Network Grep (Ngrep) Basics

Ngrep or Network Grep is a utility which can be used to find patterns and search at the network layer live using pcap filters, regular and hexadecimal expressions. Ngrep can currently decode and search for patterns in protocols such as IP, TCP, UDP, IGMP, ICMP, PPP etc. In the most typical use case, Ngrep can help debug protocol implementations, process pcap files, observe binary protocols or even act as a basic sniffing tool. Please visit the Ngrep Usage Page for more details.

Enable Javascript or Download Flash Playe if you see this!

It might be useful checkout the videos on Packet Sniffing using TcpDump and WireShark. The videos are available here:

1. Packet Sniffing using TcpDump
2. Packet Sniffing using WireShark

Links:

1. Ngrep Official Website on SourceForge

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the founder of an online startup (currently in stealth mode). Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net