ngrep - possible to hide payloads?

Question

I use ngrep a lot to inspect HTTP headers to see what's going on. I use the -q flag for quiet output, but I really don't want to see the payloads, only the headers.

Is there a way to do this? My current command is:

ngrep 'Content-Length:' port 80 -t  -W byline -q

Answer 1

Have you tried setting -S to a small number?

-S limitlen
  Set the upper limit on the size of packets that ngrep will look at. Useful for 
  looking at only the first N bytes of packets without changing the BPF snaplen.