Libnids is an implementation of an E-component of Network Intrusion Detection 
System. It emulates the IP stack of Linux 2.0.x. Libnids offers IP 
defragmentation, TCP stream assembly and TCP port scan detection.  The most 
valuable feature of libnids is reliability. A number of tests were conducted, 
which proved that libnids predicts behaviour of protected Linux hosts as 
closely as possible.  Libnids is highly configurable in run-time and offers a 
convenient interface.  Currently it compiles on Linux, *BSD and Solaris.  
Using libnids, one has got a convenient access to data carried by a TCP 
stream, no matter how artfully obscured by an attacker.

This requires libnet.