#!/usr/bin/env ruby
a = []
out = IO.popen('tcpdump -n -i eth1 -X tcp port 80') #print http packet contents
until out.eof?                      #Wrap up each packet into an array in an array
  line = out.readline                 
  a << [] if line.match(/.{3}\x3a/)      #Matches the timestamp beginning a packet
  a.last << line
end

a.shift if a.length > 300           #Keep the array of arrays from getting too big
a.each { |packet| puts packet.flatten if packet.inspect.include?("GET") &&
  packet.inspect.match(/192\.168\.[0-9]+\.[0-9]+\.http/) } #match GET requests to internal server