PacketFu example setting a Berkeley Packet Filter syntax for a capture.

bpf_examle.rb

require 'packetfu'

# get the default routable interface
iface = PacketFu::Utils.default_int

# Get my local ip
my_ip = PacketFu::Utils.ifconfig(iface)[:ip_saddr]

# Create a new capture on the en0 interface, just because I can
cap = PacketFu::Capture.new(:iface => 'en0')

# Set the bpf to filter ipv4 tcp connections with my host on port 22
cap.bpf(:filter => "ip host #{my_ip} and tcp port 22")

# Start capturing packs
cap.start

# Should need to process the packets with .stream() as I've shown earlier.