# Install ngrep with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper Network grep. Version 1.49.0 via Homebrew; verified 2026-06-25. ## Install ```sh sudo av install brew:ngrep ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install ngrep ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install ngrep ``` Evidence: MacPorts ports tree: net/ngrep/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add ngrep ``` Evidence: Alpine Linux edge package indexes: ngrep from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install ngrep ``` Evidence: Debian stable package indexes: ngrep from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install ngrep ``` Evidence: Fedora Rawhide package metadata: ngrep from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#ngrep ``` Evidence: nixpkgs package indexes: pkgs/by-name/ng/ngrep/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S ngrep ``` Evidence: Arch Linux sync databases: ngrep from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install ngrep ``` Evidence: openSUSE Tumbleweed package metadata: ngrep from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:ngrep - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.49.0 - **Source summary:** Network grep - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** ngrep - **Source archive:** - **Last updated:** 2026-06-25T13:37:57+02:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - ngrep (cli) - ngrep (alias) ## Dependencies - libpcap - pcre2 ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.49.0 - Package-manager updated: 2026-06-25 - Local data: ok - Upstream repository: https://github.com/jpr5/ngrep - Upstream latest detected: v1.49.0 (current) ## Project history and usage ngrep is "network grep": a pcap-based command-line packet analyzer that applies regular-expression or hexadecimal matching to packet payloads while also accepting BPF filters like tcpdump. It is built for quick inspection of plaintext traffic and saved capture files. ### Project history ngrep was written by Jordan Ritter and dates back to the early 2000s; a freshmeat announcement for ngrep 1.39.1 appeared on April 23, 2001. The tool's identity has stayed stable: bring GNU grep-style matching to the network layer. The project lived for years as a classic Unix network utility and later moved active issue and patch handling to GitHub. Its README still frames ngrep as a PCAP tool that understands IPv4/IPv6, TCP, UDP, ICMP, IGMP, raw packets, several link-layer interface types, and BPF filter logic. ### Adoption history ngrep became a small but widely packaged troubleshooting utility because it sits between tcpdump and a full packet analyzer. It was included de facto in many popular distributions over decades, and the maintainer explicitly asks distribution package maintainers to forward bugs and patches so upstream can track downstream fixes. Its adoption is bounded by encryption. ngrep is excellent for DNS, old HTTP, SMTP, SIP, IMAP, test traffic, malware beacons in plaintext, and pcap triage; it is less useful when payloads are TLS-encrypted unless the useful signal is in headers, metadata, or local decrypted test traffic. ### How it is used A typical workflow is `sudo ngrep -d any -W byline 'Host:|User-Agent:' tcp port 80`, or using an empty match expression with a BPF filter to print payloads for a protocol. It can read and write pcap dump files, making it useful for quick command-line passes before opening Wireshark. Package nerds install it because it is the fast, memorable answer to "show me packets containing this string". It is especially handy on servers where a GUI analyzer is unavailable and tcpdump output is too raw for the immediate question. ### Why package nerds care ngrep is a survivor from the era when small C network tools solved one sharp problem well. It matters less as a dependency and more as an operator tool: a tiny package that can save a debugging session when traffic is still human-readable. ### Timeline - 2001-04-23: ngrep 1.39.1 was announced on freshmeat. - 2008: SourceForge tickets show Jordan Ritter still handling upstream bug fixes. - 2026-02-08: the GitHub repository listed v1.49.0 as a release with PCRE2, Docker/Podman name-resolution, and Windows build updates. ### Related projects - tcpdump - libpcap - Wireshark - snoop - GNU grep ### Sources - - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** ngrep - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - ngrep - 1.47+ds1-6: normalized package name match | Debian stable package indexes: ngrep from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | grep for network traffic | https://github.com/jpr5/ngrep - Nix - ngrep: normalized package name match | nixpkgs package indexes: pkgs/by-name/ng/ngrep/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - ngrep - 1.47+ds1-5build2: normalized package name match | Ubuntu 24.04 LTS package indexes: ngrep from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | grep for network traffic | https://github.com/jpr5/ngrep - apk - ngrep - 1.49.0-r0: normalized package name match | Alpine Linux edge package indexes: ngrep from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | A grep-like utility that allows you to search for network packets on an interface | https://ngrep.sourceforge.net/ - apk - ngrep-dbg - 1.49.0-r0: normalized package name match | Alpine Linux edge package indexes: ngrep-dbg from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | A grep-like utility that allows you to search for network packets on an interface (debug symbols) | https://ngrep.sourceforge.net/ - apk - ngrep-doc - 1.49.0-r0: normalized package name match | Alpine Linux edge package indexes: ngrep-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | A grep-like utility that allows you to search for network packets on an interface (documentation) | https://ngrep.sourceforge.net/ - dnf - ngrep - 1.47^20241209gitb2e3ba3-4.fc44: normalized package name match | Fedora Rawhide package metadata: ngrep from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Network layer grep tool | https://github.com/jpr5/ngrep - pacman - ngrep - 1.49.0-1: normalized package name match | Arch Linux sync databases: ngrep from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A grep-like utility that allows you to search for network packets on an interface. | https://github.com/jpr5/ngrep/ - zypper - ngrep - 1.49.0-1.3: normalized package name match | openSUSE Tumbleweed package metadata: ngrep from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Network grep | https://github.com/jpr5/ngrep - MacPorts - ngrep: normalized package name match | MacPorts ports tree: net/ngrep/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [libpcap](https://www.automicvault.com/pkg/brew/libpcap/) - Runtime dependency declared by Homebrew. - [pcre2](https://www.automicvault.com/pkg/brew/pcre2/) - Runtime dependency declared by Homebrew. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. - [tcpdump](https://www.automicvault.com/pkg/brew/tcpdump/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. - [httpry](https://www.automicvault.com/pkg/brew/httpry/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. - [ipsumdump](https://www.automicvault.com/pkg/brew/ipsumdump/) - Shares av.db curated category or tags: cli, networking, packet-analysis. - [packetq](https://www.automicvault.com/pkg/brew/packetq/) - Shares av.db curated category or tags: cli, networking, packet-analysis. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-analysis. - [libtrace](https://www.automicvault.com/pkg/brew/libtrace/) - Shares av.db curated category or tags: cli, networking, packet-analysis. - [packetbeat](https://www.automicvault.com/pkg/brew/packetbeat/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. ## Combined YAML source View the package source record on GitHub. [combined/ngrep.yml](https://github.com/automic-vault/db/blob/main/combined/ngrep.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph