FOTM sniffer

sniffer

require 'packetfu'

include PacketFu
iface = ARGV[0] || "en1"

def sniff(iface)
  cap = Capture.new(:iface => iface, :start => true)
  cap.stream.each do |p|
    pkt = Packet.parse p
    if pkt.is_tcp?
      next if pkt.ip_daddr != '23.96.96.142' 
      m = /GET (\/api.+) HTTP.+/.match(pkt.payload)
      if m
        puts "API REQUEST: curl \"http://fotm.info#{m[1]}\""
      end
    end
  end
end

sniff(iface)

gem install packetfu pcaprub