See filesnarf.c for usage.
Sample:
./filesnarf
filesnarf: listening on eth1
(cat /home/rees/x in another window)
141.211.133.112.2049 > 141.211.133.92.711: x (29@0)
M o n   A u g   2 1   1 3 : 2 2 4d 6f 6e 20 41 75 67 20 32 31 20 31 33 3a 32 32 
: 3 7   E D T   2 0 0 6 .       3a 33 37 20 45 44 54 20 32 30 30 36 0a          

The linux v4 client re-uses tcp connections, and nids will only follow a
connection if it sees the SYN.  So you must unmount all file systems on the
target server, then start filesnarf, then mount the server.
