ngrep
ngrep is a tool to monitor network requests in a *nix interface. As the name suggests, the command takes a regular expression and monitors unencrypted traffic to match the pattern. The command can sniff any text protocol like HTTP, SMTP, etc ...
Let's monitor all traffic originating from current machine to codeclamp.com.
user@user-ThinkPad-T400 ~> sudo ngrep codeclamp -d wlan0 interface: wlan0 (192.168.0.0/255.255.255.0) match: codeclamp ###################### U 192.168.0.109:25156 -> 192.168.0.1:53 H............codeclamp.com..... # U 192.168.0.109:64072 -> 192.168.0.1:53 .%...........codeclamp.com..... # U 192.168.0.1:53 -> 192.168.0.109:25156 H............codeclamp.com.............. ..B.,. # U 192.168.0.1:53 -> 192.168.0.109:64072 .%...........codeclamp.com................?.dns1.... ##### T 192.168.0.109:39216 -> 66.6.44.4:80 [AP] GET / HTTP/1.1..Host: codeclamp.com..User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0..Ac cept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8..Accept-Language: en-US,en;q=0.5..Accept-Encoding: gzip, deflate..DNT: 1..Connection: keep-alive.... ####
-d option mentions the interface to listen. ngrep captured all the requests to codeclamp.com. The obtained information contains all the sequences of network calls. Call to wifi router, DNS resolution, hosted site home page. The recorded information has source and destination machine IP and port.
Monitoring the site-specific requests works well for non-HTTPS sites.
Next, let's, monitor all UDP network requests.
user@user-ThinkPad-T400 ~> sudo ngrep -q -d wlan0 -i "" udp interface: wlan0 (192.168.0.0/255.255.255.0) filter: (ip or ip6) and ( udp ) U 192.168.0.109:32165 -> 192.168.0.1:53 .............felog.grammarly.io..... U 192.168.0.1:53 -> 192.168.0.109:32165 .............felog.grammarly.io................).ec2-54-221-3-35.compute-1.amazonaws.com..0..........6..#
-i is ignore case switch.













