If you want to *listen* rather than *speak*, I imagine your going to need the Net::Pcap module that interfaces with the pcap system library. Beyond that, you might want to try the NetPacket module collection to take care of packet decoding for you. Once you have the packets decoded down to the TCP level you can look at ports and other factors to determine if a given packet is indeed ftp traffic.

Alternatively you could use tcpdump to listen in and only report on FTP traffic. You could pipe this output into a file for later analysis, or right into a perl script for real-time analysis.

Cheers,

- danboo