoing to/from eth0 interface and show the DNS (UDP/53) querys and responses
ngrep -l -q -d eth0 -i "" udp and port 53
==Security==
Capturing raw network traffic from an interface requires special privileges or [[superuser]] privileges on some platforms, especially on Unix-like systems. ngrep default behavior is to drop privileges in those platforms, running under a specific unprivileged user.
Like tcpdump, it is also possible to use ngrep for the specific purpose of intercepting and displaying the communications of another user or computer, or an entire network.
A privileged user running ngrep in a server or workstation connected to a device configured with [[port mirroring]] on a [[switch]], [[router (computing)|router]], or [[gateway (telecommunications)|gateway]], or connected to any other device used for network traffic capture on a [[Local area network|LAN]], [[Metropolitan area network|MAN]], or [[Wide area network|WAN]], can watch all unencrypted information related to login ID's, passwords, or [[Uniform Resource Locator|URL]]s and content of websites being viewed in that network.
==Supported protocols==
* [[IPv4]] and [[IPv6]], Internet Protocol version 4 and version 6
* [[Transmission Control Protocol|TCP]], Transmission Control Protocol
* [[User Datagram Protocol|UDP]], User Datagram Protocol
* [[ICMPv4]] and [[ICMPv6]], Internet Control Message Protocol version 4 and version 6
* [[IGMP]], Internet Group Management Protocol
* [[Ethernet]], [[IEEE 802.3]]
* [[Point-to-Point Protocol|PPP]], Point to Point Protocol
* [[Serial Line Internet Protocol|SLIP]], Serial Line Internet Protocol
* [[FDDI]], Fiber Data Distribution Protocol
* [[Token Ring]], [[IEEE 802.5]]
==See also==
{{Portal|Free and open-source software}}
* [[Comparison of packet analyzers]]
* [[snoop (software)|snoop]], a [[command line]] [[packet analyzer]] included with [[Solaris (operating system)|Solaris]] and [[illumos]]
* [[dsniff]], a [[packet sniffer]] and set of traffic analysis tools
* [[netsniff-ng]], a free Linux networking toolkit
* [[etherape]], a network mapping tool that relies on sniffing traffic
* [[tcptrace]], a tool for analyzing the logs produced by tcpdump
* [[Microsoft Network Monitor]], a [[packet analyzer]]
* [[xplico]], a [[network forensics]] analysis tool
==References==
{{Reflist}}
==External links==
*[http://ngrep.sourceforge.net/ Official site for ngrep]
*[http://linux.die.net/man/8/ngrep/ Ngrep - Linux man page]
[[Category:Network analyzers]]
[[Category:Unix network-related software]]
[[Category:Windows security software]]
[[Category:MacOS security software]]
[[Category:Free software programmed in C]]
[[Category:Free network management software]]
[[Category:Software using the BSD license]]