There is a section in ADC that describes a new Network Kernel Extension mechanism (NKE) introduced in Tiger. http://developer.apple.com/documentation/Darwin/Conceptual/NKEConceptual/index.html
There is a page that says there is a socket filter example called TCPLogger available: http://developer.apple.com/documentation/Darwin/Conceptual/NKEConceptual/index.html#//apple_ref/doc/uid/TP40001858
Now the question is: where is it? Or at least are there any Tiger-specific socket filters samples available?
I’ve found the tcplognke sample (http://developer.apple.com/samplecode/tcplognke/index.html#//apple_ref/doc/uid/DTS10003669). Perhaps this may help you.