Unix Toolbox: ngrep - easily grep local network traffic 7 comments

Posted by robon August 14, 2007

You are working on a Rails app and it communicates with a web service. You run into communication problems. To figure it out, you can spit out debugging information at either end or you can slog though a session of tcpdump and its hundreds of options.

Naw, you now know of a much simpler way: ngrep.

1: Go get and install it. http://ngrep.sourceforge.net/download.html

2: Use the command by passing it your interface name (-d lo0), and the port on which you want to watch traffic (port 3000).


sudo ngrep -Wbyline -d lo0 port 3000

Then, if needed, pipe to normal grep until you only see what you want:


sudo ngrep -Wbyline -d lo0 port 3000 | grep -v "noise" | grep "bad-ass unix tools"

Here's the output of a sample run. I'm running the command in a terminal window, while I post a form with my browser or Net:HTTP. The output is split into packets. Here's what you get:

Enjoy!


Comments

Leave a response

  1. noodlAugust 15, 2007 @ 08:17 AM

    Thanks for the heads up, it looks interesting. Here’s a list of simillar tools we recommend for apache support.

    http://wiki.apache.org/httpd/WatchingHttpHeaders

  2. Scott BrooksAugust 15, 2007 @ 08:58 AM

    It’s funny that you grep out the svn folders by reflex when ever you go to grep something. I do the exact same thing even when I grep non svn projects.

  3. Rob OrsiniAugust 15, 2007 @ 09:29 AM

    @noodl: Thanks for the link.

    @Scott: Damn, you busted me! :) I think you caught that little scrub before I noticed it and update the post. A lot of my Unix knowledge exists in my fingers; not by brain. Vim is a great example of that. Thanks for the comment.

  4. noodlAugust 15, 2007 @ 11:31 AM

    @ scott, heh, i noticed that too but let it drop. back when i used linux on the desktop i found this useful http://svn.collab.net/repos/svn/trunk/contrib/client-side/wcgrep but the mac’s find command doesn’t like the arguments in this script. are you aware of a mac suitable replacement?

  5. ArtAugust 15, 2007 @ 11:30 PM

    The Windows version is not distributed with the required libraries. Are you expecting the users to chase them on the net?

  6. anonymousAugust 16, 2007 @ 01:59 AM

    This is awesomeness!

    You have raised the quality of my work life by at least 2.3%!!!
  7. Paul PrescodAugust 16, 2007 @ 09:35 AM

    “ack” is a really nice SVN-aware grep replacement with many more features.

    http://petdance.com/ack/

    ngrep looks like another great tool!