Syntax for ngrep to filter logon attempts.

[toolfolks]

Hi guys,

plodding along with all this Linux typing stuff... ( difficult being Dyslexic as well as old.... ).

I have puttyed ( correct wording ? ) into the server as root.
As an attempt to understand this I will attempt to connect from 2 mobiles one with a correct password and one incorrect to see what comes back and get a basic understanding.

The mobiles are on our wifi so will have IP address of 2.xx.xx.xx

I guessed at the following to filter:

ngrep -q 'HTTP' 'host 2.xx.xx.xx' but nothing came through.

What is the correct syntax please ?

Cheers

 

[Adrian Fretwell]

ngrep -W byline -td any . host 2.xx.xx.xx and port 5060

or if you want to watch multiple ports

ngrep -W byline -td any . host 2.xx.xx.xx and \(port 5060 or port 5080\)

You can also use sngrep, which provides a nicer graphical representation in terminal.

You mention "puttyed", most people call it an ssh session or "ssh in". Some utilities like sngrep don't always display very well in putty.