Howto munge packets?

[Neal D. Becker]

We have a project that requires intercepting certain IP packets,
modifying their payload, and sending them on their way.  The
modification is nontrivial, and so I think it would best be done in
user space.  Can anyone suggest a general approach for how to
intercept packets, send them to user space, and then on to their
destination?  Should we look at netfilter/netlink?  I'd like to avoid
any kernel code.

TIA.