Libnids is an implementation of an E-component of Network Intrusion Detection System. It emulates the IP stack of Linux 2.x and offers IP defragmentation, TCP stream assembly and TCP port scan detection. Using libnids, one has got a convenient access to data carried by a TCP stream, no matter how artfully obscured by an attacker.