Usage of String Search command Ngrep in Linux systems

Ngrep is the web version of grep, and he strives for more grep features to search for the specified packets. Because the installation ngrep requires a IBPCAP library, it supports a large number of operating systems and network protocols that identify TCP, UDP, and ICMP packets.

Install Ngrep

Download Address

The code is as follows:

git clone git://git.code.sf.net/p/ngrep/code Ngrep-code

Enter directory

The code is as follows:

CD Ngrep-code

./configure--with-pcap-includes=/usr/local/include/pcap

Make

Make install

Options

-H is Help/usage

-V is version information

-Q IS was quiet (don ' t print packet reception hash marks) silent mode, without this switch, unmatched packets are displayed "#"

-E is show empty packets display empty packets

I-ignore case ignores capitalization

-V is invert match reverse match

-R is don t do privilege revocation logic

The-X is print in alternate hexdump format displays in 16-in format

-X is interpret match expression as hexadecimal match in 16-in format

-W is word-regex (expression must match as a word) whole word match

-P is don ' t go into promiscuous mode does not use promiscuous modes

-L is-stdout line buffered

-D is replay pcap_dumps with their recorded time intervals

-T is print timestamp every time a packet is matched show timestamp before each matching package

-T is print delta timestamp every times a packet is matched displays the time interval between the last matched packets

-M is Don T does multi-line match (do single-line match instead) only single line matching

The-i-read packet stream from PCAP format file Pcap_dump reads data from a file to match

-O dump matched packets in PCAP format to pcap_dump save matching data to file

-N is looking at only num packets capture a specified number of packets for viewing

-a The specified number of packets followed by a match to the packet dump after match A for-A is dump NUM packets

-S is set the BPF Caplen

-S is set the Limitlen on matched packets

-W is set the dump format (normal, byline, single, none) setting display format byline will resolve line breaks in the package

The-c is force the column width to the specified size force the width of the columns to be displayed

-P is set the non-printable display char to what is specified

The-F is read the BPF filter from the specified file uses BPF defined in files (Berkeley Packet filter)

-N is Show sub protocol number displays the sub-protocol numbers defined by the IANA

-D is use specified device (index) instead of the PCAP default

Application Examples:

Capture all post requests (with a-w byline parameter to resolve line breaks in the package):

The code is as follows:

ranger@ranger:~$ sudo ngrep-q-w byline "(POST). *"

Interface:eth0 (192.168.122.0/255.255.254.0)

Match: (POST). *

T 192.168.122.74:46048-> 140.207.228.58:80 [A]

POST/HOTEL/OTA_HOTELSEARCH.ASMX?WSDL http/1.1.

Content-type:text/xml; Charset=utf-8.

Soapaction:http://ctrip.com/request.

Accept-encoding:gzip, deflate.

content-length:1330.

Accept: */*.

ACCEPT-LANGUAGE:ZH-CN.

user-agent:mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; trident/4.0).

Ua-cpu:x86.

Accept-encoding:gzip, deflate.

Connection:close.

Host:openapi.ctrip.com.

.

　　 <Request>

<HotelRequest>

<requestbody xmlns:ns= "http://www.opentravel.org/OTA/2003/05" xmlns:xsi= "Http://www.w3.org/2001/XMLSchema-instance"

xmlns:xsd= "Http://www.w3.org/2001/XMLSchema" >

<NS:OTA_HOTELSEARCHRQ version= "1.0" primarylangid= "en"

xsi:schemalocation= "Http://www.opentravel.org/OTA/2003/05 ota_hotelsearchrq.xsd"