{"id":13438661,"url":"https://github.com/jpr5/ngrep","last_synced_at":"2025-10-21T05:05:33.737Z","repository":{"id":46008022,"uuid":"453178","full_name":"jpr5/ngrep","owner":"jpr5","description":"ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.","archived":false,"fork":false,"pushed_at":"2023-10-05T18:48:24.000Z","size":2070,"stargazers_count":897,"open_issues_count":21,"forks_count":99,"subscribers_count":23,"default_branch":"master","last_synced_at":"2024-10-28T00:23:21.923Z","etag":null,"topics":["grepping","sniffer"],"latest_commit_sha":null,"homepage":"https://github.com/jpr5/ngrep","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jpr5.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGES","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2009-12-30T08:14:15.000Z","updated_at":"2024-10-26T01:15:56.000Z","dependencies_parsed_at":"2024-01-03T04:02:31.321Z","dependency_job_id":null,"html_url":"https://github.com/jpr5/ngrep","commit_stats":{"total_commits":359,"total_committers":5,"mean_commits":71.8,"dds":"0.013927576601671321","last_synced_commit":"2a9603bc67dface9606a658da45e1f5c65170444"},"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jpr5%2Fngrep","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jpr5%2Fngrep/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jpr5%2Fngrep/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jpr5%2Fngrep/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jpr5","download_url":"https://codeload.github.com/jpr5/ngrep/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244565145,"owners_count":20473217,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["grepping","sniffer"],"created_at":"2024-07-31T03:01:07.323Z","updated_at":"2025-10-21T05:05:33.732Z","avatar_url":"https://github.com/jpr5.png","language":"C","funding_links":[],"categories":["C","Networking","Network","\u003ca id=\"f13469c9891173804423be4403b2c4ff\"\u003e\u003c/a\u003epcap","\u003ca id=\"79499aeece9a2a9f64af6f61ee18cbea\"\u003e\u003c/a\u003e浏览嗅探\u0026\u0026流量拦截\u0026\u0026流量分析\u0026\u0026中间人"],"sub_categories":["TOPs","Other Resources","\u003ca id=\"eb49514924c3f4bf2acf6f3a4436af13\"\u003e\u003c/a\u003e未分类","\u003ca id=\"99398a5a8aaf99228829dadff48fb6a7\"\u003e\u003c/a\u003e未分类-Network"],"readme":"## ngrep 1.48 (10.13.2025) [![Build](https://github.com/jpr5/ngrep/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/jpr5/ngrep/actions/workflows/build.yml)\n\nngrep is like GNU grep applied to the network layer.  It's a PCAP-based tool\nthat allows you to specify an extended regular or hexadecimal expression to\nmatch against data payloads of packets.  It understands many kinds of protocols,\nincluding IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of\ninterface types, and understands BPF filter logic in the same fashion as more\ncommon packet sniffing tools, such as tcpdump and snoop.\n\n## What's New\n\n * Upgrade to PCRE2\n * Add additional level of quiet for certain filtering scenarios\n * Update to latest autotools for ngrep and regex-0.12 (2.72, 2023)\n * Update manpage for missing options and typos\n * Fix BPF `DLT_` type detections within libpcap (e.g. `DLT_LINUX_SLL`)\n * Allow for specifying specific location of PCRE2 includes\n * Eliminate various non-fatal build warnings (e.g. `pcap_lookupdev` deprecation)\n * Fix `./configure --disable-tcpkill`\n * Source cleanup (nuke old files, unused vars, missing refs, etc)\n * WinXX: `-d` allows device-name now (e.g. `\\Device\\...`)\n * WinXX: Removed `delay_socket` hack in favor of `Sleep()`\n * WinXX: Build with PCRE2 by default\n * WinXX: Add new dedicated build script (`build.ps1`)\n * WinXX: Builds on both x86_64 and ARM64 cpu architectures\n\n## How to use\n\nngrep was originally developed to:\n\n* debug plaintext protocol interactions such as HTTP, IMAP, DNS, SIP, etc.\n* identify and analyze anomalous network communications such as those between\n  malware, zombies and viruses\n* store, read and reprocess pcap dump files while looking for specific data\n  patterns\n\nAs well, it could be used to do plaintext credential collection, as with HTTP\nBasic Authentication, FTP or POP3 authentication.  Like all useful tools, it can\nbe used for good and for bad.\n\nVisit [EXAMPLES](EXAMPLES.md) to learn more about how ngrep works and can be\nleveraged to see all sorts of neat things.\n\n## Working Platforms\n\nngrep was ported extensively to a multitude of platforms, but over time access to\nthem diminished.  The list below is the original list; for a current list of\nconfirmed working platforms, see our [autobuilds](https://github.com/jpr5/ngrep/actions/workflows/build.yml),\nwhich includes the most popular OSes, compiler toolchains and cpu architectures.\n\n* Linux 2.0+ (RH6+, SuSE, TurboLinux, Debian, Gentoo, Ubuntu, Mandrake, Slackware)/x86, RedHat/alpha, Cobalt (Qube2), Linux/MIPS\n* Solaris 2.5.1, 2.6/SPARC, Solaris 7, Solaris 8/SPARC, Solaris 9/SPARC\n* FreeBSD 2.2.5, 3.1, 3.2, 3.4-RC, 3.4-RELEASE, 4.0, 5.0\n* OpenBSD 2.4 (after upgrading pcap from 0.2), 2.9, 3.0, 3.1+\n* NetBSD 1.5/SPARC\n* Digital Unix V4.0D (OSF/1), Tru64 5.0, Tru64 5.1A\n* HPUX 11\n* IRIX\n* AIX 4.3.3.0/PowerPC\n* BeOS R5\n* Mac OS X 10+\n* GNU HURD\n* Windows 95, 98, NT, 2000, XP, 2003/x86, 7, 8, 8.1, 10\n\n## Support, Feedback, \u0026 Patches\n\nIf you need help, have constructive feedback, or would like to submit a patch,\nplease visit ngrep's project at GitHub and use the online tools there.  It will\nhelp the author better manage the various requests and patches so that nothing\nis lost or missed (as has been the case in the past, unfortunately).\n\n* Issues: https://github.com/jpr5/ngrep/issues\n* Patches: https://github.com/jpr5/ngrep/pulls\n\nPlease see [CREDITS](CREDITS) for a partial list of the many people who helped make ngrep\nwhat it is today.  Also, please note that ngrep is released under a simple\nBSD-style license, though depending on which regex library you compile\nagainst, you'll either get the GPL (GNU regex) or Artistic (PCRE).\n\n## A Request to Distribution Package Maintainers\n\nOver the decades (!), ngrep has been included de facto in many popular distributions,\nseveral of which have dedicated package maintainers.  Many of them have helpfully\nfielded issues reported by users of their distributions, and have even created patches\nto ngrep -- but I am seldom made aware.  Every few years I have to hunt down what bug\nreports and patches may exist, in often arcane vendor-specific tracking systems, so\nthat I can incorporate them for everyone's benefit.  And sometimes I don't find them\nall.\n\nIf you are a package maintainer for an OS or distribution, and find yourself\nfielding a bug report or writing a patch for ngrep, *please* at minimum CC me so\nthat I can track (and possibly solve) the issue.  Ideally, send me a link to a\npatch or pull request so that I can review it and merge it in.\n\nThe way I see it, at the end of the day it's my code, so it's my responsibility, but\nI can't be everywhere to see everything.  I need your help to do a good job.\n\nThank you, sincerely, for all that you have done, and all that you will do. 🙏\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjpr5%2Fngrep","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjpr5%2Fngrep","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjpr5%2Fngrep/lists"}