ngrep mit Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper installieren

Projektlinks

• Homepage
• Upstream-Dokumentation
• Paketmanager-Seite

Befehle und Aliase

• ngrep

Projektgeschichte

ngrep was written by Jordan Ritter and dates back to the early 2000s; a freshmeat announcement for ngrep 1.39.1 appeared on April 23, 2001. The tool's identity has stayed stable: bring GNU grep-style matching to the network layer.

The project lived for years as a classic Unix network utility and later moved active issue and patch handling to GitHub. Its README still frames ngrep as a PCAP tool that understands IPv4/IPv6, TCP, UDP, ICMP, IGMP, raw packets, several link-layer interface types, and BPF filter logic.

Adoptionsgeschichte

ngrep became a small but widely packaged troubleshooting utility because it sits between tcpdump and a full packet analyzer. It was included de facto in many popular distributions over decades, and the maintainer explicitly asks distribution package maintainers to forward bugs and patches so upstream can track downstream fixes.

Its adoption is bounded by encryption. ngrep is excellent for DNS, old HTTP, SMTP, SIP, IMAP, test traffic, malware beacons in plaintext, and pcap triage; it is less useful when payloads are TLS-encrypted unless the useful signal is in headers, metadata, or local decrypted test traffic.

Wie es verwendet wird

A typical workflow is `sudo ngrep -d any -W byline 'Host:|User-Agent:' tcp port 80`, or using an empty match expression with a BPF filter to print payloads for a protocol. It can read and write pcap dump files, making it useful for quick command-line passes before opening Wireshark.

Package nerds install it because it is the fast, memorable answer to "show me packets containing this string". It is especially handy on servers where a GUI analyzer is unavailable and tcpdump output is too raw for the immediate question.

Warum Paket-Nerds sich dafür interessieren

ngrep is a survivor from the era when small C network tools solved one sharp problem well. It matters less as a dependency and more as an operator tool: a tiny package that can save a debugging session when traffic is still human-readable.

Zeitleiste

• 2001-04-23: ngrep 1.39.1 was announced on freshmeat.
• 2008: SourceForge tickets show Jordan Ritter still handling upstream bug fixes.
• 2026-02-08: the GitHub repository listed v1.49.0 as a release with PCRE2, Docker/Podman name-resolution, and Windows build updates.

Related projects

• tcpdump
• libpcap
• Wireshark
• snoop
• GNU grep

Quellen

• https://formulae.brew.sh/formula/ngrep
• https://github.com/jpr5/ngrep/
• https://github.com/jpr5/ngrep/blob/master/ngrep.8
• https://groups.google.com/g/fm.announce/c/jqb4TkwNbbw
• https://sourceforge.net/p/ngrep/bugs/30/