Known bugs: o error message: ngrep uses obsolete (PF_INET,SOCK_PACKET) Not a bug in ngrep. Upgrade to the latest libpcap: http://www.tcpdump.org/release/libpcap-0.6.2.tar.gz o ngrep reports duplicate packets on the local loopback interface Not a bug in ngrep. Upgrade to the latest libpcap: http://www.tcpdump.org/release/libpcap-0.6.2.tar.gz o 'ngrep host foo.com' segfaults after displaying interface info Technically, not a bug in ngrep. A particular API call in libpcap segfaults on certain operating systems (FreeBSD is one). Newer versions of libpcap obviate the need to use that particular API. You can get it at: http://www.tcpdump.org/release/libpcap-0.6.2.tar.gz For the time being, a configure switch '--without-restart' is provided to turn off the API call. If your copy of ngrep segfaults after displaying the interface info, try recompiling with this switch.