Help with ngrep

pingu_penguin · 11-12-2022, 06:21 AM

Hi,
I gave ngrep a try and tried to monitor some ping packets to google.com only.

So I go :
# ngrep -q -d eth0 '' icmp
first , which show me all ping packets. Fine enough.

However when I try to filter by domain:
# ngrep -q -d eth0 '' icmp and dst host google.com

I get to see the icmp packets to other locations as well.

I would like to see the ping to google only.
What am I missing or doing inherently wrong here ?

Thanks.

teckk · 11-12-2022, 07:47 AM

I've never used that. Best that I can do.
https://github.com/jpr5/ngrep/
https://man.archlinux.org/man/commun...rep/ngrep.8.en

TB0ne · 11-12-2022, 08:31 AM

Quote:

Originally Posted by pingu_penguin

Hi,
I gave ngrep a try and tried to monitor some ping packets to google.com only.

So I go :
# ngrep -q -d eth0 '' icmp
first , which show me all ping packets. Fine enough.

However when I try to filter by domain:
# ngrep -q -d eth0 '' icmp and dst host google.com

I get to see the icmp packets to other locations as well. I would like to see the ping to google only. What am I missing or doing inherently wrong here ?

As teckk said, the man page is where you can figure out the syntax for that command. And since you don't show us the input you're getting, or show us a sample of the output, we can't guess as to what you need to get what you're after.

Lots of ngrep examples; have you looked for any?

Code:

ngrep -q -d eth0 icmp "google.com"

pingu_penguin · 11-12-2022, 08:50 AM

Okay ngrep seems to be working as expected.
This is weird, honestly, I don't know what to say.

Thanks for your time folks, I will update the thread with more ngrep queries if needed.