Capture traffic of all interfaces
Capture traffic of a specific interface
Capture traffic crossing port 22 of interface eth0
Capture traffic from or to a host
ngrep host www.example.comFilter keyword 'User-Agent:' of interface eth0
ngrep -d eth0 'User-Agent:'