A cleaned up fork of ngrep for OpenBSD
git clone git://
Log | Files | Refs | README | LICENSE

commit 82d5665644ab26aa150ceda19a4056cef6dae8a8
parent b972cb3b1c3a161df5659dd8305af1c88932a431
Author: Jordan Ritter <>
Date:   Mon, 29 Mar 2004 02:23:56 +0000

updated documentation with new command line options

Mngrep.8 | 31+++++++++++++++++++++++++++++--
1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/ngrep.8 b/ngrep.8 @@ -6,7 +6,7 @@ .\" .\" Please refer to the LICENSE file for more information. -.TH NGREP 8 "February 2004" *nux "User Manuals" +.TH NGREP 8 "March 2004" *nux "User Manuals" .SH NAME @@ -14,7 +14,7 @@ ngrep \- network grep .SH SYNOPSIS -.B ngrep <-hXViwqpevxlDtT> <-IO +.B ngrep <-hXViwqpevxlDtTRM> <-IO .I pcap_dump .B > < -n .I num @@ -26,6 +26,14 @@ ngrep \- network grep .I snaplen .B > < -S .I limitlen +.B > < -W +.I normal|byline|none +.B > < -c +.I cols +.B > < -P +.I char +.B > < -F +.I file .B > < .I match expression .B > < @@ -166,6 +174,25 @@ this option to force ngrep to listen on interface \fIdev\fP. .IP "-A num" Dump \fInum\fP packets of trailing context after matching a packet. +.IP "-W normal|byline|none" +Alter the method by which ngrep displays packet payload. ``normal'' +mode represents the standard behaviour, ``byline'' instructs ngrep to +respect embedded linefeeds (useful for observing HTTP transactions, +for instance), and ``none'' results in the payload on one single line +(useful for scripted processing of ngrep output). + +.IP "-c cols" +Ignore the detected terminal width and force the column width to the +specified size. + +.IP "-P char" +Change the non-printable character from the default ``.'' to the +character specified. + +.IP "-F file" +Read the bpf filter from the specified file, rather than from the +command line. + .IP "\fI match expression\fP" A match expression is either an extended regular expression, or if the \fI-X\fP option is specified, a string signifying a hexadecimal value.