ngrep
A command-line packet capture tool that matches network payloads against regular or hexadecimal expressions.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get ngrep
Package managers
- Homebrew
brew install ngrep
About ngrep
ngrep applies the idea of GNU grep to the network layer. Built on pcap, it lets you give an extended regular expression or hexadecimal pattern and prints the packets whose data payloads match.
It understands IPv4 and IPv6, TCP, UDP, ICMP, IGMP and raw packets across many interface types, and accepts BPF filter expressions in the same way as tcpdump. It suits administrators and developers who want to spot specific strings in live traffic without opening a full packet analyser.
Strengths
- Grep-style matching on packet payloads
- Accepts tcpdump-style BPF filters
- Supports IPv4, IPv6 and common transport protocols
- Lightweight single command-line tool
Limitations
- Text output only, with no protocol decoding like Wireshark
- Capturing traffic usually needs root or administrator rights
Details
- Pricing
- FreeFree open-source software.
- License
- Open source, license not stated
- Developer
- Jordan Ritter
- Platforms
- Windows, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Quickly finding specific strings in live network traffic from a terminal
- Categories
- Network tools, CLI tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to ngrep
Compare allSoftware that can replace ngrep for an important use case, and what changes if you switch.
tcpdump
The classic command-line packet capture and analysis tool.
tcpdump is the standard BSD-licensed command-line capture tool that writes pcap files for other tools, though it lacks ngrep's grep-style payload matching.
Termshark
Terminal interface for tshark that feels like Wireshark.
Termshark gives a Wireshark-like terminal interface with full protocol decoding through tshark, running on macOS and Linux rather than Windows.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
Wireshark adds a graphical interface with dissectors for hundreds of protocols and display filters, replacing text-only output with readable decoded packets.
Similar software
Related functionality, not necessarily a direct replacement.
sngrep
A terminal tool that captures SIP traffic and displays call message flows as ladder diagrams.
Tcpreplay
A suite of command-line tools for editing captured network traffic and replaying it onto a network.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
Npcap
Windows packet capture driver used by Wireshark, Nmap and similar tools.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Ettercap
Suite for network sniffing and man-in-the-middle analysis on a LAN.
