ttyrpld is a multi-OS kernel-level TTY keylogger and screenlogger with (a)synchronous replay support. It runs on Linux, Solaris, FreeBSD, NetBSD and OpenBSD.
IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid.
Use the PCAP library to implement connection to bpf kernel pseudo-device.