Years ago, I wrote a proxy for DICOM protocal (used in medical imaging machines) to serve as a sniffer. It decodes the data stream and shows the user, and allows a Perl script to make changes to the data, re-encodes it, and passes it along.

This was a hibrid solution, using NT-specific functions for high-speed throughput of the read/write (I/O completion ports and no copying of buffers in between), and an embedded Perl interpreter to decode the data that's T'ed out from it.

—John