I'm integrating ngrep to OpenSolaris and I've discovered a strange thing :)
On your web http://ngrep.sourceforge.net/usage.html there is a line:
> ngrep -w 'm' -I /tmp/dns.dump
which works on Linux (I've tried Debian) and doesn't work on Solaris. It is not correct in reference of the manual page. The correct order should be:
> ngrep -w -I /tmp/dns.dump 'm'
And the correct order works on Linux and on Solaris too :) It's just a detail however I've spend two hours by debugging some ugly bison code before I discovered that I can just swap parameters in reference of the man page.
I think that it would be nice to update your web (just switch the parameters) according to this discovery - it may save some time to other users of Solaris.
Btw at Solaris it writes (with the incorrect order of parameters):
> pcap compile: syntax error in filter expression
Stale bug, closing.
FYI bug reports are managed here now: https://github.com/jpr5/ngrep/issues