Using the -x flag with ngrep causes the data portion of packets to be displayed in hex. Is there a way to also display the frames/headers as well?
1 Answer
It seems that ngrep does not show/search within the packets headers. From man ngrep, you can read from ngrep description:
ngrep is a pcap-aware tool that will allow you to specify
extended regular expressions to match against data payloads of packets.
I could not find any option to show the headers. It would be better to use tcpdump if you want more details like headers.
