Arstechnica has a nice article about using Ruby with libpcap. Reading it you can learn how to write a basic AIM sniffer. It’s a great read!