Aimsnarf is a smallish Ruby script that displays AIM conversations from network traffic (either live or from a pcap file). The script may also work on ICQ conversations, if they run on port 5190 (Adium uses this for ICQ conversation). I originally wrote aimsnarf because I was frustrated with attemping to get all the dependencies for aimsniff working correctly. I wanted something self-contained with as few dependencies as possible.

Aimsnarf doesn't work on OTR (off-the-record) encrypted chats, for obvious reasons. Here's a screenshot:


Download the latest version of aimsnarf here.

It requires Ruby and the ruby-pcap library in order to run.


Aimsnarf is simple to use, here's the usage:

Usage: aimsnarf.rb [ -dnv ] [ -i interface | -r file ] [ -c count ]
-n do not convert address to name
-d debug mode
-v verbose mode