I have to admit that I've sort-of moved on from the idea of intercepting the packet data. I've found another (somewhat easier) work around.
To anyone who's curious; here's what I did.
I had a spare WiFi router with dd-wrt flashed on it. So I plugged the ObserverIP into the router, and then the router into my primary router. On the dd-wrt router, I turned off wifi (don't need the extra interference). I also have it set in router mode (as opposed to gateway mode which is the default mode), but gateway mode will work fine too. Leaving it in gateway mode means you won't be able to access the ObserverIP unless you have a PC plugged into the dd-wrt router. Placing it into router mode, and adding static routes will make it available to the multiple subnets on the lan, but is more advanced.
Side note: I used a
Linksys WRT54GL, it's a bit bulky. A
TP-LINK MR3020 is smaller and would accomplish the same thing using OpenWRT
Here's a rough picture of the setup:
--------------- --------- --------------
| ObserverIP | ---> | dd-wrt | ---> | Primary WiFi |
--------------- --------- --------------
I setup DHCP reservation for the ObserverIP on the dd-wrt, so that everytime it reboots, the dd-wrt will give it the same IP. (I could have done static IP too, but chose for the reservation. This way I'm "hands off" of the ObserverIP).
Then on the dd-wrt, I added these firewall rules by going to Administration > Commands > paste the below, and click "Save Firewall". Change the x.x.x.x to your web server's IP.
iptables -t nat -A PREROUTING -s 192.168.1.55 -p tcp --dport 80 -j DNAT --to-destination x.x.x.x:80
iptables -t nat -A POSTROUTING -j MASQUERADE
The first line says anything coming from the 192.168.0.55 (which is the ObserverIP) and going TO anything on port 80 (we know wunderground rtupdate uses port 80), redirect those packets to my webserver's port 80 (x.x.x.x:80) instead. The 2nd line says to masquerade the traffic.
The result?
Wunderground destined data instantly started going to my web server! It is awesome! To prevent it from erroring, and to keep updating wunderground automatically, you have to match the incoming data. Which means creating a subdirectory on your webserver called weatherstation and a PHP file within called updateweatherstation.php.
Inside the updateweatherstation.php file I have automatically and instantly relay the raw data to wunderground without delay. That way I don't take away any functionality of the ObserverIP, and wunderground is always getting the data straight away. As soon as my server sees it, it sends it to wunderground. No delay.
<?php
$wunderground = file_get_contents("http://rtupdate.wunderground.com/weatherstation/updateweatherstation.php?" . $_SERVER['QUERY_STRING']);
echo $wunderground;
?>
Note: you
need to echo the results, otherwise the "Server" LED on the ObserverIP won't light up
Note: This quick PHP file also doesn't do any kind of spoof checking (that is, a random bot finding out you have this setup and sending false data and messing up your metrics)
After that,
the data is yours!
Back in that same updateweatherstation.php PHP file, I have it write the data to a couple of JSON files that I use for live updates on my website. I also have another section in updateweatherstation.php that is sending the weather data to a localhost socket so that weewx can pick it up and archive it.
Here's how I'm saving the data to a JSON file:
<?php
date_default_timezone_set('America/New_York');
$data = array(
"updated" => date("F d, Y g:i:s A"),
"outTemp" => $_GET['tempf'],
"outHumidity" => $_GET['humidity'],
"dewpoint" => $_GET['dewptf'],
"windchill" => $_GET['windchillf'],
"windDir" => $_GET['winddir'],
"windSpeed" => $_GET['windspeedmph'],
"windGust" => $_GET['windgustmph'],
"rain" => $_GET['rainin'],
"radiation" => $_GET['solarradiation'],
"UV" => $_GET['UV'],
"inTemp" => $_GET['indoortempf'],
"inHumidity" => $_GET['indoorhumidity'],
"barometer" => $_GET['baromin'],
"txBatteryStatus" => $_GET['lowbatt']
);
$json = json_encode($data);
$file = 'current.json';
file_put_contents($file, $json);
?>This would make current.json available in the same web directory, which is /weatherstation. So for example
http://myserver/weatherstation/current.json The contents of the JSON look like this,
which is the exact same data wunderground received milliseconds ago! 
{"updated":"January 15, 2016 8:23:27 PM","outTemp":"35.4","outHumidity":"63","dewpoint":"24.1","windchill":"35.4","windDir":"113","windSpeed":"0.00","windGust":"0.00","rain":"0.00","radiation":"0.00","UV":"0","inTemp":"68.9","inHumidity":"49","barometer":"29.57","txBatteryStatus":"0"}Could I have used one of the readily available pieces of hardware & software (that run on a
TP-LINK MR3020) to do this for me? Sure, but my solution is (mostly) free! (I already own the web server, and I already owned the
Linksys WRT54GL).
A bit time consuming, but a lot easier than trying to intercept and decode packets over 915mhz!
I can write up a proper blog post with more details, if anyone is interested.
