复制代码代码如下: cd ngrep-code ./configure --with-pcap-includes=/usr/local/include/pcap make make install
选项 -h is help/usage -V is version information -q is be quiet （don"t print packet reception hash marks）静默模式，如果没有此开关，未匹配的数据包都以“#”显示 -e is show empty packets 显示空数据包 -i is ignore case 忽略大小写 -v is invert match 反转匹配 -R is don"t do privilege revocation logic -x is print in alternate hexdump format 以16进制格式显示 -X is interpret match expression as hexadecimal 以16进制格式匹配 -w is word-regex （expression must match as a word） 整字匹配 -p is don"t go into promiscuous mode 不使用混杂模式 -l is make stdout line buffered -D is replay pcap_dumps with their recorded time intervals -t is print timestamp every time a packet is matched在每个匹配的包之前显示时间戳 -T is print delta timestamp every time a packet is matched显示上一个匹配的数据包之间的时间间隔 -M is don"t do multi-line match （do single-line match instead）仅进行单行匹配 -I is read packet stream from pcap format file pcap_dump 从文件中读取数据进行匹配 -O is dump matched packets in pcap format to pcap_dump 将匹配的数据保存到文件 -n is look at only num packets 仅捕获指定数目的数据包进行查看 -A is dump num packets after a match匹配到数据包后Dump随后的指定数目的数据包 -s is set the bpf caplen -S is set the limitlen on matched packets -W is set the dump format （normal, byline, single, none） 设置显示格式byline将解析包中的换行符 -c is force the column width to the specified size 强制显示列的宽度 -P is set the non-printable display char to what is specified -F is read the bpf filter from the specified file 使用文件中定义的bpf（Berkeley Packet Filter） -N is show sub protocol number 显示由IANA定义的子协议号 -d is use specified device （index） instead of the pcap default
易网时代-编程资源站