The problem with a TIS "sniffer" is that it is designed to be a "login"
type thing. It could probably be done, but the information supplied is
specific to each aircraft request. And without knowing the location of
the requesting aircraft... I have much greater hope for TIS-B
(essentially the transistion plan from existing ATC radar to ADS-B.
But, of course, it's only available "elsewhere." Of course, TIS isn't
much better down where I fly... probably less than 1/10th of 1%
coverage.

It *is* possible to build an antenna (suite) that estimates direction
from differential time of arrival, coupled with relative signal
stength. We use something similar in some military applications, at
almost the same frequency as the xpndr. But it's not cheap, and the
bigger the antennas (and more spread out) the better. Distance would
still be a very crude estimate, of course, unless you make the array
active (interrogate like TCAS does) - and that is a big certification
issue as an intentional radiator.