ngrep

ngrep is the packet capture tool I always wanted. I always found tcpdump and wireshark etc too intimidating. ngrep prints everything it capture on stdout and like any other command line tool on *nix, the output can be further piped into other tools like grep, awk, sed or cut. Let me show a few examples

1. Capture all requests on port 80
sudo ngrep -q -W byline '' 'dst port 80'

2. Capture all http get requests on port 80 and headers

sudo ngrep -W byline -q -t '(^GET .* HTTP)' 'port 80'

3. Capture all GET requests on port 80
sudo ngrep -W byline -q -t '(^GET .* HTTP)' 'port 80'|grep -E '^GET /.*' 

4. Capture all GET/POST requests and responses (not in sync)
sudo ngrep -W byline -q -t '(^GET .* HTTP)|(^HTTP/1.1)'|grep -E '^(HTTP/1.1)|(GET /)' -B1