How to Install and Use ngrep in Linux to Search and Filter Network Packets with Regular Expressions

While network packet analyzers like tcpdump and Wireshark capture complete network frame headers, isolating specific payload strings (such as unencrypted HTTP headers, SQL queries, or SIP handshakes) requires writing complex display filters or exporting multi-gigabyte PCAP files. The ngrep (network grep) command-line utility combines the raw packet capture capabilities of Libpcap with the regex pattern matching power of GNU grep, allowing system administrators to stream and search wire payloads directly in the Linux terminal.

Why Use ngrep for Network Diagnostics?

ngrep is purpose-built for protocol debugging on application-layer traffic. Instead of dealing with binary packet offsets, you provide standard extended regular expressions (ERE). ngrep inspects incoming and outgoing packet payloads, printing matching segments alongside source and destination IP addresses, ports, and timestamp headers in human-readable ASCII or hexadecimal format.

Installation Instructions

On Ubuntu and Debian

sudo apt update
sudo apt install ngrep

On Fedora, RHEL, and Rocky Linux

sudo dnf install epel-release -y
sudo dnf install ngrep -y

On Arch Linux

sudo pacman -S ngrep

Step-by-Step Practical Examples

Step 1: Capturing Plaintext HTTP GET and POST Requests

To monitor unencrypted web traffic on port 80 and display full packet payloads:

sudo ngrep -q -W byline "^(GET|POST) " 'tcp and port 80'

• -q (Quiet): Suppresses non-matching packet hash markers (#).
• -W byline: Formats packet line breaks cleanly for readability.
• 'tcp and port 80': Standard BPF (Berkeley Packet Filter) syntax.

Step 2: Monitoring DNS Queries in Real Time

To inspect DNS hostname lookups on UDP port 53 without capturing payload noise:

sudo ngrep -q -t -W byline "." 'udp and port 53'

The -t flag prefixes each match with a human-readable timestamp (YYYY/MM/DD HH:MM:SS.UUUUUU).

Step 3: Searching for Specific User-Agents or Host Headers

To isolate traffic originating from a specific browser or API client:

sudo ngrep -i "user-agent: curl" 'tcp and port 80'

The -i flag enforces case-insensitive matching across payload bytes.

Step 4: Outputting Raw Hex and ASCII Dumps

When inspecting binary protocols or non-standard payloads, enable hexadecimal byte representation:

sudo ngrep -X "LOGIN" 'tcp port 21 or port 110'

The -X flag renders a side-by-side hex and ASCII output view identical to classic packet dissectors.

Step 5: Reading from an Existing PCAP File

You can apply regex filters offline to previously captured Wireshark or tcpdump traces:

ngrep -I capture_trace.pcap "SELECT.*FROM"

ngrep Command-Line Parameter Reference

Option	Parameter Name	Functional Behaviour	Recommended Use Case
-d <device>	Network Interface	Binds to a specific adapter (e.g. eth0, wlan0)	Multi-homed servers and VPN troubleshooting
-W byline	Line Wrapping	Honours carriage returns and newlines in payloads	Essential for readable HTTP, SMTP, and SIP debugging
-q	Quiet Mode	Suppresses progress hashes (#) for non-matching packets	Keeps terminal clean during high-traffic captures
-i	Ignore Case	Case-insensitive pattern matching	Matching mixed-case HTTP headers and protocols
-X	Hex Dump	Displays payload in hexadecimal and ASCII columns	Analyzing raw binary protocols and corrupted packets
-O <file>	Output PCAP	Saves matching packets to a standard PCAP file	Exporting forensic captures for Wireshark inspection

Security and Operational Notes

• Root Privileges: Capturing raw sockets on Linux network interfaces requires elevated privileges. Always execute ngrep via sudo or assign the CAP_NET_RAW capability.
• Encrypted Traffic Limitations: ngrep cannot inspect payloads encapsulated inside HTTPS / TLS (port 443) or SSH (port 22). To inspect encrypted streams, terminate TLS at a reverse proxy or use an intercepting proxy such as mitmproxy.
• High-Throughput Packet Drops: On 10Gbps interfaces with heavy traffic, running complex regex patterns can cause packet drops. Combine ngrep with specific BPF filters (e.g. host 192.168.1.50 and port 8080) to minimize processing overhead.