in reply to real-time packet capture

You can use the Expect module to control the timing. Here is an example program that uses Expect this way.

You may find that snort will do much of what you want.

It should work perfectly the first time! - toma