Network Monitoring with ngrep
See who’s doing what, with a grep for your network interface.
The
ngrep (http://www.packetfactory.net/Projects/ngrep)
utility is an interesting packet capture tool, similar to
[Hack #37] and [Hack #38]. It
is unique in that it attempts to make it as easy as possible to match
which captured packets to print, by using a grep-compatible format
(complete with
regular expressions and a bunch
of GNU grep’s switches). It also converts the
packets to ASCII (or hex) before printing.
For example, to see the contents of all HTTP GET requests that pass through your router, try this:
# ngrep -q GETIf you’re interested only in a particular host, protocol, or port (or other packet matching criteria), you can specify a bpf filter as well as a data pattern. It uses a syntax similar to tcpdump:
# ngrep -qi rob@nocat.net port 25
T 10.42.4.7:65174 -> 209.204.146.26:25 [AP]
RCPT TO:..
T 209.204.146.26:25 -> 10.42.4.7:65174 [AP]
250 2.1.5 ... Recipient ok..
T 10.42.4.7:65174 -> 209.204.146.26:25 [AP]
Date: Sun, 8 Sep 2002 23:55:18 -0700..Mime-Version: 1.0 (Apple Message fram
ework v543)..Content-Type: text/plain; charset=US-ASCII; format=flowed..Sub
ject: Greetings.....From: John Doe ..To: rob@nocat.net..Content-Transfer-En
coding: 7bit..Message-Id: ..X-Mailer: Apple Mail v2)....What does t
hat pgp command you mentioned do again?....Thanks,....--A Friend....Since ngrep prints to STDOUT, you can do post-processing on the output to make a nice printing filter. If you process ...
Get Wireless Hacks now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
