NGREP-LIB(3) User Manuals NGREP-LIB(3)
ngrep-lib - network grep library
The ngrep library is a front-end for accessing the Packet
Capture Library (libpcap) without going through the hassle
of programming the filters, making sure you pick the right
size for the header etc.
Needed include-files are:
#include <netinet/in systm.h>
#include <netinet/ip icmp.h>
#include <net/if arp.h>
These are the functions to access the library:
void ngrep callback arp(void *my arp);
void ngrep callback ip(void *my ip);
void ngrep callback tcp(void *my tcp);
void ngrep callback udp(void *my udp);
void ngrep callback icmp(void *my icmp);
void ngrep callback process(void *my ip, void *my tcp,
void *my udp, void *my icmp);
This function initializes the callback functions for
ngrep. They can be NULL, in which case there is no call-
back. ngrep callback process is defined for historical
void ngrep callback info(void *my info, void *my stats);
This function initializes the callback functions for info.
The first is actually the same first lines with the output
of ngrep, with the interface, filter, match and output
information. The second is the output at the end where you
get the amount of received and dropped packets.
void ngrep setfilter(char *bpffilter, char *matchexpres-
sion, char *options);
This function initializes the filter, the match expression
and the options. The parameters are the same as you use
them on the command line for ngrep. For example:
ngrep_setfilter("port 4000 or icmp",NULL,"-d tun0");
void ngrep run(void);
This function runs ngrep.
void ngrep main(char *bpffilter, char *match, char
This function is the same as calling ngrep_setfilter() and
void my ip(struct ip *iphdr);
This callback function has one parameter: the IP header.
This one should be used as the first parameter with
ngrep callback process(). It will be called when an IP
packet has arrived during ngrep run().
void my tcp(struct ip *iphdr, struct tcphdr *tcphdr, char
void my udp(struct ip *iphdr, struct udphdr *udphdr, char
void my icmp(struct ip *iphdr, struct icmp *icmphdr, char
void my arp(struct arphdr *arphdr);
These callback functions have four parameters: the IP
header, the TCP/UDP or ICMP header, the data and the size
of the data. These should be used as the second, third or
fourth parameter of ngrep callback process(). These will
be called when TCP, UDP or ICMP packets have arrived dur-
ing ngrep run().
void my info(char *interface, char *filter, char *match,
This callback function is called during ngrep setfilter()
with information regarding the filters set by ngrep set-
void my stats(long received, long dropped);
This callback function is called after ngrep run() has
finished. It contains some statistical information.
See test-lib.c for how to use them.
Use -lngrep -lpcap to link the executable.
See the man-page of ngrep(8) for the syntax of the
options, match and bpffilter. The only option removed is
-q (quiet), that's now done via the info and stats call-
ngrep written by Jordan Ritter .
ngrep-library written by Edwin Groothuis
Send bug reports to the author.
At this moment, the maximum number of total spaces in the
parameters passed to ngrep_main() is 95.
The ARP callback function is only used for Ethernet net-
Unix January 2002 NGREP-LIB(3)