If you create a socket with PF_PACKET you can intercept all the traffic on a Linux system on all interfaces. Think of a low-tech version of tcpdump. Intercept

If you create a socket with PF_PACKET you can intercept all the traffic on a Linux system on all interfaces. Think of a low-tech version of tcpdump. Intercept all data on port 80, parse the http headers, do whatever you need with them, easy. Not sure why anybody would replay the requests though.