As ngrep uses pcap_open_offline(), with newer versions of libpcap it'll be able to...
This is a consequence of newer versions of libpcap having a "pcap" subdirectory of...
You might want to point to pcap-filter(7) for the BPF filter syntax
OS X uses ".dylib", not ".so", for shared libraries. If SharpPcap is loading libpcap...
It's expected behavior with libpcap prior to 1.1. WinPcap 4.1.3 is based on libpcap...