Mine

#!/usr/local/bin/ruby
a = Array.new
out = IO.popen('tcpdump -n -i eth1 -X tcp port 80') #print http packet contents
 until out.eof? do                    #Wrap up each packet into an array in an array
  line = out.readline                 
  if line.match(/.{3}\x3a/) then      #Matches the timestamp beginning a packet
   a.push(Array.new)
   a.last.push(line)
   else a.last.push(line)
  end
  a.shift if a.length > 300           #Keep the array of arrays from getting too big
  a.each { |packet| puts packet.flatten if packet.inspect.include?("GET") && \
   packet.inspect.match(/192\.168\.[0-9]+\.[0-9]+\.http/) } #match GET requests to internal server
 end