ngrep Headers/Frames

Question

Using the -x flag with ngrep causes the data portion of packets to be displayed in hex. Is there a way to also display the frames/headers as well?

Answer 1

It seems that ngrep does not show/search within the packets headers. From man ngrep, you can read from ngrep description:

ngrep is a pcap-aware tool that will  allow  you to  specify
extended  regular  expressions to match against data payloads of packets.

I could not find any option to show the headers. It would be better to use tcpdump if you want more details like headers.