Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
ngrep searches network packet payloads for text or regular-expression patterns, while a separate BPF filter narrows which packets it captures. After installing it, a useful starting point is sudo ngrep -d any -wi 'error' tcp: this looks for the case-insensitive word error in TCP payloads visible on Linux’s any capture interface. Capture only traffic you are authorized to inspect; packet output and saved captures may contain sensitive data.
What ngrep does
The name means “network grep”: unlike ordinary grep, which searches files or streams of text, ngrep captures packets through libpcap and matches data in their payloads. It accepts regular expressions and Berkeley Packet Filter (BPF) expressions, the filter language also used by tcpdump. The upstream usage examples and ngrep manual document these two parts of a command.
It is a quick way to find visible strings in plaintext protocols or inspect a simple pattern in a capture file. It is not a full protocol analyzer: it does not normally decrypt TLS, and a string split across separate TCP packets may not match. For stream reconstruction or protocol-aware analysis, use TShark or Wireshark.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Install and verify ngrep
On Debian or Ubuntu:
sudo apt update
sudo apt install ngrepOn Arch Linux:
sudo pacman -S ngrepCheck that the executable is installed and see its version and usage:
#1 Best Overall
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
command -v ngrep
ngrep -V
ngrep -hPackage versions and available options vary by distribution and release. The Arch package page lists 1.49.0-1, while Debian unstable documentation describes a different packaged version. Check your own version with ngrep -V and consult man ngrep for its options. The upstream project site links to releases and source information.
Understand the command syntax
ngrep [options] match-expression [bpf-filter]The expression and filter do different jobs:
| Part | Purpose | Example |
|---|---|---|
| Options | Select an interface, output style, capture limit, or file. | -d any -W byline |
| Match expression | Searches captured packet payload bytes. | 'error|fail' |
| BPF filter | Selects packets before payload matching. | tcp port 8080 |
For example, in ngrep 'error' tcp port 8080, error is the payload pattern; tcp port 8080 is the packet filter. Quote expressions with shell metacharacters such as |, parentheses, spaces, or *, so the shell passes them to ngrep unchanged.
Choose the interface
Modern Linux interfaces are often named things like enp3s0 or wlp2s0, rather than eth0 or wlan0. Find the names first:
Recommended Free Tools
ip -br link
ip link showThen select the interface with -d. For example:
sudo ngrep -d enp3s0 'error' tcp
sudo ngrep -d wlp2s0 'GET' tcp port 80
sudo ngrep -d lo 'localhost'
sudo ngrep -d any 'error'lo is loopback, used for traffic confined to the local host. Linux’s any pseudo-interface is convenient for capturing across regular interfaces, but can produce noisy output and may make interface or direction details less obvious. It does not guarantee visibility into traffic in every container, network namespace, VM, or remote system. Capture where the relevant traffic is visible.
Rank #2
- Cat 6 performance at a Cat5e price but with higher bandwidth
- High Performance Cat6, 30 AWG, RJ45 Ethernet Patch Cable provides universal connectivity for LAN network components such as PCs,computer servers,printers,routers,switch boxes,network media players,NAS,VoIP phones
- Jadaol cat6 standard cable support Cat8 and Cat7 network and provides performance of up to 250 MHz 10Gbps and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T/1000BASE-TX (Gigabit Ethernet) and 10GBASE-T (10-Gigabit Ethernet)
- UTP(Unshielded Twisted Pair) patch cable with RJ45 gold-plated Connectors and are made of 100% bare copper wire, ensure minimal noise and interference
- The unique flat cable shape allows for a cleaner and safer installation. You can easily and seamlessly make the cable run along walls, follow edges & corners or even make it completely invisible by sliding it under a carpet.
Search payloads with patterns and BPF filters
Live capture often needs elevated privileges. Start with sudo if ngrep cannot open an interface; the exact privilege requirements depend on system configuration. A broad capture can flood the terminal, so narrow it with a pattern, interface, or BPF filter.
Search TCP payloads
sudo ngrep -d any -wi 'error' tcp-i makes matching case-insensitive and -w requests word-based matching. The final tcp limits capture to TCP packets. To look for alternatives, use a regular-expression alternation:
sudo ngrep -i 'error|fail|denied' tcpFilter by port or host
sudo ngrep -d any -W byline 'GET|POST' tcp port 80
sudo ngrep -d eth0 'password' host 192.0.2.10
sudo ngrep 'GET' tcp dst port 8080
sudo ngrep 'response' tcp src port 8080
sudo ngrep 'DNS' udp port 53Replace example interface names and addresses with values from your system. BPF also supports combinations and exclusions; quote a compound filter, especially when it contains parentheses:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ngrep -d any -i 'error' 'tcp and port 8080'
sudo ngrep 'error' '(tcp port 80 or tcp port 8080)'
sudo ngrep 'debug' 'not port 22'A BPF filter reduces the packets ngrep examines, which usually makes a capture more useful and less noisy than collecting everything. BPF syntax is shared broadly with tcpdump; see the tcpdump manual.
Rank #3
- Designed for Outdoor & Direct Burial Installations – Heavy-duty double-shielded Cat8 Ethernet cable minimizes EMI/RFI interference and delivers stable long-distance performance. Waterproof, anti-corrosion PVC jacket allows safe direct burial and reliable use in outdoor or indoor environments.
- 26AWG for Stable High-Load Networks – Thicker 26AWG conductors provide faster, more stable data transmission than standard 32AWG cables. Ideal for high-performance home networks, gaming setups, smart homes, and data-intensive applications.
- F/FTP Shielding & Hyper-Speed Performance: Cat8 Ethernet cable constructed with 4 shielded foiled twisted pairs and 26AWG OFC conductors; supports bandwidth up to 2000 MHz and data transmission speeds up to 40 Gbps, effectively reducing signal interference and ensuring stable connections. Ideal for low-latency gaming, 4K/8K streaming, and high-speed internet connections.
- RJ45 Connectors & Wide Compatibility: Cat8 Ethernet cable with two shielded RJ45 connectors; compatible with networking switches, IP cameras, routers, Nintendo Switch, modems, PS3, PS4, Xbox, patch panels, servers, smart TVs, and more; works with Cat7, Cat6, Cat5e, and Cat5 devices
- Weatherproof & UV Resistant: Outdoor-rated Cat8 Ethernet cable with UV-resistant PVC jacket; withstands direct sunlight, extreme cold, humidity, and hot weather; anti-aging and durable; Includes 18-month support.
Use regular expressions or hexadecimal matching
Patterns are applied to packet payload data. Examples include a literal, an optional substring, or an HTTP method line:
sudo ngrep 'timeout' tcp
sudo ngrep -i 'pass(word)?' tcp
sudo ngrep -W byline '^(GET|POST|PUT|DELETE) ' tcp port 80The HTTP example only works if the request is visible in the payload and has not been encrypted or otherwise encoded. Binary protocols may have no searchable printable text. Use -X to interpret the expression as hexadecimal:
sudo ngrep -X '504b0304' tcp
sudo ngrep -X '0xDEADBEEF' tcpFormat, limit, and timestamp output
Choose a display style that suits the protocol and your workflow:
sudo ngrep -W byline 'HTTP' tcp port 80
sudo ngrep -W single 'ERROR' tcp port 8080
sudo ngrep -x 'HTTP' tcp port 80-W byline respects embedded line feeds, useful for line-oriented text. -W single puts each packet on one line, which can help with scripts but can make multiline payloads hard to read. -x shows hexadecimal as well as ASCII bytes; it is incompatible with some line-oriented formatting modes, including -W byline. Non-printable bytes are normally displayed as periods; -P changes that display character, for example -P '?'.
Rank #4
- High-Performance Connectivity: This Cat 6 ethernet cable is designed for superior performance, with a 24 AWG copper wire core. It provides universal connectivity as an ethernet cord for LAN network components such as PCs, servers, printers, routers, and more, ensuring reliable and fast network connections
- Advanced Cat6 Technology: Experience Cat6 performance with higher bandwidth at a Cat5e price. This network cable is future-proof, ready for 10-Gigabit Ethernet and backwards compatible with any existing Cat 5 cable network. It meets or exceeds Category 6 performance according to the TIA/EIA 568-C.2 standard
- Reliable Wired Network Solution: Known variously as a Cat6 network cable, ethernet cable Cat 6, or Cat 6 data/LAN cable, this RJ45 cable offers a more secure and reliable connection than wireless networks. It's ideal for internet connections that demand consistency and security
- Durable and Secure Design: The connectors of this ethernet cable feature gold-plated contacts and strain-relief boots for enhanced durability. Bare copper conductors not only improve cable performance but also comply with communication cable specifications
- High-Speed Data Transfer: With up to 550 MHz bandwidth, this ethernet cord is ideal for server applications, cloud computing, video surveillance, and streaming high-definition video. It also supports Power over Ethernet (PoE, PoE+, PoE++) for powering devices like IP cameras, VoIP phones, and wireless access points, ensuring fast and reliable network performance.
To add timing information, use the documented timestamp modes:
sudo ngrep -t 'error' tcp
sudo ngrep -T 'error' tcp-t prints an absolute timestamp; -T prints the time delta between matches. When piping output and you need it to appear promptly, use line buffering:
sudo ngrep -l 'error' tcp | tee ngrep-errors.logControl how much is displayed or examined:
sudo ngrep -n 10 'error' tcp
sudo ngrep -A 3 'login' tcp port 80
sudo ngrep -s 65536 -S 256 'password' tcp-n stops after the specified number of matching packets. -A 3 shows three packets of trailing context after a match, not three text lines. -S limits the bytes examined for matching; -s sets the capture snap length. They are not interchangeable. The documented default snap length is 65,536 bytes, but confirm behavior in the local manual because versions can differ. The -p option disables promiscuous mode; that can limit visible traffic, especially on switched networks.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRead from or write to a capture file
To save matched packets while capturing, use -O:
sudo ngrep -O matches.pcap 'error' tcpTo search an existing pcap-compatible capture, use -I:
Best Value
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
ngrep -I capture.pcap 'error'That lets you repeat or adjust a search without recapturing live traffic. The -D option replays offline packets at their recorded time intervals:
ngrep -D -I capture.pcap 'error'You can inspect a saved capture with other tools, for example:
tcpdump -r matches.pcap
wireshark matches.pcapSee the Wireshark manual for its capture and analysis capabilities.
Why ngrep may show no output
Check likely causes in this order:
- Wrong interface: compare
ip -br linkwith the interface carrying the traffic. Try-d anyas a diagnostic, or-d lofor local-only traffic. - No matching traffic: generate a request or reproduce the issue while the capture is running.
- Filter too narrow: test without the BPF filter, then add a port or host restriction back.
- Encrypted payload: TLS, SSH, HTTPS, and encrypted database sessions do not normally expose application text to ngrep. Searching port 443 for
GETdoes not decrypt HTTPS. - Pattern or quoting issue: quote the expression and test a simpler literal, perhaps with
-i. - Payload truncation: check snap length with
-s; the bytes of interest may not be captured. - Packet boundaries: a string split across TCP segments may not match as a complete string in an individual packet.
- Namespace or location: the traffic may belong to a container, VM, network namespace, or another machine that the selected capture point cannot see.
Use simple diagnostic captures, then narrow them:
sudo ngrep -d any '' tcp
sudo ngrep -d any '' 'port 80'
sudo ngrep -d any -i 'test' tcpAn empty match expression can display a large amount of traffic. Use it briefly and only where authorized. If output is delayed in a pipeline, add -l; if it overwhelms the terminal, limit matches with -n or save a bounded capture.
Security and privacy
Packet captures can contain credentials, cookies, authorization headers, personal information, and proprietary messages. Use a narrow filter, avoid collecting real secrets for a demonstration, and store or share capture files carefully. Capture only on systems and networks where you have authorization.
Live capture commonly uses sudo, but avoid running the binary permanently as root. The manual describes privilege dropping as a mitigation against risks from malformed or hostile packets. Some versions provide -R to prevent that behavior; it is not a routine permission fix and should be used only when you understand the security consequences.
When to use another tool
| Tool | Best fit |
|---|---|
ngrep |
Quick regex or byte-pattern searches in visible packet payloads, live or from a pcap. |
tcpdump |
Packet-level capture, header and flag inspection, Boolean capture filters, and robust capture-file workflows. |
| TShark | Command-line protocol dissection, Wireshark display filters, structured fields, or TCP stream reassembly. |
| Wireshark | Interactive protocol analysis, conversation inspection, TCP stream following, and GUI-based review. |
Wireshark and TShark are preferable when you need protocol decoding or stream reassembly; their capabilities are described in the Wireshark documentation. For kernel-level tracing, performance analysis, or production telemetry, eBPF tools address a different problem rather than serving as drop-in replacements for ngrep.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
