multiple readers for stack-processed net traffic

[vax@carolina.rr.com (VaX#n8)]

Hi, I'd like to be able to create a second "tap" for application data that
presents data exactly as the application sees it, and in such a way that
guarantees that both applications read the data before it is freed or
acknowledged.  I have skimmed the Coriolis book on the 2.0 IP stacks (yes,
I know it's old), and it seems like the most direct way to do this is to
alter tcp_recvmsg and udp_rcv, probably using an LKM.  I have not given
much thought yet about how this second application will indicate that it
wants to snoop on given sockets, though.  I was wondering if any of you
kernel gurus have any suggestions on how to accomplish the above goals.

Thanks,
VaX#n8