The ngrep application accepts a pattern to watch for (such as grep), a filter string (such as tcpdump), and many command-line flags to fine-tune its behavior.

The following example watches the traffic on port 80 and reports any packets with the string Linux in them:

$> ngrep -q -c 64 Linux port 80
interface: eth0 (192.168.1.0/255.255.255.0)
filter: ( port 80 ) and (ip or ip6)
match: Linux

T 192.168.1.44:36602 -> 152.160.80.35:80 [AP]
  GET /Training/linux_detail/ HTTP/1.1..Host: noucorp.com..Us
  er-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20
  100101 Firefox/45.0..Accept: text/html,application/xhtml+xm
  l,application/xml;q=0.9,*/*;q=0.8..Accept-Language: en-US,e
  n;q=0.5..Accept-Encoding: gzip, deflate..Referer: http://no
  ucorp.com/Training/..Connection: keep-alive..Cache-Control:
   max-age=0....                                             

The -q flag directs ngrep to only print the headers and payloads.

The -c flag defines the number of columns to use for payload data. By default, the number is four, which is not useful for text-based packets.

After the flags is the match string (Linux), followed by a filter expression using the same filter language as tcpdump.