ngrep

ngrep -q -d eth1 -W byline host stackoverflow.com and port 80
^ ^ ^ ^
| | | |
| | | |
| | | v
| | | filter expression
| | |
| | +--> -W is set the dump format ("normal", "byline", "single", "none")
| |
| +----------> -d is use specified device instead of the pcap default
|
+-------------> -q is be quiet ("don't print packet reception hash marks")
ngrep -d any port 25
# 过滤 syslog 端口里的 error 关键字
ngrep -d any 'error' port syslog
# FTP 里的账号密码
ngrep -wi -d any 'user|pass' port 21
ngrep -W byline port 80
# 查看本地 DNS 查询
ngrep -d lo -x port 53
# 输出 dump
ngrep -O /tmp/dns.dump -d any -T port domain
# 读取 dump
ngrep -w 'm' -I /tmp/dns.dump
ngrep -tD ns3 -I /tmp/dns.dump