libnids API stupid simple! initialize the setup nids_init() register your callbacks nids_register_ip(), nids_register_tcp(), etc go! nids_run() or nids_next() react! nids_killtcp() within callbacks, access the stream keeps track of TCP state for you server and client data, endpoints, etc ... can track multiple sessions and hosts