#!/usr/bin/env rubya = []out = IO.popen('tcpdump -n -i eth1 -X tcp port 80') #print http packet contentsuntil out.eof? #Wrap up each packet into an array in an array line = out.readline a << [] if line.match(/.{3}\x3a/) #Matches the timestamp beginning a packet a.last << lineenda.shift if a.length > 300 #Keep the array of arrays from getting too biga.each { |packet| puts packet.flatten if packet.inspect.include?("GET") && packet.inspect.match(/192\.168\.[0-9]+\.[0-9]+\.http/) } #match GET requests to internal server