Stack Overflow
Stack Overflow

Questions tagged [ngrep]

ngrep is a grep variant for parsing text from network protocol data.

20 questions
3
votes
1 answer

How to spawn another process and capture output in python?

I'm just learning Python but have about 16 years experience with PERL and PHP. I'm trying to get the output of ngrep and write it to a log file using Python while also tailing the log file. I've seen some examples online but some seem old and…
Steve Hernandez
  • 174
  • 1
  • 10
2
votes
3 answers

Regular Expression - search until specific string appears

I'm using ngrep and grep to extract some strings out of network traffic: sudo ngrep -W byline | grep... Now I want grep to search for a string and copy from first letter on until some different string appears. Strings are rtmp and .. For…
Rainer Zufall
  • 23
  • 2
2
votes
1 answer

How to unzip HTTP response body by ngrep?

I'm trying to capture HTTP messages between my laptop and github.com with ngrep, but some responses are not human readable because they are sent in chunked encoding and zipped, like: T 207.97.227.239:80 -> 192.168.0.175:41372 [AP] HTTP/1.1 404 Not…
npcode
  • 1,370
  • 1
  • 14
  • 29
1
vote
0 answers

How to **prevent** Scrapy Request from downloading the request?

I am making a Selenium-based spider for dynamic websites. But I want to stay within the Scrapy framework as this spider is part of a bigger project which utilizes all the spiders using the same workflow/commands. The easiest thing to do is, to pass…
Nikolay Shindarov
  • 1,616
  • 2
  • 18
  • 25
1
vote
1 answer

piped sed does not output to file using ngrep

I am using ngrep to filter some tcp packetes into STDOUT Since it now become more important to log the output (after changing the result a bit usingsed) into a file. piping it with sed looks OK in stdout - But no content is written when writing to…
Ole K
  • 754
  • 1
  • 9
  • 32
1
vote
1 answer

Ngrep on OSX not working?

How do I even install ngrep on mac os x? I tried with brew, no avail... It gives me errors when I use ngrep but when I use sngrep it gives me more errors ): (it seems like progress though) Unable to handle linktype 149 With command sudo sngrep -d…
Noble
  • 51
  • 10
1
vote
0 answers

can i get source mac address of packet using ngrep?

I want to get the source mac address of the packet, so is it possible to get it using ngrep command ? or is there any way using which i can get mac adresses ,IP addresses and the files getting accessed along with used port again method used like GET…
user3463039
  • 11
  • 2
1
vote
1 answer

Save a FLV video with Wireshark or ngrep − or whatever

There is a FLV video on a webstie that I'd like to save in order to display it offline. I already tried several solutions which didn't work: Basically, it's impossible to get the video from the HTML source code. I do know the exact URL of the…
Dan Elbow
  • 11
  • 1
0
votes
1 answer

Can I parse ngrep's output with popen()?

I tried running this code, but nothing is ever shown. (Yes, I ran it as root) If I can't get ngrep's output I guess I'll try to figure out how to use libpcap with c++ although I haven't been able to find any good examples. int main(void) { FILE*…
user667674
0
votes
1 answer

How can I redirect ngrep output to file

I am running ngrep on machine to listen to request and response. How can I redirect its output to a file? I am doing something like this:- sudo ngrep -q -t "/dummy/v1/xyz" -W byline -d any port 1231 > ngrep_output.txt But when I am doing tail -f…
hatellla
  • 4,796
  • 8
  • 49
  • 101
0
votes
0 answers

TCP response not getting sent

We seeing this behavior where all of a sudden our TCP response are not getting sent. Even when the connection is up (i.e We are able to receive request ) The TCP client is connected to server over a VPN. It work most of time but some time we don't…
Noobie
  • 461
  • 1
  • 12
  • 34
0
votes
1 answer

how do you limit the number of ngrep results?

There appears to be no way to do this from the man page. When I run ngrep on a port that's serving continuous traffic, I get a ton of results streaming. I want to limit to the number of results such a what can be done with grep -m.
imagineerThat
  • 5,293
  • 7
  • 42
  • 78
0
votes
1 answer

Ngrep multiple pcaps

I use Moloch for a NDR and have it save in 10G pcaps, needless to say there are alot. When i try to parse certain data from the pcaps via ngrep it only lets me parse one at a time. If i use a simple ngrep with wildcard I get pcap compile: syntax…
Problematiq
  • 1
  • 2
0
votes
1 answer

Ngrep external machine

I have a machine which sends values to port 2712. Locally I use: ngrep -d lo '' 'port 2712' Which shows me the values: U 192.168.122.103:51027 -> 192.168.122.103:2712 0.5 How can I from a machine in the same LAN listen to the same port…
user3580316
0
votes
1 answer

ngrep - inverted port results

I'm curious if ngrep can do inverted matched based on ports? I've tried something along the lines of: ngrep -d any -v port 22 interface: any filter: ( port 22 ) and (ip or ip6) And although it says the filter is for 'port 22', it doesn't pick up…
hobbes
  • 467
  • 1
  • 7
  • 22
1
2