Using the Command `ngrep` to Capture Network Traffic (with Examples)

ngrep, short for Network Grep, is a command-line network packet analyzer and capturing tool with powerful filtering capabilities using regular expressions. It’s particularly valuable for network administrators and security professionals who want to monitor, debug, or analyze network traffic in real-time. The utility allows users to specify a particular text or pattern they wish to capture within network packets, providing a focused look into network communications.

Use case 1: Capture Traffic of All Interfaces

Code:

ngrep -d any

Motivation:
Using the command to capture traffic on all network interfaces is a common practice when you want to monitor or analyze the overall network activity of a system. This is especially useful for multi-homed systems that have several network interfaces active at the same time and for identifying unexpected traffic across different networks.

Explanation:

• ngrep: This is the command call for Network Grep.
• -d any: The -d option specifies the network interface to listen on. Using any allows ngrep to capture packets on all available interfaces.

Example output:
The output will display packets being transmitted across different interfaces, including source/destination addresses and associated data payloads:

interface: any
filter: (ip or ip6)
#
T 192.168.1.5:12345 -> 192.168.1.10:22 [AP]
Ssh-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2

T 192.168.1.10:22 -> 192.168.1.5:12345 [AP]
SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2

Use case 2: Capture Traffic of a Specific Interface

Code:

ngrep -d eth0

Motivation:
Capturing traffic on a specific interface like eth0 is useful when a system administrator wants to monitor a defined network segment or make targeted analysis toward traffic associated with a particular network card. It avoids the noise coming from other interfaces, providing focused insights.

Explanation:

• ngrep: The command call for Network Grep.
• -d eth0: The -d option specifies listening on the eth0 interface, assuming it’s the main ethernet interface in a standard setup.

Example output:
This will show packets that are being processed on the specified eth0 interface:

interface: eth0
filter: (ip or ip6)
#
U 192.168.1.5:137 -> 192.168.1.255:137
Name query NB WORKGROUP<1d>

Use case 3: Capture Traffic Crossing Port 22 of Interface eth0

Code:

ngrep -d eth0 port 22

Motivation:
Monitoring traffic on port 22 is especially relevant for identifying SSH connections, which are vital for secure system operations. It is a security measure to ensure that there are no unauthorized SSH attempts or traffic anomalies occurring over this critical port.

Explanation:

• ngrep: Command call.
• -d eth0: Specifies the eth0 interface.
• port 22: Sets a filter to capture only traffic that is using port 22 which is typically used for SSH.

Example output:
Output will capture packets involved in SSH communications through port 22:

interface: eth0
filter: (ip or ip6) and ( port 22 )
#
T 192.168.1.5:55678 -> 192.168.1.10:22 [AP]
Ssh-2.0-PuTTY_Release_0.73

Use case 4: Capture Traffic from or to a Host

Code:

ngrep host www.example.com

Motivation:
Capturing packets related to a specific host is crucial when you are troubleshooting communication issues with that host or when monitoring specific service traffic. It helps in isolating traffic associated strictly with the host of interest, like a web server.

Explanation:

• ngrep: Network Grep command call.
• host www.example.com: Sets a filter to capture any packet sent from or directed to the specified host.

Example output:
This will display the network traffic involving the specified host, either incoming or outgoing:

interface: eth0
filter: (ip or ip6) and ( host www.example.com )
#
T 192.168.1.5:57312 -> 93.184.216.34:80 [AP]
GET / HTTP/1.1.
Host: www.example.com
Accept: */*

Use case 5: Filter Keyword ‘User-Agent:’ of Interface eth0

Code:

ngrep -d eth0 'User-Agent:'

Motivation:
Filtering with ‘User-Agent:’ is invaluable when analyzing web traffic to identify which clients are accessing a web server, allowing for operational insights into platform usage, or to detect specific patterns in bot activity that could suggest unusual traffic.

Explanation:

• ngrep: Invokes Network Grep.
• -d eth0: Specifies the interface eth0.
• 'User-Agent:': This is the regular expression to filter the packets, specifically looking for the ‘User-Agent’ string in HTTP headers.

Example output:
Output will focus on packets that include the ‘User-Agent’ field, offering an insight into client applications:

interface: eth0
filter: (ip or ip6)
#
T 192.168.1.5:58844 -> 192.168.1.11:80 [AP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...

Conclusion

ngrep is an adaptable tool suited for various network packet analysis tasks, from capturing multi-interface traffic to zeroing in on specific hosts or communication packets. This flexibility in applying different filters and interfaces is invaluable for network diagnostics, security assessments, and real-time analysis, making ngrep an important command-line utility in the toolkit of network professionals.