ngrep description
ngrep will help you identify and analyze anomalous network communications such as those between worms, viruses and/or zombies

ngrep strives to provide most of GNU greps common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets.

ngrep currently recognizes IPv4/6, UDP, TCP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, FDDI, SLIP, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

How to use ngrep:

ngrep has traditionally been used to debug plaintext protocol interactions such as HTTP, SMTP, FTP, etc., to identify and analyze anomalous network communications such as those between worms, viruses and/or zombies, and to store, read and reprocess pcap dump files while looking for specific data patterns.

On the other hand, it can be used to do the more mundane plaintext credential collection as with HTTP Basic Authentication, FTP or POP3 authentication, and so forth. Like all useful tools, it can be used for good and bad.