ngrep

ngrep -q -W byline 'password' 'port 80'

Search for patterns in network traffic in real time with ngrep, the grep of packets, to see credentials and cleartext data.

Run it when you want to see if a specific pattern crosses the network: ngrep filters traffic like grep filters files — searching for 'password' on port 80 shows HTTP requests and responses containing the word, revealing cleartext credentials, tokens, or sensitive data traveling unencrypted. In hunting, it's the tool to confirm a specific suspicion: the app sending credentials over HTTP, the service with cleartext authentication, the payload with a certain string. It's also used in IR to capture the C2 pattern live (the attacker's domain or URL).

Don't use it for broad monitoring: ngrep only sees what matches the pattern, and on busy interfaces a capture filter is mandatory (performance suffers with complex patterns over all traffic). Encrypted traffic (HTTPS, SSH) can't be grepped — you'll only see handshakes; for content you need decryption. And legal and operational caution: capturing other users' cleartext credentials is sensitive material — in an engagement, the scope and retention of what's captured are defined beforehand. The cleartext pattern ('password') is visible in traffic; the same data obfuscated (base64, hash) requires the right pattern or post-analysis.