ngrep - possible to hide payloads?

Question

I use ngrep a lot to inspect HTTP headers to see what's going on. I use the -q flag for quiet output, but I really don't want to see the payloads, only the headers.

Is there a way to do this? My current command is:

ngrep 'Content-Length:' port 80 -t  -W byline -q

score 4 · Accepted Answer · answered Feb 01 '10 at 11:32

4

Have you tried setting -S to a small number?

-S limitlen
  Set the upper limit on the size of packets that ngrep will look at. Useful for 
  looking at only the first N bytes of packets without changing the BPF snaplen.

answered Feb 01 '10 at 11:32

Dennis Williamson

62,149
16
116
151

I use `-S 0` and pipe it to `| grep T` so it only shows the source and destination header – theist Nov 18 '20 at 18:35

ngrep - possible to hide payloads?

1 Answers1