What is ngrep?
There are many tools used in network analysis. Ngrep is the network version of grep. It is used to monitor and analyze all kinds of network traffic such as HTTP, SMTP, FTP.
ngrep is installed by default on Logsign servers. It needs root privileges to capture packets, so run the commands below as root or with sudo. The -d option selects the network interface to listen on; use -d any to listen on all interfaces, or replace eth0 in the examples with the interface name shown by ip -br link.
Examples of using ngrep are as follows:
ngrep -q port 80: Monitors traffic passing through HTTP. Unencrypted data appears as clear text.
ngrep -q port 21: Monitors incoming FTP connections to the server. Information such as user name and password can be seen in the requests sent to the server.
ngrep -q -i 'text to be searched' tcp port 80: Monitors the requests coming to HTTP and prints the content containing the specified value to the screen.
ngrep -W byline port 80: Shows the data passing through HTTP line by line.
ngrep -q -W byline port 80 > /tmp/web.log: Saves the output to the /tmp/web.log file. To save the matching packets in pcap format instead (for example, to open them in Wireshark), use ngrep -W byline -O /tmp/web.pcap port 80.
ngrep -d any port 25: Shows SMTP traffic on all interfaces.
ngrep -d eth0 port 1234 or 4321 and host 12.12.12.12: Shows packets on the eth0 interface with source or destination port 1234 or 4321 and source or destination IP 12.12.12.12.
ngrep -d eth0 port 4444 and src 192.168.1.212 and dst 192.168.1.54: Shows packets on port 4444 with source IP 192.168.1.212 and destination IP 192.168.1.54.
ngrep -d eth0 port 54321 and src 192.168.1.212 and dst not 192.168.1.54: Shows packets with source IP 192.168.1.212 and port 54321, excluding those with destination IP 192.168.1.54.