NGREP(8) NGREP(8) (NAME) ngrep - grep (network grep) (SYNOPSIS) ngrep <-hNXViwqpevxlDtTRMCu> <-IO pcap_dump > < -n num > < -d dev > < -A num > < -s snaplen > < -S limitlen > < -W normal|byline|single|none > < -c cols > < -P char > < -F file > < match expression > < bpf filter > (DESCRIPTION) ngrep GNU grep . ngrep pcap (extended regular expressions) (payload) . TCP UDP ICMP Ethernet PPP SLIP FDDI null bpf (packet sniffing) tcpdump(8) snoop(1) . (OPTIONS) -h . -N ( ). -X (). . -V . -i (regex). -w . -q ( ). -p (promiscuous mode) . -e . . . -v . -x (dump) ASCII. -l (stdout) (line buffered). -C . -u UTF-8 . -D pcap_dump ( ). -t YYYY/MM/DD HH:MM:SS.UUUUUU . -T +S.UUUUUU () . . -R DROPPRIVS_USER ( ) . ngrep . ngrep (root) . . (sniffers) ngrep . . -c cols ``cols'' . ngrep ngrep ``cols'' ( ). -F file bpf . tcpdump . <<-F>> bpf (override) . -P char . <<.>> . -K num TCP ( tcpkill). (segment) RST . -W normal|byline|single|none . <> (linefeed) ( HTTP ). <> ( ). <> <> IP / . <> . <<-x>> . -s snaplen caplen bpf snaplen ( 65536 ). -S limitlen ngrep . N BPF snaplen . -I pcap_dump pcap_dump ngrep. dump pcap . . -O pcap_dump dump pcap. stdout . -n num num . -d dev ngrep . ngrep dev . -A num (dump) num (trailing context) . -r IP Docker Podman . IP container_name(ip_address) . Docker Podman ngrep Events API . (polling) CLI (cache TTL) . --disable-container-resolution . (MATCH AND FILTER EXPRESSIONS) match expression (extended regular expression) -X . GNU regex library . `0x' `DEADBEEF' `0xDEADBEEF'. bpf filter (dump) . bpf filter IP . bpf filter `true' () . bpf filter (primitive) . (id) ( ) (qualifier) . : type (type) . : host net port. `host blort' `net 1.2.3' `port 80'. host . dir (dir) / id . : src dst src or dst src and dst. `src foo' `dst net 1.2.3' `src or dst port ftp-data'. src or dst . <> ( slip) inbound outbound . proto (proto) -IP . : tcp udp icmp. `udp src foo' `tcp port 21'. . `src foo' `ip and ((tcp or udp) src foo)' `net bar' `ip and (net bar)' `port 53' `ip and ((tcp or udp) port 53)' . <<>> : gateway broadcast less greater (arithmetic expressions). . and or not . `host blort and not port ftp and not port ftp-data'. . `tcp dst port ftp or ftp- data or domain' `tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain' . : dst host host IP host . src host host IP host . host host IP host . host ip arp rarp : ip host host : ether dst ehost ehost . Ehost /etc/ethers ( ethers(3N) ). ether src ehost ehost . ether host ehost ehost . gateway host host (gateway) . host IP IP host . Host /etc/hosts /etc/ethers . ( : ether host ehost and not host host host / ehost .) dst net net IP net . Net /etc/networks ( networks(4) ). src net net IP net . net net IP net . net net mask mask IP net (netmask) . src dst . net net/len IP net len . src dst . dst port port ip/tcp ip/udp port . port /etc/services ( tcp(4P) udp(4P) ). . ( dst port 513 tcp/login udp/who port domain tcp/domain udp/domain ). src port port port . port port port . tcp udp : tcp src port port tcp port . less length length . : len <= length. greater length length . : len >= length. ip proto protocol ip ( ip(4P) ) protocol. Protocol tcp udp icmp . tcp udp (\) C-shell \\ . ip broadcast (broadcast) IP . (subnet mask) . ip multicast (multicast) IP . ip : ether proto ip tcp, udp, icmp : ip proto p p . expr relop expr relop > < >= <= = != expr ( C) [+, -, *, /, &, |] . : proto [ expr : size ] Proto ip tcp udp icmp . expr . Size . len . `ether[0] & 1 != 0' (multicast) . `ip[0] & 0xf != 5' IP (options) . `ip[6:2] & 0x1fff = 0' (unfragmented) . tcp udp . tcp[0] TCP . : ( ). (`!' `not'). / (`&&' `and'). / (`||' `or'). . . and . . : not host vs and ace : not host vs and host ace : not ( host vs or ace ) ngrep . (metacharacters) () . . (DIAGNOSTICS) ngrep libpcap GNU regex library stderr . (EXIT STATUS) ngrep : 0 . 1 . 2 . 3+ ! (AUTHOR) Jordan Ritter . (REPORTING BUGS) GitHub ngrep : http://github.com/jpr5/ngrep/issues . (NOTES) ALL YOUR BASE ARE BELONG TO US. *nux 2026 NGREP(8)