Take the 2-minute tour ×

I use ngrep a lot to inspect HTTP headers to see what's going on. I use the -q flag for quiet output, but I really don't want to see the payloads, only the headers.

Is there a way to do this? My current command is:

ngrep 'Content-Length:' port 80 -t  -W byline -q
share|improve this question

1 Answer 1

up vote 1 down vote accepted

Have you tried setting -S to a small number?

-S limitlen
  Set the upper limit on the size of packets that ngrep will look at. Useful for 
  looking at only the first N bytes of packets without changing the BPF snaplen.
share|improve this answer
Thanks Dennis, did exactly what I needed. –  PeterB Feb 1 '10 at 13:31

Your Answer


